v24.3.0

## Why

"sandboxd" from `build-tools` needs to connect to the MCP server in `universe`. They need to be able to talk to each other. I'm thinking it might be nice if they shared an "API protocol"?

## How

Added Zod schema for input and output of to-be-supported messages to `eas-build-job`.

## Test plan

CI should pass. I think I tested this locally too.

CHANGELOG.md

@@ -6,19 +6,82 @@ This is the log of notable changes to EAS CLI and related packages.
 
 ### 🛠 Breaking changes
 
+### 🎉 New features
+
+- [eas-build-job] Add a shared protocol for sandbox daemon commands. ([#4346](https://github.com/expo/eas-cli/pull/4346) by [@sjchmiela](https://github.com/sjchmiela))
+
+### 🐛 Bug fixes
+
+### 🧹 Chores
+
+## [24.2.0](https://github.com/expo/eas-cli/releases/tag/v24.2.0) - 2026-09-11
+
+### 🎉 New features
+
+- [eas-build-job] Remove repository URLs from Git job inputs and fetch them when resolving project sources. ([#4360](https://github.com/expo/eas-cli/pull/4360) by [@sjchmiela](https://github.com/sjchmiela))
+- [eas-cli] Add `eas workflow:insights` to display Workflows Insights for a time range: run counts and success rate compared with the previous period, runs over time, and a per-workflow breakdown, with `--json` output for scripts. ([#4367](https://github.com/expo/eas-cli/pull/4367) by [@hSATAC](https://github.com/hSATAC))
+- [eas-cli] Add `eas workflow:insights:maestro` to display Maestro test insights for a time range: pass and flake rates, a sortable per-flow table, and a single flow's history with error patterns and recent runs, with `--json` output for scripts. ([#4370](https://github.com/expo/eas-cli/pull/4370) by [@hSATAC](https://github.com/hSATAC))
+
+### 🐛 Bug fixes
+
+- [eas-cli] Reject `--end` without `--start` in the `observe:*`, `update:insights`, `channel:insights`, and `update:view --insights` commands instead of silently falling back to the default time range. ([#4367](https://github.com/expo/eas-cli/pull/4367) by [@hSATAC](https://github.com/hSATAC))
+- [eas-cli] Reject a time range that does not run forwards in the `observe:*`, `update:insights`, `channel:insights`, `update:view --insights`, and `workflow:insights` commands instead of sending it to the server. ([#4367](https://github.com/expo/eas-cli/pull/4367) by [@hSATAC](https://github.com/hSATAC))
+- [eas-cli] Reject non-integer values for `--limit` and `--offset` instead of sending them to the server. ([#4367](https://github.com/expo/eas-cli/pull/4367) by [@hSATAC](https://github.com/hSATAC))
+
+### 🧹 Chores
+
+- [build-tools] Require PATH project sources for local builds. ([#4362](https://github.com/expo/eas-cli/pull/4362) by [@sjchmiela](https://github.com/sjchmiela))
+
+## [24.1.2](https://github.com/expo/eas-cli/releases/tag/v24.1.2) - 2026-09-11
+
+### 🐛 Bug fixes
+
+- [eas-cli] Shorten the local egress banner printed by `eas simulator:start` and stop mentioning `eas simulator:egress` in interactive mode, where the client runs in the same terminal. ([#4383](https://github.com/expo/eas-cli/pull/4383) by [@brentvatne](https://github.com/brentvatne))
+
+## [24.1.1](https://github.com/expo/eas-cli/releases/tag/v24.1.1) - 2026-09-11
+
+### 🐛 Bug fixes
+
+- [eas-cli] Stop telling interactive `eas simulator:start --egress local` users to run `eas simulator:egress` when the egress client already runs in the same terminal. ([#4382](https://github.com/expo/eas-cli/pull/4382) by [@brentvatne](https://github.com/brentvatne))
+
+## [24.1.0](https://github.com/expo/eas-cli/releases/tag/v24.1.0) - 2026-09-10
+
+### 🎉 New features
+
+- [eas-cli] Add `--egress-allow <host:port>` to `eas simulator:start` so local egress sessions can reach dev servers on this machine or its network. ([#4369](https://github.com/expo/eas-cli/pull/4369) by [@brentvatne](https://github.com/brentvatne))
+- [eas-cli][build-tools] Forward `--egress-allow localhost:<port>` and `127.0.0.1:<port>` entries from the simulator host's loopback interface to this machine (like `adb reverse`), so dev server URLs that use `127.0.0.1` work through local egress. ([#4369](https://github.com/expo/eas-cli/pull/4369) by [@brentvatne](https://github.com/brentvatne))
+- [build-tools] Add the `eas/start_local_egress` step for iOS simulator sessions with local egress: the device host's system proxy points at a reverse tunnel to the EAS CLI machine, so HTTP(S) requests that honor it exit from that machine and third parties see its IP. ([#4364](https://github.com/expo/eas-cli/pull/4364) by [@brentvatne](https://github.com/brentvatne))
+- [eas-cli] Add `--egress local` to `eas simulator:start` and the `eas simulator:egress` command, which run the local egress client for the session. ([#4364](https://github.com/expo/eas-cli/pull/4364) by [@brentvatne](https://github.com/brentvatne))
+- [build-tools] Require the serve-sim session token for device run session previews, so the tunnel no longer exposes the shell-exec route. ([#4306](https://github.com/expo/eas-cli/pull/4306) by [@gwdp](https://github.com/gwdp))
+
+### 🐛 Bug fixes
+
+- [build-tools] Report a system error when project source refresh fails for a remote build. ([#4359](https://github.com/expo/eas-cli/pull/4359) by [@sjchmiela](https://github.com/sjchmiela))
+
+## [24.0.0](https://github.com/expo/eas-cli/releases/tag/v24.0.0) - 2026-09-09
+
+### 🛠 Breaking changes
+
 - [eas-cli] Align the `eas observe:*` commands with the renamed Observe GraphQL schema. `--json` output now uses `name`/`value` instead of `metricName`/`metricValue` (metrics) and `name` instead of `eventName` (log events and event-name summaries), and `eas observe:events` now lists user-defined events only — exceptions moved to the new `eas observe:errors`. ([#4338](https://github.com/expo/eas-cli/pull/4338) by [@douglowder](https://github.com/douglowder))
 
 ### 🎉 New features
 
+- [build-tools] Add `lcd_width`, `lcd_height`, and `lcd_density` inputs to configure the Android emulator display. ([#4349](https://github.com/expo/eas-cli/pull/4349) by [@krystofwoldrich-agent](https://github.com/krystofwoldrich-agent))
 - [eas-cli] Add `eas channel:protect` and `eas channel:unprotect` to manage EAS Update channel protection, and show protection in channel list and view output. ([#4319](https://github.com/expo/eas-cli/pull/4319) by [@sjkim-expo](https://github.com/sjkim-expo))
+- [eas-cli] Add `eas observe:errors` to display error and exception issue groups (grouped by fingerprint), with `--fingerprint <fingerprint>` to drill into a group's individual occurrences and stack traces. ([#4339](https://github.com/expo/eas-cli/pull/4339) by [@douglowder](https://github.com/douglowder))
+- [eas-cli] Add `eas observe:event` to display a single Observe event (metric, log, or error) by its ID. ([#4252](https://github.com/expo/eas-cli/pull/4252) by [@douglowder](https://github.com/douglowder))
 
 ### 🐛 Bug fixes
 
+- [build-tools] Start Argent remote sessions with `bun x` so they work when the `bunx` symlink is missing. ([491b372a](https://github.com/expo/eas-cli/commit/491b372a) by [@krystofwoldrich](https://github.com/krystofwoldrich))
 - [build-tools] Reduce `expo-device-hub` preview resolution from 1280 px to 960 px to match `serve-sim` and lower streaming bandwidth. ([#4326](https://github.com/expo/eas-cli/pull/4326) by [@krystofwoldrich-agent](https://github.com/krystofwoldrich-agent))
 - [build-tools] Install FFmpeg before launching `expo-device-hub` in Android device sessions. ([#4332](https://github.com/expo/eas-cli/pull/4332) by [@krystofwoldrich-agent](https://github.com/krystofwoldrich-agent))
+- [eas-cli] Print the session token in simulator preview links, so they still open once the preview is gated. ([#4312](https://github.com/expo/eas-cli/pull/4312) by [@gwdp](https://github.com/gwdp))
 
 ### 🧹 Chores
 
+- [eas-cli] Make ASC API key issuer identifier optional in GraphQL and credentials types. ([#4248](https://github.com/expo/eas-cli/pull/4248) by [@sswrk](https://github.com/sswrk))
+
 ## [23.2.0](https://github.com/expo/eas-cli/releases/tag/v23.2.0) - 2026-08-31
 
 ### 🎉 New features

cli-versions.json

@@ -1,4 +1,4 @@
 {
-  "STAGING": "23.2.0",
-  "PRODUCTION": "23.2.0"
+  "STAGING": "24.2.0",
+  "PRODUCTION": "24.2.0"
 }

lerna.json

@@ -1,5 +1,5 @@
 {
   "npmClient": "yarn",
-  "version": "23.2.0",
+  "version": "24.3.0",
   "$schema": "node_modules/lerna/schemas/lerna-schema.json"
 }

packages/build-tools/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/build-tools",
-  "version": "23.2.0",
+  "version": "24.3.0",
   "bugs": "https://github.com/expo/eas-cli/issues",
   "license": "BUSL-1.1",
   "author": "Expo <[email protected]>",
@@ -39,17 +39,17 @@
   "dependencies": {
     "@expo/config": "55.0.10",
     "@expo/config-plugins": "55.0.7",
-    "@expo/downloader": "23.0.0",
-    "@expo/eas-build-job": "23.1.0",
+    "@expo/downloader": "24.0.0",
+    "@expo/eas-build-job": "24.3.0",
     "@expo/env": "^0.4.0",
-    "@expo/logger": "23.1.0",
+    "@expo/logger": "24.0.0",
     "@expo/package-manager": "1.9.10",
     "@expo/plist": "^0.3.5",
     "@expo/results": "^1.0.0",
     "@expo/spawn-async": "1.7.2",
-    "@expo/steps": "23.1.0",
-    "@expo/template-file": "23.0.0",
-    "@expo/turtle-spawn": "23.1.0",
+    "@expo/steps": "24.3.0",
+    "@expo/template-file": "24.0.0",
+    "@expo/turtle-spawn": "24.0.0",
     "@expo/xcpretty": "^4.3.1",
     "@ngrok/ngrok": "1.7.0",
     "@sentry/node": "7.77.0",
@@ -75,6 +75,7 @@
     "semver": "^7.6.2",
     "tar": "7.5.19",
     "uuid": "9.0.1",
+    "ws": "8.21.1",
     "yaml": "^2.8.1",
     "zod": "^4.3.5"
   },
@@ -92,6 +93,7 @@
     "@types/retry": "^0.12.5",
     "@types/semver": "^7.5.8",
     "@types/uuid": "^9.0.8",
+    "@types/ws": "8.5.10",
     "jest": "^29.7.0",
     "memfs": "^4.17.1",
     "nock": "13.4.0",

packages/build-tools/src/__tests__/customBuildContext.test.ts

@@ -11,6 +11,19 @@ jest.mock('../utils/stepMetrics');
 const mockUploadStepMetricsToWwwAsync = jest.mocked(uploadStepMetricsToWwwAsync);
 
 describe(CustomBuildContext, () => {
+  it('copies the MCP server URL from the build context', () => {
+    const ctx = new BuildContext(createTestIosJob(), {
+      env: { __API_SERVER_URL: 'http://api.expo.test' },
+      logBuffer: { getLogs: () => [], getPhaseLogs: () => [] },
+      logger: createMockLogger(),
+      uploadArtifact: jest.fn(),
+      workingdir: '',
+      mcpServerUrl: 'ws://localhost:8787',
+    });
+
+    expect(new CustomBuildContext(ctx).mcpServerUrl).toBe('ws://localhost:8787');
+  });
+
   it('should not lose workflowInterpolationContext', () => {
     const contextUploadArtifact = jest.fn();
     const ctx = new BuildContext(

packages/build-tools/src/__tests__/generic.test.ts

@@ -4,9 +4,11 @@ import { BuildStepGlobalContext, StepsConfigParser } from '@expo/steps';
 import { runGenericJobAsync } from '../generic';
 import { CustomBuildContext } from '../customBuildContext';
 import { uploadJobOutputsToWwwAsync } from '../utils/outputs';
+import { stopLocalEgressResourcesAsync } from '../steps/utils/localEgress';
 
 jest.mock('../customBuildContext');
 jest.mock('../utils/outputs');
+jest.mock('../steps/utils/localEgress', () => ({ stopLocalEgressResourcesAsync: jest.fn() }));
 jest.mock('../common/projectSources');
 jest.mock('../steps/easFunctions', () => ({ getEasFunctions: jest.fn().mockReturnValue([]) }));
 jest.mock('../steps/easFunctionGroups', () => ({
@@ -58,6 +60,25 @@ describe(runGenericJobAsync, () => {
     mockUploadJobOutputsToWwwAsync.mockResolvedValue(undefined);
   });
 
+  it.each(['success', 'failure'])(
+    'releases local egress after workflow %s, before uploading outputs',
+    async outcome => {
+      const executeAsync =
+        outcome === 'success'
+          ? jest.fn().mockResolvedValue(undefined)
+          : jest.fn().mockRejectedValue(new Error(outcome));
+      (StepsConfigParser as unknown as jest.Mock).mockImplementation(() => ({
+        parseAsync: jest.fn().mockResolvedValue({ executeAsync }),
+      }));
+      const { runResult } = await runGenericJobAsync(mockCtx);
+      expect(runResult.ok).toBe(outcome === 'success');
+      expect(stopLocalEgressResourcesAsync).toHaveBeenCalledWith(mockCtx.logger);
+      expect(jest.mocked(stopLocalEgressResourcesAsync).mock.invocationCallOrder[0]).toBeLessThan(
+        mockUploadJobOutputsToWwwAsync.mock.invocationCallOrder[0]
+      );
+    }
+  );
+
   it('awaits drainPendingMetricUploads in COMPLETE_JOB phase', async () => {
     const mockWorkflow = { executeAsync: jest.fn().mockResolvedValue(undefined) };
     (StepsConfigParser as unknown as jest.Mock).mockImplementation(() => ({

packages/build-tools/src/common/__tests__/projectSources.test.ts

@@ -2,8 +2,10 @@ import {
   ArchiveSourceType,
   BuildMode,
   BuildTrigger,
+  ErrorCode,
   Job,
   Platform,
+  SystemError,
   Workflow,
 } from '@expo/eas-build-job';
 import spawn from '@expo/turtle-spawn';
@@ -45,7 +47,7 @@ describe('projectSources', () => {
     expect(logger.info).toHaveBeenCalledWith('Normalizing project source permissions');
   });
 
-  it('should use the refreshed repository URL', async () => {
+  it.each([true, false])('uses the refreshed URL (legacy URL: %s)', async includeRepositoryUrl => {
     const robotAccessToken = randomUUID();
     const buildId = randomUUID();
     await vol.promises.mkdir('/workingdir/environment-secrets/', { recursive: true });
@@ -61,7 +63,9 @@ describe('projectSources', () => {
         appId: randomUUID(),
         projectArchive: {
           type: ArchiveSourceType.GIT,
-          repositoryUrl: 'https://x-access-token:[email protected]/expo/eas-cli.git',
+          ...(includeRepositoryUrl
+            ? { repositoryUrl: 'https://x-access-token:[email protected]/expo/eas-cli.git' }
+            : {}),
           gitRef: 'refs/heads/main',
           gitCommitHash,
         },
@@ -111,102 +115,88 @@ describe('projectSources', () => {
     );
   });
 
-  it('should fallback to the original repository URL if the refresh fails', async () => {
-    const robotAccessToken = randomUUID();
-    const buildId = randomUUID();
-    await vol.promises.mkdir('/workingdir/environment-secrets/', { recursive: true });
+  it.each(['http', 'network', 'json', 'schema', 'missing-url', 'PATH', 'GCS', 'R2'])(
+    'throws a system error if refresh fails (%s)',
+    async failure => {
+      const robotAccessToken = randomUUID();
+      const buildId = randomUUID();
+      await vol.promises.mkdir('/workingdir/environment-secrets/', { recursive: true });
 
-    const ctx = new BuildContext(
-      {
-        triggeredBy: BuildTrigger.GIT_BASED_INTEGRATION,
-        type: Workflow.MANAGED,
-        mode: BuildMode.BUILD,
-        initiatingUserId: randomUUID(),
-        appId: randomUUID(),
-        projectArchive: {
-          type: ArchiveSourceType.GIT,
-          repositoryUrl: 'https://x-access-token:[email protected]/expo/eas-cli.git',
-          gitRef: 'refs/heads/main',
-          gitCommitHash: randomBytes(20).toString('hex'),
-        },
-        platform: Platform.IOS,
-        secrets: {
-          robotAccessToken,
-          environmentSecrets: [],
-        },
-      } as Job,
-      {
-        env: {
-          __API_SERVER_URL: 'https://api.expo.dev',
-          EXPO_TOKEN: robotAccessToken,
-          EAS_BUILD_ID: buildId,
-          EAS_BUILD_RUNNER: 'eas-build',
-        },
-        workingdir: '/workingdir',
-        logger: createMockLogger(),
-        logBuffer: { getLogs: () => [], getPhaseLogs: () => [] },
-        uploadArtifact: jest.fn(),
+      const ctx = new BuildContext(
+        {
+          triggeredBy: BuildTrigger.GIT_BASED_INTEGRATION,
+          type: Workflow.MANAGED,
+          mode: BuildMode.BUILD,
+          initiatingUserId: randomUUID(),
+          appId: randomUUID(),
+          projectArchive: {
+            type: ArchiveSourceType.GIT,
+            gitRef: 'refs/heads/main',
+            gitCommitHash: randomBytes(20).toString('hex'),
+          },
+          platform: Platform.IOS,
+          secrets: {
+            robotAccessToken,
+            environmentSecrets: [],
+          },
+        } as Job,
+        {
+          env: {
+            __API_SERVER_URL: 'https://api.expo.dev',
+            EXPO_TOKEN: robotAccessToken,
+            EAS_BUILD_ID: buildId,
+            EAS_BUILD_RUNNER: 'eas-build',
+          },
+          workingdir: '/workingdir',
+          logger: createMockLogger(),
+          logBuffer: { getLogs: () => [], getPhaseLogs: () => [] },
+          uploadArtifact: jest.fn(),
+        }
+      );
+      const fetchMock = jest.mocked(fetch);
+      const cause = new Error('Source request failed');
+      fetchMock.mockImplementation(async () => {
+        if (failure === 'network') {
+          throw cause;
+        }
+        return {
+          ok: failure !== 'http',
+          status: failure === 'http' ? 500 : 200,
+          json: async () => {
+            if (failure === 'json') {
+              throw cause;
+            }
+            if (['PATH', 'GCS', 'R2'].includes(failure)) {
+              return { data: { type: failure, path: '/project.tar.gz', bucketKey: 'project' } };
+            }
+            if (failure === 'missing-url') {
+              return {
+                data: {
+                  type: ArchiveSourceType.GIT,
+                  gitRef: 'refs/heads/main',
+                  gitCommitHash: randomBytes(20).toString('hex'),
+                },
+              };
+            }
+            return { data: { repository_url: 'https://github.com/expo/eas-cli.git' } };
+          },
+        } as Response;
+      });
+
+      const result = prepareProjectSourcesAsync(ctx, ctx.buildDirectory);
+      await expect(result).rejects.toBeInstanceOf(SystemError);
+      await expect(result).rejects.toMatchObject({
+        errorCode: ErrorCode.SERVER_ERROR,
+        cause: expect.any(Error),
+      });
+      if (failure === 'network') {
+        await expect(result).rejects.toMatchObject({ cause });
       }
-    );
-    const fetchMock = jest.mocked(fetch);
-    fetchMock.mockImplementation(
-      async () =>
-        ({
-          ok: false,
-          text: async () => 'Failed to generate repository URL',
-        }) as Response
-    );
-
-    await prepareProjectSourcesAsync(ctx, ctx.buildDirectory);
-    expect(shallowCloneRepositoryAsync).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        archiveSource: {
-          ...ctx.job.projectArchive,
-          repositoryUrl: 'https://x-access-token:[email protected]/expo/eas-cli.git',
-        },
-      })
-    );
-    fetchMock.mockImplementation(
-      async () =>
-        ({
-          ok: false,
-          json: async () => ({
-            // repositoryUrl is the right key
-            repository_url: 'https://x-access-token:[email protected]/expo/eas-cli.git',
-          }),
-        }) as Response
-    );
-
-    await prepareProjectSourcesAsync(ctx, ctx.buildDirectory);
-    expect(shallowCloneRepositoryAsync).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        archiveSource: {
-          ...ctx.job.projectArchive,
-          repositoryUrl: 'https://x-access-token:[email protected]/expo/eas-cli.git',
-        },
-      })
-    );
-
-    fetchMock.mockImplementation(
-      async () =>
-        ({
-          ok: false,
-          json: () => Promise.reject(new Error('Failed to generate repository URL')),
-        }) as Response
-    );
-
-    await prepareProjectSourcesAsync(ctx, ctx.buildDirectory);
-    expect(shallowCloneRepositoryAsync).toHaveBeenLastCalledWith(
-      expect.objectContaining({
-        archiveSource: {
-          ...ctx.job.projectArchive,
-          repositoryUrl: 'https://x-access-token:[email protected]/expo/eas-cli.git',
-        },
-      })
-    );
-
-    expect(shallowCloneRepositoryAsync).toHaveBeenCalledTimes(3);
-  }, 15_000);
+      expect(shallowCloneRepositoryAsync).not.toHaveBeenCalled();
+      expect(spawn).not.toHaveBeenCalled();
+    },
+    15_000
+  );
 
   it('should retry fetching the repository URL', async () => {
     const robotAccessToken = randomUUID();
@@ -224,7 +214,6 @@ describe('projectSources', () => {
         appId: randomUUID(),
         projectArchive: {
           type: ArchiveSourceType.GIT,
-          repositoryUrl: 'https://x-access-token:[email protected]/expo/eas-cli.git',
           gitRef: 'refs/heads/main',
           gitCommitHash,
         },
@@ -281,7 +270,7 @@ describe('projectSources', () => {
     );
   }, 15_000);
 
-  it(`should fallback to the original repository URL if we're missing some config`, async () => {
+  it(`throws a system error if refresh configuration is missing`, async () => {
     const robotAccessToken = randomUUID();
     await vol.promises.mkdir('/workingdir/environment-secrets/', { recursive: true });
     const logger = createMockLogger();
@@ -295,7 +284,6 @@ describe('projectSources', () => {
         appId: randomUUID(),
         projectArchive: {
           type: ArchiveSourceType.GIT,
-          repositoryUrl: 'https://x-access-token:[email protected]/expo/eas-cli.git',
           gitRef: 'refs/heads/main',
           gitCommitHash: randomBytes(20).toString('hex'),
         },
@@ -319,12 +307,11 @@ describe('projectSources', () => {
       }
     );
 
-    await prepareProjectSourcesAsync(ctx, ctx.buildDirectory);
-
-    expect(logger.error).toHaveBeenCalledWith(
-      { err: expect.any(Error) },
-      'Failed to refresh project archive, falling back to the original one'
-    );
+    await expect(prepareProjectSourcesAsync(ctx, ctx.buildDirectory)).rejects.toMatchObject({
+      errorCode: ErrorCode.SERVER_ERROR,
+      cause: new Error('EAS_BUILD_ID is not set'),
+    });
+    expect(shallowCloneRepositoryAsync).not.toHaveBeenCalled();
   });
 
   describe('uploadProjectMetadataAsFireAndForget', () => {
@@ -404,6 +391,10 @@ describe('projectSources', () => {
 
       const fetchMock = jest.mocked(fetch);
       fetchMock.mockImplementation(async () => ({ ok: true }) as Response);
+      fetchMock.mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({ data: ctx.job.projectArchive }),
+      } as Response);
 
       // Call prepareProjectSourcesAsync and don't await metadata upload
       await prepareProjectSourcesAsync(ctx, ctx.buildDirectory);
@@ -517,6 +508,10 @@ describe('projectSources', () => {
 
       const fetchMock = jest.mocked(fetch);
       fetchMock.mockResolvedValue({ ok: true } as Response);
+      fetchMock.mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({ data: ctx.job.projectArchive }),
+      } as Response);
 
       const startTime = Date.now();
       await prepareProjectSourcesAsync(ctx, ctx.buildDirectory);
@@ -581,6 +576,10 @@ describe('projectSources', () => {
 
       const fetchMock = jest.mocked(fetch);
       fetchMock.mockResolvedValue({ ok: true } as Response);
+      fetchMock.mockResolvedValueOnce({
+        ok: true,
+        json: async () => ({ data: ctx.job.projectArchive }),
+      } as Response);
 
       // Should not throw even though upload will fail
       await expect(prepareProjectSourcesAsync(ctx, ctx.buildDirectory)).resolves.not.toThrow();
@@ -595,3 +594,55 @@ describe('projectSources', () => {
     });
   });
 });
+
+describe('local project sources', () => {
+  function createContext(type: ArchiveSourceType): BuildContext<Job> {
+    return new BuildContext(
+      {
+        platform: Platform.IOS,
+        projectArchive: { type, path: '/source.tar.gz' },
+      } as Job,
+      {
+        env: { EAS_BUILD_RUNNER: 'local-build-plugin', __API_SERVER_URL: 'https://api.expo.dev' },
+        workingdir: '/workingdir',
+        logger: createMockLogger(),
+        logBuffer: { getLogs: () => [], getPhaseLogs: () => [] },
+        uploadArtifact: jest.fn(),
+      }
+    );
+  }
+
+  it('copies and unpacks a PATH source without fetching from www', async () => {
+    await vol.promises.mkdir('/workingdir', { recursive: true });
+    await vol.promises.writeFile('/source.tar.gz', 'local archive');
+    const ctx = createContext(ArchiveSourceType.PATH);
+    await expect(prepareProjectSourcesAsync(ctx, ctx.buildDirectory)).resolves.toEqual({
+      handled: true,
+    });
+    expect(await vol.promises.readFile('/workingdir/project.tar.gz', 'utf8')).toBe('local archive');
+    expect(spawn).toHaveBeenCalledWith(
+      'tar',
+      ['-C', ctx.buildDirectory, '--strip-components', '1', '-zxf', '/workingdir/project.tar.gz'],
+      { logger: ctx.logger }
+    );
+    expect(fetch).not.toHaveBeenCalled();
+    expect(shallowCloneRepositoryAsync).not.toHaveBeenCalled();
+  });
+
+  it.each(Object.values(ArchiveSourceType).filter(type => type !== ArchiveSourceType.PATH))(
+    'rejects local %s sources before fetching or unpacking',
+    async type => {
+      const ctx = createContext(type);
+      const result = prepareProjectSourcesAsync(ctx, ctx.buildDirectory);
+      await expect(result).rejects.toBeInstanceOf(SystemError);
+      await expect(result).rejects.toMatchObject({
+        errorCode: 'SERVER_ERROR',
+        trackingCode: 'INVALID_LOCAL_PROJECT_SOURCE',
+        message: `Expected a PATH project source for a local build, received ${type}.`,
+      });
+      expect(fetch).not.toHaveBeenCalled();
+      expect(spawn).not.toHaveBeenCalled();
+      expect(shallowCloneRepositoryAsync).not.toHaveBeenCalled();
+    }
+  );
+});

packages/build-tools/src/common/git.ts

@@ -10,7 +10,7 @@ export async function shallowCloneRepositoryAsync({
   destinationDirectory,
 }: {
   logger: bunyan;
-  archiveSource: ArchiveSource & { type: ArchiveSourceType.GIT };
+  archiveSource: ArchiveSource & { type: ArchiveSourceType.GIT; repositoryUrl: string };
   destinationDirectory: string;
 }): Promise<void> {
   const { repositoryUrl } = archiveSource;

packages/build-tools/src/common/projectSources.ts

@@ -1,5 +1,5 @@
 import downloadFile from '@expo/downloader';
-import { ArchiveSource, ArchiveSourceSchemaZ, ArchiveSourceType, Job } from '@expo/eas-build-job';
+import { ArchiveSourceType, Job, SystemError } from '@expo/eas-build-job';
 import { bunyan } from '@expo/logger';
 import { asyncResult } from '@expo/results';
 import spawn from '@expo/turtle-spawn';
@@ -19,33 +19,26 @@ export async function prepareProjectSourcesAsync<TJob extends Job>(
   destinationDirectory: string
 ): // Return type required to make switch exhaustive.
 Promise<{ handled: boolean }> {
-  let projectArchive: ArchiveSource = ctx.job.projectArchive;
   if (ctx.isLocal) {
-    console.warn('Local build, skipping project archive refresh');
-  } else {
-    const projectArchiveResult = await asyncResult(fetchProjectArchiveSourceAsync(ctx));
-
-    if (!projectArchiveResult.ok) {
-      ctx.logger.error(
-        { err: projectArchiveResult.reason },
-        'Failed to refresh project archive, falling back to the original one'
+    if (ctx.job.projectArchive.type !== ArchiveSourceType.PATH) {
+      throw new SystemError(
+        `Expected a PATH project source for a local build, received ${ctx.job.projectArchive.type}.`,
+        { trackingCode: 'INVALID_LOCAL_PROJECT_SOURCE' }
       );
     }
-
-    projectArchive = projectArchiveResult.value ?? ctx.job.projectArchive;
+    await prepareProjectSourcesLocallyAsync(ctx, ctx.job.projectArchive.path, destinationDirectory);
+    return { handled: true };
   }
 
+  const projectArchiveResult = await asyncResult(fetchProjectArchiveSourceAsync(ctx));
+  if (!projectArchiveResult.ok) {
+    throw new SystemError('Failed to fetch project sources. Re-run the job.', {
+      cause: projectArchiveResult.reason,
+    });
+  }
+  const projectArchive = projectArchiveResult.value;
+
   switch (projectArchive.type) {
-    case ArchiveSourceType.R2:
-    case ArchiveSourceType.GCS: {
-      throw new Error('Remote project sources should be resolved earlier to URL');
-    }
-
-    case ArchiveSourceType.PATH: {
-      await prepareProjectSourcesLocallyAsync(ctx, projectArchive.path, destinationDirectory); // used in eas build --local
-      return { handled: true };
-    }
-
     case ArchiveSourceType.NONE: {
       // May be used in no-sources jobs like submission jobs.
       return { handled: true };
@@ -249,7 +242,7 @@ async function uploadProjectMetadataAsync(
   }
 }
 
-async function fetchProjectArchiveSourceAsync(ctx: BuildContext<Job>): Promise<ArchiveSource> {
+async function fetchProjectArchiveSourceAsync(ctx: BuildContext<Job>) {
   const taskId = nullthrows(ctx.env.EAS_BUILD_ID, 'EAS_BUILD_ID is not set');
   const expoApiServerURL = nullthrows(ctx.env.__API_SERVER_URL, '__API_SERVER_URL is not set');
   const robotAccessToken = nullthrows(
@@ -287,7 +280,20 @@ async function fetchProjectArchiveSourceAsync(ctx: BuildContext<Job>): Promise<A
     );
   }
 
-  const dataResult = z.object({ data: ArchiveSourceSchemaZ }).safeParse(jsonResult.value);
+  const dataResult = z
+    .object({
+      data: z.discriminatedUnion('type', [
+        z.object({
+          type: z.literal(ArchiveSourceType.GIT),
+          repositoryUrl: z.string().url(),
+          gitRef: z.string().nullable(),
+          gitCommitHash: z.string(),
+        }),
+        z.object({ type: z.literal(ArchiveSourceType.URL), url: z.string().url() }),
+        z.object({ type: z.literal(ArchiveSourceType.NONE) }),
+      ]),
+    })
+    .safeParse(jsonResult.value);
   if (!dataResult.success) {
     throw new Error(
       `Unexpected data from server (${response.status}): ${z.prettifyError(dataResult.error)}`

packages/build-tools/src/context.ts

@@ -68,6 +68,7 @@ export interface BuildContextOptions {
   skipNativeBuild?: boolean;
   metadata?: Metadata;
   expoApiV2BaseUrl?: string;
+  mcpServerUrl?: string;
 }
 
 export class SkipNativeBuildError extends Error {}
@@ -84,6 +85,7 @@ export class BuildContext<TJob extends Job = Job> {
   ) => void;
   public readonly skipNativeBuild?: boolean;
   public readonly expoApiV2BaseUrl?: string;
+  public readonly mcpServerUrl?: string;
   public artifacts: Artifacts = {};
 
   private readonly _isLocal: boolean;
@@ -112,6 +114,7 @@ export class BuildContext<TJob extends Job = Job> {
     this._metadata = options.metadata;
     this.skipNativeBuild = options.skipNativeBuild;
     this.expoApiV2BaseUrl = options.expoApiV2BaseUrl;
+    this.mcpServerUrl = options.mcpServerUrl;
 
     const environmentSecrets = this.getEnvironmentSecrets(job);
     this._env = {

packages/build-tools/src/customBuildContext.ts

@@ -63,6 +63,7 @@ export class CustomBuildContext<TJob extends Job = Job> implements ExternalBuild
   public readonly logger: bunyan;
   public readonly graphqlClient: Client;
   public readonly runtimeApi: BuilderRuntimeApi;
+  public readonly mcpServerUrl?: string;
   public job: TJob;
   public metadata?: Metadata;
 
@@ -84,6 +85,7 @@ export class CustomBuildContext<TJob extends Job = Job> implements ExternalBuild
     this.runtimeApi = {
       uploadArtifact: (...args) => buildCtx['uploadArtifact'](...args),
     };
+    this.mcpServerUrl = buildCtx.mcpServerUrl;
     this.expoApiV2BaseUrl = buildCtx.expoApiV2BaseUrl;
     this.startTime = new Date();
   }

packages/build-tools/src/generic.ts

@@ -16,6 +16,7 @@ import { BuildContext } from './context';
 import { CustomBuildContext } from './customBuildContext';
 import { getEasFunctionGroups } from './steps/easFunctionGroups';
 import { getEasFunctions } from './steps/easFunctions';
+import { stopLocalEgressResourcesAsync } from './steps/utils/localEgress';
 import { uploadJobOutputsToWwwAsync } from './utils/outputs';
 import { retryAsync } from './utils/retry';
 
@@ -82,7 +83,17 @@ export async function runGenericJobAsync(
     }
   });
 
-  const runResult = await asyncResult(workflow.executeAsync());
+  const runResult = await asyncResult(
+    (async () => {
+      try {
+        await workflow.executeAsync();
+      } finally {
+        // The session-owning step may never run if simulator boot/setup fails,
+        // or may time out while resource acquisition is still in flight.
+        await stopLocalEgressResourcesAsync(ctx.logger);
+      }
+    })()
+  );
 
   await ctx.runBuildPhase(BuildPhase.COMPLETE_JOB, async () => {
     const results = await Promise.allSettled([

packages/build-tools/src/steps/easFunctions.ts

@@ -51,8 +51,10 @@ import { createStartAppiumRemoteSessionBuildFunction } from './functions/startAp
 import { createStartCuttlefishDeviceBuildFunction } from './functions/startCuttlefishDevice';
 import { createStartIosSimulatorBuildFunction } from './functions/startIosSimulator';
 import { createStartIosSimulatorRecordingsBuildFunction } from './functions/startIosSimulatorRecordings';
+import { createStartLocalEgressBuildFunction } from './functions/startLocalEgress';
 import { createStartWebPreviewRemoteSessionBuildFunction } from './functions/startWebPreviewRemoteSession';
 import { createStartServeSimMetricsBuildFunction } from './functions/startServeSimMetrics';
+import { createStartSandboxBuildFunction } from './functions/startSandbox';
 import { createCollectServeSimMetricsBuildFunction } from './functions/collectServeSimMetrics';
 import { createUploadArtifactBuildFunction } from './functions/uploadArtifact';
 import { createUploadDeviceRunSessionScreenRecordingsBuildFunction } from './functions/uploadDeviceRunSessionScreenRecordings';
@@ -103,11 +105,13 @@ export function getEasFunctions(ctx: CustomBuildContext): BuildFunction[] {
     createStartAndroidEmulatorBuildFunction(),
     createStartCuttlefishDeviceBuildFunction(),
     createStartIosSimulatorBuildFunction(),
+    createStartLocalEgressBuildFunction(),
     createStartIosSimulatorRecordingsBuildFunction(),
     createFinishIosSimulatorRecordingsBuildFunction(),
     createUploadDeviceRunSessionScreenRecordingsBuildFunction(ctx),
     createStartWebPreviewRemoteSessionBuildFunction(ctx),
     createStartServeSimMetricsBuildFunction(),
+    createStartSandboxBuildFunction(ctx),
     createCollectServeSimMetricsBuildFunction(ctx),
     createInstallMaestroBuildFunction(),
 

packages/build-tools/src/steps/functions/__tests__/checkout.test.ts

@@ -14,7 +14,6 @@ const projectTargetDirectory = '/workingdir/project';
 
 const GIT_PROJECT_ARCHIVE = {
   type: ArchiveSourceType.GIT,
-  repositoryUrl: 'https://x-access-token:[email protected]/expo/app.git',
   gitRef: 'refs/heads/main',
   gitCommitHash: '0123456789abcdef0123456789abcdef01234567',
 };

packages/build-tools/src/steps/functions/__tests__/remoteSessionLocalEgress.test.ts

@@ -0,0 +1,205 @@
+import { type bunyan } from '@expo/logger';
+import { BuildRuntimePlatform, type BuildStepContext } from '@expo/steps';
+import spawn from '@expo/turtle-spawn';
+import fs from 'node:fs';
+
+import { type CustomBuildContext } from '../../../customBuildContext';
+import { IosSimulatorUtils } from '../../../utils/IosSimulatorUtils';
+import { isProcessDescendantOfAsync } from '../../../utils/processes';
+import { turtleFetch } from '../../../utils/turtleFetch';
+import {
+  monitorLocalEgressAsync,
+  readLocalEgressHandoffAsync,
+  registerLocalEgressResources,
+  stopLocalEgressResourcesAsync,
+} from '../../utils/localEgress';
+import {
+  startDeviceWebPreviewWithTunnelAsync,
+  uploadRemoteSessionConfigAsync,
+  waitForDeviceRunSessionStoppedAsync,
+} from '../../utils/remoteDeviceRunSession';
+import { createStartAgentDeviceRemoteSessionBuildFunction } from '../startAgentDeviceRemoteSession';
+import { createStartAppiumRemoteSessionBuildFunction } from '../startAppiumRemoteSession';
+import { createStartArgentRemoteSessionBuildFunction } from '../startArgentRemoteSession';
+import { createStartWebPreviewRemoteSessionBuildFunction } from '../startWebPreviewRemoteSession';
+
+jest.mock('@expo/turtle-spawn');
+jest.mock('../../../utils/IosSimulatorUtils');
+jest.mock('../../../utils/processes');
+jest.mock('../../../utils/turtleFetch');
+jest.mock('../../utils/agentDeviceArtifacts');
+jest.mock('../../utils/argentArtifacts');
+jest.mock('../../utils/agentDeviceEvents', () => ({
+  startAgentDeviceEventCollectionAsync: async () => ({ stopAsync: jest.fn() }),
+}));
+jest.mock('../../utils/argentEvents', () => ({
+  ARGENT_EVENT_LOG_FILENAME: 'events.jsonl',
+  startArgentEventCollectionAsync: async () => ({ stopAsync: jest.fn() }),
+}));
+jest.mock('../../utils/appiumEvents', () => ({
+  startAppiumEventCollectionAsync: async () => ({ stopAsync: jest.fn() }),
+}));
+jest.mock('../../utils/localEgress', () => ({
+  ...jest.requireActual('../../utils/localEgress'),
+  readLocalEgressHandoffAsync: jest.fn(),
+  monitorLocalEgressAsync: jest.fn(),
+}));
+jest.mock('../../utils/remoteDeviceRunSession', () => ({
+  getDeviceRunSessionIdOrThrow: () => 'session-id',
+  getNgrokTunnelDomainOrThrow: () => 'example.test',
+  getNgrokAuthtokenOrThrow: () => 'ngrok-token',
+  selectXcodeDeveloperDirectoryAsync: jest.fn(),
+  ensureFfmpegInstalledOnceAsync: jest.fn(),
+  spawnDetached: () => ({ pid: 123, getOutput: () => '', stopAsync: jest.fn() }),
+  waitForFileAsync: async () => ({ port: 1234, token: 'controller-token' }),
+  startNgrokTunnelAsync: async () => ({ url: 'https://controller.test', stopAsync: jest.fn() }),
+  startDeviceWebPreviewWithTunnelAsync: jest.fn(),
+  uploadRemoteSessionConfigAsync: jest.fn(),
+  waitForDeviceRunSessionStoppedAsync: jest.fn(),
+}));
+
+const logger = { info: jest.fn(), warn: jest.fn() } as unknown as bunyan;
+const ctx = {} as CustomBuildContext;
+const env = { DEVICE_RUN_SESSION_ID: 'session-id' };
+const handoff = { url: 'https://egress.test', token: 'secret', fingerprint: 'key=', port: 8899 };
+const fields = {
+  egressUrl: handoff.url,
+  egressToken: handoff.token,
+  egressFingerprint: handoff.fingerprint,
+  egressPort: handoff.port,
+};
+const controllers = [
+  ['agent-device', createStartAgentDeviceRemoteSessionBuildFunction, 'agentDeviceRemoteSessionUrl'],
+  ['Appium', createStartAppiumRemoteSessionBuildFunction, 'appiumUrl'],
+  ['Argent', createStartArgentRemoteSessionBuildFunction, 'toolsUrl'],
+  ['web preview', createStartWebPreviewRemoteSessionBuildFunction, 'previewUrl'],
+] as const;
+
+describe.each(controllers)('%s local egress', (_name, createFunction, controllerField) => {
+  const stopPreview = jest.fn();
+  const stopEgress = jest.fn();
+  let lifetime: AbortSignal;
+  async function run(signal?: AbortSignal): Promise<void> {
+    await createFunction(ctx).fn!(
+      { logger, global: { runtimePlatform: BuildRuntimePlatform.DARWIN } } as BuildStepContext,
+      {
+        inputs: {
+          package_version: { value: undefined },
+          max_idle_time_minutes: { value: undefined },
+        },
+        outputs: {},
+        env,
+        signal,
+      } as never
+    );
+  }
+  beforeEach(() => {
+    jest.clearAllMocks();
+    lifetime = registerLocalEgressResources(stopEgress);
+    stopEgress.mockResolvedValue(undefined);
+    stopPreview.mockResolvedValue(undefined);
+    jest.spyOn(fs, 'existsSync').mockReturnValue(true);
+    jest.spyOn(fs.promises, 'mkdtemp').mockResolvedValue('/tmp/appium-egress-test');
+    jest.spyOn(fs.promises, 'writeFile').mockResolvedValue(undefined);
+    jest.spyOn(fs.promises, 'rm').mockResolvedValue(undefined);
+    jest.spyOn(fs.promises, 'readdir').mockResolvedValue(['tool-server.json'] as never);
+    jest
+      .spyOn(fs.promises, 'readFile')
+      .mockResolvedValue(JSON.stringify({ port: 1234, pid: 124, token: 'controller-token' }));
+    jest.mocked(spawn).mockResolvedValue({ stdout: '{}' } as never);
+    jest.mocked(isProcessDescendantOfAsync).mockResolvedValue(true);
+    jest
+      .mocked(IosSimulatorUtils.getAvailableDevicesAsync)
+      .mockResolvedValue([{ udid: 'sim' }] as never);
+    jest.mocked(turtleFetch).mockResolvedValue({ ok: true } as never);
+    jest.mocked(readLocalEgressHandoffAsync).mockResolvedValue(handoff);
+    jest.mocked(monitorLocalEgressAsync).mockResolvedValue(undefined);
+    jest.mocked(startDeviceWebPreviewWithTunnelAsync).mockResolvedValue({
+      previewUrl: 'https://preview.test',
+      previewToken: 'preview-secret',
+      stopAsync: stopPreview,
+    });
+    jest.mocked(uploadRemoteSessionConfigAsync).mockResolvedValue(undefined);
+    jest.mocked(waitForDeviceRunSessionStoppedAsync).mockImplementation(async () => {
+      expect(lifetime.aborted).toBe(false);
+      expect(monitorLocalEgressAsync).toHaveBeenCalledTimes(1);
+    });
+  });
+  afterEach(async () => {
+    await stopLocalEgressResourcesAsync(logger);
+    jest.restoreAllMocks();
+  });
+
+  it('reports credentials and starts monitoring before waiting, then releases resources', async () => {
+    await run();
+    expect(uploadRemoteSessionConfigAsync).toHaveBeenCalledWith({
+      ctx,
+      deviceRunSessionId: 'session-id',
+      logger,
+      remoteConfig: expect.objectContaining({
+        ...fields,
+        [controllerField]: expect.any(String),
+        [controllerField === 'previewUrl' ? 'previewToken' : 'webPreviewToken']: 'preview-secret',
+      }),
+    });
+    expect(monitorLocalEgressAsync).toHaveBeenCalledWith({
+      port: handoff.port,
+      env,
+      logger,
+      signal: expect.any(AbortSignal),
+    });
+    expect(lifetime.aborted).toBe(true);
+    expect(stopEgress).toHaveBeenCalledTimes(1);
+  });
+  it('leaves ordinary remote config unchanged and does not monitor', async () => {
+    await stopLocalEgressResourcesAsync(logger);
+    stopEgress.mockClear();
+    jest.mocked(readLocalEgressHandoffAsync).mockResolvedValue(null);
+    jest.mocked(waitForDeviceRunSessionStoppedAsync).mockResolvedValue(undefined);
+    await run();
+    const { remoteConfig } = jest.mocked(uploadRemoteSessionConfigAsync).mock.calls[0][0];
+    expect(remoteConfig).toHaveProperty(controllerField);
+    expect(Object.keys(remoteConfig).some(key => key.startsWith('egress'))).toBe(false);
+    expect(monitorLocalEgressAsync).not.toHaveBeenCalled();
+    expect(stopEgress).not.toHaveBeenCalled();
+  });
+  it.each(['startup', 'report', 'wait', 'teardown'])(
+    'releases egress after %s fails',
+    async phase => {
+      const error = new Error(`${phase} failed`);
+      if (phase === 'startup') {
+        jest.mocked(startDeviceWebPreviewWithTunnelAsync).mockRejectedValue(error);
+      } else if (phase === 'report') {
+        jest.mocked(uploadRemoteSessionConfigAsync).mockRejectedValue(error);
+      } else if (phase === 'wait') {
+        jest.mocked(waitForDeviceRunSessionStoppedAsync).mockRejectedValue(error);
+      } else {
+        stopPreview.mockRejectedValue(error);
+      }
+      await expect(run()).rejects.toThrow(error);
+      expect(lifetime.aborted).toBe(true);
+      expect(stopEgress).toHaveBeenCalledTimes(1);
+      expect(monitorLocalEgressAsync).toHaveBeenCalledTimes(
+        phase === 'startup' || phase === 'report' ? 0 : 1
+      );
+    }
+  );
+  it('passes cancellation to the monitor and releases the lifetime', async () => {
+    const abort = new AbortController();
+    jest.mocked(waitForDeviceRunSessionStoppedAsync).mockImplementation(async () => abort.abort());
+    await run(abort.signal);
+    expect(monitorLocalEgressAsync).toHaveBeenCalledWith(
+      expect.objectContaining({ signal: abort.signal })
+    );
+    expect(lifetime.aborted).toBe(true);
+    expect(stopEgress).toHaveBeenCalledTimes(1);
+  });
+  it('does not report or start a monitor after cancellation', async () => {
+    const abort = new AbortController();
+    abort.abort();
+    await expect(run(abort.signal)).rejects.toThrow();
+    expect(uploadRemoteSessionConfigAsync).not.toHaveBeenCalled();
+    expect(monitorLocalEgressAsync).not.toHaveBeenCalled();
+    expect(stopEgress).toHaveBeenCalledTimes(1);
+  });
+});

packages/build-tools/src/steps/functions/__tests__/startAndroidEmulator.test.ts

@@ -83,6 +83,31 @@ describe(createStartAndroidEmulatorBuildFunction, () => {
     mockedMkdtemp.mockRestore();
   });
 
+  it('passes profile and LCD inputs to emulator creation', async () => {
+    const systemImagePackage = 'system-images;android-35;default;x86_64';
+    await createStep({
+      device_identifier: 'medium_phone',
+      system_image_package: systemImagePackage,
+      lcd_width: 720,
+      lcd_height: 1600,
+      lcd_density: 262,
+    }).executeAsync();
+
+    expect(mockedSpawn).toHaveBeenCalledWith('sdkmanager', [systemImagePackage], expect.anything());
+    expect(mockedAndroidUtils.createAsync).toHaveBeenCalledWith(
+      expect.objectContaining({
+        deviceIdentifier: 'medium_phone',
+        systemImagePackage,
+        lcdWidth: 720,
+        lcdHeight: 1600,
+        lcdDensity: 262,
+      })
+    );
+    expect(mockedAndroidUtils.createAsync.mock.invocationCallOrder[0]).toBeLessThan(
+      mockedAndroidUtils.startAsync.mock.invocationCallOrder[0]
+    );
+  });
+
   it('retries base emulator startup with increasing readiness timeouts', async () => {
     mockedAndroidUtils.startAsync
       .mockResolvedValueOnce(createStartResult('emulator-1111'))

packages/build-tools/src/steps/functions/__tests__/startArgentRemoteSession-orchestration.test.ts

@@ -142,7 +142,10 @@ describe('createStartArgentRemoteSessionBuildFunction orchestration', () => {
     const spawnCalls = jest.mocked(spawn).mock.calls;
     const enableEventLogIndex = spawnCalls.findIndex(
       ([command, args]) =>
-        command === 'bunx' && Array.isArray(args) && args.includes('tool-server-event-log')
+        command === 'bun' &&
+        Array.isArray(args) &&
+        args[0] === 'x' &&
+        args.includes('tool-server-event-log')
     );
     expect(enableEventLogIndex).toBeGreaterThanOrEqual(0);
     expect(jest.mocked(spawn).mock.invocationCallOrder[enableEventLogIndex]).toBeLessThan(

packages/build-tools/src/steps/functions/__tests__/startArgentRemoteSession.test.ts

@@ -74,7 +74,7 @@ describe(warnIfArgentPackageVersionCannotBeVerified, () => {
     ).not.toThrow();
     expect(warn).toHaveBeenCalledTimes(2);
     expect(warn).toHaveBeenCalledWith(
-      expect.stringContaining('Continuing and letting bunx resolve it.')
+      expect.stringContaining('Continuing and letting bun x resolve it.')
     );
   });
 });

packages/build-tools/src/steps/functions/__tests__/startLocalEgress.test.ts

@@ -0,0 +1,187 @@
+import { type bunyan } from '@expo/logger';
+import { type BuildStepContext } from '@expo/steps';
+import fs from 'node:fs';
+
+import {
+  LOCAL_EGRESS_HANDOFF_PATH,
+  configureSystemProxyAsync,
+  downloadChiselAsync,
+  startChiselServerAsync,
+  stopLocalEgressResourcesAsync,
+  writeLocalEgressHandoffAsync,
+} from '../../utils/localEgress';
+import { findAvailablePortAsync, startNgrokTunnelAsync } from '../../utils/remoteDeviceRunSession';
+import { createStartLocalEgressBuildFunction } from '../startLocalEgress';
+
+jest.mock('../../utils/localEgress', () => ({
+  ...jest.requireActual('../../utils/localEgress'),
+  configureSystemProxyAsync: jest.fn(),
+  downloadChiselAsync: jest.fn(),
+  startChiselServerAsync: jest.fn(),
+  writeLocalEgressHandoffAsync: jest.fn(),
+}));
+jest.mock('../../utils/remoteDeviceRunSession', () => ({
+  findAvailablePortAsync: jest.fn(),
+  startNgrokTunnelAsync: jest.fn(),
+  getNgrokAuthtokenOrThrow: () => 'ngrok-token',
+  getNgrokTunnelDomainOrThrow: () => 'example.com',
+}));
+
+const logger = { info: jest.fn(), warn: jest.fn() } as unknown as bunyan;
+const server = { pid: 12345, getOutput: () => '', stopAsync: jest.fn() };
+const tunnel = { url: 'https://egress.example.com', stopAsync: jest.fn() };
+
+async function start(signal?: AbortSignal): Promise<void> {
+  await createStartLocalEgressBuildFunction().fn!({ logger } as BuildStepContext, {
+    env: {},
+    inputs: {},
+    outputs: {},
+    signal,
+  });
+}
+
+describe('local egress acquisition', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    jest.spyOn(fs.promises, 'mkdtemp').mockResolvedValue('/tmp/egress-acquisition-test');
+    jest.spyOn(fs.promises, 'writeFile').mockResolvedValue(undefined);
+    jest.spyOn(fs.promises, 'rm').mockResolvedValue(undefined);
+    server.stopAsync.mockResolvedValue(undefined);
+    tunnel.stopAsync.mockResolvedValue(undefined);
+    jest.mocked(findAvailablePortAsync).mockResolvedValue(52001);
+    jest.mocked(downloadChiselAsync).mockResolvedValue('/tmp/egress-acquisition-test/chisel');
+    jest.mocked(startChiselServerAsync).mockResolvedValue({ process: server, fingerprint: 'key=' });
+    jest.mocked(startNgrokTunnelAsync).mockResolvedValue(tunnel);
+    jest.mocked(configureSystemProxyAsync).mockResolvedValue({ service: 'Ethernet' });
+    jest.mocked(writeLocalEgressHandoffAsync).mockResolvedValue(undefined);
+  });
+
+  afterEach(async () => {
+    await stopLocalEgressResourcesAsync(logger);
+    jest.restoreAllMocks();
+  });
+
+  it('stops the detached server and removes credentials when ngrok acquisition fails', async () => {
+    jest.mocked(startNgrokTunnelAsync).mockRejectedValue(new Error('listener quota'));
+    await expect(start()).rejects.toThrow('listener quota');
+    expect(server.stopAsync).toHaveBeenCalledTimes(1);
+    expect(configureSystemProxyAsync).not.toHaveBeenCalled();
+    expect(fs.promises.rm).toHaveBeenCalledWith('/tmp/egress-acquisition-test', {
+      recursive: true,
+      force: true,
+    });
+  });
+
+  it('attempts every release even when one resource cannot stop', async () => {
+    await start();
+    tunnel.stopAsync.mockRejectedValue(new Error('ngrok close failed'));
+    await stopLocalEgressResourcesAsync(logger);
+    expect(server.stopAsync).toHaveBeenCalledTimes(1);
+    expect(fs.promises.rm).toHaveBeenCalledWith(LOCAL_EGRESS_HANDOFF_PATH, { force: true });
+    expect(logger.warn).toHaveBeenCalledWith(
+      expect.objectContaining({ err: expect.any(Error) }),
+      'Could not stop a local egress resource.'
+    );
+  });
+
+  it.each([false, true])(
+    'disposes late listeners without delaying cleanup (close fails: %s)',
+    async closeFails => {
+      let finishTunnel!: (value: typeof tunnel) => void;
+      jest.mocked(startNgrokTunnelAsync).mockImplementation(
+        () =>
+          new Promise(resolve => {
+            finishTunnel = resolve;
+          })
+      );
+      const started = start();
+      const rejected = expect(started).rejects.toThrow();
+      await new Promise(resolve => setImmediate(resolve));
+      expect(startNgrokTunnelAsync).toHaveBeenCalledTimes(1);
+      const stopped = stopLocalEgressResourcesAsync(logger);
+      await Promise.all([stopped, rejected]);
+      expect(server.stopAsync).toHaveBeenCalledTimes(1);
+      expect(tunnel.stopAsync).not.toHaveBeenCalled();
+      if (closeFails) {
+        tunnel.stopAsync.mockRejectedValue(new Error('late close failed'));
+      }
+      finishTunnel(tunnel);
+      await new Promise(resolve => setImmediate(resolve));
+      if (closeFails) {
+        expect(logger.warn).toHaveBeenCalledWith(
+          expect.objectContaining({ err: expect.any(Error) }),
+          'Could not release a cancelled local egress acquisition.'
+        );
+      }
+      expect(tunnel.stopAsync).toHaveBeenCalledTimes(1);
+      expect(configureSystemProxyAsync).not.toHaveBeenCalled();
+      expect(writeLocalEgressHandoffAsync).not.toHaveBeenCalled();
+    }
+  );
+
+  it.each(['job', 'step'])('finishes %s cancellation when ngrok never settles', async source => {
+    jest.mocked(startNgrokTunnelAsync).mockReturnValue(new Promise(() => {}));
+    const controller = new AbortController();
+    const started = start(controller.signal);
+    const rejected = expect(started).rejects.toThrow();
+    await new Promise(resolve => setImmediate(resolve));
+    expect(startNgrokTunnelAsync).toHaveBeenCalledTimes(1);
+    if (source === 'step') {
+      controller.abort(new Error('cancelled'));
+    }
+    const stopped = source === 'job' ? stopLocalEgressResourcesAsync(logger) : Promise.resolve();
+    const outcome = await Promise.race([
+      Promise.all([stopped, rejected]).then(() => 'stopped'),
+      new Promise(resolve => setImmediate(() => resolve('still waiting'))),
+    ]);
+    expect(outcome).toBe('stopped');
+    expect(server.stopAsync).toHaveBeenCalledTimes(1);
+    expect(configureSystemProxyAsync).not.toHaveBeenCalled();
+    expect(writeLocalEgressHandoffAsync).not.toHaveBeenCalled();
+  });
+
+  it('handles ngrok rejection after finalization without an unhandled rejection', async () => {
+    let rejectTunnel!: (error: Error) => void;
+    jest.mocked(startNgrokTunnelAsync).mockReturnValue(
+      new Promise((_resolve, reject) => {
+        rejectTunnel = reject;
+      })
+    );
+    const started = start();
+    const rejected = expect(started).rejects.toThrow();
+    await new Promise(resolve => setImmediate(resolve));
+    await Promise.all([stopLocalEgressResourcesAsync(logger), rejected]);
+    rejectTunnel(new Error('late connection failure'));
+    await new Promise(resolve => setImmediate(resolve));
+    expect(server.stopAsync).toHaveBeenCalledTimes(1);
+    expect(configureSystemProxyAsync).not.toHaveBeenCalled();
+  });
+
+  it('does not launch a server after a download finishes following cancellation', async () => {
+    let finishDownload!: (value: string) => void;
+    jest.mocked(downloadChiselAsync).mockImplementation(
+      () =>
+        new Promise(resolve => {
+          finishDownload = resolve;
+        })
+    );
+    const controller = new AbortController();
+    const started = start(controller.signal);
+    const rejected = expect(started).rejects.toThrow('cancelled');
+    await new Promise(resolve => setImmediate(resolve));
+    controller.abort(new Error('cancelled'));
+    await rejected;
+    finishDownload('/tmp/chisel');
+    await new Promise(resolve => setImmediate(resolve));
+    expect(startChiselServerAsync).not.toHaveBeenCalled();
+    expect(
+      jest
+        .mocked(fs.promises.rm)
+        .mock.calls.filter(([target]) => target === '/tmp/egress-acquisition-test')
+    ).toHaveLength(2);
+    expect(fs.promises.rm).toHaveBeenCalledWith('/tmp/egress-acquisition-test', {
+      recursive: true,
+      force: true,
+    });
+  });
+});

packages/build-tools/src/steps/functions/__tests__/startSandbox.test.ts

@@ -0,0 +1,131 @@
+import { SystemError } from '@expo/eas-build-job';
+import { Client, fetchExchange } from '@urql/core';
+
+import * as sandboxDaemon from '../../utils/sandboxDaemon';
+
+import { createStartSandboxBuildFunction, markSandboxReadyAsync } from '../startSandbox';
+
+describe('sandbox build functions', () => {
+  it('aborts an active ready request and keeps its authentication headers', async () => {
+    const controller = new AbortController();
+    let requestStarted!: () => void;
+    const started = new Promise<void>(resolve => {
+      requestStarted = resolve;
+    });
+    const fetchMock = jest.spyOn(globalThis, 'fetch').mockImplementation(async (_input, init) => {
+      expect(new Headers(init?.headers).get('Authorization')).toBe('Bearer test-token');
+      return await new Promise<Response>((_resolve, reject) => {
+        init!.signal!.addEventListener('abort', () => reject(init!.signal!.reason), { once: true });
+        requestStarted();
+      });
+    });
+    const graphqlClient = new Client({
+      url: 'https://api.expo.test/graphql',
+      exchanges: [fetchExchange],
+      fetchOptions: { headers: { Authorization: 'Bearer test-token' } },
+    });
+    try {
+      const pending = markSandboxReadyAsync(
+        { graphqlClient } as any,
+        'sandbox-id',
+        controller.signal
+      );
+      const rejected = expect(pending).rejects.toMatchObject({ name: 'AbortError' });
+      await started;
+      controller.abort();
+      await rejected;
+    } finally {
+      fetchMock.mockRestore();
+    }
+  });
+  it('does not mark the sandbox ready if startup was canceled', async () => {
+    const controller = new AbortController();
+    const stopAsync = jest.fn(async () => {});
+    const start = jest
+      .spyOn(sandboxDaemon, 'startSandboxDaemonAsync')
+      .mockImplementation(async options => {
+        expect(options.signal).toBe(controller.signal);
+        controller.abort();
+        return { ready: Promise.resolve(), stopAsync };
+      });
+    const mutation = jest.fn();
+    const fn = createStartSandboxBuildFunction({
+      env: { __EAS_SANDBOX_MCP_TOKEN: 'token' },
+      mcpServerUrl: 'ws://localhost:8787',
+      graphqlClient: { mutation },
+    } as any);
+    try {
+      await expect(
+        fn.fn!({ logger: {} } as any, {
+          inputs: { sandbox_id: { value: 'sandbox-id' } },
+          outputs: {},
+          env: {},
+          signal: controller.signal,
+        })
+      ).rejects.toThrow();
+      expect(mutation).not.toHaveBeenCalled();
+      expect(stopAsync).toHaveBeenCalledTimes(1);
+    } finally {
+      start.mockRestore();
+    }
+  });
+  it('provides one long-running step', () => {
+    const ctx = { job: {} } as any;
+    expect(createStartSandboxBuildFunction(ctx).getFullId()).toBe('eas/start_sandbox');
+  });
+
+  it('throws a system error when the sandbox token is missing', async () => {
+    const fn = createStartSandboxBuildFunction({
+      job: {},
+      env: {},
+      mcpServerUrl: 'ws://localhost:8787',
+    } as any);
+
+    await expect(
+      fn.fn!({} as any, {
+        inputs: { sandbox_id: { value: 'sandbox-id' } },
+        outputs: {},
+        env: {},
+      })
+    ).rejects.toBeInstanceOf(SystemError);
+  });
+
+  it('throws a system error when the MCP server URL is missing', async () => {
+    const fn = createStartSandboxBuildFunction({
+      job: {},
+      env: { __EAS_SANDBOX_MCP_TOKEN: 'sandbox-token' },
+    } as any);
+
+    await expect(
+      fn.fn!({} as any, {
+        inputs: { sandbox_id: { value: 'sandbox-id' } },
+        outputs: {},
+        env: {},
+      })
+    ).rejects.toBeInstanceOf(SystemError);
+  });
+
+  it('marks the sandbox as ready', async () => {
+    const mutation = jest.fn(() => ({
+      toPromise: async () => ({ data: { sandbox: { markSandboxReady: { id: 'sandbox-id' } } } }),
+    }));
+
+    await markSandboxReadyAsync({ graphqlClient: { mutation } } as any, 'sandbox-id');
+
+    expect(mutation).toHaveBeenCalledWith(
+      expect.anything(),
+      { sandboxId: 'sandbox-id' },
+      undefined
+    );
+  });
+
+  it('throws a system error when marking the sandbox as ready fails', async () => {
+    const mutation = jest.fn(() => ({
+      toPromise: async () => ({ error: new Error('request failed') }),
+    }));
+
+    await expect(
+      markSandboxReadyAsync({ graphqlClient: { mutation } } as any, 'sandbox-id')
+    ).rejects.toThrow('Failed to mark sandbox sandbox-id as ready.');
+  });
+});

packages/build-tools/src/steps/functions/__tests__/startWebPreviewRemoteSession.test.ts

@@ -52,6 +52,25 @@ describe(createStartWebPreviewRemoteSessionBuildFunction, () => {
     stopAsync.mockResolvedValue(undefined);
   });
 
+  it('reports the session token when serve-sim minted one', async () => {
+    jest.mocked(startDeviceWebPreviewWithTunnelAsync).mockResolvedValue({
+      previewUrl: 'https://web-preview.example.test',
+      previewToken: 'tok-1',
+      stopAsync,
+    });
+
+    await runAsync(BuildRuntimePlatform.DARWIN);
+
+    expect(uploadRemoteSessionConfigAsync).toHaveBeenCalledWith(
+      expect.objectContaining({
+        remoteConfig: {
+          previewUrl: 'https://web-preview.example.test',
+          previewToken: 'tok-1',
+        },
+      })
+    );
+  });
+
   it.each([
     [BuildRuntimePlatform.DARWIN, true],
     [BuildRuntimePlatform.LINUX, false],

packages/build-tools/src/steps/functions/startAgentDeviceRemoteSession.ts

@@ -13,6 +13,10 @@ import os from 'node:os';
 import path from 'node:path';
 
 import { type CustomBuildContext } from '../../customBuildContext';
+import {
+  uploadRemoteSessionConfigWithLocalEgressAsync,
+  withLocalEgressSession,
+} from '../utils/localEgressSession';
 import { Sentry } from '../../sentry';
 import { pollAgentDeviceArtifactsForUploadAsync } from '../utils/agentDeviceArtifacts';
 import { startAgentDeviceEventCollectionAsync } from '../utils/agentDeviceEvents';
@@ -25,7 +29,6 @@ import {
   spawnDetached,
   startDeviceWebPreviewWithTunnelAsync,
   startNgrokTunnelAsync,
-  uploadRemoteSessionConfigAsync,
   waitForDeviceRunSessionStoppedAsync,
   waitForFileAsync,
 } from '../utils/remoteDeviceRunSession';
@@ -66,7 +69,7 @@ export function createStartAgentDeviceRemoteSessionBuildFunction(
         allowedValueTypeName: BuildStepInputValueTypeName.NUMBER,
       }),
     ],
-    fn: async ({ logger, global }, { inputs, env, signal }) => {
+    fn: withLocalEgressSession(async ({ logger, global }, { inputs, env, signal }) => {
       // Fail fast before any expensive setup if the injected env
       // vars are missing: DEVICE_RUN_SESSION_ID (to report the remote config
       // back to the API server), EAS_SIMULATOR_NGROK_TUNNEL_DOMAIN (base domain
@@ -121,13 +124,16 @@ export function createStartAgentDeviceRemoteSessionBuildFunction(
         });
         logger.info(`Web preview URL: ${webPreview.previewUrl}`);
 
-        await uploadRemoteSessionConfigAsync({
+        await uploadRemoteSessionConfigWithLocalEgressAsync({
+          env,
+          signal,
           ctx,
           deviceRunSessionId,
           remoteConfig: {
             agentDeviceRemoteSessionUrl,
             agentDeviceRemoteSessionToken: daemonToken,
             webPreviewUrl: webPreview.previewUrl,
+            ...(webPreview.previewToken ? { webPreviewToken: webPreview.previewToken } : {}),
           },
           logger,
         });
@@ -173,7 +179,7 @@ export function createStartAgentDeviceRemoteSessionBuildFunction(
         }
         await daemonProcess.stopAsync();
       }
-    },
+    }),
   });
 }
 

packages/build-tools/src/steps/functions/startAndroidEmulator.ts

@@ -46,6 +46,21 @@ export function createStartAndroidEmulatorBuildFunction(): BuildFunction {
         defaultValue: AndroidEmulatorUtils.defaultSystemImagePackage,
         allowedValueTypeName: BuildStepInputValueTypeName.STRING,
       }),
+      BuildStepInput.createProvider({
+        id: 'lcd_width',
+        required: false,
+        allowedValueTypeName: BuildStepInputValueTypeName.NUMBER,
+      }),
+      BuildStepInput.createProvider({
+        id: 'lcd_height',
+        required: false,
+        allowedValueTypeName: BuildStepInputValueTypeName.NUMBER,
+      }),
+      BuildStepInput.createProvider({
+        id: 'lcd_density',
+        required: false,
+        allowedValueTypeName: BuildStepInputValueTypeName.NUMBER,
+      }),
       BuildStepInput.createProvider({
         id: 'count',
         required: false,
@@ -86,6 +101,9 @@ export function createStartAndroidEmulatorBuildFunction(): BuildFunction {
       const systemImagePackage = `${inputs.system_image_package.value}`;
       // We can cast because allowedValueTypeName validated this is a string.
       const deviceIdentifier = inputs.device_identifier.value as AndroidDeviceName | undefined;
+      const lcdWidth = inputs.lcd_width.value as number | undefined;
+      const lcdHeight = inputs.lcd_height.value as number | undefined;
+      const lcdDensity = inputs.lcd_density.value as number | undefined;
       const shouldAdjustAnimationScale =
         env.ANDROID_EMULATOR_ADJUST_ANIMATION_SCALE !== 'false' &&
         env.ANDROID_EMULATOR_ADJUST_ANIMATION_SCALE !== '0';
@@ -129,6 +147,9 @@ export function createStartAndroidEmulatorBuildFunction(): BuildFunction {
               deviceName,
               systemImagePackage,
               deviceIdentifier: deviceIdentifier ?? null,
+              lcdWidth: lcdWidth ?? null,
+              lcdHeight: lcdHeight ?? null,
+              lcdDensity: lcdDensity ?? null,
               env,
               logger,
             });

packages/build-tools/src/steps/functions/startAppiumRemoteSession.ts

@@ -15,6 +15,10 @@ import semver from 'semver';
 import { z } from 'zod';
 
 import { type CustomBuildContext } from '../../customBuildContext';
+import {
+  uploadRemoteSessionConfigWithLocalEgressAsync,
+  withLocalEgressSession,
+} from '../utils/localEgressSession';
 import { AndroidEmulatorUtils } from '../../utils/AndroidEmulatorUtils';
 import { IosSimulatorUtils } from '../../utils/IosSimulatorUtils';
 import { sleepAsync } from '../../utils/retry';
@@ -28,7 +32,6 @@ import {
   spawnDetached,
   startDeviceWebPreviewWithTunnelAsync,
   startNgrokTunnelAsync,
-  uploadRemoteSessionConfigAsync,
   waitForDeviceRunSessionStoppedAsync,
 } from '../utils/remoteDeviceRunSession';
 
@@ -62,7 +65,7 @@ export function createStartAppiumRemoteSessionBuildFunction(
         allowedValueTypeName: BuildStepInputValueTypeName.NUMBER,
       }),
     ],
-    fn: async ({ logger, global }, { inputs, env, signal }) => {
+    fn: withLocalEgressSession(async ({ logger, global }, { inputs, env, signal }) => {
       const deviceRunSessionId = getDeviceRunSessionIdOrThrow(env);
       const ngrokTunnelDomain = getNgrokTunnelDomainOrThrow(env);
       const ngrokAuthtoken = getNgrokAuthtokenOrThrow(env);
@@ -138,7 +141,9 @@ export function createStartAppiumRemoteSessionBuildFunction(
           timeoutMs: APPIUM_STARTUP_TIMEOUT_MS,
         });
 
-        await uploadRemoteSessionConfigAsync({
+        await uploadRemoteSessionConfigWithLocalEgressAsync({
+          env,
+          signal,
           ctx,
           deviceRunSessionId,
           remoteConfig: {
@@ -149,6 +154,7 @@ export function createStartAppiumRemoteSessionBuildFunction(
               'appium:udid': device.udid,
             },
             webPreviewUrl: webPreview.previewUrl,
+            ...(webPreview.previewToken ? { webPreviewToken: webPreview.previewToken } : {}),
           },
           logger,
         });
@@ -177,7 +183,7 @@ export function createStartAppiumRemoteSessionBuildFunction(
         await appiumProcess.stopAsync();
         await fs.promises.rm(appiumHome, { recursive: true, force: true });
       }
-    },
+    }),
   });
 }
 

packages/build-tools/src/steps/functions/startArgentRemoteSession.ts

@@ -14,6 +14,10 @@ import semver from 'semver';
 import { z } from 'zod';
 
 import { CustomBuildContext } from '../../customBuildContext';
+import {
+  uploadRemoteSessionConfigWithLocalEgressAsync,
+  withLocalEgressSession,
+} from '../utils/localEgressSession';
 import { Sentry } from '../../sentry';
 import { isProcessDescendantOfAsync } from '../../utils/processes';
 import { sleepAsync } from '../../utils/retry';
@@ -28,7 +32,6 @@ import {
   spawnDetached,
   startDeviceWebPreviewWithTunnelAsync,
   startNgrokTunnelAsync,
-  uploadRemoteSessionConfigAsync,
   waitForDeviceRunSessionStoppedAsync,
 } from '../utils/remoteDeviceRunSession';
 
@@ -79,7 +82,7 @@ export function createStartArgentRemoteSessionBuildFunction(
         allowedValueTypeName: BuildStepInputValueTypeName.NUMBER,
       }),
     ],
-    fn: async ({ logger, global }, { inputs, env, signal }) => {
+    fn: withLocalEgressSession(async ({ logger, global }, { inputs, env, signal }) => {
       // Fail fast before any expensive setup if the injected env
       // vars are missing: DEVICE_RUN_SESSION_ID (to report the remote config
       // back to the API server), EAS_SIMULATOR_NGROK_TUNNEL_DOMAIN (base domain
@@ -112,24 +115,30 @@ export function createStartArgentRemoteSessionBuildFunction(
 
       logger.info('Enabling the Argent artifacts list endpoint flag.');
       await spawn(
-        'bunx',
-        [`${ARGENT_PACKAGE_NAME}@${versionSpec}`, 'enable', ARGENT_ARTIFACTS_LIST_ENDPOINT_FLAG],
+        'bun',
+        [
+          'x',
+          `${ARGENT_PACKAGE_NAME}@${versionSpec}`,
+          'enable',
+          ARGENT_ARTIFACTS_LIST_ENDPOINT_FLAG,
+        ],
         { env, logger }
       );
 
       logger.info('Enabling the Argent tool-server event log flag.');
       await spawn(
-        'bunx',
-        [`${ARGENT_PACKAGE_NAME}@${versionSpec}`, 'enable', ARGENT_EVENT_LOG_FLAG],
+        'bun',
+        ['x', `${ARGENT_PACKAGE_NAME}@${versionSpec}`, 'enable', ARGENT_EVENT_LOG_FLAG],
         { env, logger }
       );
 
-      logger.info(`Launching ${ARGENT_PACKAGE_NAME}@${versionSpec} tool-server via bunx.`);
-      // Keep Argent itself in foreground mode under the detached bunx process. This preserves
-      // the bunx -> Argent CLI -> tool-server ancestry used to identify the matching state file.
+      logger.info(`Launching ${ARGENT_PACKAGE_NAME}@${versionSpec} tool-server via bun x.`);
+      // Keep Argent itself in foreground mode under the detached bun process. This preserves
+      // the bun -> Argent CLI -> tool-server ancestry used to identify the matching state file.
       const argentServer = spawnDetached({
-        command: 'bunx',
+        command: 'bun',
         args: [
+          'x',
           `${ARGENT_PACKAGE_NAME}@${versionSpec}`,
           'server',
           'start',
@@ -209,13 +218,16 @@ export function createStartArgentRemoteSessionBuildFunction(
         });
         logger.info(`Web preview URL: ${webPreview.previewUrl}`);
 
-        await uploadRemoteSessionConfigAsync({
+        await uploadRemoteSessionConfigWithLocalEgressAsync({
+          env,
+          signal,
           ctx,
           deviceRunSessionId,
           remoteConfig: {
             toolsUrl: publicToolsUrl,
             ...(toolServerToken ? { toolsAuthToken: toolServerToken } : {}),
             webPreviewUrl: webPreview.previewUrl,
+            ...(webPreview.previewToken ? { webPreviewToken: webPreview.previewToken } : {}),
           },
           logger,
         });
@@ -252,7 +264,7 @@ export function createStartArgentRemoteSessionBuildFunction(
         }
         await argentServer.stopAsync();
       }
-    },
+    }),
   });
 }
 
@@ -294,7 +306,7 @@ export function warnIfArgentPackageVersionCannotBeVerified({
     logger.warn(
       `Argent remote simulator sessions require ${ARGENT_PACKAGE_NAME}@${MIN_ARGENT_REMOTE_SESSION_VERSION} or newer, ` +
         `but package_version "${packageVersion}" is not an exact semver version that EAS can verify. ` +
-        `Continuing and letting bunx resolve it.`
+        `Continuing and letting bun x resolve it.`
     );
     return;
   }

packages/build-tools/src/steps/functions/startLocalEgress.ts

@@ -0,0 +1,199 @@
+import { type bunyan } from '@expo/logger';
+import { BuildFunction, BuildRuntimePlatform } from '@expo/steps';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import {
+  CHISEL_VERSION,
+  LOCAL_EGRESS_HANDOFF_PATH,
+  LOCAL_EGRESS_PROXY_PORT,
+  configureSystemProxyAsync,
+  createChiselAuthfileContents,
+  downloadChiselAsync,
+  generateEgressCredentials,
+  registerLocalEgressResources,
+  startChiselServerAsync,
+  stopLocalEgressResourcesAsync,
+  writeLocalEgressHandoffAsync,
+} from '../utils/localEgress';
+import {
+  type DetachedProcessHandle,
+  type NgrokTunnelHandle,
+  findAvailablePortAsync,
+  getNgrokAuthtokenOrThrow,
+  getNgrokTunnelDomainOrThrow,
+  startNgrokTunnelAsync,
+} from '../utils/remoteDeviceRunSession';
+
+/**
+ * The downloader and ngrok SDK do not accept an AbortSignal. Stop awaiting them
+ * on cancellation, while retaining handlers that dispose any eventual result.
+ */
+function awaitLocalEgressAcquisitionAsync<T>(
+  pending: Promise<T>,
+  signal: AbortSignal,
+  disposeAbandonedAsync: (result?: T) => Promise<void>,
+  logger: bunyan
+): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    let abandoned = false;
+    const abort = (): void => {
+      signal.removeEventListener('abort', abort);
+      abandoned = true;
+      reject(signal.reason);
+    };
+    signal.addEventListener('abort', abort, { once: true });
+    if (signal.aborted) {
+      abort();
+    }
+    void pending
+      .then(
+        async result => {
+          signal.removeEventListener('abort', abort);
+          if (abandoned) {
+            await disposeAbandonedAsync(result);
+          } else {
+            resolve(result);
+          }
+        },
+        async error => {
+          signal.removeEventListener('abort', abort);
+          if (abandoned) {
+            await disposeAbandonedAsync();
+          } else {
+            reject(error);
+          }
+        }
+      )
+      .catch(err =>
+        logger.warn({ err }, 'Could not release a cancelled local egress acquisition.')
+      );
+  });
+}
+
+/**
+ * Points the device host's system HTTP(S) proxy at the EAS CLI's egress client.
+ * Must run before `eas/start_ios_simulator`: the simulator reads the system proxy
+ * at boot. Nothing else on the host changes, so requests from libraries that
+ * bypass the system proxy are not covered; the shared session monitor reports
+ * them. The shared session cleanup releases the resources started here when
+ * the session ends, with a job finalizer as a fallback.
+ */
+export function createStartLocalEgressBuildFunction(): BuildFunction {
+  return new BuildFunction({
+    namespace: 'eas',
+    id: 'start_local_egress',
+    name: 'Start local egress',
+    __metricsId: 'eas/start_local_egress',
+    supportedRuntimePlatforms: [BuildRuntimePlatform.DARWIN],
+    fn: async ({ logger }, { env, signal }) => {
+      const ngrokTunnelDomain = getNgrokTunnelDomainOrThrow(env);
+      const ngrokAuthtoken = getNgrokAuthtokenOrThrow(env);
+      let workDir: string | undefined;
+      let server: DetachedProcessHandle | undefined;
+      let tunnel: NgrokTunnelHandle | undefined;
+      let finishSetup!: () => void;
+      const setupFinished = new Promise<void>(resolve => {
+        finishSetup = resolve;
+      });
+      // Register before acquisition. Cancellation ends setup promptly; pending
+      // SDK calls retain their own late-result disposal handlers.
+      const lifetimeSignal = registerLocalEgressResources(async () => {
+        await setupFinished;
+        const results = await Promise.allSettled([
+          Promise.resolve().then(() => tunnel?.stopAsync()),
+          Promise.resolve().then(() => server?.stopAsync()),
+        ]);
+        for (const result of results) {
+          if (result.status === 'rejected') {
+            logger.warn({ err: result.reason }, 'Could not stop a local egress resource.');
+          }
+        }
+        await Promise.all([
+          fs.promises.rm(LOCAL_EGRESS_HANDOFF_PATH, { force: true }),
+          workDir ? fs.promises.rm(workDir, { recursive: true, force: true }) : undefined,
+        ]);
+      });
+      const startupSignal = signal ? AbortSignal.any([signal, lifetimeSignal]) : lifetimeSignal;
+
+      try {
+        startupSignal.throwIfAborted();
+        workDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'eas-local-egress-'));
+        startupSignal.throwIfAborted();
+        logger.info(`Downloading the reverse tunnel server (chisel ${CHISEL_VERSION}).`);
+        const downloadDir = workDir;
+        const chiselPath = await awaitLocalEgressAcquisitionAsync(
+          downloadChiselAsync({ destinationDir: downloadDir, logger }),
+          startupSignal,
+          async () => await fs.promises.rm(downloadDir, { recursive: true, force: true }),
+          logger
+        );
+        startupSignal.throwIfAborted();
+
+        const credentials = generateEgressCredentials();
+        const authfilePath = path.join(workDir, 'authfile.json');
+        await fs.promises.writeFile(
+          authfilePath,
+          createChiselAuthfileContents({ ...credentials, port: LOCAL_EGRESS_PROXY_PORT }),
+          { encoding: 'utf8', mode: 0o600 }
+        );
+        startupSignal.throwIfAborted();
+
+        const controlPort = await findAvailablePortAsync();
+        startupSignal.throwIfAborted();
+        logger.info(`Starting the reverse tunnel server on 127.0.0.1:${controlPort}.`);
+        const started = await startChiselServerAsync({
+          chiselPath,
+          controlPort,
+          authfilePath,
+          env,
+          signal: startupSignal,
+        });
+        server = started.process;
+        startupSignal.throwIfAborted();
+        tunnel = await awaitLocalEgressAcquisitionAsync(
+          startNgrokTunnelAsync({
+            port: controlPort,
+            subdomainPrefix: 'egress',
+            baseDomain: ngrokTunnelDomain,
+            authtoken: ngrokAuthtoken,
+            logger,
+          }),
+          startupSignal,
+          async listener => await listener?.stopAsync(),
+          logger
+        );
+        startupSignal.throwIfAborted();
+
+        const { service } = await configureSystemProxyAsync({
+          env,
+          logger,
+          port: LOCAL_EGRESS_PROXY_PORT,
+          signal: startupSignal,
+        });
+        startupSignal.throwIfAborted();
+        await writeLocalEgressHandoffAsync({
+          url: tunnel.url,
+          token: credentials.password,
+          fingerprint: started.fingerprint,
+          port: LOCAL_EGRESS_PROXY_PORT,
+        });
+        startupSignal.throwIfAborted();
+        logger.info(
+          `Local egress is configured on network service "${service}". HTTP(S) and WebSocket ` +
+            'requests that honor the system proxy (WebKit, URLSession and other CFNetwork clients) ' +
+            'fail until the EAS CLI egress client connects, then exit from that machine. Requests ' +
+            'from libraries that bypass the system proxy are not covered and exit from this worker. ' +
+            'Connection sampling may report these bypasses, but can miss short connections and unconnected UDP traffic.'
+        );
+      } catch (error) {
+        finishSetup();
+        await stopLocalEgressResourcesAsync(logger);
+        throw error;
+      } finally {
+        finishSetup();
+      }
+    },
+  });
+}

packages/build-tools/src/steps/functions/startSandbox.ts

@@ -0,0 +1,105 @@
+import { SystemError } from '@expo/eas-build-job';
+import { BuildFunction, BuildStepInput, BuildStepInputValueTypeName } from '@expo/steps';
+import { graphql } from 'gql.tada';
+
+import { CustomBuildContext } from '../../customBuildContext';
+import { withLogPhaseAsync } from '../../utils/logPhase';
+import { startSandboxDaemonAsync } from '../utils/sandboxDaemon';
+
+const MARK_SANDBOX_READY_MUTATION = graphql(`
+  mutation MarkSandboxReady($sandboxId: ID!) {
+    sandbox {
+      markSandboxReady(sandboxId: $sandboxId) {
+        id
+      }
+    }
+  }
+`);
+
+const RECONNECT_DELAY_MS = 1_000;
+const AWAIT_SANDBOX_STEP_NAME = 'Await sandbox completion';
+
+export function createStartSandboxBuildFunction(ctx: CustomBuildContext): BuildFunction {
+  return new BuildFunction({
+    namespace: 'eas',
+    id: 'start_sandbox',
+    name: 'Start sandbox daemon',
+    __metricsId: 'eas/start_sandbox',
+    inputProviders: [
+      BuildStepInput.createProvider({
+        id: 'sandbox_id',
+        required: true,
+        allowedValueTypeName: BuildStepInputValueTypeName.STRING,
+      }),
+    ],
+    fn: async (stepCtx, { inputs, signal }) => {
+      const sandboxToken = ctx.env.__EAS_SANDBOX_MCP_TOKEN;
+      if (!sandboxToken) {
+        throw new SystemError('__EAS_SANDBOX_MCP_TOKEN is required to start the sandbox daemon.');
+      }
+      const mcpServerUrl = ctx.mcpServerUrl;
+      if (!mcpServerUrl) {
+        throw new SystemError('MCP server URL is required to start the sandbox daemon.');
+      }
+      const sandboxId = String(inputs.sandbox_id.value);
+      const daemon = await startSandboxDaemonAsync({
+        credential: sandboxToken,
+        serverUrl: mcpServerUrl,
+        reconnectDelayMs: RECONNECT_DELAY_MS,
+        logger: stepCtx.logger,
+        signal,
+      });
+      try {
+        await daemon.ready;
+        signal?.throwIfAborted();
+        await markSandboxReadyAsync(ctx, sandboxId, signal);
+        signal?.throwIfAborted();
+        stepCtx.logger.info('Sandbox daemon started.');
+
+        await withLogPhaseAsync(stepCtx.logger, AWAIT_SANDBOX_STEP_NAME, async () => {
+          await waitForCancellationAsync(signal);
+        });
+      } finally {
+        await daemon.stopAsync();
+      }
+    },
+  });
+}
+
+export async function markSandboxReadyAsync(
+  ctx: CustomBuildContext,
+  sandboxId: string,
+  signal?: AbortSignal
+): Promise<void> {
+  signal?.throwIfAborted();
+  const result = await ctx.graphqlClient
+    .mutation(
+      MARK_SANDBOX_READY_MUTATION,
+      { sandboxId },
+      signal
+        ? {
+            fetch: (input, init) =>
+              fetch(input, {
+                ...init,
+                signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal,
+              }),
+          }
+        : undefined
+    )
+    .toPromise();
+  signal?.throwIfAborted();
+  if (result.error) {
+    throw new SystemError(`Failed to mark sandbox ${sandboxId} as ready.`, {
+      cause: result.error,
+    });
+  }
+}
+
+async function waitForCancellationAsync(signal?: AbortSignal): Promise<void> {
+  if (signal?.aborted) {
+    return;
+  }
+  await new Promise<void>(resolve => {
+    signal?.addEventListener('abort', () => resolve(), { once: true });
+  });
+}

packages/build-tools/src/steps/functions/startWebPreviewRemoteSession.ts

@@ -6,12 +6,15 @@ import {
 } from '@expo/steps';
 
 import { CustomBuildContext } from '../../customBuildContext';
+import {
+  uploadRemoteSessionConfigWithLocalEgressAsync,
+  withLocalEgressSession,
+} from '../utils/localEgressSession';
 import {
   getDeviceRunSessionIdOrThrow,
   getNgrokTunnelDomainOrThrow,
   selectXcodeDeveloperDirectoryAsync,
   startDeviceWebPreviewWithTunnelAsync,
-  uploadRemoteSessionConfigAsync,
   waitForDeviceRunSessionStoppedAsync,
 } from '../utils/remoteDeviceRunSession';
 
@@ -37,7 +40,7 @@ export function createStartWebPreviewRemoteSessionBuildFunction(
         allowedValueTypeName: BuildStepInputValueTypeName.NUMBER,
       }),
     ],
-    fn: async ({ logger, global }, { inputs, env, signal }) => {
+    fn: withLocalEgressSession(async ({ logger, global }, { inputs, env, signal }) => {
       const deviceRunSessionId = getDeviceRunSessionIdOrThrow(env);
       const ngrokTunnelDomain = getNgrokTunnelDomainOrThrow(env);
       const maxDurationSeconds = inputs.max_duration_seconds?.value as number | undefined;
@@ -61,10 +64,15 @@ export function createStartWebPreviewRemoteSessionBuildFunction(
       logger.info(`Preview URL: ${webPreview.previewUrl}`);
 
       try {
-        await uploadRemoteSessionConfigAsync({
+        await uploadRemoteSessionConfigWithLocalEgressAsync({
+          env,
+          signal,
           ctx,
           deviceRunSessionId,
-          remoteConfig: { previewUrl: webPreview.previewUrl },
+          remoteConfig: {
+            previewUrl: webPreview.previewUrl,
+            ...(webPreview.previewToken ? { previewToken: webPreview.previewToken } : {}),
+          },
           logger,
         });
 
@@ -78,6 +86,6 @@ export function createStartWebPreviewRemoteSessionBuildFunction(
       } finally {
         await webPreview.stopAsync();
       }
-    },
+    }),
   });
 }

packages/build-tools/src/steps/utils/__tests__/localEgress.test.ts

@@ -0,0 +1,425 @@
+import { type bunyan } from '@expo/logger';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { spawnDetached } from '../remoteDeviceRunSession';
+
+import {
+  CHISEL_VERSION,
+  LOCAL_EGRESS_PROXY_PORT,
+  buildEgressRemoteConfigFields,
+  buildNetworksetupProxyArgs,
+  collectSimulatorProcessIds,
+  createChiselAuthfileContents,
+  getChiselAssetName,
+  getChiselDownloadUrl,
+  parseChiselFingerprint,
+  parseDefaultRouteInterface,
+  parseDirectSimulatorConnections,
+  parseExitIpResponse,
+  parseNetworkServiceNameForDevice,
+  readLocalEgressHandoffAsync,
+  registerLocalEgressResources,
+  startChiselServerAsync,
+  stopLocalEgressResourcesAsync,
+  writeLocalEgressHandoffAsync,
+} from '../localEgress';
+
+jest.mock('@ngrok/ngrok');
+jest.mock('@expo/turtle-spawn');
+jest.mock('../remoteDeviceRunSession', () => ({ spawnDetached: jest.fn() }));
+
+describe(getChiselAssetName, () => {
+  it.each([
+    ['darwin', 'arm64', `chisel_${CHISEL_VERSION}_darwin_arm64.gz`],
+    ['darwin', 'x64', `chisel_${CHISEL_VERSION}_darwin_amd64.gz`],
+    ['linux', 'x64', `chisel_${CHISEL_VERSION}_linux_amd64.gz`],
+    ['linux', 'arm64', `chisel_${CHISEL_VERSION}_linux_arm64.gz`],
+  ] as const)('maps %s/%s to %s', (platform, arch, expected) => {
+    expect(getChiselAssetName({ platform, arch })).toBe(expected);
+  });
+
+  it('rejects platforms without a pinned binary', () => {
+    expect(() => getChiselAssetName({ platform: 'win32', arch: 'x64' })).toThrow(
+      'Local egress is not supported on win32/x64'
+    );
+    expect(() => getChiselAssetName({ platform: 'linux', arch: 'ia32' })).toThrow(
+      'Local egress is not supported on linux/ia32'
+    );
+  });
+
+  it('downloads from the pinned GitHub release', () => {
+    expect(getChiselDownloadUrl(`chisel_${CHISEL_VERSION}_darwin_arm64.gz`)).toBe(
+      `https://github.com/jpillora/chisel/releases/download/v${CHISEL_VERSION}/chisel_${CHISEL_VERSION}_darwin_arm64.gz`
+    );
+  });
+});
+
+describe(createChiselAuthfileContents, () => {
+  it('allows reverse remotes on the loopback proxy port and unprivileged loopback ports only', () => {
+    const contents = createChiselAuthfileContents({ user: 'eas', password: 'pw', port: 8899 });
+    const parsed = JSON.parse(contents) as Record<string, string[]>;
+    expect(parsed['eas:pw']).toHaveLength(2);
+    expect(parsed['eas:pw'][0]).toBe('^R:127\\.0\\.0\\.1:8899$');
+
+    const patterns = parsed['eas:pw'].map(source => new RegExp(source));
+    const allowed = (remote: string): boolean => patterns.some(pattern => pattern.test(remote));
+    expect(allowed('R:127.0.0.1:8899')).toBe(true);
+    expect(allowed('R:127.0.0.1:1024')).toBe(true);
+    expect(allowed('R:127.0.0.1:3000')).toBe(true);
+    expect(allowed('R:127.0.0.1:8081')).toBe(true);
+    expect(allowed('R:127.0.0.1:65535')).toBe(true);
+    // Privileged and out-of-range ports, other interfaces, and forward remotes stay denied.
+    expect(allowed('R:127.0.0.1:1023')).toBe(false);
+    expect(allowed('R:127.0.0.1:80')).toBe(false);
+    expect(allowed('R:127.0.0.1:0')).toBe(false);
+    expect(allowed('R:127.0.0.1:65536')).toBe(false);
+    expect(allowed('R:127.0.0.1:88990')).toBe(false);
+    expect(allowed('R:0.0.0.0:8899')).toBe(false);
+    expect(allowed('R:0.0.0.0:3000')).toBe(false);
+    expect(allowed('R:[::1]:3000')).toBe(false);
+    expect(allowed('R:127x0x0x1:8899')).toBe(false);
+    expect(allowed('R:socks')).toBe(false);
+    expect(allowed('example.com:443')).toBe(false);
+    expect(allowed('127.0.0.1:3000')).toBe(false);
+  });
+});
+
+describe(parseChiselFingerprint, () => {
+  it('extracts the fingerprint chisel prints at startup', () => {
+    const output =
+      '2026/09/07 22:00:00 server: Fingerprint eZm5d2ZQ+Zb2aS0lJm7A5GkWm9G9ZqnPz2W0i2Y6Q1c=\n' +
+      '2026/09/07 22:00:00 server: Reverse tunnelling enabled\n' +
+      '2026/09/07 22:00:00 server: Listening on http://127.0.0.1:52001\n';
+    expect(parseChiselFingerprint(output)).toBe('eZm5d2ZQ+Zb2aS0lJm7A5GkWm9G9ZqnPz2W0i2Y6Q1c=');
+  });
+
+  it('returns null before the fingerprint line appears', () => {
+    expect(parseChiselFingerprint('')).toBeNull();
+    expect(parseChiselFingerprint('2026/09/07 22:00:00 server: starting')).toBeNull();
+  });
+});
+
+describe(parseDefaultRouteInterface, () => {
+  it('reads the interface from `route -n get default`', () => {
+    const output =
+      '   route to: default\n' +
+      'destination: default\n' +
+      '       mask: default\n' +
+      '    gateway: 172.20.10.1\n' +
+      '  interface: en0\n' +
+      '      flags: <UP,GATEWAY,DONE,STATIC,PRCLONING,GLOBAL>\n';
+    expect(parseDefaultRouteInterface(output)).toBe('en0');
+  });
+
+  it('returns null when there is no default route', () => {
+    expect(
+      parseDefaultRouteInterface('route: writing to routing socket: not in table\n')
+    ).toBeNull();
+  });
+});
+
+describe(parseNetworkServiceNameForDevice, () => {
+  const listOutput =
+    'An asterisk (*) denotes that a network service is disabled.\n' +
+    '(1) Thunderbolt Ethernet Slot 0\n' +
+    '(Hardware Port: Thunderbolt Ethernet Slot 0, Device: en8)\n' +
+    '\n' +
+    '(2) Thunderbolt Bridge\n' +
+    '(Hardware Port: Thunderbolt Bridge, Device: bridge0)\n' +
+    '\n' +
+    '(3) Wi-Fi\n' +
+    '(Hardware Port: Wi-Fi, Device: en0)\n' +
+    '\n' +
+    '(4) iPhone USB\n' +
+    '(Hardware Port: iPhone USB, Device: en9)\n';
+
+  it('returns the service whose device matches', () => {
+    expect(parseNetworkServiceNameForDevice(listOutput, 'en0')).toBe('Wi-Fi');
+    expect(parseNetworkServiceNameForDevice(listOutput, 'en8')).toBe('Thunderbolt Ethernet Slot 0');
+  });
+
+  it('returns null for an unknown device', () => {
+    expect(parseNetworkServiceNameForDevice(listOutput, 'utun3')).toBeNull();
+  });
+});
+
+describe(buildNetworksetupProxyArgs, () => {
+  it('sets both the HTTP and HTTPS proxy to the loopback egress port', () => {
+    expect(
+      buildNetworksetupProxyArgs({ service: 'Ethernet', host: '127.0.0.1', port: 8899 })
+    ).toEqual([
+      ['-setwebproxy', 'Ethernet', '127.0.0.1', '8899'],
+      ['-setsecurewebproxy', 'Ethernet', '127.0.0.1', '8899'],
+    ]);
+  });
+});
+
+describe(collectSimulatorProcessIds, () => {
+  const runtimeRoot =
+    '/Library/Developer/CoreSimulator/Volumes/iOS_23F77/Library/Developer/CoreSimulator/Profiles/Runtimes/iOS 26.5.simruntime/Contents/Resources/RuntimeRoot';
+  const psOutput =
+    '    1     0 /sbin/launchd\n' +
+    '  501     1 /usr/local/bin/node\n' +
+    `  600     1 ${runtimeRoot}/sbin/launchd_sim\n` +
+    '  610   600 /Users/expo/Library/Developer/CoreSimulator/Devices/ABC/data/Containers/Bundle/Application/DEF/App.app/App\n' +
+    `  611   600 ${runtimeRoot}/System/Library/ExtensionKit/Extensions/NetworkingExtension.appex/com.apple.WebKit.Networking\n` +
+    '  620   610 /usr/bin/helper\n' +
+    '  700     1 /usr/sbin/lsof\n';
+
+  it('returns every descendant of launchd_sim and nothing else', () => {
+    expect(collectSimulatorProcessIds(psOutput).sort((a, b) => a - b)).toEqual([610, 611, 620]);
+  });
+
+  it('returns nothing when no simulator is running', () => {
+    expect(
+      collectSimulatorProcessIds('    1     0 /sbin/launchd\n  501     1 /usr/local/bin/node\n')
+    ).toEqual([]);
+  });
+});
+
+describe(parseDirectSimulatorConnections, () => {
+  const lsofOutput = [
+    'p610',
+    'cApp',
+    'f10',
+    'PTCP',
+    'n127.0.0.1:52344->127.0.0.1:8899',
+    'TST=ESTABLISHED',
+    'f11',
+    'PTCP',
+    'n192.168.64.2:52345->93.184.216.34:443',
+    'TST=ESTABLISHED',
+    'f12',
+    'PTCP',
+    'n192.168.64.2:52346->104.16.0.1:443',
+    'TST=SYN_SENT',
+    'f13',
+    'PTCP',
+    'n*:8080',
+    'TST=LISTEN',
+    'f14',
+    'PUDP',
+    'n*:5353',
+    'f15',
+    'PUDP',
+    'n192.168.64.2:60000->1.1.1.1:443',
+    'f16',
+    'PTCP',
+    'n[::1]:52347->[::1]:8899',
+    'TST=ESTABLISHED',
+    'f17',
+    'PTCP',
+    'n[fd00::2]:52348->[2606:4700:4700::1111]:443',
+    'TST=ESTABLISHED',
+    'p700',
+    'cnode',
+    'f20',
+    'PTCP',
+    'n192.168.64.2:52349->93.184.216.34:443',
+    'TST=ESTABLISHED',
+    '',
+  ].join('\n');
+
+  it('reports simulator connections to non-loopback peers only', () => {
+    expect(parseDirectSimulatorConnections(lsofOutput, new Set([610]))).toEqual([
+      { pid: 610, command: 'App', protocol: 'TCP', remote: '93.184.216.34:443' },
+      { pid: 610, command: 'App', protocol: 'TCP', remote: '104.16.0.1:443' },
+      { pid: 610, command: 'App', protocol: 'UDP', remote: '1.1.1.1:443' },
+      { pid: 610, command: 'App', protocol: 'TCP', remote: '[2606:4700:4700::1111]:443' },
+    ]);
+  });
+
+  it('ignores processes outside the simulator', () => {
+    expect(parseDirectSimulatorConnections(lsofOutput, new Set([700]))).toEqual([
+      { pid: 700, command: 'node', protocol: 'TCP', remote: '93.184.216.34:443' },
+    ]);
+    expect(parseDirectSimulatorConnections(lsofOutput, new Set([999]))).toEqual([]);
+  });
+
+  it('returns nothing for an empty listing', () => {
+    expect(parseDirectSimulatorConnections('', new Set([610]))).toEqual([]);
+  });
+});
+
+describe(buildEgressRemoteConfigFields, () => {
+  it('returns nothing without a handoff', () => {
+    expect(buildEgressRemoteConfigFields(null)).toEqual({});
+  });
+
+  it('maps the handoff to the remoteConfig field names', () => {
+    expect(
+      buildEgressRemoteConfigFields({
+        url: 'https://egress-abc.eas-simulator.ngrok.dev',
+        token: 'pw',
+        fingerprint: 'fp=',
+        port: LOCAL_EGRESS_PROXY_PORT,
+      })
+    ).toEqual({
+      egressUrl: 'https://egress-abc.eas-simulator.ngrok.dev',
+      egressToken: 'pw',
+      egressFingerprint: 'fp=',
+      egressPort: LOCAL_EGRESS_PROXY_PORT,
+    });
+  });
+});
+
+describe(parseExitIpResponse, () => {
+  it('reads the ip field', () => {
+    expect(parseExitIpResponse('{"ip":"64.114.211.44"}')).toBe('64.114.211.44');
+  });
+
+  it('rejects responses without an ip', () => {
+    expect(() => parseExitIpResponse('{"error":"rate limited"}')).toThrow(
+      'Unexpected exit IP response'
+    );
+  });
+});
+
+describe('local egress handoff', () => {
+  let tempDir: string;
+
+  beforeEach(async () => {
+    tempDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'local-egress-test-'));
+  });
+
+  afterEach(async () => {
+    await fs.promises.rm(tempDir, { recursive: true, force: true });
+  });
+
+  it('round-trips through the handoff file', async () => {
+    const handoffPath = path.join(tempDir, 'handoff.json');
+    const handoff = {
+      url: 'https://egress-abc.eas-simulator.ngrok.dev',
+      token: 'pw',
+      fingerprint: 'fp=',
+      port: 8899,
+    };
+    await writeLocalEgressHandoffAsync(handoff, handoffPath);
+    await expect(readLocalEgressHandoffAsync(handoffPath)).resolves.toEqual(handoff);
+  });
+
+  it('returns null when no egress step ran', async () => {
+    await expect(
+      readLocalEgressHandoffAsync(path.join(tempDir, 'missing.json'))
+    ).resolves.toBeNull();
+  });
+
+  it('rejects a malformed handoff', async () => {
+    const handoffPath = path.join(tempDir, 'handoff.json');
+    await fs.promises.writeFile(handoffPath, JSON.stringify({ url: 'x' }), 'utf8');
+    await expect(readLocalEgressHandoffAsync(handoffPath)).rejects.toThrow('malformed');
+  });
+});
+
+describe(startChiselServerAsync, () => {
+  const options = {
+    chiselPath: '/tmp/chisel',
+    controlPort: 52001,
+    authfilePath: '/tmp/authfile.json',
+    env: { PATH: '/bin', AUTH: 'unexpected:password' },
+  };
+  let output: string;
+  let stopAsync: jest.Mock;
+
+  beforeEach(() => {
+    jest.useFakeTimers();
+    output = 'server: Fingerprint pinned-key=\n';
+    stopAsync = jest.fn().mockResolvedValue(undefined);
+    jest.spyOn(process, 'kill').mockReturnValue(true);
+    jest.mocked(spawnDetached).mockReturnValue({
+      pid: 12345,
+      getOutput: () => output,
+      stopAsync,
+    });
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+    jest.useRealTimers();
+  });
+
+  it('waits for the child to bind its exact port and clears inherited AUTH', async () => {
+    let resolved = false;
+    const started = startChiselServerAsync(options).then(result => {
+      resolved = true;
+      return result;
+    });
+    output += 'server: Listening on http://127.0.0.1:520010\n';
+    await jest.advanceTimersByTimeAsync(250);
+    expect(resolved).toBe(false);
+    output += 'server: Listening on http://127.0.0.1:52001\n';
+    await jest.advanceTimersByTimeAsync(250);
+    await expect(started).resolves.toMatchObject({ fingerprint: 'pinned-key=' });
+    expect(spawnDetached).toHaveBeenCalledWith(
+      expect.objectContaining({ env: { PATH: '/bin', AUTH: '' } })
+    );
+    expect(options.env.AUTH).toBe('unexpected:password');
+    expect(stopAsync).not.toHaveBeenCalled();
+  });
+
+  it('rejects and stops a child that prints its fingerprint then fails to bind', async () => {
+    const started = startChiselServerAsync(options);
+    const rejected = expect(started).rejects.toThrow('address already in use');
+    output += 'listen tcp 127.0.0.1:52001: bind: address already in use\n';
+    jest.mocked(process.kill).mockImplementation(() => {
+      throw new Error('ESRCH');
+    });
+    await jest.advanceTimersByTimeAsync(250);
+    await rejected;
+    expect(stopAsync).toHaveBeenCalledTimes(1);
+  });
+
+  it('stops the child when startup is cancelled', async () => {
+    const controller = new AbortController();
+    const started = startChiselServerAsync({ ...options, signal: controller.signal });
+    const rejected = expect(started).rejects.toThrow('cancelled');
+    controller.abort(new Error('cancelled'));
+    await jest.advanceTimersByTimeAsync(250);
+    await rejected;
+    expect(stopAsync).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('local egress resource lifetime', () => {
+  const logger = { warn: jest.fn() } as unknown as bunyan;
+
+  it('aborts the lifetime and awaits the same cleanup for concurrent callers', async () => {
+    let finish!: () => void;
+    const cleanup = jest.fn(
+      () =>
+        new Promise<void>(resolve => {
+          finish = resolve;
+        })
+    );
+    const signal = registerLocalEgressResources(cleanup);
+    const first = stopLocalEgressResourcesAsync(logger);
+    const second = stopLocalEgressResourcesAsync(logger);
+    expect(signal.aborted).toBe(true);
+    await Promise.resolve();
+    expect(cleanup).toHaveBeenCalledTimes(1);
+    let complete = false;
+    void second.then(() => {
+      complete = true;
+    });
+    await Promise.resolve();
+    expect(complete).toBe(false);
+    finish();
+    await Promise.all([first, second]);
+    await stopLocalEgressResourcesAsync(logger);
+    expect(cleanup).toHaveBeenCalledTimes(1);
+  });
+
+  it('reports cleanup failure without masking the job result', async () => {
+    const error = new Error('cleanup failed');
+    registerLocalEgressResources(async () => {
+      throw error;
+    });
+    await expect(stopLocalEgressResourcesAsync(logger)).resolves.toBeUndefined();
+    expect(logger.warn).toHaveBeenCalledWith(
+      { err: error },
+      'Could not stop a local egress resource.'
+    );
+  });
+});

packages/build-tools/src/steps/utils/__tests__/remoteDeviceRunSession.test.ts

@@ -11,6 +11,7 @@ import { setTimeout as setTimeoutAsync } from 'node:timers/promises';
 import { CustomBuildContext } from '../../../customBuildContext';
 import { Sentry } from '../../../sentry';
 import { turtleFetch } from '../../../utils/turtleFetch';
+import { readServeSimServersAsync } from '../serveSimMetricsRecorder';
 import { sleepAsync } from '../../../utils/retry';
 import {
   createExpoDeviceHubArgs,
@@ -33,6 +34,11 @@ jest.mock('../../../utils/turtleFetch');
 jest.mock('../../../utils/retry', () => ({ sleepAsync: jest.fn() }));
 jest.mock('../../../sentry');
 jest.mock('@expo/turtle-spawn');
+// Spyable so a test can stand in for the serve-sim state directory, which a local serve-sim owns.
+jest.mock('../serveSimMetricsRecorder', () => {
+  const actual = jest.requireActual('../serveSimMetricsRecorder');
+  return { ...actual, readServeSimServersAsync: jest.fn(actual.readServeSimServersAsync) };
+});
 
 function createLoggerMock(): bunyan {
   return {
@@ -130,6 +136,7 @@ describe(createServeSimArgs, () => {
       '4321',
       '--host',
       '127.0.0.1',
+      '--require-token',
       '--transport',
       'webrtc',
       '--webrtc-codec',
@@ -329,6 +336,9 @@ describe(startDeviceWebPreviewWithTunnelAsync, () => {
     jest.mocked(spawn).mockReset();
     jest.mocked(ngrok.forward).mockReset();
     jest.mocked(turtleFetch).mockReset();
+    jest
+      .mocked(readServeSimServersAsync)
+      .mockResolvedValue([{ udid: 'device-id', url: 'http://127.0.0.1:1', token: 'tok-1' }]);
 
     const spawnPromise = Object.assign(Promise.resolve(undefined), {
       child: {
@@ -417,6 +427,63 @@ describe(startDeviceWebPreviewWithTunnelAsync, () => {
     expect(close).toHaveBeenCalledTimes(1);
   });
 
+  it('carries the serve-sim session token for Darwin', async () => {
+    jest.mocked(ngrok.forward).mockResolvedValue({
+      url: () => 'https://preview.example.test',
+      close: jest.fn().mockResolvedValue(undefined),
+    } as never);
+
+    const preview = await startDeviceWebPreviewWithTunnelAsync(createCtxMock(), {
+      runtimePlatform: BuildRuntimePlatform.DARWIN,
+      baseDomain,
+      env,
+      logger: createLoggerMock(),
+      timeoutMs: 10_000,
+    });
+
+    expect(preview.previewToken).toBe('tok-1');
+    expect(preview.previewUrl).toBe('https://preview.example.test');
+  });
+
+  // serve-sim is always launched with --require-token, so a missing token means it is running
+  // ungated on a public tunnel. Failing beats handing out a preview that is dead or unprotected.
+  it('fails for Darwin when serve-sim reports no token', async () => {
+    jest
+      .mocked(readServeSimServersAsync)
+      .mockResolvedValue([{ udid: 'device-id', url: 'http://127.0.0.1:1' }]);
+
+    await expect(
+      startDeviceWebPreviewWithTunnelAsync(createCtxMock(), {
+        runtimePlatform: BuildRuntimePlatform.DARWIN,
+        baseDomain,
+        env,
+        logger: createLoggerMock(),
+        timeoutMs: 10_000,
+      })
+    ).rejects.toThrow(/wrote no session token/);
+  });
+
+  // expo-device-hub mints no token, so the Android preview must not require one.
+  it('starts for Linux without a token, and does not gate expo-device-hub', async () => {
+    jest.mocked(readServeSimServersAsync).mockResolvedValue([]);
+    jest.mocked(ngrok.forward).mockResolvedValue({
+      url: () => 'https://android-preview.example.test',
+      close: jest.fn().mockResolvedValue(undefined),
+    } as never);
+
+    const preview = await startDeviceWebPreviewWithTunnelAsync(createCtxMock(), {
+      runtimePlatform: BuildRuntimePlatform.LINUX,
+      baseDomain,
+      env,
+      logger: createLoggerMock(),
+      timeoutMs: 10_000,
+    });
+
+    expect(preview.previewToken).toBeUndefined();
+    const [, args] = jest.mocked(spawn).mock.calls[0];
+    expect(args).not.toContain('--require-token');
+  });
+
   it('starts serve-sim for Darwin with its metrics policy and cleans up the preview resources', async () => {
     const packageVersion = '4.5.6';
     const close = jest.fn().mockResolvedValue(undefined);

packages/build-tools/src/steps/utils/__tests__/sandboxDaemon.test.ts

@@ -0,0 +1,203 @@
+import { SystemError } from '@expo/eas-build-job';
+import Log from '@expo/logger';
+import http from 'node:http';
+import net, { AddressInfo } from 'node:net';
+import WebSocket, { WebSocketServer } from 'ws';
+
+import { startSandboxDaemonAsync } from '../sandboxDaemon';
+
+jest.unmock('@expo/logger');
+
+describe(startSandboxDaemonAsync.name, () => {
+  const logger = Log.child({ buildStepId: 'sandbox-test' });
+  it.each(['ftp://localhost', 'not a URL'])('reports invalid server URL %s', async serverUrl => {
+    const errorLog = jest.spyOn(logger, 'error').mockImplementation(() => {});
+    const daemon = await startSandboxDaemonAsync({
+      credential: 'secret-token',
+      serverUrl,
+      reconnectDelayMs: 10,
+      logger,
+    });
+    try {
+      await expect(daemon.ready).rejects.toBeInstanceOf(SystemError);
+      expect(errorLog).toHaveBeenCalledWith(
+        { err: expect.objectContaining({ message: expect.any(String) }) },
+        expect.any(String)
+      );
+    } finally {
+      await daemon.stopAsync();
+      errorLog.mockRestore();
+    }
+  });
+
+  it('logs errors after the connection opens', async () => {
+    const server = new WebSocketServer({ port: 0, host: '127.0.0.1' });
+    await new Promise<void>(resolve => server.once('listening', resolve));
+    const connection = new Promise<WebSocket>(resolve => server.once('connection', resolve));
+    const warn = jest.spyOn(logger, 'warn').mockImplementation(() => {});
+    const daemon = await startSandboxDaemonAsync({
+      credential: 'secret-token',
+      serverUrl: `ws://127.0.0.1:${(server.address() as AddressInfo).port}`,
+      reconnectDelayMs: 60_000,
+      logger,
+    });
+    try {
+      const socket = await connection;
+      await daemon.ready;
+      // An invalid opcode makes the client emit a protocol error.
+      const closed = new Promise<void>(resolve => socket.once('close', () => resolve()));
+      (socket as any)._socket.write(Buffer.from([0x83, 0x00]));
+      await closed;
+      expect(warn).toHaveBeenCalledWith(
+        { err: expect.objectContaining({ message: expect.stringContaining('invalid opcode') }) },
+        expect.stringContaining('invalid opcode')
+      );
+    } finally {
+      await daemon.stopAsync();
+      await new Promise<void>(resolve => server.close(() => resolve()));
+      warn.mockRestore();
+    }
+  });
+  it('fails if the server does not complete the handshake', async () => {
+    const sockets = new Set<net.Socket>();
+    const tcpServer = net.createServer(socket => {
+      sockets.add(socket);
+      socket.on('close', () => sockets.delete(socket));
+    });
+    await new Promise<void>(resolve => tcpServer.listen(0, '127.0.0.1', resolve));
+    const address = tcpServer.address() as AddressInfo;
+    const errorLog = jest.spyOn(logger, 'error').mockImplementation(() => {});
+    const daemon = await startSandboxDaemonAsync({
+      credential: 'secret-token',
+      serverUrl: `ws://127.0.0.1:${address.port}`,
+      reconnectDelayMs: 10,
+      logger,
+    });
+    try {
+      await expect(daemon.ready).rejects.toBeInstanceOf(SystemError);
+      expect(errorLog).toHaveBeenCalledWith(
+        { err: expect.objectContaining({ message: 'Opening handshake has timed out' }) },
+        expect.stringContaining('Opening handshake has timed out')
+      );
+    } finally {
+      await daemon.stopAsync();
+      for (const socket of sockets) {
+        socket.destroy();
+      }
+      await new Promise<void>(resolve => tcpServer.close(() => resolve()));
+      errorLog.mockRestore();
+    }
+  }, 15_000);
+
+  it.each(['stop', 'abort'])('can %s while the initial connection is pending', async action => {
+    const controller = new AbortController();
+    const tcpServer = net.createServer();
+    await new Promise<void>(resolve => tcpServer.listen(0, '127.0.0.1', resolve));
+    const address = tcpServer.address() as AddressInfo;
+    const daemon = await startSandboxDaemonAsync({
+      credential: 'secret-token',
+      serverUrl: `ws://127.0.0.1:${address.port}`,
+      reconnectDelayMs: 60_000,
+      logger,
+      signal: controller.signal,
+    });
+    const connectionError = daemon.ready.catch(error => error);
+
+    if (action === 'abort') {
+      controller.abort();
+    } else {
+      await daemon.stopAsync();
+    }
+
+    await expect(connectionError).resolves.toBeInstanceOf(Error);
+    await daemon.stopAsync();
+    await new Promise<void>(resolve => tcpServer.close(() => resolve()));
+  });
+
+  it('fails when the initial connection cannot be opened', async () => {
+    const errorLog = jest.spyOn(logger, 'error').mockImplementation(() => {});
+    const httpServer = http.createServer();
+    await new Promise<void>(resolve => httpServer.listen(0, '127.0.0.1', resolve));
+    const address = httpServer.address() as AddressInfo;
+    await new Promise<void>(resolve => httpServer.close(() => resolve()));
+
+    const daemon = await startSandboxDaemonAsync({
+      credential: 'secret-token',
+      serverUrl: `ws://127.0.0.1:${address.port}`,
+      reconnectDelayMs: 60_000,
+      logger,
+    });
+
+    await expect(daemon.ready).rejects.toThrow('Sandbox MCP server connection failed');
+    await expect(daemon.ready).rejects.toBeInstanceOf(SystemError);
+    expect(errorLog).toHaveBeenCalledWith(
+      { err: expect.objectContaining({ message: expect.stringContaining('ECONNREFUSED') }) },
+      expect.stringContaining('ECONNREFUSED')
+    );
+    await daemon.stopAsync();
+    errorLog.mockRestore();
+  });
+
+  it('connects with the credential and closes on stop', async () => {
+    const httpServer = http.createServer();
+    const mcpServer = new WebSocketServer({ noServer: true });
+    httpServer.on('upgrade', (request, socket, head) => {
+      expect(request.url).toBe('/sandbox/connect');
+      expect(request.headers.authorization).toBe('Bearer secret-token');
+      mcpServer.handleUpgrade(request, socket, head, client =>
+        mcpServer.emit('connection', client)
+      );
+    });
+    await new Promise<void>(resolve => httpServer.listen(0, '127.0.0.1', resolve));
+    const address = httpServer.address() as AddressInfo;
+    const connection = new Promise<WebSocket>(resolve => mcpServer.once('connection', resolve));
+
+    const daemonPromise = startSandboxDaemonAsync({
+      credential: 'secret-token',
+      serverUrl: `ws://127.0.0.1:${address.port}`,
+      reconnectDelayMs: 10,
+      logger,
+    });
+    const socket = await connection;
+    const daemon = await daemonPromise;
+    await daemon.ready;
+    const socketClosed = new Promise<void>(resolve => socket.once('close', () => resolve()));
+
+    await daemon.stopAsync();
+    await socketClosed;
+
+    mcpServer.close();
+    await new Promise<void>(resolve => httpServer.close(() => resolve()));
+  });
+
+  it('cancels the reconnect delay when stopped', async () => {
+    const httpServer = http.createServer();
+    const mcpServer = new WebSocketServer({ noServer: true });
+    httpServer.on('upgrade', (request, socket, head) => {
+      mcpServer.handleUpgrade(request, socket, head, client =>
+        mcpServer.emit('connection', client)
+      );
+    });
+    await new Promise<void>(resolve => httpServer.listen(0, '127.0.0.1', resolve));
+    const address = httpServer.address() as AddressInfo;
+    const connection = new Promise<WebSocket>(resolve => mcpServer.once('connection', resolve));
+    const daemonPromise = startSandboxDaemonAsync({
+      credential: 'secret-token',
+      serverUrl: `ws://127.0.0.1:${address.port}`,
+      reconnectDelayMs: 60_000,
+      logger,
+    });
+    const socket = await connection;
+    const daemon = await daemonPromise;
+    await daemon.ready;
+    const socketClosed = new Promise<void>(resolve => socket.once('close', () => resolve()));
+    socket.close();
+    await socketClosed;
+    await new Promise<void>(resolve => setImmediate(resolve));
+
+    await daemon.stopAsync();
+
+    mcpServer.close();
+    await new Promise<void>(resolve => httpServer.close(() => resolve()));
+  });
+});

packages/build-tools/src/steps/utils/__tests__/serveSimMetricsRecorder.test.ts

@@ -101,6 +101,14 @@ describe(readServeSimServersAsync, () => {
     ]);
   });
 
+  it('includes the session token when the state file carries one', async () => {
+    await writeServerStateAsync('E', { device: 'E', url: 'http://127.0.0.1:5', token: 'tok-abc' });
+
+    expect(await readServeSimServersAsync(stateDir)).toEqual([
+      { udid: 'E', url: 'http://127.0.0.1:5', token: 'tok-abc' },
+    ]);
+  });
+
   it('returns [] when the state dir does not exist', async () => {
     expect(await readServeSimServersAsync(path.join(workDir, 'nope'))).toEqual([]);
   });
@@ -120,6 +128,20 @@ describe(streamServeSimMetricsToFileAsync, () => {
     expect(String(jest.mocked(fetch).mock.calls[0][0])).toBe('https://sim.example/metrics');
   });
 
+  it('sends the session token as a bearer header when given one', async () => {
+    jest.mocked(fetch).mockResolvedValue(sseResponse());
+    await streamServeSimMetricsToFileAsync({
+      serveSimUrl: 'https://sim.example',
+      serveSimToken: 'tok-abc',
+      filePath: path.join(workDir, 'auth.ndjson'),
+      signal: new AbortController().signal,
+      logger: createLoggerMock(),
+    });
+    expect(jest.mocked(fetch).mock.calls[0][1]?.headers).toMatchObject({
+      Authorization: 'Bearer tok-abc',
+    });
+  });
+
   it('writes nothing on a non-ok response', async () => {
     jest.mocked(fetch).mockResolvedValue(new Response('nope', { status: 502 }));
     const filePath = path.join(workDir, 'empty.ndjson');

packages/build-tools/src/steps/utils/localEgress.ts

@@ -0,0 +1,724 @@
+import downloadFile from '@expo/downloader';
+import { SystemError } from '@expo/eas-build-job';
+import { bunyan } from '@expo/logger';
+import { BuildStepEnv } from '@expo/steps';
+import spawn from '@expo/turtle-spawn';
+import { createHash, randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import zlib from 'node:zlib';
+
+import { sleepAsync } from '../../utils/retry';
+
+import { type DetachedProcessHandle, spawnDetached } from './remoteDeviceRunSession';
+
+/**
+ * Local egress provides an HTTP(S) proxy through the machine running the EAS CLI.
+ * Requests that use this proxy exit through that machine's network.
+ *
+ * Worker side: a chisel server in reverse mode listens on loopback and is exposed
+ * through the session's ngrok domain. When the CLI's egress client connects, chisel
+ * opens LOCAL_EGRESS_PROXY_PORT on this host and forwards every connection to the
+ * HTTP proxy the CLI runs. The macOS system proxy points at that port. Until the
+ * client connects, nothing listens on the port and proxied requests fail.
+ *
+ * Contract: HTTP(S) and WebSocket requests that honor the system proxy (WebKit,
+ * URLSession and other CFNetwork clients) exit from the egress client's network
+ * and fail while the client is disconnected. Requests from libraries that bypass
+ * the system proxy are not covered and exit from this host. Nothing here enforces
+ * routing; the session monitor reports such direct connections instead.
+ */
+
+export const LOCAL_EGRESS_PROXY_HOST = '127.0.0.1';
+export const LOCAL_EGRESS_PROXY_PORT = 8899;
+export const LOCAL_EGRESS_USERNAME = 'eas';
+export const LOCAL_EGRESS_HANDOFF_PATH = path.join(os.tmpdir(), 'eas-simulator-local-egress.json');
+
+export const CHISEL_VERSION = '1.12.0';
+// sha256 of the release .gz assets, cross-checked against chisel_1.12.0_checksums.txt.
+const CHISEL_SHA256_BY_ASSET: Record<string, string> = {
+  'chisel_1.12.0_darwin_arm64.gz':
+    '707a4b932eea214765146504a0df246cefc415b4297af65a80dd67cf69ba85a9',
+  'chisel_1.12.0_darwin_amd64.gz':
+    '4aeae36c867f11c8e8c3f2b913a0e063ea3c6d29e1c14a52ed2e6eef8cfc4395',
+  'chisel_1.12.0_linux_amd64.gz':
+    'f3f180f1d93aa72cce4e6386f98cc06569a0146fbd65eb4423cf83e6434bcfe6',
+  'chisel_1.12.0_linux_arm64.gz':
+    '2ec6152cd2c74fe0146d4d79e4e7aa174521368c56e433d55e023a92ea404ec3',
+};
+
+const CHISEL_STARTUP_TIMEOUT_MS = 15_000;
+const EGRESS_MONITOR_INTERVAL_MS = 2_000;
+const EGRESS_ESCAPE_SCAN_INTERVAL_MS = 5_000;
+const EGRESS_ESCAPE_LOG_LIMIT = 50;
+
+export type LocalEgressHandoff = {
+  /** Public URL of the reverse tunnel server, reachable through ngrok. */
+  url: string;
+  /** Secret the client presents to the tunnel server, paired with LOCAL_EGRESS_USERNAME. */
+  token: string;
+  /** Fingerprint of the tunnel server key, for the client to pin. */
+  fingerprint: string;
+  /** Loopback port on this host that the client must serve. */
+  port: number;
+};
+
+export function getChiselAssetName({
+  platform,
+  arch,
+}: {
+  platform: NodeJS.Platform;
+  arch: string;
+}): string {
+  const os = platform === 'darwin' ? 'darwin' : platform === 'linux' ? 'linux' : null;
+  const cpu = arch === 'arm64' ? 'arm64' : arch === 'x64' ? 'amd64' : null;
+  if (!os || !cpu) {
+    throw new SystemError(
+      `Local egress is not supported on ${platform}/${arch}. The reverse tunnel binary is available for macOS and Linux on arm64 and x64.`
+    );
+  }
+  return `chisel_${CHISEL_VERSION}_${os}_${cpu}.gz`;
+}
+
+export function getChiselDownloadUrl(assetName: string): string {
+  return `https://github.com/jpillora/chisel/releases/download/v${CHISEL_VERSION}/${assetName}`;
+}
+
+async function sha256FileAsync(filePath: string): Promise<string> {
+  const hash = createHash('sha256');
+  await pipeline(fs.createReadStream(filePath), hash);
+  return hash.digest('hex');
+}
+
+export async function downloadChiselAsync({
+  destinationDir,
+  logger,
+  platform = process.platform,
+  arch = process.arch,
+}: {
+  destinationDir: string;
+  logger: bunyan;
+  platform?: NodeJS.Platform;
+  arch?: string;
+}): Promise<string> {
+  const assetName = getChiselAssetName({ platform, arch });
+  const expectedSha256 = CHISEL_SHA256_BY_ASSET[assetName];
+  if (!expectedSha256) {
+    throw new SystemError(`No pinned checksum for ${assetName}.`);
+  }
+  const url = getChiselDownloadUrl(assetName);
+  const archivePath = path.join(destinationDir, assetName);
+  logger.info(`Downloading ${url}.`);
+  await downloadFile(url, archivePath, { retry: 3, timeout: 60_000 });
+
+  const actualSha256 = await sha256FileAsync(archivePath);
+  if (actualSha256 !== expectedSha256) {
+    throw new SystemError(
+      `Checksum mismatch for ${assetName}: expected ${expectedSha256}, got ${actualSha256}. ` +
+        'The download may be corrupted or tampered with; the session was not started.'
+    );
+  }
+
+  const binaryPath = path.join(destinationDir, 'chisel');
+  await pipeline(
+    fs.createReadStream(archivePath),
+    zlib.createGunzip(),
+    fs.createWriteStream(binaryPath)
+  );
+  await fs.promises.chmod(binaryPath, 0o755);
+  return binaryPath;
+}
+
+export function generateEgressCredentials(): { user: string; password: string } {
+  return { user: LOCAL_EGRESS_USERNAME, password: randomBytes(24).toString('base64url') };
+}
+
+// Matches 1024-65535: every unprivileged TCP port.
+const UNPRIVILEGED_PORT_PATTERN =
+  '(102[4-9]|10[3-9][0-9]|1[1-9][0-9]{2}|[2-9][0-9]{3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])';
+
+/**
+ * chisel authfile: one user, allowed to open reverse remotes on loopback only.
+ * The proxy port carries proxied requests. Any unprivileged loopback port may be
+ * forwarded too: the EAS CLI opens one per `--egress-allow localhost:<port>`
+ * entry so `127.0.0.1:<port>` inside the simulator reaches that port on the
+ * developer's machine, like `adb reverse`. iOS never sends loopback-literal
+ * requests to the system proxy, so the proxy alone cannot serve them.
+ * Reverse remotes are matched as `R:<interface>:<port>`.
+ */
+export function createChiselAuthfileContents({
+  user,
+  password,
+  port,
+}: {
+  user: string;
+  password: string;
+  port: number;
+}): string {
+  const escapedHost = LOCAL_EGRESS_PROXY_HOST.replace(/\./g, '\\.');
+  return JSON.stringify({
+    [`${user}:${password}`]: [
+      `^R:${escapedHost}:${port}$`,
+      `^R:${escapedHost}:${UNPRIVILEGED_PORT_PATTERN}$`,
+    ],
+  });
+}
+
+export function parseChiselFingerprint(output: string): string | null {
+  const match = /Fingerprint\s+(\S+)/.exec(output);
+  return match?.[1] ?? null;
+}
+
+function isProcessRunning(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function startChiselServerAsync({
+  chiselPath,
+  controlPort,
+  authfilePath,
+  env,
+  signal,
+}: {
+  chiselPath: string;
+  controlPort: number;
+  authfilePath: string;
+  env: BuildStepEnv;
+  signal?: AbortSignal;
+}): Promise<{ process: DetachedProcessHandle; fingerprint: string }> {
+  const server = spawnDetached({
+    command: chiselPath,
+    args: [
+      'server',
+      '--host',
+      LOCAL_EGRESS_PROXY_HOST,
+      '--port',
+      String(controlPort),
+      '--reverse',
+      '--authfile',
+      authfilePath,
+    ],
+    // AUTH adds an unrestricted user even when --authfile is supplied.
+    env: { ...env, AUTH: '' },
+  });
+
+  try {
+    const deadline = Date.now() + CHISEL_STARTUP_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      signal?.throwIfAborted();
+      if (server.pid === undefined || !isProcessRunning(server.pid)) {
+        break;
+      }
+      const output = server.getOutput();
+      const fingerprint = parseChiselFingerprint(output);
+      // Chisel prints the fingerprint before binding. This line comes from the
+      // child only after its listener succeeds, unlike a probe of a reused port.
+      const listening = output
+        .split('\n')
+        .some(line =>
+          line
+            .trimEnd()
+            .endsWith(`server: Listening on http://${LOCAL_EGRESS_PROXY_HOST}:${controlPort}`)
+        );
+      if (fingerprint && listening) {
+        return { process: server, fingerprint };
+      }
+      await sleepAsync(250);
+    }
+    throw new SystemError(
+      `The reverse tunnel server did not start within ${CHISEL_STARTUP_TIMEOUT_MS / 1000}s. Output:\n${
+        server.getOutput() || '<empty>'
+      }`
+    );
+  } catch (error) {
+    await server.stopAsync();
+    throw error;
+  }
+}
+
+export function parseDefaultRouteInterface(routeOutput: string): string | null {
+  const match = /^\s*interface:\s*(\S+)/m.exec(routeOutput);
+  return match?.[1] ?? null;
+}
+
+/**
+ * `networksetup -listnetworkserviceorder` prints each service as two lines:
+ * "(1) Wi-Fi" followed by "(Hardware Port: Wi-Fi, Device: en0)". Return the
+ * service name whose device matches.
+ */
+export function parseNetworkServiceNameForDevice(
+  listOutput: string,
+  device: string
+): string | null {
+  const lines = listOutput.split('\n').map(line => line.trim());
+  for (let i = 0; i < lines.length; i++) {
+    const hardwarePortMatch = /^\(Hardware Port: (.+), Device: (\S+)\)$/.exec(lines[i]);
+    if (!hardwarePortMatch || hardwarePortMatch[2] !== device) {
+      continue;
+    }
+    const serviceLineMatch = /^\(\d+\) (.+)$/.exec(lines[i - 1] ?? '');
+    return serviceLineMatch?.[1] ?? hardwarePortMatch[1];
+  }
+  return null;
+}
+
+export async function resolveActiveNetworkServiceNameAsync({
+  env,
+}: {
+  env: BuildStepEnv;
+}): Promise<string> {
+  const routeResult = await spawn('route', ['-n', 'get', 'default'], { env, stdio: 'pipe' });
+  const device = parseDefaultRouteInterface(routeResult.stdout);
+  if (!device) {
+    throw new SystemError(
+      'Could not determine the default network interface of the device host, so the system proxy ' +
+        'cannot be configured. Output of `route -n get default`:\n' +
+        (routeResult.stdout || '<empty>')
+    );
+  }
+  const listResult = await spawn('networksetup', ['-listnetworkserviceorder'], {
+    env,
+    stdio: 'pipe',
+  });
+  const service = parseNetworkServiceNameForDevice(listResult.stdout, device);
+  if (!service) {
+    throw new SystemError(
+      `Could not find the network service for interface ${device}, so the system proxy cannot be ` +
+        'configured. Output of `networksetup -listnetworkserviceorder`:\n' +
+        (listResult.stdout || '<empty>')
+    );
+  }
+  return service;
+}
+
+export function buildNetworksetupProxyArgs({
+  service,
+  host,
+  port,
+}: {
+  service: string;
+  host: string;
+  port: number;
+}): string[][] {
+  return [
+    ['-setwebproxy', service, host, String(port)],
+    ['-setsecurewebproxy', service, host, String(port)],
+  ];
+}
+
+/**
+ * Point the macOS system HTTP and HTTPS proxy at the loopback egress port. The
+ * simulator reads these settings when it boots, so this must run before
+ * `start_ios_simulator`. Existing bypass and automatic proxy settings are left
+ * unchanged. Requests that bypass this proxy can leave from this host's address.
+ */
+export async function configureSystemProxyAsync({
+  env,
+  logger,
+  port,
+  signal,
+}: {
+  env: BuildStepEnv;
+  logger: bunyan;
+  port: number;
+  signal?: AbortSignal;
+}): Promise<{ service: string }> {
+  if (process.env.ENVIRONMENT === 'development') {
+    logger.info('Job running outside of EAS, not changing the system proxy.');
+    return { service: '<development>' };
+  }
+  const service = await resolveActiveNetworkServiceNameAsync({ env });
+  for (const args of buildNetworksetupProxyArgs({ service, host: LOCAL_EGRESS_PROXY_HOST, port })) {
+    signal?.throwIfAborted();
+    await spawn('networksetup', args, { env, logger, signal });
+  }
+  logger.info(`System proxy for "${service}" set to ${LOCAL_EGRESS_PROXY_HOST}:${port}.`);
+  return { service };
+}
+
+export async function writeLocalEgressHandoffAsync(
+  handoff: LocalEgressHandoff,
+  handoffPath: string = LOCAL_EGRESS_HANDOFF_PATH
+): Promise<void> {
+  await fs.promises.writeFile(handoffPath, JSON.stringify(handoff), {
+    encoding: 'utf8',
+    mode: 0o600,
+  });
+}
+
+export async function readLocalEgressHandoffAsync(
+  handoffPath: string = LOCAL_EGRESS_HANDOFF_PATH
+): Promise<LocalEgressHandoff | null> {
+  let raw: string;
+  try {
+    raw = await fs.promises.readFile(handoffPath, 'utf8');
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code === 'ENOENT') {
+      return null;
+    }
+    throw err;
+  }
+  const parsed = JSON.parse(raw) as Partial<LocalEgressHandoff>;
+  if (
+    typeof parsed.url !== 'string' ||
+    typeof parsed.token !== 'string' ||
+    typeof parsed.fingerprint !== 'string' ||
+    typeof parsed.port !== 'number'
+  ) {
+    throw new SystemError(`Local egress handoff at ${handoffPath} is malformed.`);
+  }
+  return {
+    url: parsed.url,
+    token: parsed.token,
+    fingerprint: parsed.fingerprint,
+    port: parsed.port,
+  };
+}
+
+/** remoteConfig fields the CLI needs to start the egress client. */
+export function buildEgressRemoteConfigFields(
+  handoff: LocalEgressHandoff | null
+): Record<string, string | number> {
+  if (!handoff) {
+    return {};
+  }
+  return {
+    egressUrl: handoff.url,
+    egressToken: handoff.token,
+    egressFingerprint: handoff.fingerprint,
+    egressPort: handoff.port,
+  };
+}
+
+// The egress step returns before the session ends, so the resources it created
+// are held here and released by the session step or the job's finally block.
+let activeLocalEgressResources:
+  | { stopAsync: () => Promise<void>; controller: AbortController; stopping?: Promise<void> }
+  | undefined;
+
+export function registerLocalEgressResources(stopAsync: () => Promise<void>): AbortSignal {
+  if (activeLocalEgressResources) {
+    throw new SystemError('Local egress resources are already registered for this job.');
+  }
+  const controller = new AbortController();
+  activeLocalEgressResources = { stopAsync, controller };
+  return controller.signal;
+}
+
+export async function stopLocalEgressResourcesAsync(logger: bunyan): Promise<void> {
+  const resources = activeLocalEgressResources;
+  if (!resources) {
+    return;
+  }
+  resources.controller.abort();
+  resources.stopping ??= Promise.resolve()
+    .then(resources.stopAsync)
+    .catch(err => logger.warn({ err }, 'Could not stop a local egress resource.'))
+    .finally(() => {
+      activeLocalEgressResources = undefined;
+    });
+  await resources.stopping;
+}
+
+export async function isPortListeningAsync({
+  host,
+  port,
+  timeoutMs = 1_000,
+}: {
+  host: string;
+  port: number;
+  timeoutMs?: number;
+}): Promise<boolean> {
+  return await new Promise<boolean>(resolve => {
+    const socket = net.connect({ host, port });
+    const finish = (listening: boolean): void => {
+      socket.destroy();
+      resolve(listening);
+    };
+    socket.setTimeout(timeoutMs, () => finish(false));
+    socket.once('connect', () => finish(true));
+    socket.once('error', () => finish(false));
+  });
+}
+
+export function parseExitIpResponse(body: string): string {
+  const parsed = JSON.parse(body) as { ip?: unknown };
+  if (typeof parsed.ip !== 'string' || parsed.ip.length === 0) {
+    throw new SystemError(`Unexpected exit IP response: ${body}`);
+  }
+  return parsed.ip;
+}
+
+export async function fetchExitIpThroughProxyAsync({
+  port,
+  env,
+}: {
+  port: number;
+  env: BuildStepEnv;
+}): Promise<string> {
+  const result = await spawn(
+    'curl',
+    [
+      '-sS',
+      '--max-time',
+      '10',
+      '-x',
+      `http://${LOCAL_EGRESS_PROXY_HOST}:${port}`,
+      'https://api.ipify.org?format=json',
+    ],
+    { env, stdio: 'pipe' }
+  );
+  return parseExitIpResponse(result.stdout);
+}
+
+/**
+ * Processes inside the simulator run on the host as descendants of launchd_sim,
+ * so `ps -axo pid=,ppid=,comm=` ancestry identifies them. Returns every
+ * descendant pid; launchd_sim itself opens no network connections.
+ */
+export function collectSimulatorProcessIds(psOutput: string): number[] {
+  const childrenByParent = new Map<number, number[]>();
+  const roots: number[] = [];
+  for (const line of psOutput.split('\n')) {
+    const match = /^\s*(\d+)\s+(\d+)\s+(\S.*)$/.exec(line);
+    if (!match) {
+      continue;
+    }
+    const pid = Number(match[1]);
+    const parentPid = Number(match[2]);
+    const command = match[3].trim();
+    const siblings = childrenByParent.get(parentPid) ?? [];
+    siblings.push(pid);
+    childrenByParent.set(parentPid, siblings);
+    if (path.basename(command) === 'launchd_sim') {
+      roots.push(pid);
+    }
+  }
+
+  const descendants: number[] = [];
+  const seen = new Set<number>(roots);
+  const queue = [...roots];
+  for (let i = 0; i < queue.length; i++) {
+    for (const child of childrenByParent.get(queue[i]) ?? []) {
+      if (seen.has(child)) {
+        continue;
+      }
+      seen.add(child);
+      descendants.push(child);
+      queue.push(child);
+    }
+  }
+  return descendants;
+}
+
+export type DirectSimulatorConnection = {
+  pid: number;
+  command: string;
+  protocol: string;
+  /** Remote peer as lsof prints it, e.g. `93.184.216.34:443` or `[2606::1]:443`. */
+  remote: string;
+};
+
+function remoteHostOf(remote: string): string {
+  if (remote.startsWith('[')) {
+    const end = remote.indexOf(']');
+    return end === -1 ? remote : remote.slice(1, end);
+  }
+  const colon = remote.lastIndexOf(':');
+  return colon === -1 ? remote : remote.slice(0, colon);
+}
+
+function isLoopbackHost(host: string): boolean {
+  return (
+    host === 'localhost' || host.startsWith('127.') || host === '::1' || host === '::ffff:127.0.0.1'
+  );
+}
+
+/**
+ * Parse `lsof -nP -i -F pcPnT` output. Returns the TCP and UDP connections that
+ * simulator processes hold to peers outside loopback. Those did not go through
+ * the proxy on 127.0.0.1, so they exit from this host instead of the egress
+ * client. Listening sockets, unconnected UDP sockets and connections to
+ * loopback (the proxy itself) are ignored.
+ */
+export function parseDirectSimulatorConnections(
+  lsofOutput: string,
+  simulatorPids: ReadonlySet<number>
+): DirectSimulatorConnection[] {
+  const connections: DirectSimulatorConnection[] = [];
+  let pid: number | null = null;
+  let command = '';
+  let protocol: string | null = null;
+  let name: string | null = null;
+  let tcpState: string | null = null;
+
+  const flush = (): void => {
+    if (pid !== null && simulatorPids.has(pid) && protocol && name) {
+      const arrow = name.indexOf('->');
+      const remote = arrow === -1 ? null : name.slice(arrow + 2);
+      const active =
+        protocol !== 'TCP' ||
+        tcpState === null ||
+        tcpState === 'ESTABLISHED' ||
+        tcpState === 'SYN_SENT';
+      if (remote && active && !isLoopbackHost(remoteHostOf(remote))) {
+        connections.push({ pid, command, protocol, remote });
+      }
+    }
+    protocol = null;
+    name = null;
+    tcpState = null;
+  };
+
+  for (const line of lsofOutput.split('\n')) {
+    const field = line[0];
+    const value = line.slice(1);
+    switch (field) {
+      case 'p':
+        flush();
+        pid = Number(value);
+        command = '';
+        break;
+      case 'c':
+        command = value;
+        break;
+      case 'f':
+        flush();
+        break;
+      case 'P':
+        protocol = value;
+        break;
+      case 'n':
+        name = value;
+        break;
+      case 'T':
+        if (value.startsWith('ST=')) {
+          tcpState = value.slice('ST='.length);
+        }
+        break;
+      default:
+        break;
+    }
+  }
+  flush();
+  return connections;
+}
+
+async function findDirectSimulatorConnectionsAsync({
+  env,
+}: {
+  env: BuildStepEnv;
+}): Promise<DirectSimulatorConnection[]> {
+  const ps = await spawn('ps', ['-axo', 'pid=,ppid=,comm='], { env, stdio: 'pipe' });
+  const pids = collectSimulatorProcessIds(ps.stdout);
+  if (pids.length === 0) {
+    return [];
+  }
+  let lsofOutput: string;
+  try {
+    const lsof = await spawn('lsof', ['-nP', '-i', '-F', 'pcPnT', '-a', '-p', pids.join(',')], {
+      env,
+      stdio: 'pipe',
+    });
+    lsofOutput = lsof.stdout;
+  } catch (err) {
+    // lsof exits with 1 when none of the processes holds a matching socket, and
+    // when one of them exited between `ps` and `lsof`. Its stdout is still valid.
+    const result = err as { status?: number | null; stdout?: string };
+    if (result.status !== 1) {
+      throw err;
+    }
+    lsofOutput = result.stdout ?? '';
+  }
+  return parseDirectSimulatorConnections(lsofOutput, new Set(pids));
+}
+
+/**
+ * Log proxy listener availability, the exit IP observed by a worker request
+ * through it, and simulator connections that bypassed the proxy. Neither check
+ * verifies that proxied simulator requests reach the egress client. Never
+ * rejects: it runs in the background for the whole session.
+ */
+export async function monitorLocalEgressAsync({
+  port,
+  env,
+  logger,
+  signal,
+}: {
+  port: number;
+  env: BuildStepEnv;
+  logger: bunyan;
+  signal: AbortSignal;
+}): Promise<void> {
+  let connected = false;
+  let lastEscapeScanAt = 0;
+  let escapeScanBroken = false;
+  const reportedEscapes = new Set<string>();
+  const lifetimeSignal = activeLocalEgressResources?.controller.signal;
+  try {
+    while (!signal.aborted && !lifetimeSignal?.aborted) {
+      const listening = await isPortListeningAsync({ host: LOCAL_EGRESS_PROXY_HOST, port });
+      if (listening && !connected) {
+        connected = true;
+        logger.info('Local egress proxy listener is available.');
+        try {
+          const exitIp = await fetchExitIpThroughProxyAsync({ port, env });
+          logger.info(
+            `Worker proxy exit-IP check observed ${exitIp}. This does not verify simulator routing.`
+          );
+        } catch (err) {
+          logger.warn(
+            { err },
+            'The local egress proxy listener is available, but the worker exit-IP check through it failed.'
+          );
+        }
+      } else if (!listening && connected) {
+        connected = false;
+        logger.warn(
+          'Local egress proxy listener is unavailable. Proxied HTTP(S) requests fail until it returns.'
+        );
+      }
+
+      if (!escapeScanBroken && Date.now() - lastEscapeScanAt >= EGRESS_ESCAPE_SCAN_INTERVAL_MS) {
+        lastEscapeScanAt = Date.now();
+        try {
+          for (const connection of await findDirectSimulatorConnectionsAsync({ env })) {
+            const key = `${connection.pid}|${connection.protocol}|${connection.remote}`;
+            if (reportedEscapes.has(key)) {
+              continue;
+            }
+            reportedEscapes.add(key);
+            if (reportedEscapes.size > EGRESS_ESCAPE_LOG_LIMIT) {
+              if (reportedEscapes.size === EGRESS_ESCAPE_LOG_LIMIT + 1) {
+                logger.warn(
+                  `Local egress: more than ${EGRESS_ESCAPE_LOG_LIMIT} direct connections were reported; further ones are not logged.`
+                );
+              }
+              continue;
+            }
+            logger.warn(
+              `Local egress: ${connection.command} (pid ${connection.pid}) opened a direct ${connection.protocol} connection to ${connection.remote}, bypassing the system proxy. That traffic exits from this worker, not from the egress client.`
+            );
+          }
+        } catch (err) {
+          escapeScanBroken = true;
+          logger.warn(
+            { err },
+            'Local egress: could not inspect simulator connections. Direct connections that bypass the proxy will not be reported.'
+          );
+        }
+      }
+      await sleepAsync(EGRESS_MONITOR_INTERVAL_MS);
+    }
+  } catch (err) {
+    logger.warn({ err }, 'Local egress monitoring stopped unexpectedly.');
+  }
+}

packages/build-tools/src/steps/utils/localEgressSession.ts

@@ -0,0 +1,55 @@
+import { type BuildFunction, type BuildStepEnv } from '@expo/steps';
+
+import {
+  buildEgressRemoteConfigFields,
+  monitorLocalEgressAsync,
+  readLocalEgressHandoffAsync,
+  stopLocalEgressResourcesAsync,
+} from './localEgress';
+import { uploadRemoteSessionConfigAsync } from './remoteDeviceRunSession';
+
+/** Release the pre-boot egress resources even if controller startup or teardown fails. */
+export function withLocalEgressSession(
+  fn: NonNullable<BuildFunction['fn']>
+): NonNullable<BuildFunction['fn']> {
+  return async (context, args) => {
+    try {
+      args.signal?.throwIfAborted();
+      await fn(context, args);
+    } finally {
+      await stopLocalEgressResourcesAsync(context.logger);
+    }
+  };
+}
+
+/** All simulator controllers publish the same egress handoff and run the same monitor. */
+export async function uploadRemoteSessionConfigWithLocalEgressAsync({
+  env,
+  signal,
+  ...options
+}: Parameters<typeof uploadRemoteSessionConfigAsync>[0] & {
+  env: BuildStepEnv;
+  signal?: AbortSignal;
+}): Promise<void> {
+  // Written by start_local_egress before simulator boot; absent for ordinary sessions.
+  const localEgress = await readLocalEgressHandoffAsync();
+  signal?.throwIfAborted();
+  await uploadRemoteSessionConfigAsync({
+    ...options,
+    remoteConfig: { ...options.remoteConfig, ...buildEgressRemoteConfigFields(localEgress) },
+  });
+  if (localEgress && !signal?.aborted) {
+    options.logger.info(
+      'Local egress: waiting for the EAS CLI egress client to connect. Proxied HTTP(S) ' +
+        'requests are unavailable until it does.'
+    );
+    // The monitor also observes the registered resources' lifetime signal, which
+    // withLocalEgressSession aborts on success, failure, or cancellation.
+    void monitorLocalEgressAsync({
+      port: localEgress.port,
+      env,
+      logger: options.logger,
+      signal: signal ?? new AbortController().signal,
+    });
+  }
+}

packages/build-tools/src/steps/utils/remoteDeviceRunSession.ts

@@ -17,6 +17,7 @@ import { CustomBuildContext } from '../../customBuildContext';
 import { Sentry } from '../../sentry';
 import { sleepAsync } from '../../utils/retry';
 import { turtleFetch } from '../../utils/turtleFetch';
+import { SERVE_SIM_STATE_DIR, readServeSimServersAsync } from './serveSimMetricsRecorder';
 
 const XCODE_DEVELOPER_DIR = '/Applications/Xcode.app/Contents/Developer';
 const WEB_PREVIEW_HOST = '127.0.0.1';
@@ -652,6 +653,7 @@ export function createServeSimArgs({
     String(port),
     '--host',
     WEB_PREVIEW_HOST,
+    '--require-token',
     '--transport',
     'webrtc',
     '--webrtc-codec',
@@ -705,7 +707,7 @@ export function createExpoDeviceHubArgs({
   ];
 }
 
-async function findAvailablePortAsync(): Promise<number> {
+export async function findAvailablePortAsync(): Promise<number> {
   const server = createServer();
   server.unref();
   await new Promise<void>((resolve, reject) => {
@@ -737,7 +739,7 @@ export async function waitForWebPreviewReadyAsync({
   serverName: string;
   port: number;
   timeoutMs: number;
-}): Promise<void> {
+}): Promise<string> {
   const readyUrl = `http://${WEB_PREVIEW_HOST}:${port}/readyz`;
   const deadline = Date.now() + timeoutMs;
   let lastError: unknown;
@@ -754,8 +756,8 @@ export async function waitForWebPreviewReadyAsync({
         retries: 0,
         timeout: 2_000,
       });
-      WebPreviewReadyResponseSchema.parse(await response.json());
-      return;
+      const ready = WebPreviewReadyResponseSchema.parse(await response.json());
+      return ready.device;
     } catch (error) {
       lastError = error;
     }
@@ -770,6 +772,8 @@ export async function waitForWebPreviewReadyAsync({
 
 export type DeviceWebPreviewHandle = {
   previewUrl: string;
+  /** Session token gating the preview. Only serve-sim mints one. */
+  previewToken?: string;
   stopAsync: () => Promise<void>;
 };
 
@@ -785,6 +789,7 @@ async function startWebPreviewWithTunnelAsync(
     serverName,
     packageSpec,
     createArgs,
+    readPreviewTokenAsync,
   }: {
     baseDomain: string;
     env: BuildStepEnv;
@@ -793,6 +798,7 @@ async function startWebPreviewWithTunnelAsync(
     serverName: string;
     packageSpec: string;
     createArgs: (port: number, turnArgs: string[]) => string[];
+    readPreviewTokenAsync?: (device: string) => Promise<string>;
   }
 ): Promise<DeviceWebPreviewHandle> {
   const port = await findAvailablePortAsync();
@@ -806,7 +812,13 @@ async function startWebPreviewWithTunnelAsync(
 
   try {
     logger.info(`Waiting for ${serverName} to become ready.`);
-    await waitForWebPreviewReadyAsync({ previewServer, serverName, port, timeoutMs });
+    const device = await waitForWebPreviewReadyAsync({
+      previewServer,
+      serverName,
+      port,
+      timeoutMs,
+    });
+    const previewToken = await readPreviewTokenAsync?.(device);
     const tunnel = await startNgrokTunnelAsync({
       port,
       subdomainPrefix: 'web-preview',
@@ -816,6 +828,7 @@ async function startWebPreviewWithTunnelAsync(
     });
     return {
       previewUrl: tunnel.url,
+      previewToken,
       stopAsync: async () => {
         const results = await Promise.allSettled([tunnel.stopAsync(), previewServer.stopAsync()]);
         for (const result of results) {
@@ -831,6 +844,14 @@ async function startWebPreviewWithTunnelAsync(
   }
 }
 
+export async function readServeSimPreviewTokenAsync(
+  udid: string,
+  stateDir: string = SERVE_SIM_STATE_DIR
+): Promise<string | undefined> {
+  const servers = await readServeSimServersAsync(stateDir);
+  return servers.find(server => server.udid === udid)?.token;
+}
+
 export async function startServeSimWithTunnelAsync(
   ctx: CustomBuildContext,
   {
@@ -857,6 +878,20 @@ export async function startServeSimWithTunnelAsync(
     packageSpec: createServeSimPackageSpec(packageVersion),
     createArgs: (port, turnArgs) =>
       createServeSimArgs({ port, turnArgs, metricsCorsArgs, packageVersion }),
+    readPreviewTokenAsync: async device => {
+      const previewToken = await readServeSimPreviewTokenAsync(device);
+      if (!previewToken) {
+        // A serve-sim that does not know --require-token fails earlier, in the readiness check, so
+        // reaching here means it started and left no token in its state file.
+        throw new SystemError(
+          `serve-sim became ready but wrote no session token for device ${device}. The preview is ` +
+            'on a public tunnel and would be reachable without one, so the session cannot continue. ' +
+            'This usually means the state file was not written as expected; retry the session, and ' +
+            'report it if it repeats.'
+        );
+      }
+      return previewToken;
+    },
   });
 }
 

packages/build-tools/src/steps/utils/sandboxDaemon.ts

@@ -0,0 +1,106 @@
+import { SystemError } from '@expo/eas-build-job';
+import { type bunyan } from '@expo/logger';
+import { setTimeout as setTimeoutAsync } from 'node:timers/promises';
+import WebSocket from 'ws';
+
+export interface SandboxDaemonOptions {
+  credential: string;
+  serverUrl: string;
+  reconnectDelayMs: number;
+  logger: bunyan;
+  signal?: AbortSignal;
+}
+
+export interface SandboxDaemon {
+  ready: Promise<void>;
+  stopAsync(): Promise<void>;
+}
+
+export async function startSandboxDaemonAsync(
+  options: SandboxDaemonOptions
+): Promise<SandboxDaemon> {
+  options.signal?.throwIfAborted();
+  let socket: WebSocket | undefined;
+  const abortController = new AbortController();
+  let hasConnected = false;
+  let resolveConnected!: () => void;
+  let rejectConnected!: (error: Error) => void;
+  const connected = new Promise<void>((resolve, reject) => {
+    resolveConnected = resolve;
+    rejectConnected = reject;
+  });
+  const stop = (): void => {
+    abortController.abort();
+    socket?.close(1000, 'sandbox stopped');
+  };
+  options.signal?.addEventListener('abort', stop, { once: true });
+
+  const connectionLoop = (async () => {
+    while (!abortController.signal.aborted) {
+      try {
+        socket = new WebSocket(new URL('/sandbox/connect', options.serverUrl), {
+          handshakeTimeout: 10_000,
+          headers: { Authorization: `Bearer ${options.credential}` },
+        });
+        await waitForOpen(socket);
+        options.logger.info('Sandbox MCP server connected.');
+        hasConnected = true;
+        resolveConnected();
+        await waitForClose(socket);
+      } catch (error: any) {
+        if (!hasConnected) {
+          const message = `Sandbox MCP server connection failed: ${error?.message ?? 'unknown error'}`;
+          if (!abortController.signal.aborted) {
+            options.logger.error({ err: error }, message);
+          }
+          rejectConnected(new SystemError(message, { cause: error }));
+          return;
+        }
+        if (!abortController.signal.aborted) {
+          options.logger.warn(
+            { err: error },
+            `Sandbox MCP server connection failed: ${error?.message ?? 'unknown error'}`
+          );
+        }
+      }
+      if (!abortController.signal.aborted) {
+        try {
+          await setTimeoutAsync(options.reconnectDelayMs, undefined, {
+            signal: abortController.signal,
+          });
+        } catch (error) {
+          if (!abortController.signal.aborted) {
+            throw error;
+          }
+        }
+      }
+    }
+  })();
+
+  return {
+    ready: connected,
+    async stopAsync(): Promise<void> {
+      options.signal?.removeEventListener('abort', stop);
+      stop();
+      await connectionLoop;
+    },
+  };
+}
+
+function waitForOpen(socket: WebSocket): Promise<void> {
+  return new Promise((resolve, reject) => {
+    socket.once('open', resolve);
+    socket.once('error', reject);
+    socket.once('close', () => reject(new Error('Sandbox MCP server closed before it connected.')));
+  });
+}
+
+function waitForClose(socket: WebSocket): Promise<void> {
+  if (socket.readyState === WebSocket.CLOSING || socket.readyState === WebSocket.CLOSED) {
+    return Promise.resolve();
+  }
+  return new Promise((resolve, reject) => {
+    socket.once('close', resolve);
+    socket.once('error', reject);
+  });
+}

packages/build-tools/src/steps/utils/serveSimMetricsRecorder.ts

@@ -13,9 +13,9 @@ const POLL_INTERVAL_MS = 2_000;
 const MAX_CONSECUTIVE_STREAM_FAILURES_PER_DEVICE = 10;
 const END_STREAM_TIMEOUT_MS = 2_000;
 // serve-sim's own per-device registry while serving: `${tmpdir}/serve-sim/server-<udid>.json`.
-const SERVE_SIM_STATE_DIR = path.join(os.tmpdir(), 'serve-sim');
+export const SERVE_SIM_STATE_DIR = path.join(os.tmpdir(), 'serve-sim');
 
-type ServeSimServer = { udid: string; url: string };
+type ServeSimServer = { udid: string; url: string; token?: string };
 
 type ServeSimMetricsSession = {
   logger: bunyan;
@@ -130,6 +130,7 @@ async function pollServeSimMetricsAsync(session: ServeSimMetricsSession): Promis
       logger.info(`Collecting serve-sim metrics for ${server.udid}.`);
       const donePromise = streamServeSimMetricsToFileAsync({
         serveSimUrl: server.url,
+        serveSimToken: server.token,
         filePath,
         signal: streamSignal,
         logger,
@@ -172,9 +173,14 @@ export async function readServeSimServersAsync(stateDir: string): Promise<ServeS
       const state = JSON.parse(await readFile(path.join(stateDir, entry), 'utf-8')) as {
         device?: unknown;
         url?: unknown;
+        token?: unknown;
       };
       if (typeof state.device === 'string' && typeof state.url === 'string') {
-        servers.push({ udid: state.device, url: state.url });
+        servers.push({
+          udid: state.device,
+          url: state.url,
+          ...(typeof state.token === 'string' ? { token: state.token } : {}),
+        });
       }
     } catch {
       continue;
@@ -185,11 +191,13 @@ export async function readServeSimServersAsync(stateDir: string): Promise<ServeS
 
 export async function streamServeSimMetricsToFileAsync({
   serveSimUrl,
+  serveSimToken,
   filePath,
   signal,
   logger,
 }: {
   serveSimUrl: string;
+  serveSimToken?: string;
   filePath: string;
   signal: AbortSignal;
   logger: bunyan;
@@ -201,7 +209,10 @@ export async function streamServeSimMetricsToFileAsync({
   let receivedData = false;
   let metadata: Record<string, unknown> | undefined;
   try {
-    const response = await fetch(new URL('/metrics', serveSimUrl).toString(), { signal });
+    const response = await fetch(new URL('/metrics', serveSimUrl).toString(), {
+      signal,
+      ...(serveSimToken ? { headers: { Authorization: `Bearer ${serveSimToken}` } } : {}),
+    });
     if (!response.ok || !response.body) {
       logger.warn(`serve-sim /metrics responded ${response.status} for ${serveSimUrl}.`);
       return { receivedData, metadata };

packages/build-tools/src/utils/AndroidEmulatorUtils.ts

@@ -99,12 +99,18 @@ export namespace AndroidEmulatorUtils {
     deviceName,
     systemImagePackage,
     deviceIdentifier,
+    lcdWidth,
+    lcdHeight,
+    lcdDensity,
     env,
     logger,
   }: {
     deviceName: AndroidVirtualDeviceName;
     systemImagePackage: string;
     deviceIdentifier: AndroidDeviceName | null;
+    lcdWidth: number | null;
+    lcdHeight: number | null;
+    lcdDensity: number | null;
     env: NodeJS.ProcessEnv;
     logger: bunyan;
   }): Promise<void> {
@@ -176,6 +182,13 @@ export namespace AndroidEmulatorUtils {
         }
       }
 
+      if (lcdWidth !== null && lcdHeight !== null && lcdDensity !== null) {
+        logger.info(
+          `Setting screen resolution to ${lcdWidth}x${lcdHeight} and density to ${lcdDensity} ppi.`
+        );
+        configIniFileContent = `${configIniFileContent}\nhw.lcd.height=${lcdHeight}\nhw.lcd.width=${lcdWidth}\nhw.lcd.density=${lcdDensity}\n`;
+      }
+
       const shouldAdjustHeapSize =
         env.ANDROID_EMULATOR_ADJUST_HEAP_SIZE !== 'false' &&
         env.ANDROID_EMULATOR_ADJUST_HEAP_SIZE !== '0';

packages/build-tools/src/utils/__integration-tests__/AndroidEmulatorUtils.test.ts

@@ -71,6 +71,9 @@ describe('AndroidEmulatorUtils', () => {
         deviceName,
         systemImagePackage: AndroidEmulatorUtils.defaultSystemImagePackage,
         deviceIdentifier: null,
+        lcdWidth: null,
+        lcdHeight: null,
+        lcdDensity: null,
         env: process.env,
         logger: createMockLogger({ logToConsole: true }),
       });
@@ -95,6 +98,9 @@ describe('AndroidEmulatorUtils', () => {
       deviceName,
       systemImagePackage: AndroidEmulatorUtils.defaultSystemImagePackage,
       deviceIdentifier: null,
+      lcdWidth: null,
+      lcdHeight: null,
+      lcdDensity: null,
       env: process.env,
       logger: createMockLogger({ logToConsole: true }),
     });
@@ -158,6 +164,9 @@ describe('AndroidEmulatorUtils', () => {
       deviceName,
       systemImagePackage: AndroidEmulatorUtils.defaultSystemImagePackage,
       deviceIdentifier: null,
+      lcdWidth: null,
+      lcdHeight: null,
+      lcdDensity: null,
       env: process.env,
       logger: createMockLogger({ logToConsole: true }),
     });
@@ -209,6 +218,9 @@ describe('AndroidEmulatorUtils', () => {
             deviceName,
             systemImagePackage: AndroidEmulatorUtils.defaultSystemImagePackage,
             deviceIdentifier: null,
+            lcdWidth: null,
+            lcdHeight: null,
+            lcdDensity: null,
             env: envForAttempt,
             logger: createMockLogger({ logToConsole: true }),
           });
@@ -290,6 +302,9 @@ describe('AndroidEmulatorUtils', () => {
         deviceName,
         systemImagePackage: AndroidEmulatorUtils.defaultSystemImagePackage,
         deviceIdentifier: null,
+        lcdWidth: null,
+        lcdHeight: null,
+        lcdDensity: null,
         env: process.env,
         logger,
       });
@@ -361,6 +376,9 @@ describe('AndroidEmulatorUtils', () => {
       deviceName,
       systemImagePackage: AndroidEmulatorUtils.defaultSystemImagePackage,
       deviceIdentifier: null,
+      lcdWidth: null,
+      lcdHeight: null,
+      lcdDensity: null,
       env: process.env,
       logger: createMockLogger({ logToConsole: true }),
     });

packages/build-tools/src/utils/__tests__/AndroidEmulatorUtils.test.ts

@@ -8,7 +8,11 @@ import path from 'node:path';
 
 import { createMockLogger } from '../../__tests__/utils/logger';
 import { Sentry } from '../../sentry';
-import { AndroidEmulatorUtils, AndroidVirtualDeviceName } from '../AndroidEmulatorUtils';
+import {
+  AndroidDeviceName,
+  AndroidEmulatorUtils,
+  AndroidVirtualDeviceName,
+} from '../AndroidEmulatorUtils';
 import { retryAsync } from '../retry';
 
 jest.mock('@expo/turtle-spawn', () => ({
@@ -48,6 +52,120 @@ describe('AndroidEmulatorUtils', () => {
     );
   });
 
+  describe(AndroidEmulatorUtils.createAsync, () => {
+    it('applies an explicit LCD configuration after screen scaling', async () => {
+      const deviceName = 'eas-simulator' as AndroidVirtualDeviceName;
+      const avdDirectory = `/home/expo/.android/avd/${deviceName}.avd`;
+      await fs.promises.mkdir(avdDirectory, { recursive: true });
+      await fs.promises.writeFile(
+        `${avdDirectory}/config.ini`,
+        [
+          'hw.ramSize=1536',
+          'hw.lcd.height=2424',
+          'hw.lcd.width=1080',
+          'hw.lcd.density=420',
+          'skin.path=pixel_9',
+          'showDeviceFrame=yes',
+        ].join('\n')
+      );
+      const avdManagerPromise = Promise.resolve({ stdout: '', stderr: '' }) as any;
+      const write = jest.fn();
+      const end = jest.fn();
+      avdManagerPromise.child = { stdin: { write, end } };
+      mockedSpawn.mockReturnValue(avdManagerPromise);
+      const logger = createMockLogger();
+
+      await AndroidEmulatorUtils.createAsync({
+        deviceName,
+        systemImagePackage: 'system-images;android-35;default;x86_64',
+        deviceIdentifier: 'medium_phone' as AndroidDeviceName,
+        lcdWidth: 720,
+        lcdHeight: 1600,
+        lcdDensity: 262,
+        env: {
+          HOME: '/home/expo',
+          ANDROID_EMULATOR_ADJUST_SCREEN: '1',
+          ANDROID_EMULATOR_ADJUST_HEAP_SIZE: '0',
+        },
+        logger,
+      });
+
+      expect(mockedSpawn).toHaveBeenCalledWith(
+        'avdmanager',
+        [
+          'create',
+          'avd',
+          '--name',
+          deviceName,
+          '--package',
+          'system-images;android-35;default;x86_64',
+          '--force',
+          '--device',
+          'medium_phone',
+        ],
+        { env: expect.any(Object), stdio: 'pipe' }
+      );
+      expect(write).toHaveBeenCalledWith('no');
+      expect(end).toHaveBeenCalled();
+      expect(logger.info).toHaveBeenCalledWith(
+        'Setting scaled screen resolution: hw.lcd.height to 1270 and hw.lcd.width to 566.'
+      );
+      expect(logger.info).toHaveBeenCalledWith(
+        'Setting screen resolution to 720x1600 and density to 262 ppi.'
+      );
+      await expect(fs.promises.readFile(`${avdDirectory}/config.ini`, 'utf8')).resolves.toBe(
+        [
+          'hw.ramSize=1536',
+          'hw.lcd.height=2424',
+          'hw.lcd.width=1080',
+          'hw.lcd.density=420',
+          'skin.path=pixel_9',
+          'showDeviceFrame=yes',
+          'hw.ramSize=2048',
+          '',
+          'hw.lcd.density=220',
+          '',
+          'hw.lcd.height=1270',
+          'hw.lcd.width=566',
+          '',
+          'hw.lcd.height=1600',
+          'hw.lcd.width=720',
+          'hw.lcd.density=262',
+          '',
+        ].join('\n')
+      );
+    });
+
+    it('does not apply an LCD configuration when it is omitted', async () => {
+      const deviceName = 'generic-emulator' as AndroidVirtualDeviceName;
+      const avdDirectory = `/home/expo/.android/avd/${deviceName}.avd`;
+      const initialConfig = ['skin.path=pixel_9', 'showDeviceFrame=yes'].join('\n');
+      await fs.promises.mkdir(avdDirectory, { recursive: true });
+      await fs.promises.writeFile(`${avdDirectory}/config.ini`, initialConfig);
+      const avdManagerPromise = Promise.resolve({ stdout: '', stderr: '' }) as any;
+      avdManagerPromise.child = { stdin: { write: jest.fn(), end: jest.fn() } };
+      mockedSpawn.mockReturnValue(avdManagerPromise);
+
+      await AndroidEmulatorUtils.createAsync({
+        deviceName,
+        systemImagePackage: AndroidEmulatorUtils.defaultSystemImagePackage,
+        deviceIdentifier: null,
+        lcdWidth: null,
+        lcdHeight: null,
+        lcdDensity: null,
+        env: {
+          HOME: '/home/expo',
+          ANDROID_EMULATOR_ADJUST_HEAP_SIZE: '0',
+        },
+        logger: createMockLogger(),
+      });
+
+      const config = await fs.promises.readFile(`${avdDirectory}/config.ini`, 'utf8');
+      expect(config).toContain(initialConfig);
+      expect(config).not.toContain('hw.lcd.');
+    });
+  });
+
   describe(AndroidEmulatorUtils.startAsync, () => {
     function mockSuccessfulStart(deviceName: AndroidVirtualDeviceName) {
       // Under `stdio: 'pipe'` these are net.Sockets, which is what startAsync

packages/create-eas-build-function/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-eas-build-function",
-  "version": "23.1.0",
+  "version": "24.3.0",
   "description": "Create functions for use in EAS Build custom builds.",
   "keywords": [
     "expo",
@@ -35,7 +35,7 @@
     "clean": "rimraf ./build/ \"*.tsbuildinfo\""
   },
   "dependencies": {
-    "@expo/steps": "23.1.0"
+    "@expo/steps": "24.3.0"
   },
   "devDependencies": {
     "@expo/package-manager": "1.9.10",

packages/downloader/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/downloader",
-  "version": "23.0.0",
+  "version": "24.0.0",
   "bugs": "https://github.com/expo/eas-cli/issues",
   "license": "BUSL-1.1",
   "author": "Expo <[email protected]>",

packages/eas-build-cache-provider/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eas-build-cache-provider",
-  "version": "23.0.0",
+  "version": "24.0.0",
   "description": "A build cache provider plugin for the Expo CLI",
   "homepage": "https://github.com/expo/eas-cli",
   "bugs": "https://github.com/expo/eas-cli/issues",

packages/eas-build-job/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/eas-build-job",
-  "version": "23.1.0",
+  "version": "24.3.0",
   "bugs": "https://github.com/expo/eas-cli/issues",
   "license": "MIT",
   "author": "Expo <[email protected]>",
@@ -25,9 +25,9 @@
     "clean": "rimraf node_modules dist coverage \"*.tsbuildinfo\""
   },
   "dependencies": {
-    "@expo/logger": "23.1.0",
+    "@expo/logger": "24.0.0",
     "@expo/results": "1.0.0",
-    "@expo/turtle-spawn": "23.1.0",
+    "@expo/turtle-spawn": "24.0.0",
     "joi": "^17.13.1",
     "semver": "^7.6.2",
     "zod": "^4.3.5"

packages/eas-build-job/src/__tests__/android.test.ts

@@ -240,7 +240,6 @@ describe('Android.JobSchema', () => {
       username: 'turtle-tutorial',
       projectArchive: {
         type: ArchiveSourceType.GIT,
-        repositoryUrl: 'http://localhost:3000',
         gitRef: 'master',
         gitCommitHash: '1b57db5b1cd12638aba0d12da71a2d691416700d',
       },

packages/eas-build-job/src/__tests__/common.test.ts

@@ -1,4 +1,8 @@
 import {
+  ArchiveSource,
+  ArchiveSourceSchema,
+  ArchiveSourceSchemaZ,
+  ArchiveSourceType,
   EasCliVersionsFetchTimeoutError,
   EnvSchema,
   SshSettingsZ,
@@ -675,3 +679,36 @@ describe('fetchEasCliVersionsAsync', () => {
     }
   });
 });
+
+describe('Git archive sources', () => {
+  const source: ArchiveSource = {
+    type: ArchiveSourceType.GIT,
+    gitRef: null,
+    gitCommitHash: '1234567890',
+  };
+
+  it('accepts Git job sources without a repository URL', () => {
+    expect(ArchiveSourceSchema.validate(source)).toMatchObject({ value: source });
+    expect(ArchiveSourceSchema.validate(source).error).toBeUndefined();
+    expect(ArchiveSourceSchemaZ.parse(source)).toEqual(source);
+  });
+
+  it('strips the legacy repository URL with the job validation options', () => {
+    const archive = {
+      ...source,
+      repositoryUrl: 'https://x-access-token:[email protected]/expo/eas-cli.git',
+    };
+    const result = ArchiveSourceSchema.validate(archive, { stripUnknown: true });
+    expect(result.error).toBeUndefined();
+    expect(result.value).toEqual(source);
+    expect(ArchiveSourceSchemaZ.parse(archive)).toEqual(source);
+  });
+
+  it('still requires the commit and ref', () => {
+    for (const field of ['gitCommitHash', 'gitRef'] as const) {
+      const archive = { ...source, [field]: undefined };
+      expect(ArchiveSourceSchema.validate(archive).error).toBeDefined();
+      expect(ArchiveSourceSchemaZ.safeParse(archive).success).toBe(false);
+    }
+  });
+});

packages/eas-build-job/src/__tests__/generic.test.ts

@@ -9,7 +9,6 @@ describe('Generic.JobZ', () => {
     const job: Generic.Job = {
       projectArchive: {
         type: ArchiveSourceType.GIT,
-        repositoryUrl: 'https://github.com/expo/expo.git',
         gitCommitHash: '1234567890',
         gitRef: null,
       },
@@ -51,7 +50,6 @@ describe('Generic.JobZ', () => {
     const job: Generic.Job = {
       projectArchive: {
         type: ArchiveSourceType.GIT,
-        repositoryUrl: 'https://github.com/expo/expo.git',
         gitCommitHash: '1234567890',
         gitRef: null,
       },
@@ -96,7 +94,6 @@ describe('Generic.JobZ', () => {
     const job: Generic.Job = {
       projectArchive: {
         type: ArchiveSourceType.GIT,
-        repositoryUrl: 'https://github.com/expo/expo.git',
         gitCommitHash: '1234567890',
         gitRef: null,
       },
@@ -131,7 +128,6 @@ describe('Generic.JobZ', () => {
     const job: Generic.Job = {
       projectArchive: {
         type: ArchiveSourceType.GIT,
-        repositoryUrl: 'https://github.com/expo/expo.git',
         gitCommitHash: '1234567890',
         gitRef: null,
       },
@@ -183,7 +179,6 @@ describe('Generic.JobZ', () => {
     const job = {
       projectArchive: {
         type: ArchiveSourceType.GIT,
-        repositoryUrl: 'https://github.com/expo/expo.git',
         gitCommitHash: '1234567890',
         gitRef: null,
       },
@@ -232,7 +227,6 @@ describe('Generic.JobZ', () => {
     const job: Omit<Generic.Job, 'customBuildConfig' | 'steps'> = {
       projectArchive: {
         type: ArchiveSourceType.GIT,
-        repositoryUrl: 'https://github.com/expo/expo.git',
         gitCommitHash: '1234567890',
         gitRef: null,
       },

packages/eas-build-job/src/__tests__/sandbox.test.ts

@@ -0,0 +1,66 @@
+import { SandboxDaemonCommands, SandboxDaemonRequestZ, SandboxDaemonResponseZ } from '../sandbox';
+
+describe('sandbox daemon protocol', () => {
+  it('validates command parameters', () => {
+    expect(
+      SandboxDaemonCommands.execCommand.params.parse({
+        cmd: 'pwd',
+        workdir: '/tmp',
+        tty: true,
+        yieldTimeMs: 10,
+      })
+    ).toEqual({ cmd: 'pwd', workdir: '/tmp', tty: true, yieldTimeMs: 10 });
+    expect(
+      SandboxDaemonCommands.writeStdin.params.parse({
+        sessionId: 1,
+        chars: '\u0003',
+        yieldTimeMs: 0,
+      })
+    ).toEqual({ sessionId: 1, chars: '\u0003', yieldTimeMs: 0 });
+  });
+
+  it.each([
+    { output: '', wallTimeSeconds: 0, exitCode: 0 },
+    { output: '', wallTimeSeconds: 0, terminationSignal: 'SIGTERM' },
+    { output: '', wallTimeSeconds: 0, sessionId: 1 },
+  ])('validates a command result with one terminal state', result => {
+    expect(SandboxDaemonCommands.execCommand.result.parse(result)).toEqual(result);
+  });
+
+  it.each([
+    { output: '', wallTimeSeconds: 0 },
+    { output: '', wallTimeSeconds: 0, exitCode: 0, sessionId: 1 },
+  ])('rejects a command result without exactly one terminal state', result => {
+    expect(() => SandboxDaemonCommands.writeStdin.result.parse(result)).toThrow();
+  });
+
+  it('validates success and error response envelopes', () => {
+    expect(
+      SandboxDaemonRequestZ.parse({
+        jsonrpc: '2.0',
+        id: 'request-id',
+        method: 'execCommand',
+        params: { cmd: 'pwd' },
+      })
+    ).toEqual({
+      jsonrpc: '2.0',
+      id: 'request-id',
+      method: 'execCommand',
+      params: { cmd: 'pwd' },
+    });
+    expect(
+      SandboxDaemonResponseZ.parse({ jsonrpc: '2.0', id: 'request-id', result: { output: '' } })
+    ).toEqual({ jsonrpc: '2.0', id: 'request-id', result: { output: '' } });
+    expect(
+      SandboxDaemonResponseZ.parse({
+        jsonrpc: '2.0',
+        id: 'request-id',
+        error: { code: -32603, message: 'Command failed' },
+      })
+    ).toEqual({
+      jsonrpc: '2.0',
+      id: 'request-id',
+      error: { code: -32603, message: 'Command failed' },
+    });
+  });
+});

packages/eas-build-job/src/common.ts

@@ -45,11 +45,6 @@ export type ArchiveSource =
   | { type: ArchiveSourceType.PATH; path: string }
   | {
       type: ArchiveSourceType.GIT;
-      /**
-       * Url that can be used to clone repository.
-       * It should contain embedded credentials for private registries.
-       */
-      repositoryUrl: string;
       /** A Git ref - points to a branch head, tag head or a branch name. */
       gitRef: string | null;
       /**
@@ -79,7 +74,6 @@ export const ArchiveSourceSchema = Joi.object<ArchiveSource>({
   .when(Joi.object({ type: ArchiveSourceType.GIT }).unknown(), {
     then: Joi.object({
       type: Joi.string().valid(ArchiveSourceType.GIT).required(),
-      repositoryUrl: Joi.string().required(),
       gitCommitHash: Joi.string().required(),
       gitRef: Joi.string().allow(null).required(),
     }),
@@ -94,7 +88,6 @@ export const ArchiveSourceSchema = Joi.object<ArchiveSource>({
 export const ArchiveSourceSchemaZ = z.discriminatedUnion('type', [
   z.object({
     type: z.literal(ArchiveSourceType.GIT),
-    repositoryUrl: z.string().url(),
     gitRef: z.string().nullable(),
     gitCommitHash: z.string(),
   }),

packages/eas-build-job/src/index.ts

@@ -34,6 +34,7 @@ export * from './compositeFunction';
 export * from './submission-config';
 export * from './projectPackage';
 export * from './deviceRunSession';
+export * from './sandbox';
 
 const version = require('../package.json').version;
 export { version };

packages/eas-build-job/src/sandbox.ts

@@ -0,0 +1,83 @@
+import { z } from 'zod';
+
+export const SandboxDaemonCommands = {
+  execCommand: {
+    params: z.object({
+      cmd: z.string().min(1),
+      workdir: z.string().optional(),
+      tty: z.boolean().optional(),
+      yieldTimeMs: z.number().int().min(0).max(30_000).optional(),
+    }),
+    result: z.union([
+      z.strictObject({
+        output: z.string(),
+        wallTimeSeconds: z.number().nonnegative(),
+        exitCode: z.number().int(),
+      }),
+      z.strictObject({
+        output: z.string(),
+        wallTimeSeconds: z.number().nonnegative(),
+        terminationSignal: z.string().min(1),
+      }),
+      z.strictObject({
+        output: z.string(),
+        wallTimeSeconds: z.number().nonnegative(),
+        sessionId: z.number().int().positive(),
+      }),
+    ]),
+  },
+  writeStdin: {
+    params: z.object({
+      sessionId: z.number().int().positive(),
+      chars: z.string().optional(),
+      yieldTimeMs: z.number().int().min(0).max(30_000).optional(),
+    }),
+    result: z.union([
+      z.strictObject({
+        output: z.string(),
+        wallTimeSeconds: z.number().nonnegative(),
+        exitCode: z.number().int(),
+      }),
+      z.strictObject({
+        output: z.string(),
+        wallTimeSeconds: z.number().nonnegative(),
+        terminationSignal: z.string().min(1),
+      }),
+      z.strictObject({
+        output: z.string(),
+        wallTimeSeconds: z.number().nonnegative(),
+        sessionId: z.number().int().positive(),
+      }),
+    ]),
+  },
+} as const satisfies Record<string, { params: z.ZodType; result: z.ZodType }>;
+
+export type SandboxDaemonMethod = keyof typeof SandboxDaemonCommands;
+
+export type SandboxDaemonCommandParams<Method extends SandboxDaemonMethod> = z.output<
+  (typeof SandboxDaemonCommands)[Method]['params']
+>;
+
+export type SandboxDaemonCommandResult<Method extends SandboxDaemonMethod> = z.output<
+  (typeof SandboxDaemonCommands)[Method]['result']
+>;
+
+export const SandboxDaemonRequestZ = z.object({
+  jsonrpc: z.literal('2.0'),
+  id: z.string(),
+  method: z.string(),
+  params: z.unknown().optional(),
+});
+
+export type SandboxDaemonRequest = z.output<typeof SandboxDaemonRequestZ>;
+
+export const SandboxDaemonResponseZ = z.union([
+  z.strictObject({ jsonrpc: z.literal('2.0'), id: z.string(), result: z.unknown().nonoptional() }),
+  z.strictObject({
+    jsonrpc: z.literal('2.0'),
+    id: z.string(),
+    error: z.strictObject({ code: z.number().int(), message: z.string() }),
+  }),
+]);
+
+export type SandboxDaemonResponse = z.output<typeof SandboxDaemonResponseZ>;

packages/eas-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eas-cli",
-  "version": "23.2.0",
+  "version": "24.3.0",
   "description": "EAS command line tool",
   "keywords": [
     "cli",
@@ -44,15 +44,15 @@
     "copy-new-templates": "rimraf build/commandUtils/new/templates && mkdir -p build/commandUtils/new && cp -r src/commandUtils/new/templates build/commandUtils/new"
   },
   "dependencies": {
-    "@expo/apple-utils": "2.1.22",
+    "@expo/apple-utils": "2.2.0",
     "@expo/code-signing-certificates": "0.0.5",
     "@expo/config": "55.0.10",
     "@expo/config-plugins": "55.0.7",
-    "@expo/eas-build-job": "23.1.0",
-    "@expo/eas-json": "23.1.0",
+    "@expo/eas-build-job": "24.3.0",
+    "@expo/eas-json": "24.3.0",
     "@expo/env": "^1.0.0",
     "@expo/json-file": "8.3.3",
-    "@expo/logger": "23.1.0",
+    "@expo/logger": "24.0.0",
     "@expo/multipart-body-parser": "2.0.0",
     "@expo/osascript": "2.1.4",
     "@expo/package-manager": "1.9.10",
@@ -64,7 +64,7 @@
     "@expo/results": "1.0.0",
     "@expo/rudder-sdk-node": "1.1.1",
     "@expo/spawn-async": "1.7.2",
-    "@expo/steps": "23.1.0",
+    "@expo/steps": "24.3.0",
     "@expo/timeago.js": "1.0.0",
     "@oclif/core": "^4.8.3",
     "@oclif/plugin-autocomplete": "^3.2.40",

packages/eas-cli/src/channel/insights/formatInsights.ts

@@ -1,7 +1,7 @@
 import chalk from 'chalk';
 
 import { ChannelRuntimeInsights } from '../../graphql/queries/ChannelInsightsQuery';
-import { formatTimespan } from '../../insights/formatTimespan';
+import { formatTimespan, toTimespanJson } from '../../insights/formatTimespan';
 import formatFields from '../../utils/formatFields';
 import renderTextTable from '../../utils/renderTextTable';
 
@@ -90,11 +90,7 @@ export function buildChannelInsightsJson(summary: ChannelInsightsSummary): objec
   return {
     channel: summary.channelName,
     runtimeVersion: summary.runtimeVersion,
-    timespan: {
-      start: summary.startTime,
-      end: summary.endTime,
-      ...(summary.daysBack !== undefined ? { daysBack: summary.daysBack } : {}),
-    },
+    timespan: toTimespanJson(summary),
     embeddedUpdateTotalUniqueUsers: summary.embeddedUpdateTotalUniqueUsers,
     otaTotalUniqueUsers: summary.otaTotalUniqueUsers,
     mostPopularUpdates: summary.mostPopularUpdates,

packages/eas-cli/src/commandUtils/EasCommand.ts

@@ -57,6 +57,7 @@ const BASE_GRAPHQL_ERROR_MESSAGE: string = 'GraphQL request failed.';
 interface BaseGetContextAsyncArgs {
   nonInteractive: boolean;
   vcsClientOverride?: Client;
+  projectIdOverride?: string;
 }
 
 interface GetContextAsyncArgsWithRequiredServerSideEnvironmentArgument extends BaseGetContextAsyncArgs {
@@ -183,6 +184,7 @@ export default abstract class EasCommand extends Command {
     {
       nonInteractive,
       vcsClientOverride,
+      projectIdOverride,
       // if specified and not null, the env vars from the selected environment will be fetched from the server
       // to resolve dynamic config (if dynamic config context is used) and enable getServerSideEnvironmentVariablesAsync function (if server side environment variables context is used)
       withServerSideEnvironment,
@@ -206,6 +208,7 @@ export default abstract class EasCommand extends Command {
           sessionManager: this.sessionManager,
           analytics: this.analytics,
           vcsClientOverride,
+          projectIdOverride,
           withServerSideEnvironment,
         }),
       ]);

packages/eas-cli/src/commandUtils/__tests__/EasCommand-test.ts

@@ -1,3 +1,4 @@
+import { Config } from '@oclif/core';
 import { v4 as uuidv4 } from 'uuid';
 
 import { AnalyticsWithOrchestration } from '../../analytics/AnalyticsManager';
@@ -24,17 +25,24 @@ jest.mock('../../analytics/AnalyticsManager', () => {
 });
 jest.mock('../../log');
 
-let originalProcessArgv: string[];
 const mockRequestId = uuidv4();
 
-beforeAll(() => {
-  originalProcessArgv = process.argv;
-  process.argv = [];
-});
+/**
+ * A Config that is never loaded. Letting oclif load one discovers and requires
+ * every command in the package, which takes seconds under coverage with a cold
+ * transform cache and has timed out on slow CI runners. Nothing here needs the
+ * command table or hooks.
+ */
+function getMockOclifConfig(): Config {
+  const config = new Config({ root: __dirname });
+  config.runHook = async () => ({
+    failures: [],
+    successes: [],
+  });
+  return config;
+}
 
-afterAll(() => {
-  process.argv = originalProcessArgv;
-});
+let mockConfig: Config;
 
 const analytics: AnalyticsWithOrchestration = {
   logEvent: jest.fn((): void => {}),
@@ -44,42 +52,57 @@ const analytics: AnalyticsWithOrchestration = {
 
 beforeEach(() => {
   jest.resetAllMocks();
+  mockConfig = getMockOclifConfig();
 });
 
+/**
+ * The config oclif handed to the most recently run command. Command.run returns
+ * a pre-built Config untouched only when it was created by the same @oclif/core
+ * copy the command extends; otherwise it silently builds and fully loads a new
+ * one, bringing back the command discovery this suite avoids.
+ */
+let lastCommandConfig: Config | undefined;
+
 const createTestEasCommand = (): any => {
   const { createAnalyticsAsync } = jest.requireMock('../../analytics/AnalyticsManager');
   createAnalyticsAsync.mockResolvedValue(analytics);
   const EasCommand = require('../EasCommand').default;
 
   class TestEasCommand extends EasCommand {
-    async runAsync(): Promise<void> {}
+    async runAsync(): Promise<void> {
+      lastCommandConfig = this.config;
+    }
   }
 
   TestEasCommand.id = 'testEasCommand'; // normally oclif will assign ids, but b/c this is located outside the commands folder it will not
   return TestEasCommand;
 };
 
+// These tests go through the static Command.run rather than constructing an
+// instance and calling run() like other command tests, because they cover
+// oclif's catch and finally wiring, which only runs inside the static path.
 describe('EasCommand', () => {
   describe('without exceptions', () => {
-    // The first test in this suite should have an increased timeout
-    // because of the implementation of Command from @oclif/command.
-    // It seems that loading config takes significant amount of time
-    // and I'm not sure how to mock it.
-    //
-    // See https://github.com/oclif/command/blob/master/src/command.ts#L80
-    // and look for "Config.load"
     it('ensures the user data is read', async () => {
       const TestEasCommand = createTestEasCommand();
-      await TestEasCommand.run();
+      await TestEasCommand.run([], mockConfig);
 
       const SessionManager = jest.requireMock('../../user/SessionManager').default;
       const sessionManagerSpy = jest.spyOn(SessionManager.prototype, 'getUserAsync');
       expect(sessionManagerSpy).toBeCalledTimes(1);
-    }, 60_000);
+    });
+
+    it('runs with the unloaded config instead of loading one', async () => {
+      const TestEasCommand = createTestEasCommand();
+      await TestEasCommand.run([], mockConfig);
+
+      expect(lastCommandConfig).toBe(mockConfig);
+      expect(mockConfig.plugins.size).toBe(0);
+    });
 
     it('initializes analytics', async () => {
       const TestEasCommand = createTestEasCommand();
-      await TestEasCommand.run();
+      await TestEasCommand.run([], mockConfig);
 
       const { createAnalyticsAsync } = jest.requireMock('../../analytics/AnalyticsManager');
       expect(createAnalyticsAsync).toHaveBeenCalled();
@@ -87,14 +110,14 @@ describe('EasCommand', () => {
 
     it('flushes analytics', async () => {
       const TestEasCommand = createTestEasCommand();
-      await TestEasCommand.run();
+      await TestEasCommand.run([], mockConfig);
 
       expect(analytics.flushAsync).toHaveBeenCalled();
     });
 
     it('flushes Sentry', async () => {
       const TestEasCommand = createTestEasCommand();
-      await TestEasCommand.run();
+      await TestEasCommand.run([], mockConfig);
 
       const Sentry = jest.requireMock('../../sentry').default;
       expect(Sentry.flush).toHaveBeenCalled();
@@ -102,7 +125,7 @@ describe('EasCommand', () => {
 
     it('logs events', async () => {
       const TestEasCommand = createTestEasCommand();
-      await TestEasCommand.run();
+      await TestEasCommand.run([], mockConfig);
 
       expect(analytics.logEvent).toHaveBeenCalledWith('action', {
         action: `eas ${TestEasCommand.id}`,
@@ -114,7 +137,7 @@ describe('EasCommand', () => {
     it('flushes analytics', async () => {
       const TestEasCommand = createTestEasCommand();
       try {
-        await TestEasCommand.run().then(() => {
+        await TestEasCommand.run([], mockConfig).then(() => {
           throw new Error('foo');
         });
       } catch {}
@@ -140,7 +163,7 @@ describe('EasCommand', () => {
         });
 
         try {
-          await TestEasCommand.run();
+          await TestEasCommand.run([], mockConfig);
         } catch {}
 
         expect(sentryScope.setTag).toHaveBeenCalledWith('command', TestEasCommand.id);
@@ -167,7 +190,7 @@ describe('EasCommand', () => {
         });
 
         try {
-          await TestEasCommand.run();
+          await TestEasCommand.run([], mockConfig);
         } catch {}
 
         expect(Sentry.captureException).toHaveBeenCalledTimes(1);
@@ -184,7 +207,7 @@ describe('EasCommand', () => {
           throw error;
         });
         try {
-          await TestEasCommand.run();
+          await TestEasCommand.run([], mockConfig);
         } catch {}
 
         expect(logErrorSpy).toBeCalledWith('Unexpected, internal error message');
@@ -204,7 +227,7 @@ describe('EasCommand', () => {
           throw error;
         });
         try {
-          await TestEasCommand.run();
+          await TestEasCommand.run([], mockConfig);
         } catch {}
 
         expect(logErrorSpy).toBeCalledWith('Unexpected GraphQL error message');
@@ -237,7 +260,7 @@ describe('EasCommand', () => {
           throw error;
         });
         try {
-          await TestEasCommand.run();
+          await TestEasCommand.run([], mockConfig);
         } catch {}
 
         expect(logErrorSpy).toBeCalledWith(
@@ -273,7 +296,7 @@ describe('EasCommand', () => {
           throw error;
         });
         try {
-          await TestEasCommand.run();
+          await TestEasCommand.run([], mockConfig);
         } catch {}
 
         expect(logErrorSpy).toBeCalledWith(
@@ -294,7 +317,7 @@ describe('EasCommand', () => {
           throw new Error('Error message');
         });
         try {
-          await TestEasCommand.run();
+          await TestEasCommand.run([], mockConfig);
         } catch (caughtError) {
           expect(caughtError).toBeInstanceOf(Error);
           expect((caughtError as Error).message).toEqual('testEasCommand command failed.');
@@ -310,7 +333,7 @@ describe('EasCommand', () => {
           throw new CombinedError({ graphQLErrors });
         });
         try {
-          await TestEasCommand.run();
+          await TestEasCommand.run([], mockConfig);
         } catch (caughtError) {
           expect(caughtError).toBeInstanceOf(Error);
           expect((caughtError as Error).message).toEqual('GraphQL request failed.');
@@ -340,7 +363,7 @@ describe('EasCommand', () => {
           throw new CombinedError({ graphQLErrors });
         });
         try {
-          await TestEasCommand.run();
+          await TestEasCommand.run([], mockConfig);
         } catch (caughtError) {
           expect(caughtError).toBeInstanceOf(Error);
           expect((caughtError as Error).message).toEqual('GraphQL request failed.');

packages/eas-cli/src/commandUtils/__tests__/pagination-test.ts

@@ -0,0 +1,33 @@
+import { EasPaginatedQueryFlags, getLimitFlagWithCustomValues } from '../pagination';
+
+async function parseFlagAsync(flag: { parse?: any }, input: string): Promise<number> {
+  return await flag.parse(input, {}, {});
+}
+
+describe(getLimitFlagWithCustomValues, () => {
+  const limit = getLimitFlagWithCustomValues({ defaultTo: 50, limit: 100 });
+
+  it('accepts integers within the range', async () => {
+    await expect(parseFlagAsync(limit, '1')).resolves.toBe(1);
+    await expect(parseFlagAsync(limit, '100')).resolves.toBe(100);
+  });
+
+  it('rejects values outside the range', async () => {
+    await expect(parseFlagAsync(limit, '0')).rejects.toThrow('--limit must be between 1 and 100');
+    await expect(parseFlagAsync(limit, '101')).rejects.toThrow('--limit must be between 1 and 100');
+  });
+
+  it('rejects non-integer input instead of passing it to the server', async () => {
+    await expect(parseFlagAsync(limit, '1.5')).rejects.toThrow('Unable to parse 1.5 as an integer');
+    await expect(parseFlagAsync(limit, 'ten')).rejects.toThrow('Unable to parse ten as an integer');
+  });
+});
+
+describe('EasPaginatedQueryFlags.offset', () => {
+  it('accepts zero and rejects non-integers', async () => {
+    await expect(parseFlagAsync(EasPaginatedQueryFlags.offset, '0')).resolves.toBe(0);
+    await expect(parseFlagAsync(EasPaginatedQueryFlags.offset, '2.5')).rejects.toThrow(
+      'Unable to parse 2.5 as an integer'
+    );
+  });
+});

packages/eas-cli/src/commandUtils/context/ContextField.ts

@@ -7,6 +7,8 @@ export interface ContextOptions {
   analytics: Analytics;
   nonInteractive: boolean;
   vcsClientOverride?: Client;
+  /** Short-circuits project ID resolution. */
+  projectIdOverride?: string;
   /**
    * If specified, env variables from the selected environment will be fetched from the server and used to evaluate the dynamic config.
    */

packages/eas-cli/src/commandUtils/context/ProjectIdContextField.ts

@@ -4,7 +4,14 @@ import { getProjectIdAsync } from './contextUtils/getProjectIdAsync';
 import { getPrivateExpoConfigAsync } from '../../project/expoConfig';
 
 export class ProjectIdContextField extends ContextField<string> {
-  async getValueAsync({ nonInteractive, sessionManager }: ContextOptions): Promise<string> {
+  async getValueAsync({
+    nonInteractive,
+    sessionManager,
+    projectIdOverride,
+  }: ContextOptions): Promise<string> {
+    if (projectIdOverride) {
+      return projectIdOverride;
+    }
     const projectDir = await findProjectDirAndVerifyProjectSetupAsync();
     const expBefore = await getPrivateExpoConfigAsync(projectDir);
     const projectId = await getProjectIdAsync(sessionManager, expBefore, {

packages/eas-cli/src/commandUtils/context/__tests__/ProjectIdContextField-test.ts

@@ -0,0 +1,16 @@
+import { ContextOptions } from '../ContextField';
+import { ProjectIdContextField } from '../ProjectIdContextField';
+import { findProjectDirAndVerifyProjectSetupAsync } from '../contextUtils/findProjectDirAndVerifyProjectSetupAsync';
+
+jest.mock('../contextUtils/findProjectDirAndVerifyProjectSetupAsync');
+
+describe(ProjectIdContextField, () => {
+  it('returns the override without reading the project directory', async () => {
+    const projectId = await new ProjectIdContextField().getValueAsync({
+      projectIdOverride: 'override-project-id',
+    } as ContextOptions);
+
+    expect(projectId).toBe('override-project-id');
+    expect(findProjectDirAndVerifyProjectSetupAsync).not.toHaveBeenCalled();
+  });
+});

packages/eas-cli/src/commandUtils/flags.ts

@@ -17,6 +17,12 @@ export const EasNonInteractiveAndJsonFlags = {
   }),
 };
 
+export const EasProjectIdFlag = {
+  'project-id': Flags.string({
+    description: 'EAS project ID (defaults to the project ID of the current directory)',
+  }),
+};
+
 export function resolveNonInteractiveAndJsonFlags(flags: {
   json?: boolean;
   'non-interactive'?: boolean;

packages/eas-cli/src/commandUtils/pagination.ts

@@ -23,8 +23,8 @@ const parseFlagInputStringAsInteger = (
   upperLimit: number
 ): number => {
   const inputAsNumber = Number(input);
-  if (isNaN(inputAsNumber)) {
-    throw new Error(`Unable to parse ${input} as a number`);
+  if (!Number.isInteger(inputAsNumber)) {
+    throw new Error(`Unable to parse ${input} as an integer`);
   }
   if (inputAsNumber < lowerLimit || inputAsNumber > upperLimit) {
     throw new Error(`--${flagName} must be between ${lowerLimit} and ${upperLimit}`);

packages/eas-cli/src/commandUtils/planGating.ts

@@ -0,0 +1,13 @@
+import { GraphQLError } from 'graphql';
+
+import { GraphqlError } from '../graphql/client';
+
+export function findPlanGateError(
+  error: unknown,
+  errorCodes: ReadonlySet<string>
+): GraphQLError | undefined {
+  if (!(error instanceof GraphqlError)) {
+    return undefined;
+  }
+  return error.graphQLErrors.find(e => errorCodes.has(e?.extensions?.errorCode as string));
+}

packages/eas-cli/src/commands/channel/insights.ts

@@ -11,7 +11,7 @@ import {
   resolveNonInteractiveAndJsonFlags,
 } from '../../commandUtils/flags';
 import { ChannelInsightsQuery } from '../../graphql/queries/ChannelInsightsQuery';
-import { resolveInsightsTimeRange } from '../../insights/timeRange';
+import { InsightsTimeRangeFlags, resolveInsightsTimeRange } from '../../insights/timeRange';
 import Log from '../../log';
 import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
 
@@ -28,20 +28,7 @@ export default class ChannelInsights extends EasCommand {
       description: 'Runtime version to query insights for.',
       required: true,
     }),
-    days: Flags.integer({
-      description:
-        'Show insights from the last N days (default 7, mutually exclusive with --start/--end).',
-      min: 1,
-      exclusive: ['start', 'end'],
-    }),
-    start: Flags.string({
-      description: 'Start of insights time range (ISO date).',
-      exclusive: ['days'],
-    }),
-    end: Flags.string({
-      description: 'End of insights time range (ISO date).',
-      exclusive: ['days'],
-    }),
+    ...InsightsTimeRangeFlags,
     ...EasNonInteractiveAndJsonFlags,
   };
 

packages/eas-cli/src/commands/observe/__tests__/errors.test.ts

@@ -0,0 +1,148 @@
+import { CombinedError } from '@urql/core';
+import { GraphQLError } from 'graphql';
+
+import { ExpoGraphqlClient } from '../../../commandUtils/context/contextUtils/createGraphqlClient';
+import { getMockOclifConfig } from '../../../__tests__/commands/utils';
+import { AppObserveErrorSeverity } from '../../../graphql/generated';
+import {
+  fetchObserveErrorGroupsAsync,
+  fetchObserveErrorOccurrencesAsync,
+} from '../../../observe/fetchErrors';
+import {
+  buildObserveErrorGroupsJson,
+  buildObserveErrorGroupsTable,
+  buildObserveErrorOccurrencesJson,
+  buildObserveErrorOccurrencesTable,
+} from '../../../observe/formatErrors';
+import { EAS_OBSERVE_FEATURE_NOT_AVAILABLE_IN_FREE_TIER_ERROR_CODE } from '../../../observe/planGating';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../../utils/json';
+import ObserveErrors from '../errors';
+
+jest.mock('../../../observe/fetchErrors');
+jest.mock('../../../observe/formatErrors', () => ({
+  buildObserveErrorGroupsTable: jest.fn().mockReturnValue('errors-table'),
+  buildObserveErrorGroupsJson: jest.fn().mockReturnValue({ errors: [], isTruncated: false }),
+  buildObserveErrorOccurrencesTable: jest.fn().mockReturnValue('occurrences-table'),
+  buildObserveErrorOccurrencesJson: jest
+    .fn()
+    .mockReturnValue({ occurrences: [], pageInfo: { hasNextPage: false, endCursor: null } }),
+}));
+jest.mock('../../../log');
+jest.mock('../../../utils/json');
+
+const mockFetchErrorGroupsAsync = jest.mocked(fetchObserveErrorGroupsAsync);
+const mockFetchErrorOccurrencesAsync = jest.mocked(fetchObserveErrorOccurrencesAsync);
+const mockBuildTable = jest.mocked(buildObserveErrorGroupsTable);
+const mockBuildJson = jest.mocked(buildObserveErrorGroupsJson);
+const mockBuildOccurrencesTable = jest.mocked(buildObserveErrorOccurrencesTable);
+const mockBuildOccurrencesJson = jest.mocked(buildObserveErrorOccurrencesJson);
+const mockEnableJsonOutput = jest.mocked(enableJsonOutput);
+const mockPrintJsonOnlyOutput = jest.mocked(printJsonOnlyOutput);
+
+describe(ObserveErrors, () => {
+  const graphqlClient = {} as any as ExpoGraphqlClient;
+  const mockConfig = getMockOclifConfig();
+  const projectId = 'test-project-id';
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockFetchErrorGroupsAsync.mockResolvedValue({ groups: [], isTruncated: false });
+    mockFetchErrorOccurrencesAsync.mockResolvedValue({
+      occurrences: [],
+      pageInfo: { hasNextPage: false, hasPreviousPage: false, endCursor: null } as any,
+    });
+  });
+
+  function createCommand(argv: string[]): ObserveErrors {
+    const command = new ObserveErrors(argv, mockConfig);
+    // @ts-expect-error
+    jest.spyOn(command, 'getContextAsync').mockReturnValue({
+      projectId,
+      loggedIn: { graphqlClient },
+    });
+    return command;
+  }
+
+  it('fetches error groups and renders a table by default', async () => {
+    await createCommand([]).runAsync();
+    expect(mockFetchErrorGroupsAsync).toHaveBeenCalledTimes(1);
+    expect(mockBuildTable).toHaveBeenCalledTimes(1);
+    expect(mockEnableJsonOutput).not.toHaveBeenCalled();
+  });
+
+  it('emits JSON with --json', async () => {
+    await createCommand(['--json', '--non-interactive']).runAsync();
+    expect(mockEnableJsonOutput).toHaveBeenCalledTimes(1);
+    expect(mockBuildJson).toHaveBeenCalledTimes(1);
+    expect(mockPrintJsonOnlyOutput).toHaveBeenCalledWith({ errors: [], isTruncated: false });
+  });
+
+  it('maps the --severity flag to the AppObserveErrorSeverity enum', async () => {
+    await createCommand(['--severity', 'fatal']).runAsync();
+    const options = mockFetchErrorGroupsAsync.mock.calls[0][2];
+    expect(options.severity).toBe(AppObserveErrorSeverity.Fatal);
+  });
+
+  it('fetches occurrences (not groups) and renders their table when --fingerprint is set', async () => {
+    await createCommand(['--fingerprint', 'fp-1']).runAsync();
+    expect(mockFetchErrorGroupsAsync).not.toHaveBeenCalled();
+    expect(mockFetchErrorOccurrencesAsync).toHaveBeenCalledTimes(1);
+    expect(mockFetchErrorOccurrencesAsync.mock.calls[0][2]).toMatchObject({ fingerprint: 'fp-1' });
+    expect(mockBuildOccurrencesTable).toHaveBeenCalledTimes(1);
+    expect(mockBuildTable).not.toHaveBeenCalled();
+  });
+
+  it('emits occurrences JSON with --fingerprint --json', async () => {
+    await createCommand(['--fingerprint', 'fp-1', '--json', '--non-interactive']).runAsync();
+    expect(mockEnableJsonOutput).toHaveBeenCalledTimes(1);
+    expect(mockBuildOccurrencesJson).toHaveBeenCalledTimes(1);
+    expect(mockPrintJsonOnlyOutput).toHaveBeenCalledWith({
+      occurrences: [],
+      pageInfo: { hasNextPage: false, endCursor: null },
+    });
+  });
+
+  it('forwards --limit to the occurrences fetch when --fingerprint is set', async () => {
+    await createCommand(['--fingerprint', 'fp-1', '--limit', '20']).runAsync();
+    expect(mockFetchErrorOccurrencesAsync.mock.calls[0][2]).toMatchObject({
+      fingerprint: 'fp-1',
+      limit: 20,
+    });
+  });
+
+  it('rejects --limit without --fingerprint', async () => {
+    await expect(createCommand(['--limit', '20']).runAsync()).rejects.toThrow(
+      /--after or --limit can only be used in combination with the --fingerprint flag/
+    );
+    expect(mockFetchErrorGroupsAsync).not.toHaveBeenCalled();
+    expect(mockFetchErrorOccurrencesAsync).not.toHaveBeenCalled();
+  });
+
+  it('rejects --after without --fingerprint', async () => {
+    await expect(createCommand(['--after', 'cursor-1']).runAsync()).rejects.toThrow(
+      /--after or --limit can only be used in combination with the --fingerprint flag/
+    );
+    expect(mockFetchErrorGroupsAsync).not.toHaveBeenCalled();
+  });
+
+  it('surfaces the plan-gate message when errors are not available on the plan', async () => {
+    mockFetchErrorGroupsAsync.mockRejectedValueOnce(
+      new CombinedError({
+        graphQLErrors: [
+          new GraphQLError(
+            'Subscription to EAS is required for this feature.',
+            null,
+            null,
+            null,
+            null,
+            null,
+            {
+              errorCode: EAS_OBSERVE_FEATURE_NOT_AVAILABLE_IN_FREE_TIER_ERROR_CODE,
+            }
+          ),
+        ],
+      })
+    );
+    await expect(createCommand([]).runAsync()).rejects.toThrow(/Subscription to EAS is required/);
+  });
+});

packages/eas-cli/src/commands/observe/__tests__/event.test.ts

@@ -0,0 +1,190 @@
+import { CombinedError } from '@urql/core';
+import { GraphQLError } from 'graphql';
+
+import { ExpoGraphqlClient } from '../../../commandUtils/context/contextUtils/createGraphqlClient';
+import { getMockOclifConfig } from '../../../__tests__/commands/utils';
+import { ObserveQuery } from '../../../graphql/queries/ObserveQuery';
+import {
+  buildObserveCustomEventDetail,
+  buildObserveCustomEventJson,
+} from '../../../observe/formatCustomEvents';
+import { buildObserveErrorDetail, buildObserveErrorJson } from '../../../observe/formatErrors';
+import { buildObserveEventDetail, buildObserveEventJson } from '../../../observe/formatEvents';
+import { EAS_OBSERVE_FEATURE_NOT_AVAILABLE_IN_FREE_TIER_ERROR_CODE } from '../../../observe/planGating';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../../utils/json';
+import ObserveEvent from '../event';
+
+jest.mock('../../../observe/formatEvents', () => ({
+  buildObserveEventDetail: jest.fn().mockReturnValue('metric-detail'),
+  buildObserveEventJson: jest.fn().mockReturnValue({ id: 'metric-json' }),
+}));
+jest.mock('../../../observe/formatCustomEvents', () => ({
+  buildObserveCustomEventDetail: jest.fn().mockReturnValue('log-detail'),
+  buildObserveCustomEventJson: jest.fn().mockReturnValue({ id: 'log-json' }),
+}));
+jest.mock('../../../observe/formatErrors', () => ({
+  buildObserveErrorDetail: jest.fn().mockReturnValue('error-detail'),
+  buildObserveErrorJson: jest.fn().mockReturnValue({ id: 'error-json' }),
+}));
+jest.mock('../../../graphql/queries/ObserveQuery', () => ({
+  ObserveQuery: {
+    logByIdAsync: jest.fn(),
+    metricByIdAsync: jest.fn(),
+  },
+}));
+jest.mock('../../../log');
+jest.mock('../../../utils/json');
+
+const mockLogByIdAsync = jest.mocked(ObserveQuery.logByIdAsync);
+const mockMetricByIdAsync = jest.mocked(ObserveQuery.metricByIdAsync);
+const mockBuildObserveEventDetail = jest.mocked(buildObserveEventDetail);
+const mockBuildObserveEventJson = jest.mocked(buildObserveEventJson);
+const mockBuildObserveCustomEventDetail = jest.mocked(buildObserveCustomEventDetail);
+const mockBuildObserveCustomEventJson = jest.mocked(buildObserveCustomEventJson);
+const mockBuildObserveErrorDetail = jest.mocked(buildObserveErrorDetail);
+const mockBuildObserveErrorJson = jest.mocked(buildObserveErrorJson);
+const mockEnableJsonOutput = jest.mocked(enableJsonOutput);
+const mockPrintJsonOnlyOutput = jest.mocked(printJsonOnlyOutput);
+
+// A log event ID (user event or error) is a UUID; a metric event ID is
+// base64url-encoded JSON.
+const UUID_ID = '123e4567-e89b-12d3-a456-426614174000';
+const BASE64_ID = 'eyJhIjoxfQ';
+const INVALID_ID = 'not a valid id';
+
+const userEventLog = { id: UUID_ID, __typename: 'AppObserveUserEvent' } as any;
+const errorLog = { id: UUID_ID, __typename: 'AppObserveError' } as any;
+
+describe(ObserveEvent, () => {
+  const graphqlClient = {} as any as ExpoGraphqlClient;
+  const mockConfig = getMockOclifConfig();
+  const projectId = 'test-project-id';
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockLogByIdAsync.mockResolvedValue(null);
+    mockMetricByIdAsync.mockResolvedValue(null);
+  });
+
+  function createCommand(argv: string[]): ObserveEvent {
+    const command = new ObserveEvent(argv, mockConfig);
+    // @ts-expect-error
+    jest.spyOn(command, 'getContextAsync').mockReturnValue({
+      projectId,
+      loggedIn: { graphqlClient },
+    });
+    return command;
+  }
+
+  function planGateError(): CombinedError {
+    const serverMessage =
+      'Subscription to EAS is required for this feature. ' +
+      'Subscribe: https://expo.dev/accounts/acme/settings/billing';
+    return new CombinedError({
+      graphQLErrors: [
+        new GraphQLError(serverMessage, null, null, null, null, null, {
+          errorCode: EAS_OBSERVE_FEATURE_NOT_AVAILABLE_IN_FREE_TIER_ERROR_CODE,
+        }),
+      ],
+    });
+  }
+
+  it('looks up a UUID id with the log query only', async () => {
+    mockLogByIdAsync.mockResolvedValue(userEventLog);
+    await createCommand([UUID_ID]).runAsync();
+    expect(mockLogByIdAsync).toHaveBeenCalledWith(graphqlClient, {
+      appId: projectId,
+      id: UUID_ID,
+    });
+    expect(mockMetricByIdAsync).not.toHaveBeenCalled();
+    expect(mockBuildObserveCustomEventDetail).toHaveBeenCalledTimes(1);
+  });
+
+  it('renders an error detail when a UUID id resolves to an error', async () => {
+    mockLogByIdAsync.mockResolvedValue(errorLog);
+    await createCommand([UUID_ID]).runAsync();
+    expect(mockBuildObserveErrorDetail).toHaveBeenCalledTimes(1);
+    expect(mockBuildObserveCustomEventDetail).not.toHaveBeenCalled();
+  });
+
+  it('looks up a base64 id with the metric query only', async () => {
+    mockMetricByIdAsync.mockResolvedValue({ id: BASE64_ID } as any);
+    await createCommand([BASE64_ID]).runAsync();
+    expect(mockMetricByIdAsync).toHaveBeenCalledWith(graphqlClient, {
+      appId: projectId,
+      id: BASE64_ID,
+    });
+    expect(mockLogByIdAsync).not.toHaveBeenCalled();
+    expect(mockBuildObserveEventDetail).toHaveBeenCalledTimes(1);
+  });
+
+  it('errors immediately for an ID that is neither a UUID nor base64, without querying', async () => {
+    await expect(createCommand([INVALID_ID]).runAsync()).rejects.toThrow(
+      /is not a valid Observe event ID/
+    );
+    expect(mockLogByIdAsync).not.toHaveBeenCalled();
+    expect(mockMetricByIdAsync).not.toHaveBeenCalled();
+  });
+
+  it('emits typed JSON for a metric event with --json', async () => {
+    mockMetricByIdAsync.mockResolvedValue({ id: BASE64_ID } as any);
+    await createCommand([BASE64_ID, '--json', '--non-interactive']).runAsync();
+    expect(mockEnableJsonOutput).toHaveBeenCalledTimes(1);
+    expect(mockBuildObserveEventJson).toHaveBeenCalledTimes(1);
+    expect(mockPrintJsonOnlyOutput).toHaveBeenCalledWith({
+      type: 'metric',
+      event: { id: 'metric-json' },
+    });
+  });
+
+  it('emits typed JSON for a log event with --json', async () => {
+    mockLogByIdAsync.mockResolvedValue(userEventLog);
+    await createCommand([UUID_ID, '--json', '--non-interactive']).runAsync();
+    expect(mockBuildObserveCustomEventJson).toHaveBeenCalledTimes(1);
+    expect(mockPrintJsonOnlyOutput).toHaveBeenCalledWith({
+      type: 'log',
+      event: { id: 'log-json' },
+    });
+  });
+
+  it('emits typed JSON for an error event with --json', async () => {
+    mockLogByIdAsync.mockResolvedValue(errorLog);
+    await createCommand([UUID_ID, '--json', '--non-interactive']).runAsync();
+    expect(mockBuildObserveErrorJson).toHaveBeenCalledTimes(1);
+    expect(mockPrintJsonOnlyOutput).toHaveBeenCalledWith({
+      type: 'error',
+      event: { id: 'error-json' },
+    });
+  });
+
+  it('throws not-found when a well-formed ID resolves to nothing', async () => {
+    mockLogByIdAsync.mockResolvedValue(null);
+    await expect(createCommand([UUID_ID]).runAsync()).rejects.toThrow(
+      new RegExp(`No Observe event found with ID "${UUID_ID}"`)
+    );
+  });
+
+  it('surfaces the plan-gate message when the lookup is not available on the plan', async () => {
+    mockLogByIdAsync.mockRejectedValueOnce(planGateError());
+    await expect(createCommand([UUID_ID]).runAsync()).rejects.toThrow(
+      /Subscription to EAS is required/
+    );
+  });
+
+  it('wraps an unexpected server error with an ID-specific message and preserves the request ID', async () => {
+    const serverError = new CombinedError({
+      graphQLErrors: [
+        new GraphQLError('unexpected server error', null, null, null, null, null, {
+          requestId: 'req-123',
+        }),
+      ],
+    });
+    mockLogByIdAsync.mockRejectedValue(serverError);
+
+    await expect(createCommand([UUID_ID]).runAsync()).rejects.toThrow(
+      new RegExp(
+        `Could not retrieve Observe event with ID "${UUID_ID}"[\\s\\S]*unexpected server error \\(Request ID: req-123\\)`
+      )
+    );
+  });
+});

packages/eas-cli/src/commands/observe/__tests__/versions.test.ts

@@ -40,11 +40,12 @@ describe(ObserveVersions, () => {
 
   function createCommand(argv: string[]): ObserveVersions {
     const command = new ObserveVersions(argv, mockConfig);
-    // @ts-expect-error getContextAsync is a protected method
-    jest.spyOn(command, 'getContextAsync').mockReturnValue({
-      projectId,
-      loggedIn: { graphqlClient },
-    });
+    jest
+      .spyOn(command as any, 'getContextAsync')
+      .mockImplementation(async (_commandClass: any, { projectIdOverride }: any) => ({
+        projectId: projectIdOverride ?? projectId,
+        loggedIn: { graphqlClient },
+      }));
     return command;
   }
 

packages/eas-cli/src/commands/observe/errors.ts

@@ -0,0 +1,157 @@
+import { Flags } from '@oclif/core';
+
+import EasCommand from '../../commandUtils/EasCommand';
+import {
+  EasNonInteractiveAndJsonFlags,
+  EasProjectIdFlag,
+  resolveNonInteractiveAndJsonFlags,
+} from '../../commandUtils/flags';
+import { getLimitFlagWithCustomValues } from '../../commandUtils/pagination';
+import { AppObserveErrorSeverity } from '../../graphql/generated';
+import Log from '../../log';
+import {
+  fetchObserveErrorGroupsAsync,
+  fetchObserveErrorOccurrencesAsync,
+} from '../../observe/fetchErrors';
+import {
+  ObserveAfterFlag,
+  ObserveAppVersionFlag,
+  ObserveBuildNumberFlag,
+  ObserveEnvironmentFlag,
+  ObservePlatformFlag,
+  ObserveTimeRangeFlags,
+  ObserveUpdateIdFlag,
+} from '../../observe/flags';
+import {
+  buildObserveErrorGroupsJson,
+  buildObserveErrorGroupsTable,
+  buildObserveErrorOccurrencesJson,
+  buildObserveErrorOccurrencesTable,
+} from '../../observe/formatErrors';
+import { withObservePlanGateHandlingAsync } from '../../observe/planGating';
+import { observePlatformsFromFlag } from '../../observe/platforms';
+import { resolveTimeRange } from '../../observe/startAndEndTime';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
+
+const SEVERITY_BY_FLAG: Record<string, AppObserveErrorSeverity> = {
+  fatal: AppObserveErrorSeverity.Fatal,
+  error: AppObserveErrorSeverity.Error,
+};
+
+const DEFAULT_OCCURRENCES_LIMIT = 10;
+
+export default class ObserveErrors extends EasCommand {
+  static override description =
+    'display error and exception issue groups (grouped by fingerprint) for the app';
+
+  static override flags = {
+    ...ObservePlatformFlag,
+    fingerprint: Flags.string({
+      description:
+        'Show individual occurrences (with stack traces) for this error group fingerprint instead of the grouped summary',
+      required: false,
+    }),
+    severity: Flags.option({
+      description: 'Filter by severity (ignored when --fingerprint is set)',
+      options: Object.keys(SEVERITY_BY_FLAG),
+      required: false,
+    })(),
+    ...ObserveAfterFlag,
+    limit: getLimitFlagWithCustomValues({
+      defaultTo: DEFAULT_OCCURRENCES_LIMIT,
+      limit: 100,
+    }),
+    ...ObserveTimeRangeFlags,
+    ...ObserveAppVersionFlag,
+    ...ObserveBuildNumberFlag,
+    ...ObserveUpdateIdFlag,
+    ...ObserveEnvironmentFlag,
+    ...EasProjectIdFlag,
+    ...EasNonInteractiveAndJsonFlags,
+  };
+
+  static override contextDefinition = {
+    ...this.ContextOptions.ProjectId,
+    ...this.ContextOptions.LoggedIn,
+  };
+
+  async runAsync(): Promise<void> {
+    const { flags } = await this.parse(ObserveErrors);
+    const { json, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
+
+    const {
+      projectId,
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(ObserveErrors, {
+      nonInteractive,
+      projectIdOverride: flags['project-id'],
+    });
+
+    if (!flags.fingerprint && (flags.after || flags.limit)) {
+      throw new Error(
+        '--after or --limit can only be used in combination with the --fingerprint flag.'
+      );
+    }
+
+    if (json) {
+      enableJsonOutput();
+    }
+
+    const { daysBack, startTime, endTime } = resolveTimeRange(flags);
+
+    if (flags.fingerprint) {
+      const { occurrences, pageInfo } = await withObservePlanGateHandlingAsync(() =>
+        fetchObserveErrorOccurrencesAsync(graphqlClient, projectId, {
+          fingerprint: flags.fingerprint as string,
+          startTime,
+          endTime,
+          platforms: observePlatformsFromFlag(flags.platform),
+          appVersion: flags['app-version'],
+          buildNumber: flags['build-number'],
+          updateId: flags['update-id'],
+          environment: flags.environment,
+          limit: flags.limit ?? DEFAULT_OCCURRENCES_LIMIT,
+          ...(flags.after && { after: flags.after }),
+        })
+      );
+
+      if (json) {
+        printJsonOnlyOutput(buildObserveErrorOccurrencesJson(occurrences, pageInfo));
+      } else {
+        Log.addNewLineIfNone();
+        Log.log(
+          buildObserveErrorOccurrencesTable(occurrences, pageInfo, {
+            fingerprint: flags.fingerprint,
+            daysBack,
+            startTime,
+            endTime,
+          })
+        );
+      }
+      return;
+    }
+
+    const { groups, isTruncated } = await withObservePlanGateHandlingAsync(() =>
+      fetchObserveErrorGroupsAsync(graphqlClient, projectId, {
+        startTime,
+        endTime,
+        platforms: observePlatformsFromFlag(flags.platform),
+        appVersion: flags['app-version'],
+        buildNumber: flags['build-number'],
+        updateId: flags['update-id'],
+        environment: flags.environment,
+        ...(flags.severity && { severity: SEVERITY_BY_FLAG[flags.severity] }),
+      })
+    );
+
+    if (json) {
+      printJsonOnlyOutput(buildObserveErrorGroupsJson(groups, isTruncated));
+    } else {
+      Log.addNewLineIfNone();
+      Log.log(buildObserveErrorGroupsTable(groups, { daysBack, startTime, endTime }));
+      if (isTruncated) {
+        Log.warn('Result is truncated; not all error groups are shown.');
+      }
+    }
+  }
+}

packages/eas-cli/src/commands/observe/event.ts

@@ -0,0 +1,169 @@
+import { Args } from '@oclif/core';
+import { validate as isUuid } from 'uuid';
+
+import EasCommand from '../../commandUtils/EasCommand';
+import { EasCommandError } from '../../commandUtils/errors';
+import {
+  EasNonInteractiveAndJsonFlags,
+  EasProjectIdFlag,
+  resolveNonInteractiveAndJsonFlags,
+} from '../../commandUtils/flags';
+import { GraphqlError } from '../../graphql/client';
+import { ObserveQuery } from '../../graphql/queries/ObserveQuery';
+import Log from '../../log';
+import {
+  buildObserveCustomEventDetail,
+  buildObserveCustomEventJson,
+} from '../../observe/formatCustomEvents';
+import { buildObserveErrorDetail, buildObserveErrorJson } from '../../observe/formatErrors';
+import { buildObserveEventDetail, buildObserveEventJson } from '../../observe/formatEvents';
+import { withObservePlanGateHandlingAsync } from '../../observe/planGating';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
+
+export default class ObserveEvent extends EasCommand {
+  static override description =
+    'display a single Observe event (metric, log, or error) by its ID. IDs are included in event data when the `--json` flag is passed to `eas observe:session`, `eas observe:metrics`, or `eas observe:events`.';
+
+  static override args = {
+    id: Args.string({
+      description: 'ID of the event to display',
+      required: true,
+    }),
+  };
+
+  static override flags = {
+    ...EasProjectIdFlag,
+    ...EasNonInteractiveAndJsonFlags,
+  };
+
+  static override contextDefinition = {
+    ...this.ContextOptions.ProjectId,
+    ...this.ContextOptions.LoggedIn,
+  };
+
+  async runAsync(): Promise<void> {
+    const { flags, args } = await this.parse(ObserveEvent);
+    const { json, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
+
+    const {
+      projectId,
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(ObserveEvent, {
+      nonInteractive,
+      projectIdOverride: flags['project-id'],
+    });
+
+    if (json) {
+      enableJsonOutput();
+    }
+
+    const id = args.id;
+
+    // A log event ID (user event or error) is a UUID; a metric event ID is
+    // base64url-encoded JSON. Route to the matching query so we never issue the
+    // query that is guaranteed to fail for this ID, and reject anything that is
+    // neither up front.
+    if (isUuid(id)) {
+      const log = await fetchObserveEventAsync(id, () =>
+        ObserveQuery.logByIdAsync(graphqlClient, { appId: projectId, id })
+      );
+      if (!log) {
+        throw eventNotFoundError(id);
+      }
+      if (log.__typename === 'AppObserveError') {
+        if (json) {
+          printJsonOnlyOutput({ type: 'error', event: buildObserveErrorJson(log) });
+        } else {
+          Log.addNewLineIfNone();
+          Log.log(buildObserveErrorDetail(log));
+        }
+      } else if (json) {
+        printJsonOnlyOutput({ type: 'log', event: buildObserveCustomEventJson(log) });
+      } else {
+        Log.addNewLineIfNone();
+        Log.log(buildObserveCustomEventDetail(log));
+      }
+      return;
+    }
+
+    if (parsesAsBase64(id)) {
+      const event = await fetchObserveEventAsync(id, () =>
+        ObserveQuery.metricByIdAsync(graphqlClient, { appId: projectId, id })
+      );
+      if (!event) {
+        throw eventNotFoundError(id);
+      }
+      if (json) {
+        printJsonOnlyOutput({ type: 'metric', event: buildObserveEventJson(event) });
+      } else {
+        Log.addNewLineIfNone();
+        Log.log(buildObserveEventDetail(event));
+      }
+      return;
+    }
+
+    throw new EasCommandError(
+      `"${id}" is not a valid Observe event ID. IDs come from \`eas observe:events\` or \`eas observe:session\`.`
+    );
+  }
+}
+
+/**
+ * A metric event ID is canonical base64url (of JSON). Round-tripping rejects
+ * strings that only coincidentally contain base64 characters, so a value that
+ * is neither a UUID nor this is treated as an invalid ID.
+ */
+function parsesAsBase64(id: string): boolean {
+  if (id.length === 0) {
+    return false;
+  }
+  return Buffer.from(id, 'base64url').toString('base64url') === id;
+}
+
+function eventNotFoundError(id: string): EasCommandError {
+  return new EasCommandError(
+    `No Observe event found with ID "${id}". IDs come from \`eas observe:events\` or \`eas observe:session\`, and events age out of retention.`
+  );
+}
+
+/**
+ * Runs an Observe event lookup, translating plan-gate rejections to their
+ * upgrade message and any other server error into an actionable message that
+ * preserves the underlying error and request ID for support.
+ */
+async function fetchObserveEventAsync<T>(id: string, fn: () => Promise<T>): Promise<T> {
+  try {
+    return await withObservePlanGateHandlingAsync(fn);
+  } catch (error) {
+    if (error instanceof EasCommandError) {
+      throw error;
+    }
+    throw new EasCommandError(
+      `Could not retrieve Observe event with ID "${id}". ` +
+        'The ID may be invalid or the event may not exist (events also age out of retention). ' +
+        'Verify it was copied in full from `eas observe:events` or `eas observe:session`.' +
+        `\n\n${describeObserveServerError(error)}`
+    );
+  }
+}
+
+/**
+ * Extract a human-readable description from a GraphQL/server error, including
+ * the request ID(s) so a support request can reference them. Falls back to the
+ * error's own message for non-GraphQL errors.
+ */
+function describeObserveServerError(error: unknown): string {
+  if (error instanceof GraphqlError && error.graphQLErrors.length > 0) {
+    return error.graphQLErrors
+      .map(graphQLError => {
+        const message = graphQLError.message.replace('[GraphQL] ', '');
+        const requestId = graphQLError.extensions?.requestId;
+        return requestId ? `${message} (Request ID: ${String(requestId)})` : message;
+      })
+      .join('\n');
+  }
+  if (error instanceof Error) {
+    return error.message;
+  }
+  return String(error);
+}

packages/eas-cli/src/commands/observe/events.ts

@@ -3,6 +3,7 @@ import { Args, Flags } from '@oclif/core';
 import EasCommand from '../../commandUtils/EasCommand';
 import {
   EasNonInteractiveAndJsonFlags,
+  EasProjectIdFlag,
   resolveNonInteractiveAndJsonFlags,
 } from '../../commandUtils/flags';
 import { getLimitFlagWithCustomValues } from '../../commandUtils/pagination';
@@ -15,7 +16,6 @@ import {
   ObserveBuildNumberFlag,
   ObserveEnvironmentFlag,
   ObservePlatformFlag,
-  ObserveProjectIdFlag,
   ObserveTimeRangeFlags,
   ObserveUpdateIdFlag,
 } from '../../observe/flags';
@@ -29,7 +29,6 @@ import {
 } from '../../observe/formatCustomEvents';
 import { withObservePlanGateHandlingAsync } from '../../observe/planGating';
 import { observePlatformsFromFlag } from '../../observe/platforms';
-import { resolveObserveCommandContextAsync } from '../../observe/resolveProjectContext';
 import { resolveTimeRange } from '../../observe/startAndEndTime';
 import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
 
@@ -67,7 +66,7 @@ export default class ObserveEvents extends EasCommand {
         'When no event name argument is provided, list all events across all event names instead of a summary of event names + counts.',
       default: false,
     }),
-    ...ObserveProjectIdFlag,
+    ...EasProjectIdFlag,
     ...EasNonInteractiveAndJsonFlags,
   };
 
@@ -76,10 +75,6 @@ export default class ObserveEvents extends EasCommand {
     ...this.ContextOptions.LoggedIn,
   };
 
-  private static loggedInOnlyContextDefinition = {
-    ...this.ContextOptions.LoggedIn,
-  };
-
   async runAsync(): Promise<void> {
     const { flags, args } = await this.parse(ObserveEvents);
     const { json, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
@@ -90,12 +85,12 @@ export default class ObserveEvents extends EasCommand {
       );
     }
 
-    const { projectId, graphqlClient } = await resolveObserveCommandContextAsync({
-      command: this,
-      commandClass: ObserveEvents,
-      loggedInOnlyContextDefinition: ObserveEvents.loggedInOnlyContextDefinition,
-      projectIdOverride: flags['project-id'],
+    const {
+      projectId,
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(ObserveEvents, {
       nonInteractive,
+      projectIdOverride: flags['project-id'],
     });
 
     if (json) {

packages/eas-cli/src/commands/observe/metrics-summary.ts

@@ -3,6 +3,7 @@ import { Flags } from '@oclif/core';
 import EasCommand from '../../commandUtils/EasCommand';
 import {
   EasNonInteractiveAndJsonFlags,
+  EasProjectIdFlag,
   resolveNonInteractiveAndJsonFlags,
 } from '../../commandUtils/flags';
 import Log from '../../log';
@@ -10,7 +11,6 @@ import { fetchObserveMetricsAsync } from '../../observe/fetchMetrics';
 import {
   ObserveEnvironmentFlag,
   ObservePlatformFlag,
-  ObserveProjectIdFlag,
   ObserveTimeRangeFlags,
 } from '../../observe/flags';
 import {
@@ -22,7 +22,6 @@ import {
 import { METRIC_ALIASES, resolveMetricName } from '../../observe/metricNames';
 import { withObservePlanGateHandlingAsync } from '../../observe/planGating';
 import { observePlatformTargetsFromFlag } from '../../observe/platforms';
-import { resolveObserveCommandContextAsync } from '../../observe/resolveProjectContext';
 import { resolveTimeRange } from '../../observe/startAndEndTime';
 import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
 
@@ -64,7 +63,7 @@ export default class ObserveMetricsSummary extends EasCommand {
     })(),
     ...ObserveTimeRangeFlags,
     ...ObserveEnvironmentFlag,
-    ...ObserveProjectIdFlag,
+    ...EasProjectIdFlag,
     ...EasNonInteractiveAndJsonFlags,
   };
 
@@ -73,20 +72,16 @@ export default class ObserveMetricsSummary extends EasCommand {
     ...this.ContextOptions.LoggedIn,
   };
 
-  private static loggedInOnlyContextDefinition = {
-    ...this.ContextOptions.LoggedIn,
-  };
-
   async runAsync(): Promise<void> {
     const { flags } = await this.parse(ObserveMetricsSummary);
     const { json, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
 
-    const { projectId, graphqlClient } = await resolveObserveCommandContextAsync({
-      command: this,
-      commandClass: ObserveMetricsSummary,
-      loggedInOnlyContextDefinition: ObserveMetricsSummary.loggedInOnlyContextDefinition,
-      projectIdOverride: flags['project-id'],
+    const {
+      projectId,
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(ObserveMetricsSummary, {
       nonInteractive,
+      projectIdOverride: flags['project-id'],
     });
 
     if (json) {

packages/eas-cli/src/commands/observe/metrics.ts

@@ -4,6 +4,7 @@ import EasCommand from '../../commandUtils/EasCommand';
 import { EasCommandError } from '../../commandUtils/errors';
 import {
   EasNonInteractiveAndJsonFlags,
+  EasProjectIdFlag,
   resolveNonInteractiveAndJsonFlags,
 } from '../../commandUtils/flags';
 import { getLimitFlagWithCustomValues } from '../../commandUtils/pagination';
@@ -20,7 +21,6 @@ import {
   ObserveBuildNumberFlag,
   ObserveEnvironmentFlag,
   ObservePlatformFlag,
-  ObserveProjectIdFlag,
   ObserveTimeRangeFlags,
   ObserveUpdateIdFlag,
 } from '../../observe/flags';
@@ -28,7 +28,6 @@ import { METRIC_ALIASES, METRIC_SHORT_NAMES, resolveMetricName } from '../../obs
 import { withObservePlanGateHandlingAsync } from '../../observe/planGating';
 import { buildObserveEventsJson, buildObserveEventsTable } from '../../observe/formatEvents';
 import { observePlatformTargetsFromFlag, observePlatformsFromFlag } from '../../observe/platforms';
-import { resolveObserveCommandContextAsync } from '../../observe/resolveProjectContext';
 import { resolveTimeRange } from '../../observe/startAndEndTime';
 import { selectAsync } from '../../prompts';
 import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
@@ -64,7 +63,7 @@ export default class ObserveMetrics extends EasCommand {
     ...ObserveBuildNumberFlag,
     ...ObserveUpdateIdFlag,
     ...ObserveEnvironmentFlag,
-    ...ObserveProjectIdFlag,
+    ...EasProjectIdFlag,
     ...EasNonInteractiveAndJsonFlags,
   };
 
@@ -73,20 +72,16 @@ export default class ObserveMetrics extends EasCommand {
     ...this.ContextOptions.LoggedIn,
   };
 
-  private static loggedInOnlyContextDefinition = {
-    ...this.ContextOptions.LoggedIn,
-  };
-
   async runAsync(): Promise<void> {
     const { flags, args } = await this.parse(ObserveMetrics);
     const { json, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
 
-    const { projectId, graphqlClient } = await resolveObserveCommandContextAsync({
-      command: this,
-      commandClass: ObserveMetrics,
-      loggedInOnlyContextDefinition: ObserveMetrics.loggedInOnlyContextDefinition,
-      projectIdOverride: flags['project-id'],
+    const {
+      projectId,
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(ObserveMetrics, {
       nonInteractive,
+      projectIdOverride: flags['project-id'],
     });
 
     if (json) {

packages/eas-cli/src/commands/observe/routes.ts

@@ -3,6 +3,7 @@ import { Flags } from '@oclif/core';
 import EasCommand from '../../commandUtils/EasCommand';
 import {
   EasNonInteractiveAndJsonFlags,
+  EasProjectIdFlag,
   resolveNonInteractiveAndJsonFlags,
 } from '../../commandUtils/flags';
 import { getLimitFlagWithCustomValues } from '../../commandUtils/pagination';
@@ -14,7 +15,6 @@ import {
   ObserveBuildNumberFlag,
   ObserveEnvironmentFlag,
   ObservePlatformFlag,
-  ObserveProjectIdFlag,
   ObserveTimeRangeFlags,
   ObserveUpdateIdFlag,
 } from '../../observe/flags';
@@ -28,7 +28,6 @@ import {
 import { NAVIGATION_METRIC_ALIASES, resolveNavigationMetricName } from '../../observe/metricNames';
 import { withObservePlanGateHandlingAsync } from '../../observe/planGating';
 import { observePlatformTargetsFromFlag } from '../../observe/platforms';
-import { resolveObserveCommandContextAsync } from '../../observe/resolveProjectContext';
 import { resolveTimeRange } from '../../observe/startAndEndTime';
 import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
 
@@ -71,7 +70,7 @@ export default class ObserveRoutes extends EasCommand {
       multiple: true,
     }),
     ...ObserveEnvironmentFlag,
-    ...ObserveProjectIdFlag,
+    ...EasProjectIdFlag,
     ...EasNonInteractiveAndJsonFlags,
   };
 
@@ -80,20 +79,16 @@ export default class ObserveRoutes extends EasCommand {
     ...this.ContextOptions.LoggedIn,
   };
 
-  private static loggedInOnlyContextDefinition = {
-    ...this.ContextOptions.LoggedIn,
-  };
-
   async runAsync(): Promise<void> {
     const { flags } = await this.parse(ObserveRoutes);
     const { json, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
 
-    const { projectId, graphqlClient } = await resolveObserveCommandContextAsync({
-      command: this,
-      commandClass: ObserveRoutes,
-      loggedInOnlyContextDefinition: ObserveRoutes.loggedInOnlyContextDefinition,
-      projectIdOverride: flags['project-id'],
+    const {
+      projectId,
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(ObserveRoutes, {
       nonInteractive,
+      projectIdOverride: flags['project-id'],
     });
 
     if (json) {

packages/eas-cli/src/commands/observe/session.ts

@@ -4,6 +4,7 @@ import EasCommand from '../../commandUtils/EasCommand';
 import { EasCommandError } from '../../commandUtils/errors';
 import {
   EasNonInteractiveAndJsonFlags,
+  EasProjectIdFlag,
   resolveNonInteractiveAndJsonFlags,
 } from '../../commandUtils/flags';
 import { ExpoGraphqlClient } from '../../commandUtils/context/contextUtils/createGraphqlClient';
@@ -16,11 +17,7 @@ import {
   fetchSessionMetricCandidatesAsync,
   verifyObserveSessionAccessAsync,
 } from '../../observe/fetchSessions';
-import {
-  ObserveEnvironmentFlag,
-  ObserveProjectIdFlag,
-  ObserveTimeRangeFlags,
-} from '../../observe/flags';
+import { ObserveEnvironmentFlag, ObserveTimeRangeFlags } from '../../observe/flags';
 import { withObservePlanGateHandlingAsync } from '../../observe/planGating';
 import {
   buildObserveSessionEventsJson,
@@ -33,7 +30,6 @@ import {
   isKnownMetricName,
   resolveMetricName,
 } from '../../observe/metricNames';
-import { resolveObserveCommandContextAsync } from '../../observe/resolveProjectContext';
 import { resolveTimeRange } from '../../observe/startAndEndTime';
 import { ExpoChoice, selectAsync } from '../../prompts';
 import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
@@ -71,7 +67,7 @@ export default class ObserveSession extends EasCommand {
     }),
     ...ObserveTimeRangeFlags,
     ...ObserveEnvironmentFlag,
-    ...ObserveProjectIdFlag,
+    ...EasProjectIdFlag,
     ...EasNonInteractiveAndJsonFlags,
   };
 
@@ -80,20 +76,16 @@ export default class ObserveSession extends EasCommand {
     ...this.ContextOptions.LoggedIn,
   };
 
-  private static loggedInOnlyContextDefinition = {
-    ...this.ContextOptions.LoggedIn,
-  };
-
   async runAsync(): Promise<void> {
     const { flags, args } = await this.parse(ObserveSession);
     const { json, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
 
-    const { projectId, graphqlClient } = await resolveObserveCommandContextAsync({
-      command: this,
-      commandClass: ObserveSession,
-      loggedInOnlyContextDefinition: ObserveSession.loggedInOnlyContextDefinition,
-      projectIdOverride: flags['project-id'],
+    const {
+      projectId,
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(ObserveSession, {
       nonInteractive,
+      projectIdOverride: flags['project-id'],
     });
 
     if (json) {

packages/eas-cli/src/commands/observe/versions.ts

@@ -1,6 +1,7 @@
 import EasCommand from '../../commandUtils/EasCommand';
 import {
   EasNonInteractiveAndJsonFlags,
+  EasProjectIdFlag,
   resolveNonInteractiveAndJsonFlags,
 } from '../../commandUtils/flags';
 import Log from '../../log';
@@ -8,12 +9,10 @@ import { fetchObserveVersionsAsync } from '../../observe/fetchVersions';
 import {
   ObserveEnvironmentFlag,
   ObservePlatformFlag,
-  ObserveProjectIdFlag,
   ObserveTimeRangeFlags,
 } from '../../observe/flags';
 import { buildObserveVersionsJson, buildObserveVersionsTable } from '../../observe/formatVersions';
 import { observePlatformTargetsFromFlag } from '../../observe/platforms';
-import { resolveObserveCommandContextAsync } from '../../observe/resolveProjectContext';
 import { resolveTimeRange } from '../../observe/startAndEndTime';
 import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
 
@@ -24,7 +23,7 @@ export default class ObserveVersions extends EasCommand {
     ...ObservePlatformFlag,
     ...ObserveTimeRangeFlags,
     ...ObserveEnvironmentFlag,
-    ...ObserveProjectIdFlag,
+    ...EasProjectIdFlag,
     ...EasNonInteractiveAndJsonFlags,
   };
 
@@ -33,20 +32,16 @@ export default class ObserveVersions extends EasCommand {
     ...this.ContextOptions.LoggedIn,
   };
 
-  private static loggedInOnlyContextDefinition = {
-    ...this.ContextOptions.LoggedIn,
-  };
-
   async runAsync(): Promise<void> {
     const { flags } = await this.parse(ObserveVersions);
     const { json, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
 
-    const { projectId, graphqlClient } = await resolveObserveCommandContextAsync({
-      command: this,
-      commandClass: ObserveVersions,
-      loggedInOnlyContextDefinition: ObserveVersions.loggedInOnlyContextDefinition,
-      projectIdOverride: flags['project-id'],
+    const {
+      projectId,
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(ObserveVersions, {
       nonInteractive,
+      projectIdOverride: flags['project-id'],
     });
 
     if (json) {

packages/eas-cli/src/commands/simulator/__tests__/egress.test.ts

@@ -0,0 +1,114 @@
+import { Config } from '@oclif/core';
+
+import Log from '../../../log';
+import { runLocalEgressAsync } from '../../../simulator/egress';
+import { loadSimulatorEnvAsync } from '../../../simulator/env';
+import SimulatorEgress from '../egress';
+
+jest.mock('../../../log');
+jest.mock('../../../simulator/env', () => ({
+  ...jest.requireActual('../../../simulator/env'),
+  loadSimulatorEnvAsync: jest.fn(),
+}));
+jest.mock('../../../simulator/egress', () => ({
+  ...jest.requireActual('../../../simulator/egress'),
+  runLocalEgressAsync: jest.fn(),
+}));
+
+const shellSession = {
+  EAS_SIMULATOR_SESSION_ID: 'session-b',
+  EAS_SIMULATOR_EGRESS_ALLOW: '',
+  EAS_SIMULATOR_EGRESS_URL: 'https://egress-b.example.test',
+  EAS_SIMULATOR_EGRESS_TOKEN: 'token-b',
+  EAS_SIMULATOR_EGRESS_FINGERPRINT: 'fingerprint-b',
+  EAS_SIMULATOR_EGRESS_PORT: '8899',
+};
+const fileSession = {
+  EAS_SIMULATOR_SESSION_ID: 'session-a',
+  EAS_SIMULATOR_EGRESS_ALLOW: 'localhost:3000',
+  EAS_SIMULATOR_EGRESS_URL: 'https://egress-a.example.test',
+  EAS_SIMULATOR_EGRESS_TOKEN: 'token-a',
+  EAS_SIMULATOR_EGRESS_FINGERPRINT: 'fingerprint-a',
+  EAS_SIMULATOR_EGRESS_PORT: '8898',
+};
+
+function createCommand(argv: string[]): SimulatorEgress {
+  const config = new Config({ root: __dirname });
+  config.runHook = async () => ({ failures: [], successes: [] });
+  const command = new SimulatorEgress(argv, config);
+  // @ts-expect-error getContextAsync is protected
+  jest.spyOn(command, 'getContextAsync').mockResolvedValue({ projectDir: '/test/project' });
+  return command;
+}
+
+describe(SimulatorEgress, () => {
+  const previousEnv = Object.fromEntries(
+    Object.keys(shellSession).map(key => [key, process.env[key]])
+  );
+  beforeEach(() => {
+    jest.clearAllMocks();
+    Object.assign(process.env, shellSession);
+    jest.mocked(loadSimulatorEnvAsync).mockImplementation(async () => {
+      Object.assign(process.env, fileSession);
+    });
+    jest.mocked(runLocalEgressAsync).mockResolvedValue();
+  });
+  afterEach(() => {
+    for (const [key, value] of Object.entries(previousEnv)) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  });
+
+  it('uses the complete exported session tuple without loading a stale dotenv session in env mode', async () => {
+    await createCommand(['--config-type', 'env']).runAsync();
+
+    expect(loadSimulatorEnvAsync).not.toHaveBeenCalled();
+    expect(runLocalEgressAsync).toHaveBeenCalledWith(
+      expect.objectContaining({
+        url: shellSession.EAS_SIMULATOR_EGRESS_URL,
+        token: shellSession.EAS_SIMULATOR_EGRESS_TOKEN,
+        fingerprint: shellSession.EAS_SIMULATOR_EGRESS_FINGERPRINT,
+        port: 8899,
+        allow: [],
+      })
+    );
+    expect(Log.log).toHaveBeenCalledWith(expect.stringContaining('session-b'));
+    expect(Log.log).toHaveBeenCalledWith(
+      expect.stringContaining('eas simulator:stop --id session-b')
+    );
+  });
+
+  it.each([[], ['--config-type', 'dotenv']])(
+    'loads the managed session by default or with explicit dotenv selection (%j)',
+    async (...argv) => {
+      await createCommand(argv).runAsync();
+
+      expect(loadSimulatorEnvAsync).toHaveBeenCalledWith('/test/project');
+      expect(runLocalEgressAsync).toHaveBeenCalledWith(
+        expect.objectContaining({
+          url: fileSession.EAS_SIMULATOR_EGRESS_URL,
+          token: fileSession.EAS_SIMULATOR_EGRESS_TOKEN,
+          fingerprint: fileSession.EAS_SIMULATOR_EGRESS_FINGERPRINT,
+          port: 8898,
+          allow: ['localhost:3000'],
+        })
+      );
+      expect(Log.log).toHaveBeenCalledWith(expect.stringContaining('session-a'));
+    }
+  );
+
+  it('does not fill missing exported credentials from a stale file in env mode', async () => {
+    delete process.env.EAS_SIMULATOR_EGRESS_TOKEN;
+
+    await expect(createCommand(['--config-type', 'env']).runAsync()).rejects.toThrow(
+      'no egress client to run'
+    );
+
+    expect(loadSimulatorEnvAsync).not.toHaveBeenCalled();
+    expect(runLocalEgressAsync).not.toHaveBeenCalled();
+  });
+});

packages/eas-cli/src/commands/simulator/__tests__/index.test.ts

@@ -6,6 +6,7 @@ import {
   AppPlatform,
   CreateDeviceRunSessionMutation,
   DeviceRunSessionByIdQuery,
+  DeviceRunSessionEgress,
   DeviceRunSessionResourceClass,
   DeviceRunSessionStatus,
   DeviceRunSessionType,
@@ -17,6 +18,7 @@ import { DeviceRunSessionQuery } from '../../../graphql/queries/DeviceRunSession
 import Log from '../../../log';
 import { ora } from '../../../ora';
 import { promptAsync } from '../../../prompts';
+import { runLocalEgressAsync } from '../../../simulator/egress';
 import {
   EAS_SIMULATOR_SESSION_ID,
   SIMULATOR_DOTENV_FILE_HEADER,
@@ -38,6 +40,8 @@ jest.mock('../../../log', () => ({
     log: jest.fn(),
     newLine: jest.fn(),
     warn: jest.fn(),
+    error: jest.fn(),
+    succeed: jest.fn(),
     withTick: jest.fn(),
   },
   link: jest.fn((url: string) => url),
@@ -49,6 +53,10 @@ jest.mock('../../../simulator/env', () => ({
 }));
 jest.mock('../../../simulator/expoGo');
 jest.mock('../../../prompts');
+jest.mock('../../../simulator/egress', () => ({
+  ...jest.requireActual('../../../simulator/egress'),
+  runLocalEgressAsync: jest.fn(),
+}));
 jest.mock('../../../ora', () => ({
   ora: jest.fn(() => {
     const spinner = {
@@ -856,6 +864,239 @@ describe(Simulator, () => {
     processExitSpy.mockRestore();
   });
 
+  const localEgressSessions: [
+    string,
+    DeviceRunSessionType,
+    NonNullable<DeviceRunSessionById['remoteConfig']>,
+  ][] = [
+    [
+      'agent-device',
+      DeviceRunSessionType.AgentDevice,
+      {
+        __typename: 'AgentDeviceRunSessionRemoteConfig',
+        agentDeviceRemoteSessionUrl: 'https://agent.example.com',
+        agentDeviceRemoteSessionToken: 'token',
+      },
+    ],
+    [
+      'appium',
+      DeviceRunSessionType.Appium,
+      {
+        __typename: 'AppiumRunSessionRemoteConfig',
+        appiumUrl: 'https://appium.example.com',
+        capabilities: {},
+      },
+    ],
+    [
+      'argent',
+      DeviceRunSessionType.Argent,
+      {
+        __typename: 'ArgentRunSessionRemoteConfig',
+        toolsUrl: 'https://argent.example.com',
+      },
+    ],
+    [
+      'web-preview-only',
+      DeviceRunSessionType.WebPreviewOnly,
+      {
+        __typename: 'WebPreviewOnlyRunSessionRemoteConfig',
+        previewUrl: 'https://preview.example.com',
+      },
+    ],
+    [
+      'web-preview-only',
+      DeviceRunSessionType.ServeSim,
+      {
+        __typename: 'ServeSimRunSessionRemoteConfig',
+        previewUrl: 'https://preview.example.com',
+      },
+    ],
+  ];
+  const localEgressFields = {
+    egressUrl: 'https://egress.example.com',
+    egressToken: 'pw',
+    egressFingerprint: 'fp',
+    egressPort: 8899,
+  };
+
+  it.each(localEgressSessions)(
+    'creates iOS %s sessions with local egress and saves connection details',
+    async (typeFlag, type, remoteConfig) => {
+      mockByIdAsync.mockResolvedValue(
+        makeDeviceRunSession({
+          type,
+          remoteConfig: { ...remoteConfig, ...localEgressFields },
+        })
+      );
+      const { command } = createCommand([
+        '--platform',
+        'ios',
+        '--type',
+        typeFlag,
+        '--egress',
+        'local',
+        '--non-interactive',
+      ]);
+      await command.runAsync();
+      expect(mockCreateDeviceRunSessionAsync).toHaveBeenCalledWith(
+        graphqlClient,
+        expect.objectContaining({
+          platform: AppPlatform.Ios,
+          egress: DeviceRunSessionEgress.Local,
+        })
+      );
+      expect(fs.writeFile).toHaveBeenCalledWith(
+        simulatorDotenvPath,
+        expect.stringContaining("EAS_SIMULATOR_EGRESS_TOKEN='pw'")
+      );
+      expect(Log.log).toHaveBeenCalledWith(expect.stringContaining('eas simulator:egress'));
+      expect(runLocalEgressAsync).not.toHaveBeenCalled();
+    }
+  );
+
+  it('prints the shell credential command when local egress uses env output', async () => {
+    const [typeFlag, type, remoteConfig] = localEgressSessions[1];
+    mockByIdAsync.mockResolvedValue(
+      makeDeviceRunSession({
+        type,
+        remoteConfig: { ...remoteConfig, ...localEgressFields },
+      })
+    );
+    const { command } = createCommand([
+      '--platform',
+      'ios',
+      '--type',
+      typeFlag,
+      '--egress',
+      'local',
+      '--out-config-type',
+      'env',
+      '--non-interactive',
+    ]);
+    await command.runAsync();
+    expect(fs.writeFile).not.toHaveBeenCalled();
+    expect(Log.log).toHaveBeenCalledWith(
+      expect.stringContaining(
+        'Run the egress client to connect the tunnel:\n\neas simulator:egress --config-type env\n'
+      )
+    );
+    expect(Log.log).not.toHaveBeenCalledWith(
+      expect.stringContaining(
+        'Run the egress client to connect the tunnel:\n\neas simulator:egress\n'
+      )
+    );
+    // The instructions block is the only place the command is mentioned.
+    expect(Log.log).not.toHaveBeenCalledWith(expect.stringContaining('in another process'));
+  });
+
+  it.each(localEgressSessions)(
+    'rejects local egress for Android %s before creating a session',
+    async typeFlag => {
+      const { command } = createCommand([
+        '--platform',
+        'android',
+        '--type',
+        typeFlag,
+        '--egress',
+        'local',
+        '--non-interactive',
+      ]);
+      await expect(command.runAsync()).rejects.toThrow(
+        '--egress local is only supported with --platform ios.'
+      );
+      expect(mockCreateDeviceRunSessionAsync).not.toHaveBeenCalled();
+    }
+  );
+
+  it.each(localEgressSessions)(
+    'stops %s after an interactive egress failure and removes its interrupt handler',
+    async (typeFlag, type, remoteConfig) => {
+      const failure = new Error('listen EADDRINUSE');
+      jest.mocked(runLocalEgressAsync).mockRejectedValueOnce(failure);
+      mockByIdAsync.mockResolvedValue(
+        makeDeviceRunSession({
+          type,
+          remoteConfig: { ...remoteConfig, ...localEgressFields },
+        })
+      );
+      const listeners = process.listeners('SIGINT');
+      const { command } = createCommand([
+        '--platform',
+        'ios',
+        '--type',
+        typeFlag,
+        '--egress',
+        'local',
+      ]);
+      await expect(command.runAsync()).rejects.toBe(failure);
+      expect(mockEnsureDeviceRunSessionStoppedAsync).toHaveBeenCalledWith(
+        graphqlClient,
+        'session-123'
+      );
+      expect(mockResetSimulatorEnvAsync).toHaveBeenCalledWith(projectDir, 'session-123');
+      expect(process.listeners('SIGINT')).toEqual(listeners);
+    }
+  );
+
+  it('passes normalized --egress-allow destinations to the egress client', async () => {
+    const session = makeDeviceRunSession({
+      remoteConfig: {
+        __typename: 'AgentDeviceRunSessionRemoteConfig',
+        agentDeviceRemoteSessionUrl: 'https://agent.example.com',
+        agentDeviceRemoteSessionToken: 'token',
+        egressUrl: 'https://egress.example.com',
+        egressToken: 'pw',
+        egressFingerprint: 'fp',
+        egressPort: 8899,
+      },
+    });
+    mockByIdAsync
+      .mockResolvedValueOnce(session)
+      .mockResolvedValueOnce({ ...session, status: DeviceRunSessionStatus.Stopped });
+    jest.mocked(runLocalEgressAsync).mockResolvedValueOnce(undefined);
+
+    const { command } = createCommand([
+      '--platform',
+      'ios',
+      '--egress',
+      'local',
+      '--egress-allow',
+      'localhost:3000',
+      '--egress-allow',
+      'LOCALHOST:3000',
+      '--egress-allow',
+      '192.168.1.20:8080',
+    ]);
+    await command.runAsync();
+
+    expect(runLocalEgressAsync).toHaveBeenCalledWith(
+      expect.objectContaining({ allow: ['localhost:3000', '192.168.1.20:8080'] })
+    );
+  });
+
+  it('rejects malformed --egress-allow values before creating a session', async () => {
+    // If validation were skipped, fail fast instead of polling a live session.
+    mockByIdAsync.mockResolvedValue(
+      makeDeviceRunSession({ status: DeviceRunSessionStatus.Stopped })
+    );
+    const { command } = createCommand([
+      '--platform',
+      'ios',
+      '--egress',
+      'local',
+      '--egress-allow',
+      'localhost',
+    ]);
+    await expect(command.runAsync()).rejects.toThrow('Invalid --egress-allow value "localhost"');
+    expect(mockCreateDeviceRunSessionAsync).not.toHaveBeenCalled();
+  });
+
+  it('requires --egress for --egress-allow', async () => {
+    const { command } = createCommand(['--platform', 'ios', '--egress-allow', 'localhost:3000']);
+    await expect(command.runAsync()).rejects.toThrow(/--egress/);
+    expect(mockCreateDeviceRunSessionAsync).not.toHaveBeenCalled();
+  });
+
   it('prompts to select the platform when --platform is omitted', async () => {
     mockPromptAsync.mockResolvedValueOnce({ selectedPlatform: AppPlatform.Android });
     mockByIdAsync

packages/eas-cli/src/commands/simulator/egress.ts

@@ -0,0 +1,75 @@
+import { Flags } from '@oclif/core';
+
+import EasCommand from '../../commandUtils/EasCommand';
+import Log from '../../log';
+import { readLocalEgressConfigFromEnv, runLocalEgressAsync } from '../../simulator/egress';
+import {
+  EAS_SIMULATOR_SESSION_ID,
+  SIMULATOR_DOTENV_FILE_NAME,
+  loadSimulatorEnvAsync,
+} from '../../simulator/env';
+
+export default class SimulatorEgress extends EasCommand {
+  static override hidden = true;
+  static override aliases = ['sim:egress'];
+  static override description = `[EXPERIMENTAL] run the local egress client for a simulator session to route proxied HTTP(S) requests through this machine`;
+
+  static override flags = {
+    'config-type': Flags.option({
+      description: `Read session credentials from ${SIMULATOR_DOTENV_FILE_NAME} (dotenv) or the current shell environment (env).`,
+      options: ['dotenv', 'env'] as const,
+      default: 'dotenv',
+    })(),
+  };
+
+  static override contextDefinition = {
+    ...this.ContextOptions.ProjectDir,
+  };
+
+  async runAsync(): Promise<void> {
+    const { flags } = await this.parse(SimulatorEgress);
+    const { projectDir } = await this.getContextAsync(SimulatorEgress, {
+      nonInteractive: true,
+    });
+    if (flags['config-type'] === 'dotenv') {
+      await loadSimulatorEnvAsync(projectDir);
+    }
+
+    const egress = readLocalEgressConfigFromEnv(process.env);
+    const deviceRunSessionId = process.env[EAS_SIMULATOR_SESSION_ID];
+
+    Log.log(
+      `Starting the local egress client${
+        deviceRunSessionId ? ` for simulator session ${deviceRunSessionId}` : ''
+      }. When connected, proxied HTTP(S) requests can use this machine's network.`
+    );
+    Log.log(
+      'Press Ctrl+C to stop the egress client. The simulator session keeps running; ' +
+        `proxied HTTP(S) requests are unavailable until the tunnel reconnects. Stop the session with \`eas simulator:stop${deviceRunSessionId ? ` --id ${deviceRunSessionId}` : ''}\`.`
+    );
+    Log.newLine();
+
+    const abortController = new AbortController();
+    const handleSigint = (): void => {
+      abortController.abort();
+    };
+    process.on('SIGINT', handleSigint);
+    try {
+      await runLocalEgressAsync({
+        ...egress,
+        signal: abortController.signal,
+        onConnected: () => {
+          Log.succeed('Egress tunnel connected.');
+        },
+        onDisconnected: () => {
+          Log.warn(
+            'Egress tunnel disconnected; reconnecting. Proxied HTTP(S) requests are unavailable until it reconnects.'
+          );
+        },
+      });
+    } finally {
+      process.removeListener('SIGINT', handleSigint);
+    }
+    Log.log('Egress client stopped.');
+  }
+}

packages/eas-cli/src/commands/simulator/get.ts

@@ -18,6 +18,7 @@ import {
 import {
   deviceRunSessionTypeToFlagValue,
   formatRemoteSessionInstructions,
+  sanitizeRemoteConfigForJson,
 } from '../../simulator/utils';
 import { formatBytes } from '../../utils/files';
 import formatFields, { FormatFieldsItem } from '../../utils/formatFields';
@@ -96,7 +97,9 @@ export default class SimulatorGet extends EasCommand {
         finishedAt: session.finishedAt ?? undefined,
         updatedAt: session.updatedAt,
         deviceRunSessionUrl,
-        remoteConfig: session.remoteConfig,
+        remoteConfig: session.remoteConfig
+          ? sanitizeRemoteConfigForJson(session.remoteConfig)
+          : session.remoteConfig,
         artifacts: session.artifacts,
       });
       return;

packages/eas-cli/src/commands/simulator/index.ts

@@ -11,6 +11,7 @@ import {
 } from '../../commandUtils/flags';
 import {
   AppPlatform,
+  DeviceRunSessionEgress,
   DeviceRunSessionStatus,
   DeviceRunSessionType,
   JobRunStatus,
@@ -21,6 +22,7 @@ import { DeviceRunSessionQuery } from '../../graphql/queries/DeviceRunSessionQue
 import Log, { link } from '../../log';
 import { ora } from '../../ora';
 import { promptAsync } from '../../prompts';
+import { parseEgressAllowList, runLocalEgressAsync } from '../../simulator/egress';
 import {
   EAS_SIMULATOR_SESSION_ID,
   SIMULATOR_DOTENV_FILE_NAME,
@@ -37,7 +39,9 @@ import {
   DeviceRunSessionRemoteConfig,
   formatRemoteSessionInstructions,
   formatSimulatorUnavailableMessage,
+  getLocalEgressConfig,
   getRemoteSessionEnvironmentVariables,
+  sanitizeRemoteConfigForJson,
 } from '../../simulator/utils';
 import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
 import { sleepAsync } from '../../utils/promise';
@@ -50,6 +54,7 @@ const OUT_CONFIG_TYPE_VALUES = {
 } as const;
 const PLATFORM_FLAG_VALUES = ['android', 'ios'] as const;
 type PlatformFlagValue = (typeof PLATFORM_FLAG_VALUES)[number];
+const EGRESS_FLAG_VALUES = ['local'] as const;
 const APP_PLATFORM_BY_FLAG_VALUE: Record<PlatformFlagValue, AppPlatform> = {
   android: AppPlatform.Android,
   ios: AppPlatform.Ios,
@@ -132,6 +137,17 @@ export default class Simulator extends EasCommand {
       hidden: true,
       options: Object.values(DEVICE_RUN_SESSION_RESOURCE_CLASS_FLAG_VALUES),
     })(),
+    egress: Flags.option({
+      description:
+        'With "local", the simulator system proxy points at this machine: HTTP(S) and WebSocket requests that honor it (WebKit, URLSession) exit from this machine and fail while the egress client is disconnected. Requests from libraries that bypass the system proxy are not covered. The egress client must keep running for the life of the session. Only supported with --platform ios.',
+      options: EGRESS_FLAG_VALUES,
+    })(),
+    'egress-allow': Flags.string({
+      description:
+        'Destination on this machine or its network that the simulator may reach through local egress, as an exact host:port (for example localhost:3000). Repeat for multiple destinations. A localhost or 127.0.0.1 entry also forwards that port from the simulator host to this machine (like adb reverse), so dev server URLs that use 127.0.0.1 work. Requires --egress local.',
+      multiple: true,
+      dependsOn: ['egress'],
+    }),
     force: Flags.boolean({
       description:
         '[default: true] Create a new simulator session even when an existing simulator session is present in the environment.',
@@ -218,6 +234,16 @@ export default class Simulator extends EasCommand {
     }
 
     const platform = await resolvePlatformAsync(flags.platform, nonInteractive);
+    const egress = flags.egress === 'local' ? DeviceRunSessionEgress.Local : undefined;
+    if (egress && platform !== AppPlatform.Ios) {
+      throw new EasCommandError('--egress local is only supported with --platform ios.');
+    }
+    let egressAllow: string[] = [];
+    try {
+      egressAllow = parseEgressAllowList(flags['egress-allow'] ?? []);
+    } catch (err) {
+      throw new EasCommandError(err instanceof Error ? err.message : String(err));
+    }
     if (platform === AppPlatform.Android) {
       Log.warn(
         'Android emulator support in EAS Simulator is still in development. Some features available on iOS may not work on Android yet. Full parity with iOS is coming soon.'
@@ -262,6 +288,7 @@ export default class Simulator extends EasCommand {
         ...(launchArgs?.length ? { launchArgs } : {}),
         ...(openUrl ? { openUrl } : {}),
         ...(resourceClass ? { resourceClass } : {}),
+        ...(egress ? { egress } : {}),
         maxRunTimeMinutes: flags['max-duration-minutes'],
         maxIdleTimeMinutes: flags['max-idle-time-minutes'],
       });
@@ -362,7 +389,7 @@ export default class Simulator extends EasCommand {
 
     if (flags['out-config-type'] === OUT_CONFIG_TYPE_VALUES.Dotenv) {
       await writeSimulatorEnvSafelyAsync(projectDir, {
-        ...getRemoteSessionEnvironmentVariables(remoteConfig),
+        ...getRemoteSessionEnvironmentVariables(remoteConfig, { egressAllow }),
         [EAS_SIMULATOR_SESSION_ID]: deviceRunSessionId,
       });
     }
@@ -385,30 +412,79 @@ export default class Simulator extends EasCommand {
         name,
         type: flags.type,
         deviceRunSessionUrl,
-        remoteConfig,
+        remoteConfig: sanitizeRemoteConfigForJson(remoteConfig),
       });
       return;
     }
 
     Log.newLine();
-    Log.log(formatRemoteSessionInstructions(remoteConfig, flags['out-config-type']));
+    Log.log(
+      formatRemoteSessionInstructions(remoteConfig, flags['out-config-type'], {
+        egressAllow,
+        egressClientRunsInline: !nonInteractive,
+      })
+    );
     Log.newLine();
 
+    const localEgress = getLocalEgressConfig(remoteConfig, egressAllow);
+
     if (nonInteractive) {
       sessionInterrupt.dispose();
+      // The instructions above already tell the reader to run eas simulator:egress.
       Log.log(
         `When you are done, stop the session with: eas simulator:stop --id ${deviceRunSessionId}`
       );
       return;
     }
 
-    await waitForSessionEndOrInterruptAsync({
-      graphqlClient,
-      deviceRunSessionId,
-      deviceRunSessionUrl,
-      projectDir,
-      sessionInterrupt,
-    });
+    // In interactive mode the egress client runs right here, for as long as the
+    // session does. A session with a disconnected tunnel still bills, so Ctrl+C stops both.
+    let egressPromise: Promise<void> | undefined;
+    let egressError: Error | undefined;
+    const egressAbortController = new AbortController();
+    if (localEgress) {
+      sessionInterrupt.signal.addEventListener(
+        'abort',
+        () => {
+          egressAbortController.abort();
+        },
+        { once: true }
+      );
+      egressPromise = runLocalEgressAsync({
+        ...localEgress,
+        signal: egressAbortController.signal,
+        onConnected: () => {
+          Log.succeed('Egress tunnel connected.');
+        },
+        onDisconnected: () => {
+          Log.warn(
+            'Egress tunnel disconnected; reconnecting. Proxied HTTP(S) requests are unavailable until it reconnects.'
+          );
+        },
+      }).catch(err => {
+        egressError = err instanceof Error ? err : new Error(String(err));
+        Log.error(
+          `${err instanceof Error ? err.message : String(err)} Stopping the simulator session.`
+        );
+        sessionInterrupt.abort();
+      });
+    }
+
+    try {
+      await waitForSessionEndOrInterruptAsync({
+        graphqlClient,
+        deviceRunSessionId,
+        deviceRunSessionUrl,
+        projectDir,
+        sessionInterrupt,
+      });
+    } finally {
+      egressAbortController.abort();
+      await egressPromise;
+    }
+    if (egressError) {
+      throw egressError;
+    }
   }
 }
 
@@ -526,6 +602,8 @@ async function waitForSessionEndOrInterruptAsync({
 type SessionInterrupt = {
   signal: AbortSignal;
   abortPromise: Promise<void>;
+  /** Stop the session as if the user had pressed Ctrl+C. */
+  abort: () => void;
   dispose: () => void;
 };
 
@@ -557,6 +635,9 @@ function registerSessionInterrupt(deviceRunSessionId: string): SessionInterrupt
   return {
     signal,
     abortPromise,
+    abort: () => {
+      abortController.abort();
+    },
     dispose: () => process.removeListener('SIGINT', sigintHandler),
   };
 }

packages/eas-cli/src/commands/update/insights.ts

@@ -6,7 +6,7 @@ import {
   resolveNonInteractiveAndJsonFlags,
 } from '../../commandUtils/flags';
 import { UpdateInsightsQuery } from '../../graphql/queries/UpdateInsightsQuery';
-import { INSIGHTS_DEFAULT_DAYS_BACK, resolveInsightsTimeRange } from '../../insights/timeRange';
+import { InsightsTimeRangeFlags, resolveInsightsTimeRange } from '../../insights/timeRange';
 import Log from '../../log';
 import {
   buildUpdateInsightsJson,
@@ -31,19 +31,7 @@ export default class UpdateInsights extends EasCommand {
       description: 'Filter to a single platform.',
       options: ['ios', 'android'] as const,
     })(),
-    days: Flags.integer({
-      description: `Show insights from the last N days (default ${INSIGHTS_DEFAULT_DAYS_BACK}, mutually exclusive with --start/--end).`,
-      min: 1,
-      exclusive: ['start', 'end'],
-    }),
-    start: Flags.string({
-      description: 'Start of insights time range (ISO date).',
-      exclusive: ['days'],
-    }),
-    end: Flags.string({
-      description: 'End of insights time range (ISO date).',
-      exclusive: ['days'],
-    }),
+    ...InsightsTimeRangeFlags,
     ...EasNonInteractiveAndJsonFlags,
   };
 

packages/eas-cli/src/commands/workflow/__tests__/insights-maestro.test.ts

@@ -0,0 +1,305 @@
+import { CombinedError } from '@urql/core';
+import { GraphQLError } from 'graphql';
+
+import { ExpoGraphqlClient } from '../../../commandUtils/context/contextUtils/createGraphqlClient';
+import { getMockOclifConfig } from '../../../__tests__/commands/utils';
+import { WorkflowDeviceTestCaseStatus } from '../../../graphql/generated';
+import { WorkflowDeviceTestCaseInsightsQuery } from '../../../graphql/queries/WorkflowDeviceTestCaseInsightsQuery';
+import { AppQuery } from '../../../graphql/queries/AppQuery';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../../utils/json';
+import WorkflowInsightsMaestro from '../insights/maestro';
+
+jest.mock('../../../graphql/queries/WorkflowDeviceTestCaseInsightsQuery', () => ({
+  WorkflowDeviceTestCaseInsightsQuery: {
+    insightsByAppIdAsync: jest.fn(),
+    historyByAppIdAsync: jest.fn(),
+  },
+}));
+jest.mock('../../../graphql/queries/AppQuery');
+jest.mock('../../../log');
+jest.mock('../../../utils/json');
+
+const mockInsightsByAppIdAsync = jest.mocked(
+  WorkflowDeviceTestCaseInsightsQuery.insightsByAppIdAsync
+);
+const mockHistoryByAppIdAsync = jest.mocked(
+  WorkflowDeviceTestCaseInsightsQuery.historyByAppIdAsync
+);
+const mockByIdWorkflowFileNamesAsync = jest.mocked(AppQuery.byIdWorkflowFileNamesAsync);
+const mockEnableJsonOutput = jest.mocked(enableJsonOutput);
+const mockPrintJsonOnlyOutput = jest.mocked(printJsonOnlyOutput);
+
+function metric(currentValue: number, previousValue: number): any {
+  return { __typename: 'WorkflowDeviceTestCaseInsightsMetric', currentValue, previousValue };
+}
+
+const totals: any = {
+  __typename: 'WorkflowDeviceTestCaseInsightsTotals',
+  totalRuns: metric(200, 160),
+  passedCleanCount: metric(170, 140),
+  flakyCount: metric(10, 4),
+  failedCount: metric(20, 16),
+  distinctFlakyTestCount: metric(3, 2),
+  avgDurationMs: { currentValue: 42100, previousValue: 45000 },
+  p90DurationMs: { currentValue: 72000, previousValue: null },
+};
+
+const timeSeries: any[] = [
+  { bucketStartAt: '2026-09-01T00:00:00.000Z', passedClean: 100, flaky: 5, failed: 10 },
+];
+
+const insightsResponse: any = {
+  __typename: 'App',
+  id: 'app-1',
+  fullName: '@acme/app',
+  workflowDeviceTestCaseInsights: {
+    totals,
+    timeSeries,
+    tests: {
+      edges: [
+        {
+          node: {
+            path: 'flows/login.yaml',
+            name: 'Login',
+            totalRuns: 120,
+            passedCleanCount: 100,
+            flakyCount: 8,
+            failedCount: 12,
+            avgDurationMs: 40000,
+            p90DurationMs: 70000,
+            lastRunAt: '2026-09-02T10:30:00.000Z',
+            lastRunStatus: WorkflowDeviceTestCaseStatus.Failed,
+            lastRunIsFlaky: false,
+          },
+        },
+      ],
+      pageInfo: { hasNextPage: false },
+      totalCount: 1,
+    },
+  },
+};
+
+const historyResponse: any = {
+  __typename: 'App',
+  id: 'app-1',
+  fullName: '@acme/app',
+  workflowDeviceTestCaseHistory: {
+    totals,
+    timeSeries,
+    errorPatterns: [
+      {
+        sampleMessage: 'Element not found',
+        count: 7,
+      },
+    ],
+    recentRuns: {
+      edges: [
+        {
+          node: {
+            id: 'r1',
+            status: WorkflowDeviceTestCaseStatus.Failed,
+            durationMs: 41000,
+            isFlaky: false,
+            createdAt: '2026-09-02T10:30:00.000Z',
+            workflowRunId: 'wr-1',
+            workflowRunName: 'E2E #42',
+            gitRef: 'refs/heads/main',
+            commitSha: 'abcdef1234567',
+          },
+        },
+      ],
+      pageInfo: { hasNextPage: false },
+      totalCount: 1,
+    },
+  },
+};
+
+describe(WorkflowInsightsMaestro, () => {
+  const graphqlClient = {} as ExpoGraphqlClient;
+  const mockConfig = getMockOclifConfig();
+  const now = new Date('2026-09-08T12:00:00.000Z');
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    jest.useFakeTimers({ now });
+    mockInsightsByAppIdAsync.mockResolvedValue(insightsResponse);
+    mockHistoryByAppIdAsync.mockResolvedValue(historyResponse);
+    mockByIdWorkflowFileNamesAsync.mockResolvedValue([
+      { id: 'id-of-e2e.yml', fileName: 'e2e.yml' },
+    ]);
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+  });
+
+  function createCommand(argv: string[]): {
+    command: WorkflowInsightsMaestro;
+    getContextAsync: jest.SpyInstance;
+  } {
+    const command = new WorkflowInsightsMaestro(argv, mockConfig);
+    const getContextAsync = jest
+      .spyOn(command as any, 'getContextAsync')
+      .mockImplementation(async (_commandClass: any, { projectIdOverride }: any) => ({
+        projectId: projectIdOverride ?? 'app-1',
+        loggedIn: { graphqlClient },
+      }));
+    return { command, getContextAsync };
+  }
+
+  it('queries the overview for the last 7 days sorted by fails with the default limit', async () => {
+    const { command } = createCommand([]);
+    await command.runAsync();
+
+    expect(mockInsightsByAppIdAsync).toHaveBeenCalledWith(graphqlClient, {
+      appId: 'app-1',
+      startTime: '2026-09-01T00:00:00.000Z',
+      endTime: '2026-09-09T00:00:00.000Z',
+      filters: undefined,
+      granularity: 'DAY',
+      sortField: 'FAILS',
+      sortDirection: 'DESC',
+      search: undefined,
+      first: 50,
+    });
+    expect(mockHistoryByAppIdAsync).not.toHaveBeenCalled();
+  });
+
+  it('passes filters, search, sort, and limit to the server', async () => {
+    const { command } = createCommand([
+      '--workflow',
+      'e2e.yml',
+      '--status',
+      'PASSED',
+      '--status',
+      'FLAKY',
+      '--tag',
+      'smoke',
+      '--git-ref',
+      'main',
+      '--search',
+      'login',
+      '--sort',
+      'pass-rate',
+      '--sort-direction',
+      'asc',
+      '--limit',
+      '10',
+    ]);
+    await command.runAsync();
+
+    expect(mockByIdWorkflowFileNamesAsync).toHaveBeenCalledWith(graphqlClient, 'app-1');
+    expect(mockInsightsByAppIdAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      expect.objectContaining({
+        filters: {
+          workflowIds: ['id-of-e2e.yml'],
+          statuses: ['PASSED_CLEAN', 'FLAKY'],
+          tags: ['smoke'],
+          gitRefs: ['refs/heads/main'],
+        },
+        search: 'login',
+        sortField: 'PASS_RATE',
+        sortDirection: 'ASC',
+        first: 10,
+      })
+    );
+  });
+
+  it('queries one flow history with --flow, keeping only the workflow and git ref filters', async () => {
+    const { command } = createCommand([
+      '--flow',
+      'flows/login.yaml',
+      '--workflow',
+      'e2e.yml',
+      '--git-ref',
+      'main',
+    ]);
+    await command.runAsync();
+
+    expect(mockHistoryByAppIdAsync).toHaveBeenCalledWith(graphqlClient, {
+      appId: 'app-1',
+      path: 'flows/login.yaml',
+      startTime: '2026-09-01T00:00:00.000Z',
+      endTime: '2026-09-09T00:00:00.000Z',
+      filters: { workflowIds: ['id-of-e2e.yml'], gitRefs: ['refs/heads/main'] },
+      granularity: 'DAY',
+      errorPatternsFirst: 5,
+      recentRunsFirst: 50,
+    });
+    expect(mockInsightsByAppIdAsync).not.toHaveBeenCalled();
+  });
+
+  it('rejects overview-only flags together with --flow', async () => {
+    const { command } = createCommand(['--flow', 'flows/login.yaml', '--status', 'FAILED']);
+    await expect(command.runAsync()).rejects.toThrow();
+    expect(mockHistoryByAppIdAsync).not.toHaveBeenCalled();
+  });
+
+  it('rejects unknown statuses', async () => {
+    const { command } = createCommand(['--status', 'BROKEN']);
+    await expect(command.runAsync()).rejects.toThrow();
+  });
+
+  it('skips the project directory when --project-id is given', async () => {
+    const { command, getContextAsync } = createCommand(['--project-id', 'other-app']);
+    await command.runAsync();
+
+    expect(getContextAsync).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ projectIdOverride: 'other-app' })
+    );
+    expect(mockInsightsByAppIdAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      expect.objectContaining({ appId: 'other-app' })
+    );
+  });
+
+  it('emits the overview as JSON', async () => {
+    const { command } = createCommand(['--json', '--non-interactive']);
+    await command.runAsync();
+
+    expect(mockEnableJsonOutput).toHaveBeenCalled();
+    const json = mockPrintJsonOnlyOutput.mock.calls[0][0] as any;
+    expect(json.project).toBe('@acme/app');
+    expect(json.totals.passRatePercent).toEqual({ current: 90, previous: 90 });
+    expect(json.totals.avgDurationMs).toEqual({ current: 42100, previous: 45000 });
+    expect(json.flows[0].path).toBe('flows/login.yaml');
+    expect(json.sort).toEqual({ field: 'fails', direction: 'desc' });
+  });
+
+  it('emits a flow history as JSON', async () => {
+    const { command } = createCommand([
+      '--flow',
+      'flows/login.yaml',
+      '--json',
+      '--non-interactive',
+    ]);
+    await command.runAsync();
+
+    const json = mockPrintJsonOnlyOutput.mock.calls[0][0] as any;
+    expect(json.flow).toBe('flows/login.yaml');
+    expect(json.errorPatterns).toHaveLength(1);
+    expect(json.recentRuns[0].workflowRunId).toBe('wr-1');
+  });
+
+  it('turns a plan-gate rejection into a readable error', async () => {
+    const graphQLError = new GraphQLError(
+      'Maestro insights are not available for your current plan.',
+      null,
+      null,
+      null,
+      null,
+      null,
+      { errorCode: 'EAS_WORKFLOW_DEVICE_TEST_CASE_INSIGHTS_NOT_AVAILABLE' }
+    );
+    mockInsightsByAppIdAsync.mockRejectedValue(
+      new CombinedError({ graphQLErrors: [graphQLError] })
+    );
+
+    const { command } = createCommand([]);
+    await expect(command.runAsync()).rejects.toThrow(
+      'Maestro insights are not available for your current plan.'
+    );
+  });
+});

packages/eas-cli/src/commands/workflow/__tests__/insights.test.ts

@@ -0,0 +1,298 @@
+import { CombinedError } from '@urql/core';
+import { GraphQLError } from 'graphql';
+
+import { ExpoGraphqlClient } from '../../../commandUtils/context/contextUtils/createGraphqlClient';
+import { getMockOclifConfig } from '../../../__tests__/commands/utils';
+import { AppQuery } from '../../../graphql/queries/AppQuery';
+import { WorkflowsInsightsQuery } from '../../../graphql/queries/WorkflowsInsightsQuery';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../../utils/json';
+import WorkflowInsights from '../insights';
+
+jest.mock('../../../graphql/queries/WorkflowsInsightsQuery', () => ({
+  WorkflowsInsightsQuery: { byAppIdAsync: jest.fn() },
+}));
+jest.mock('../../../graphql/queries/AppQuery');
+jest.mock('../../../log');
+jest.mock('../../../utils/json');
+
+const mockByAppIdAsync = jest.mocked(WorkflowsInsightsQuery.byAppIdAsync);
+const mockByIdWorkflowFileNamesAsync = jest.mocked(AppQuery.byIdWorkflowFileNamesAsync);
+const mockEnableJsonOutput = jest.mocked(enableJsonOutput);
+const mockPrintJsonOnlyOutput = jest.mocked(printJsonOnlyOutput);
+
+function metric(currentValue: number, previousValue: number): any {
+  return { __typename: 'WorkflowsInsightsMetric', currentValue, previousValue };
+}
+
+const workflows = [{ __typename: 'Workflow', id: 'wf-build', fileName: 'build.yml' }];
+
+const appResponse: any = {
+  __typename: 'App',
+  id: 'app-1',
+  fullName: '@acme/app',
+  workflows,
+  workflowsInsights: {
+    __typename: 'AppWorkflowsInsights',
+    overviewMetrics: {
+      __typename: 'WorkflowsInsightsOverviewMetrics',
+      totalRuns: metric(100, 80),
+      successfulRuns: metric(75, 64),
+      failedRuns: metric(20, 10),
+      activeWorkflows: metric(3, 3),
+    },
+    runsOverTime: {
+      __typename: 'WorkflowsInsightsRunsOverTimeData',
+      lineChart: {
+        __typename: 'LineChartData',
+        labels: ['2026-09-01T00:00:00.000Z'],
+        datasets: [
+          { id: 'WorkflowsInsightsRunsOverTimeDataset:total', label: 'Total Runs', data: [100] },
+          {
+            id: 'WorkflowsInsightsRunsOverTimeDataset:success',
+            data: [75],
+          },
+          { id: 'WorkflowsInsightsRunsOverTimeDataset:failure', label: 'Failed Runs', data: [20] },
+          {
+            id: 'WorkflowsInsightsRunsOverTimeDataset:canceled',
+            data: [5],
+          },
+        ],
+      },
+    },
+    workflows: {
+      __typename: 'WorkflowsInsightsWorkflowConnection',
+      edges: [
+        {
+          __typename: 'WorkflowsInsightsWorkflowEdge',
+          node: {
+            __typename: 'WorkflowsInsightsWorkflowNode',
+            workflowId: 'wf-build',
+            name: 'Build',
+            totalRuns: 100,
+            successfulRuns: 75,
+            failedRuns: 20,
+            canceledRuns: 5,
+            lastRunAt: '2026-09-01T10:00:00.000Z',
+          },
+        },
+      ],
+      pageInfo: { __typename: 'PageInfo', hasNextPage: false },
+    },
+  },
+};
+
+describe(WorkflowInsights, () => {
+  const graphqlClient = {} as ExpoGraphqlClient;
+  const mockConfig = getMockOclifConfig();
+  const now = new Date('2026-09-08T12:00:00.000Z');
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    jest.useFakeTimers({ now });
+    mockByAppIdAsync.mockResolvedValue(appResponse);
+    mockByIdWorkflowFileNamesAsync.mockResolvedValue(workflows);
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+  });
+
+  function createCommand(argv: string[]): {
+    command: WorkflowInsights;
+    getContextAsync: jest.SpyInstance;
+  } {
+    const command = new WorkflowInsights(argv, mockConfig);
+    const getContextAsync = jest
+      .spyOn(command as any, 'getContextAsync')
+      .mockImplementation(async (_commandClass: any, { projectIdOverride }: any) => ({
+        projectId: projectIdOverride ?? 'app-1',
+        loggedIn: { graphqlClient },
+      }));
+    return { command, getContextAsync };
+  }
+
+  it('queries the last 7 days by whole days with no filters and the default limit', async () => {
+    const { command } = createCommand([]);
+    await command.runAsync();
+
+    expect(mockByAppIdAsync).toHaveBeenCalledWith(graphqlClient, {
+      appId: 'app-1',
+      startTime: '2026-09-01T00:00:00.000Z',
+      endTime: '2026-09-09T00:00:00.000Z',
+      filters: undefined,
+      granularity: 'DAY',
+      first: 50,
+    });
+  });
+
+  it('picks hourly buckets for --days 1 and per-minute buckets for a short explicit range', async () => {
+    const { command: dayCommand } = createCommand(['--days', '1']);
+    await dayCommand.runAsync();
+    expect(mockByAppIdAsync).toHaveBeenLastCalledWith(
+      graphqlClient,
+      expect.objectContaining({ startTime: '2026-09-07T12:00:00.000Z', granularity: 'HOUR' })
+    );
+
+    const { command: rangeCommand } = createCommand([
+      '--start',
+      '2026-09-08T10:00:00.000Z',
+      '--end',
+      '2026-09-08T11:00:00.000Z',
+    ]);
+    await rangeCommand.runAsync();
+    expect(mockByAppIdAsync).toHaveBeenLastCalledWith(
+      graphqlClient,
+      expect.objectContaining({
+        startTime: '2026-09-08T10:00:00.000Z',
+        endTime: '2026-09-08T11:00:00.000Z',
+        granularity: 'MINUTE',
+      })
+    );
+  });
+
+  // Four days is exactly the longest window the server accepts hourly buckets for, so widening
+  // to whole hours would push it past that limit.
+  it('drops --days 4 to whole days when the clock is not on the hour', async () => {
+    jest.setSystemTime(new Date('2026-09-08T12:20:30.000Z'));
+    const { command } = createCommand(['--days', '4']);
+    await command.runAsync();
+
+    expect(mockByAppIdAsync).toHaveBeenLastCalledWith(
+      graphqlClient,
+      expect.objectContaining({
+        startTime: '2026-09-04T00:00:00.000Z',
+        endTime: '2026-09-09T00:00:00.000Z',
+        granularity: 'DAY',
+      })
+    );
+  });
+
+  // --json redirects stdout by swapping process.stdout.write, so it has to be in place before
+  // anything that can log — including the error this range triggers.
+  it('rejects a backwards explicit range after enabling JSON output and before resolving context', async () => {
+    const { command, getContextAsync } = createCommand([
+      '--json',
+      '--non-interactive',
+      '--start',
+      '2026-09-08T11:00:45.000Z',
+      '--end',
+      '2026-09-08T11:00:15.000Z',
+    ]);
+    await expect(command.runAsync()).rejects.toThrow(/requested time range is empty/);
+    expect(mockEnableJsonOutput).toHaveBeenCalled();
+    expect(getContextAsync).not.toHaveBeenCalled();
+    expect(mockByAppIdAsync).not.toHaveBeenCalled();
+  });
+
+  it('rejects --end without --start', async () => {
+    const { command } = createCommand(['--end', '2026-09-08T11:00:00.000Z']);
+    await expect(command.runAsync()).rejects.toThrow(/--end requires --start/);
+    expect(mockByAppIdAsync).not.toHaveBeenCalled();
+  });
+
+  it('rejects --days combined with --start', async () => {
+    const { command } = createCommand(['--days', '7', '--start', '2026-09-01T00:00:00.000Z']);
+    await expect(command.runAsync()).rejects.toThrow();
+  });
+
+  it('resolves workflow file names and passes the other filters to the server', async () => {
+    const { command } = createCommand([
+      '--workflow',
+      'build.yml',
+      '--status',
+      'FAILURE',
+      '--status',
+      'CANCELED',
+      '--trigger',
+      'GITHUB_PUSH',
+      '--git-ref',
+      'main',
+    ]);
+    await command.runAsync();
+
+    expect(mockByIdWorkflowFileNamesAsync).toHaveBeenCalledWith(graphqlClient, 'app-1');
+    expect(mockByAppIdAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      expect.objectContaining({
+        filters: {
+          workflowIds: ['wf-build'],
+          statuses: ['FAILURE', 'CANCELED'],
+          triggerEventTypes: ['GITHUB_PUSH'],
+          gitRefRequested: ['refs/heads/main'],
+        },
+      })
+    );
+  });
+
+  it('only accepts finished-run statuses', async () => {
+    const { command } = createCommand(['--status', 'IN_PROGRESS']);
+    await expect(command.runAsync()).rejects.toThrow();
+    expect(mockByAppIdAsync).not.toHaveBeenCalled();
+  });
+
+  it('skips the project directory when --project-id is given', async () => {
+    const { command, getContextAsync } = createCommand(['--project-id', 'other-app']);
+    await command.runAsync();
+
+    expect(getContextAsync).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ projectIdOverride: 'other-app' })
+    );
+    expect(mockByAppIdAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      expect.objectContaining({ appId: 'other-app' })
+    );
+  });
+
+  it('rejects a non-integer --limit before querying', async () => {
+    const { command } = createCommand(['--limit', '1.5']);
+    await expect(command.runAsync()).rejects.toThrow(/as an integer/);
+    expect(mockByAppIdAsync).not.toHaveBeenCalled();
+  });
+
+  it('passes --limit through as the page size', async () => {
+    const { command } = createCommand(['--limit', '10']);
+    await command.runAsync();
+
+    expect(mockByAppIdAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      expect.objectContaining({ first: 10 })
+    );
+  });
+
+  it('emits JSON when --json is passed', async () => {
+    const { command } = createCommand(['--json', '--non-interactive']);
+    await command.runAsync();
+
+    expect(mockEnableJsonOutput).toHaveBeenCalled();
+    const json = mockPrintJsonOnlyOutput.mock.calls[0][0] as any;
+    expect(json.project).toBe('@acme/app');
+    expect(json.timespan).toEqual({
+      start: '2026-09-01T00:00:00.000Z',
+      end: '2026-09-09T00:00:00.000Z',
+    });
+    expect(json.overview.totalRuns).toEqual({ current: 100, previous: 80 });
+    expect(json.overview.successRatePercent).toEqual({ current: 75, previous: 80 });
+    expect(json.runsOverTime.granularity).toBe('DAY');
+    expect(json.workflows[0].name).toBe('Build');
+    expect(json.workflows[0].fileName).toBe('build.yml');
+  });
+
+  it('turns a plan-gate rejection into a readable error with the plan limit', async () => {
+    const graphQLError = new GraphQLError(
+      'The selected timeframe exceeds the supported range for workflow insights.',
+      null,
+      null,
+      null,
+      null,
+      null,
+      { errorCode: 'EAS_WORKFLOWS_INSIGHTS_TIMESPAN_LIMIT_EXCEEDED', metadata: { limitDays: 30 } }
+    );
+    mockByAppIdAsync.mockRejectedValue(new CombinedError({ graphQLErrors: [graphQLError] }));
+
+    const { command } = createCommand(['--days', '90']);
+    await expect(command.runAsync()).rejects.toThrow(
+      'The selected timeframe exceeds the supported range for workflow insights. Your plan includes the last 30 days.'
+    );
+  });
+});

packages/eas-cli/src/commands/workflow/insights/index.ts

@@ -0,0 +1,110 @@
+import { Flags } from '@oclif/core';
+
+import EasCommand from '../../../commandUtils/EasCommand';
+import {
+  EasNonInteractiveAndJsonFlags,
+  EasProjectIdFlag,
+  resolveNonInteractiveAndJsonFlags,
+} from '../../../commandUtils/flags';
+import { getLimitFlagWithCustomValues } from '../../../commandUtils/pagination';
+import { WorkflowRunTriggerEventType } from '../../../graphql/generated';
+import { WorkflowsInsightsQuery } from '../../../graphql/queries/WorkflowsInsightsQuery';
+import { InsightsTimeRangeFlags, resolveInsightsTimeRange } from '../../../insights/timeRange';
+import Log from '../../../log';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../../utils/json';
+import {
+  INSIGHTS_RUN_STATUSES,
+  WorkflowsInsightsSharedFilterFlags,
+  getAppliedWorkflowsInsightsFilters,
+  resolveWorkflowsInsightsFiltersInputAsync,
+} from '../../../workflow/insights/filters';
+import {
+  buildWorkflowsInsightsJson,
+  buildWorkflowsInsightsTable,
+  toWorkflowsInsightsSummary,
+} from '../../../workflow/insights/formatInsights';
+import { alignInsightsTimespan } from '../../../workflow/insights/granularity';
+import { withInsightsPlanGateHandlingAsync } from '../../../workflow/insights/planGating';
+
+const DEFAULT_WORKFLOWS_LIMIT = 50;
+const MAX_WORKFLOWS_LIMIT = 100;
+
+export default class WorkflowInsights extends EasCommand {
+  static override description =
+    'display run counts, success rate, and per-workflow trends for a time range';
+
+  static override flags = {
+    ...WorkflowsInsightsSharedFilterFlags,
+    status: Flags.option({
+      description: 'Only include runs with this status (can be specified multiple times).',
+      options: INSIGHTS_RUN_STATUSES,
+      multiple: true,
+    })(),
+    trigger: Flags.option({
+      description: 'Only include runs started by this trigger (can be specified multiple times).',
+      options: Object.values(WorkflowRunTriggerEventType),
+      multiple: true,
+    })(),
+    ...InsightsTimeRangeFlags,
+    limit: getLimitFlagWithCustomValues({
+      defaultTo: DEFAULT_WORKFLOWS_LIMIT,
+      limit: MAX_WORKFLOWS_LIMIT,
+      description: `The number of workflows to list. Defaults to ${DEFAULT_WORKFLOWS_LIMIT} and is capped at ${MAX_WORKFLOWS_LIMIT}.`,
+    }),
+    ...EasProjectIdFlag,
+    ...EasNonInteractiveAndJsonFlags,
+  };
+
+  static override contextDefinition = {
+    ...this.ContextOptions.ProjectId,
+    ...this.ContextOptions.LoggedIn,
+  };
+
+  async runAsync(): Promise<void> {
+    const { flags } = await this.parse(WorkflowInsights);
+    const { json, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
+
+    if (json) {
+      enableJsonOutput();
+    }
+
+    const { timespan, granularity } = alignInsightsTimespan(resolveInsightsTimeRange(flags));
+
+    const {
+      projectId,
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(WorkflowInsights, {
+      nonInteractive,
+      projectIdOverride: flags['project-id'],
+    });
+
+    const filters = await resolveWorkflowsInsightsFiltersInputAsync(
+      graphqlClient,
+      projectId,
+      flags
+    );
+    const app = await withInsightsPlanGateHandlingAsync(() =>
+      WorkflowsInsightsQuery.byAppIdAsync(graphqlClient, {
+        appId: projectId,
+        startTime: timespan.startTime,
+        endTime: timespan.endTime,
+        filters,
+        granularity,
+        first: flags.limit ?? DEFAULT_WORKFLOWS_LIMIT,
+      })
+    );
+
+    const summary = toWorkflowsInsightsSummary(app, {
+      timespan,
+      granularity,
+      filters: getAppliedWorkflowsInsightsFilters(flags),
+    });
+
+    if (json) {
+      printJsonOnlyOutput(buildWorkflowsInsightsJson(summary));
+    } else {
+      Log.addNewLineIfNone();
+      Log.log(buildWorkflowsInsightsTable(summary));
+    }
+  }
+}

packages/eas-cli/src/commands/workflow/insights/maestro.ts

@@ -0,0 +1,179 @@
+import { Flags } from '@oclif/core';
+
+import EasCommand from '../../../commandUtils/EasCommand';
+import {
+  EasNonInteractiveAndJsonFlags,
+  EasProjectIdFlag,
+  resolveNonInteractiveAndJsonFlags,
+} from '../../../commandUtils/flags';
+import { getLimitFlagWithCustomValues } from '../../../commandUtils/pagination';
+import { WorkflowDeviceTestCaseInsightsQuery } from '../../../graphql/queries/WorkflowDeviceTestCaseInsightsQuery';
+import { InsightsTimeRangeFlags, resolveInsightsTimeRange } from '../../../insights/timeRange';
+import Log from '../../../log';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../../utils/json';
+import { WorkflowsInsightsSharedFilterFlags } from '../../../workflow/insights/filters';
+import {
+  buildMaestroFlowHistoryJson,
+  buildMaestroFlowHistoryTable,
+  buildMaestroInsightsJson,
+  buildMaestroInsightsTable,
+  toMaestroFlowHistorySummary,
+  toMaestroInsightsSummary,
+} from '../../../workflow/insights/formatMaestroInsights';
+import { alignMaestroInsightsTimespan } from '../../../workflow/insights/granularity';
+import {
+  MAESTRO_STATUS_OPTIONS,
+  getAppliedMaestroInsightsFilters,
+  resolveMaestroHistoryFiltersInputAsync,
+  resolveMaestroInsightsFiltersInputAsync,
+} from '../../../workflow/insights/maestroFilters';
+import {
+  MAESTRO_SORT_DIRECTIONS,
+  MAESTRO_SORT_OPTIONS,
+  SORT_DIRECTION_BY_OPTION,
+  SORT_FIELD_BY_OPTION,
+} from '../../../workflow/insights/maestroSort';
+import { withInsightsPlanGateHandlingAsync } from '../../../workflow/insights/planGating';
+
+const DEFAULT_LIMIT = 50;
+const MAX_LIMIT = 100;
+const ERROR_PATTERNS_LIMIT = 5;
+
+// These only shape the flows table, so they cannot be combined with a single flow's history.
+const OVERVIEW_ONLY_FLAGS = ['status', 'tag', 'search', 'sort', 'sort-direction'];
+
+export default class WorkflowInsightsMaestro extends EasCommand {
+  static override description =
+    "display Maestro test insights for a time range: pass and flake rates, per-flow stats, and a single flow's history";
+
+  static override flags = {
+    ...WorkflowsInsightsSharedFilterFlags,
+    status: Flags.option({
+      description:
+        'Only include flow runs with this status (can be specified multiple times). PASSED means passed on the first attempt.',
+      options: MAESTRO_STATUS_OPTIONS,
+      multiple: true,
+      exclusive: ['flow'],
+    })(),
+    tag: Flags.string({
+      description: 'Only include flow runs with this tag (can be specified multiple times).',
+      multiple: true,
+      exclusive: ['flow'],
+    }),
+    search: Flags.string({
+      description: 'Only list flows whose path contains this text.',
+      exclusive: ['flow'],
+    }),
+    sort: Flags.option({
+      description: 'Sort the flows table by this column.',
+      options: MAESTRO_SORT_OPTIONS,
+      default: 'fails',
+      exclusive: ['flow'],
+    })(),
+    'sort-direction': Flags.option({
+      description: 'Sort direction for the flows table.',
+      options: MAESTRO_SORT_DIRECTIONS,
+      default: 'desc',
+      exclusive: ['flow'],
+    })(),
+    flow: Flags.string({
+      description: `Show one flow's history instead of the overview, by flow path. Cannot be combined with ${OVERVIEW_ONLY_FLAGS.map(
+        flag => `--${flag}`
+      ).join(', ')}.`,
+      exclusive: OVERVIEW_ONLY_FLAGS,
+    }),
+    ...InsightsTimeRangeFlags,
+    limit: getLimitFlagWithCustomValues({
+      defaultTo: DEFAULT_LIMIT,
+      limit: MAX_LIMIT,
+      description: `The number of flows to list, or of recent runs with --flow. Defaults to ${DEFAULT_LIMIT} and is capped at ${MAX_LIMIT}.`,
+    }),
+    ...EasProjectIdFlag,
+    ...EasNonInteractiveAndJsonFlags,
+  };
+
+  static override contextDefinition = {
+    ...this.ContextOptions.ProjectId,
+    ...this.ContextOptions.LoggedIn,
+  };
+
+  async runAsync(): Promise<void> {
+    const { flags } = await this.parse(WorkflowInsightsMaestro);
+    const { json, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
+
+    if (json) {
+      enableJsonOutput();
+    }
+
+    const { timespan, granularity } = alignMaestroInsightsTimespan(resolveInsightsTimeRange(flags));
+
+    const {
+      projectId,
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(WorkflowInsightsMaestro, {
+      nonInteractive,
+      projectIdOverride: flags['project-id'],
+    });
+
+    const appliedFilters = getAppliedMaestroInsightsFilters(flags);
+    const limit = flags.limit ?? DEFAULT_LIMIT;
+
+    if (flags.flow !== undefined) {
+      const flowPath = flags.flow;
+      const filters = await resolveMaestroHistoryFiltersInputAsync(graphqlClient, projectId, flags);
+      const app = await withInsightsPlanGateHandlingAsync(() =>
+        WorkflowDeviceTestCaseInsightsQuery.historyByAppIdAsync(graphqlClient, {
+          appId: projectId,
+          path: flowPath,
+          startTime: timespan.startTime,
+          endTime: timespan.endTime,
+          filters,
+          granularity,
+          errorPatternsFirst: ERROR_PATTERNS_LIMIT,
+          recentRunsFirst: limit,
+        })
+      );
+      const summary = toMaestroFlowHistorySummary(app, {
+        flowPath,
+        timespan,
+        granularity,
+        filters: appliedFilters,
+      });
+      if (json) {
+        printJsonOnlyOutput(buildMaestroFlowHistoryJson(summary));
+      } else {
+        Log.addNewLineIfNone();
+        Log.log(buildMaestroFlowHistoryTable(summary));
+      }
+      return;
+    }
+
+    const filters = await resolveMaestroInsightsFiltersInputAsync(graphqlClient, projectId, flags);
+    const sort = { field: flags.sort, direction: flags['sort-direction'] };
+    const app = await withInsightsPlanGateHandlingAsync(() =>
+      WorkflowDeviceTestCaseInsightsQuery.insightsByAppIdAsync(graphqlClient, {
+        appId: projectId,
+        startTime: timespan.startTime,
+        endTime: timespan.endTime,
+        filters,
+        granularity,
+        sortField: SORT_FIELD_BY_OPTION[sort.field],
+        sortDirection: SORT_DIRECTION_BY_OPTION[sort.direction],
+        search: flags.search,
+        first: limit,
+      })
+    );
+    const summary = toMaestroInsightsSummary(app, {
+      timespan,
+      granularity,
+      filters: appliedFilters,
+      sort,
+    });
+    if (json) {
+      printJsonOnlyOutput(buildMaestroInsightsJson(summary));
+    } else {
+      Log.addNewLineIfNone();
+      Log.log(buildMaestroInsightsTable(summary));
+    }
+  }
+}

packages/eas-cli/src/credentials/ios/credentials.ts

@@ -105,7 +105,8 @@ export const distributionCertificateSchema: CredentialSchema<DistributionCertifi
 export type MinimalAscApiKey = {
   keyP8: string;
   keyId: string;
-  issuerId: string;
+  // Absent for individual API keys, which are valid only for submissions.
+  issuerId?: string;
   teamId?: string;
   teamName?: string;
   roles?: UserRole[];
@@ -115,7 +116,7 @@ export type MinimalAscApiKey = {
 export interface AscApiKeyPath {
   keyP8Path: string;
   keyId: string;
-  issuerId: string;
+  issuerId?: string;
 }
 
 export const ascApiKeyIdSchema: CredentialSchema<Pick<MinimalAscApiKey, 'keyId'>> = {
@@ -129,7 +130,7 @@ export const ascApiKeyIdSchema: CredentialSchema<Pick<MinimalAscApiKey, 'keyId'>
   ],
 };
 
-export const ascApiKeyIssuerIdSchema: CredentialSchema<Pick<MinimalAscApiKey, 'issuerId'>> = {
+export const ascApiKeyIssuerIdSchema: CredentialSchema<{ issuerId: string }> = {
   name: 'App Store Connect API Key',
   questions: [
     {

packages/eas-cli/src/credentials/ios/utils/printCredentials.ts

@@ -246,7 +246,11 @@ function displayAscApiKey(
     if (name) {
       fields.push({ label: 'Name', value: name });
     }
-    fields.push({ label: 'Issuer ID', value: issuerIdentifier });
+    if (issuerIdentifier) {
+      fields.push({ label: 'Issuer ID', value: issuerIdentifier });
+    } else {
+      fields.push({ label: 'Key Type', value: 'Individual (submissions only)' });
+    }
     if (roles) {
       fields.push({ label: 'Roles', value: roles.join(',') });
     }

packages/eas-cli/src/graphql/queries/AppQuery.ts

@@ -9,6 +9,7 @@ import {
   AppByFullNameQuery,
   AppByIdProfileImageUrlQuery,
   AppByIdQuery,
+  AppByIdWorkflowFileNamesQuery,
   AppByIdWorkflowRunsFilteredByStatusQuery,
   AppByIdWorkflowsQuery,
   AppFragment,
@@ -131,6 +132,34 @@ export const AppQuery = {
     assert(data.app, 'GraphQL: `app` not defined in server response');
     return data.app.byId.workflows;
   },
+  async byIdWorkflowFileNamesAsync(
+    graphqlClient: ExpoGraphqlClient,
+    appId: string
+  ): Promise<{ id: string; fileName: string }[]> {
+    const data = await withErrorHandlingAsync(
+      graphqlClient
+        .query<AppByIdWorkflowFileNamesQuery>(
+          gql`
+            query AppByIdWorkflowFileNamesQuery($appId: String!) {
+              app {
+                byId(appId: $appId) {
+                  id
+                  workflows {
+                    id
+                    fileName
+                  }
+                }
+              }
+            }
+          `,
+          { appId },
+          { additionalTypenames: ['App', 'Workflow'] }
+        )
+        .toPromise()
+    );
+    assert(data.app, 'GraphQL: `app` not defined in server response');
+    return data.app.byId.workflows;
+  },
   async byIdWorkflowRunsFilteredByStatusAsync(
     graphqlClient: ExpoGraphqlClient,
     appId: string,

packages/eas-cli/src/graphql/queries/AppStoreConnectApiKeyQuery.ts

@@ -12,7 +12,7 @@ export const AppStoreConnectApiKeyQuery = {
     graphqlClient: ExpoGraphqlClient,
     ascApiKeyId: string
   ): Promise<{
-    issuerIdentifier: string;
+    issuerIdentifier: string | undefined;
     keyIdentifier: string;
     keyP8: string;
   }> {
@@ -42,7 +42,7 @@ export const AppStoreConnectApiKeyQuery = {
     const key = data.appStoreConnectApiKey.byId;
 
     return {
-      issuerIdentifier: key.issuerIdentifier,
+      issuerIdentifier: key.issuerIdentifier ?? undefined,
       keyIdentifier: key.keyIdentifier,
       keyP8: key.keyP8,
     };

packages/eas-cli/src/graphql/queries/DeviceRunSessionQuery.ts

@@ -87,22 +87,47 @@ export const DeviceRunSessionQuery = {
                       agentDeviceRemoteSessionUrl
                       agentDeviceRemoteSessionToken
                       webPreviewUrl
+                      webPreviewToken
+                      egressUrl
+                      egressToken
+                      egressFingerprint
+                      egressPort
                     }
                     ... on ArgentRunSessionRemoteConfig {
+                      egressUrl
+                      egressToken
+                      egressFingerprint
+                      egressPort
                       toolsUrl
                       toolsAuthToken
                       webPreviewUrl
+                      webPreviewToken
                     }
                     ... on AppiumRunSessionRemoteConfig {
+                      egressUrl
+                      egressToken
+                      egressFingerprint
+                      egressPort
                       appiumUrl
                       capabilities
                       webPreviewUrl
+                      webPreviewToken
                     }
                     ... on ServeSimRunSessionRemoteConfig {
+                      egressUrl
+                      egressToken
+                      egressFingerprint
+                      egressPort
                       previewUrl
+                      previewToken
                     }
                     ... on WebPreviewOnlyRunSessionRemoteConfig {
+                      egressUrl
+                      egressToken
+                      egressFingerprint
+                      egressPort
                       previewUrl: webPreviewUrl
+                      previewToken: webPreviewToken
                     }
                   }
                   turtleJobRun {

packages/eas-cli/src/graphql/queries/ObserveQuery.ts

@@ -5,6 +5,10 @@ import { withErrorHandlingAsync } from '../client';
 import {
   AppObserveAppVersion,
   AppObserveError,
+  AppObserveErrorGroup,
+  AppObserveErrorOccurrencesFilter,
+  AppObserveErrorOccurrencesOrderBy,
+  AppObserveErrorsGroupsInput,
   AppObserveLogsOrderBy,
   AppObserveMetric,
   AppObserveMetricsListFilter,
@@ -24,6 +28,8 @@ import { print } from 'graphql';
 import {
   AppObserveAppVersionFragmentNode,
   AppObserveErrorFragmentNode,
+  AppObserveErrorGroupFragmentNode,
+  AppObserveErrorOccurrenceFragmentNode,
   AppObserveMetricFragmentNode,
   AppObserveUserEventFragmentNode,
 } from '../types/Observe';
@@ -156,6 +162,51 @@ type AppObserveNavigationRoutesQueryVariables = {
   orderBy?: AppObserveNavigationOrderBy;
 };
 
+type AppObserveErrorGroupsQuery = {
+  app: {
+    byId: {
+      id: string;
+      observe: {
+        errors: {
+          groups: {
+            isTruncated: boolean;
+            groups: AppObserveErrorGroup[];
+          };
+        };
+      };
+    };
+  };
+};
+
+type AppObserveErrorGroupsQueryVariables = {
+  appId: string;
+  input: AppObserveErrorsGroupsInput;
+};
+
+type AppObserveErrorOccurrencesQuery = {
+  app: {
+    byId: {
+      id: string;
+      observe: {
+        errors: {
+          occurrences: {
+            pageInfo: PageInfo;
+            edges: Array<{ cursor: string; node: AppObserveError }>;
+          };
+        };
+      };
+    };
+  };
+};
+
+type AppObserveErrorOccurrencesQueryVariables = {
+  appId: string;
+  filter: AppObserveErrorOccurrencesFilter;
+  first?: number;
+  after?: string;
+  orderBy?: AppObserveErrorOccurrencesOrderBy;
+};
+
 type AppObserveSessionEventsQuery = {
   app: {
     byId: {
@@ -185,6 +236,35 @@ type AppObserveSessionEventsQueryVariables = {
   logsOrderBy?: AppObserveLogsOrderBy;
 };
 
+type AppObserveMetricByIdQuery = {
+  app: {
+    byId: {
+      id: string;
+      observe: {
+        metrics: {
+          metric: AppObserveMetric | null;
+        };
+      };
+    };
+  };
+};
+
+type AppObserveLogByIdQuery = {
+  app: {
+    byId: {
+      id: string;
+      observe: {
+        log: AppObserveSessionLog | null;
+      };
+    };
+  };
+};
+
+type AppObserveByIdQueryVariables = {
+  appId: string;
+  id: string;
+};
+
 export const ObserveQuery = {
   async appVersionsAsync(
     graphqlClient: ExpoGraphqlClient,
@@ -466,6 +546,99 @@ export const ObserveQuery = {
     };
   },
 
+  async errorGroupsAsync(
+    graphqlClient: ExpoGraphqlClient,
+    { appId, input }: { appId: string; input: AppObserveErrorsGroupsInput }
+  ): Promise<{ groups: AppObserveErrorGroup[]; isTruncated: boolean }> {
+    const data = await withErrorHandlingAsync(
+      graphqlClient
+        .query<AppObserveErrorGroupsQuery, AppObserveErrorGroupsQueryVariables>(
+          gql`
+            query AppObserveErrorGroups($appId: String!, $input: AppObserveErrorsGroupsInput!) {
+              app {
+                byId(appId: $appId) {
+                  id
+                  observe {
+                    errors {
+                      groups(input: $input) {
+                        isTruncated
+                        groups {
+                          ...AppObserveErrorGroupFragment
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+            ${print(AppObserveErrorGroupFragmentNode)}
+          `,
+          { appId, input }
+        )
+        .toPromise()
+    );
+
+    return data.app.byId.observe.errors.groups;
+  },
+
+  async errorOccurrencesAsync(
+    graphqlClient: ExpoGraphqlClient,
+    variables: AppObserveErrorOccurrencesQueryVariables
+  ): Promise<{ occurrences: AppObserveError[]; pageInfo: PageInfo }> {
+    const data = await withErrorHandlingAsync(
+      graphqlClient
+        .query<AppObserveErrorOccurrencesQuery, AppObserveErrorOccurrencesQueryVariables>(
+          gql`
+            query AppObserveErrorOccurrences(
+              $appId: String!
+              $filter: AppObserveErrorOccurrencesFilter
+              $first: Int
+              $after: String
+              $orderBy: AppObserveErrorOccurrencesOrderBy
+            ) {
+              app {
+                byId(appId: $appId) {
+                  id
+                  observe {
+                    errors {
+                      occurrences(
+                        filter: $filter
+                        first: $first
+                        after: $after
+                        orderBy: $orderBy
+                      ) {
+                        pageInfo {
+                          hasNextPage
+                          hasPreviousPage
+                          endCursor
+                        }
+                        edges {
+                          cursor
+                          node {
+                            id
+                            ...AppObserveErrorOccurrenceFragment
+                          }
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+            ${print(AppObserveErrorOccurrenceFragmentNode)}
+          `,
+          variables
+        )
+        .toPromise()
+    );
+
+    const { edges, pageInfo } = data.app.byId.observe.errors.occurrences;
+    return {
+      occurrences: edges.map(edge => edge.node),
+      pageInfo,
+    };
+  },
+
   async sessionEventsAsync(
     graphqlClient: ExpoGraphqlClient,
     variables: AppObserveSessionEventsQueryVariables
@@ -546,4 +719,75 @@ export const ObserveQuery = {
       logsPageInfo: logs.pageInfo,
     };
   },
+
+  async metricByIdAsync(
+    graphqlClient: ExpoGraphqlClient,
+    { appId, id }: AppObserveByIdQueryVariables
+  ): Promise<AppObserveMetric | null> {
+    const data = await withErrorHandlingAsync(
+      graphqlClient
+        .query<AppObserveMetricByIdQuery, AppObserveByIdQueryVariables>(
+          gql`
+            query AppObserveMetricById($appId: String!, $id: ID!) {
+              app {
+                byId(appId: $appId) {
+                  id
+                  observe {
+                    metrics {
+                      metric(id: $id) {
+                        id
+                        ...AppObserveMetricFragment
+                      }
+                    }
+                  }
+                }
+              }
+            }
+            ${print(AppObserveMetricFragmentNode)}
+          `,
+          { appId, id }
+        )
+        .toPromise()
+    );
+
+    return data.app.byId.observe.metrics.metric ?? null;
+  },
+
+  async logByIdAsync(
+    graphqlClient: ExpoGraphqlClient,
+    { appId, id }: AppObserveByIdQueryVariables
+  ): Promise<AppObserveSessionLog | null> {
+    const data = await withErrorHandlingAsync(
+      graphqlClient
+        .query<AppObserveLogByIdQuery, AppObserveByIdQueryVariables>(
+          gql`
+            query AppObserveLogById($appId: String!, $id: ID!) {
+              app {
+                byId(appId: $appId) {
+                  id
+                  observe {
+                    log(id: $id) {
+                      id
+                      __typename
+                      ... on AppObserveUserEvent {
+                        ...AppObserveUserEventFragment
+                      }
+                      ... on AppObserveError {
+                        ...AppObserveErrorFragment
+                      }
+                    }
+                  }
+                }
+              }
+            }
+            ${print(AppObserveUserEventFragmentNode)}
+            ${print(AppObserveErrorFragmentNode)}
+          `,
+          { appId, id }
+        )
+        .toPromise()
+    );
+
+    return data.app.byId.observe.log ?? null;
+  },
 };

packages/eas-cli/src/graphql/queries/WorkflowDeviceTestCaseInsightsQuery.ts

@@ -0,0 +1,256 @@
+import gql from 'graphql-tag';
+
+import { ExpoGraphqlClient } from '../../commandUtils/context/contextUtils/createGraphqlClient';
+import { withUpgradeRequiredErrorHandlingAsync } from '../client';
+import {
+  WorkflowDeviceTestCaseHistoryByAppIdQuery,
+  WorkflowDeviceTestCaseHistoryByAppIdQueryVariables,
+  WorkflowDeviceTestCaseHistoryFiltersInput,
+  WorkflowDeviceTestCaseInsightsByAppIdQuery,
+  WorkflowDeviceTestCaseInsightsByAppIdQueryVariables,
+  WorkflowDeviceTestCaseInsightsFiltersInput,
+  WorkflowDeviceTestCaseInsightsTimeSeriesGranularity,
+  WorkflowDeviceTestCaseSortDirection,
+  WorkflowDeviceTestCaseStatSortField,
+} from '../generated';
+
+export type AppWithMaestroInsightsObject =
+  WorkflowDeviceTestCaseInsightsByAppIdQuery['app']['byId'];
+export type AppWithMaestroFlowHistoryObject =
+  WorkflowDeviceTestCaseHistoryByAppIdQuery['app']['byId'];
+
+const FEATURE_NAME = 'EAS Maestro insights';
+
+export const WorkflowDeviceTestCaseInsightsQuery = {
+  async insightsByAppIdAsync(
+    graphqlClient: ExpoGraphqlClient,
+    {
+      appId,
+      startTime,
+      endTime,
+      filters,
+      granularity,
+      sortField,
+      sortDirection,
+      search,
+      first,
+    }: {
+      appId: string;
+      startTime: string;
+      endTime: string;
+      filters?: WorkflowDeviceTestCaseInsightsFiltersInput;
+      granularity: WorkflowDeviceTestCaseInsightsTimeSeriesGranularity;
+      sortField: WorkflowDeviceTestCaseStatSortField;
+      sortDirection: WorkflowDeviceTestCaseSortDirection;
+      search?: string;
+      first: number;
+    }
+  ): Promise<AppWithMaestroInsightsObject> {
+    const data = await withUpgradeRequiredErrorHandlingAsync(
+      graphqlClient
+        .query<
+          WorkflowDeviceTestCaseInsightsByAppIdQuery,
+          WorkflowDeviceTestCaseInsightsByAppIdQueryVariables
+        >(
+          gql`
+            query WorkflowDeviceTestCaseInsightsByAppId(
+              $appId: String!
+              $timespan: WorkflowDeviceTestCaseInsightsTimespanInput!
+              $filters: WorkflowDeviceTestCaseInsightsFiltersInput
+              $granularity: WorkflowDeviceTestCaseInsightsTimeSeriesGranularity!
+              $sortField: WorkflowDeviceTestCaseStatSortField
+              $sortDirection: WorkflowDeviceTestCaseSortDirection
+              $search: String
+              $first: Int!
+            ) {
+              app {
+                byId(appId: $appId) {
+                  id
+                  fullName
+                  workflowDeviceTestCaseInsights(timespan: $timespan, filters: $filters) {
+                    totals {
+                      totalRuns {
+                        currentValue
+                        previousValue
+                      }
+                      passedCleanCount {
+                        currentValue
+                        previousValue
+                      }
+                      flakyCount {
+                        currentValue
+                        previousValue
+                      }
+                      distinctFlakyTestCount {
+                        currentValue
+                        previousValue
+                      }
+                      avgDurationMs {
+                        currentValue
+                        previousValue
+                      }
+                    }
+                    timeSeries(granularity: $granularity) {
+                      bucketStartAt
+                      passedClean
+                      flaky
+                      failed
+                    }
+                    tests(
+                      sortField: $sortField
+                      sortDirection: $sortDirection
+                      search: $search
+                      first: $first
+                    ) {
+                      edges {
+                        node {
+                          path
+                          name
+                          totalRuns
+                          passedCleanCount
+                          flakyCount
+                          failedCount
+                          p90DurationMs
+                          lastRunAt
+                          lastRunStatus
+                          lastRunIsFlaky
+                        }
+                      }
+                      pageInfo {
+                        hasNextPage
+                      }
+                      totalCount
+                    }
+                  }
+                }
+              }
+            }
+          `,
+          {
+            appId,
+            timespan: { start: startTime, end: endTime },
+            filters,
+            granularity,
+            sortField,
+            sortDirection,
+            search,
+            first,
+          },
+          { additionalTypenames: ['App', 'WorkflowDeviceTestCaseInsights'] }
+        )
+        .toPromise(),
+      { featureName: FEATURE_NAME }
+    );
+
+    return data.app.byId;
+  },
+
+  async historyByAppIdAsync(
+    graphqlClient: ExpoGraphqlClient,
+    {
+      appId,
+      path,
+      startTime,
+      endTime,
+      filters,
+      granularity,
+      errorPatternsFirst,
+      recentRunsFirst,
+    }: {
+      appId: string;
+      path: string;
+      startTime: string;
+      endTime: string;
+      filters?: WorkflowDeviceTestCaseHistoryFiltersInput;
+      granularity: WorkflowDeviceTestCaseInsightsTimeSeriesGranularity;
+      errorPatternsFirst: number;
+      recentRunsFirst: number;
+    }
+  ): Promise<AppWithMaestroFlowHistoryObject> {
+    const data = await withUpgradeRequiredErrorHandlingAsync(
+      graphqlClient
+        .query<
+          WorkflowDeviceTestCaseHistoryByAppIdQuery,
+          WorkflowDeviceTestCaseHistoryByAppIdQueryVariables
+        >(
+          gql`
+            query WorkflowDeviceTestCaseHistoryByAppId(
+              $appId: String!
+              $path: String!
+              $timespan: WorkflowDeviceTestCaseInsightsTimespanInput!
+              $filters: WorkflowDeviceTestCaseHistoryFiltersInput
+              $granularity: WorkflowDeviceTestCaseInsightsTimeSeriesGranularity!
+              $errorPatternsFirst: Int!
+              $recentRunsFirst: Int!
+            ) {
+              app {
+                byId(appId: $appId) {
+                  id
+                  fullName
+                  workflowDeviceTestCaseHistory(path: $path, timespan: $timespan, filters: $filters) {
+                    totals {
+                      totalRuns {
+                        currentValue
+                      }
+                      passedCleanCount {
+                        currentValue
+                      }
+                      flakyCount {
+                        currentValue
+                      }
+                      p90DurationMs {
+                        currentValue
+                      }
+                    }
+                    timeSeries(granularity: $granularity) {
+                      bucketStartAt
+                      passedClean
+                      flaky
+                      failed
+                    }
+                    errorPatterns(first: $errorPatternsFirst) {
+                      sampleMessage
+                      count
+                    }
+                    recentRuns(first: $recentRunsFirst) {
+                      edges {
+                        node {
+                          id
+                          status
+                          durationMs
+                          isFlaky
+                          createdAt
+                          workflowRunId
+                          workflowRunName
+                          gitRef
+                          commitSha
+                        }
+                      }
+                      pageInfo {
+                        hasNextPage
+                      }
+                      totalCount
+                    }
+                  }
+                }
+              }
+            }
+          `,
+          {
+            appId,
+            path,
+            timespan: { start: startTime, end: endTime },
+            filters,
+            granularity,
+            errorPatternsFirst,
+            recentRunsFirst,
+          },
+          { additionalTypenames: ['App', 'WorkflowDeviceTestCaseHistory'] }
+        )
+        .toPromise(),
+      { featureName: FEATURE_NAME }
+    );
+
+    return data.app.byId;
+  },
+};

packages/eas-cli/src/graphql/queries/WorkflowsInsightsQuery.ts

@@ -0,0 +1,116 @@
+import gql from 'graphql-tag';
+
+import { ExpoGraphqlClient } from '../../commandUtils/context/contextUtils/createGraphqlClient';
+import { withUpgradeRequiredErrorHandlingAsync } from '../client';
+import {
+  WorkflowsInsightsByAppIdQuery,
+  WorkflowsInsightsByAppIdQueryVariables,
+  WorkflowsInsightsFiltersInput,
+  WorkflowsInsightsRunsOverTimeGranularity,
+} from '../generated';
+
+export type AppWithWorkflowsInsightsObject = WorkflowsInsightsByAppIdQuery['app']['byId'];
+
+export const WorkflowsInsightsQuery = {
+  async byAppIdAsync(
+    graphqlClient: ExpoGraphqlClient,
+    {
+      appId,
+      startTime,
+      endTime,
+      filters,
+      granularity,
+      first,
+    }: {
+      appId: string;
+      startTime: string;
+      endTime: string;
+      filters?: WorkflowsInsightsFiltersInput;
+      granularity: WorkflowsInsightsRunsOverTimeGranularity;
+      first: number;
+    }
+  ): Promise<AppWithWorkflowsInsightsObject> {
+    const data = await withUpgradeRequiredErrorHandlingAsync(
+      graphqlClient
+        .query<WorkflowsInsightsByAppIdQuery, WorkflowsInsightsByAppIdQueryVariables>(
+          gql`
+            query WorkflowsInsightsByAppId(
+              $appId: String!
+              $timespan: WorkflowsInsightsTimespanInput!
+              $filters: WorkflowsInsightsFiltersInput
+              $granularity: WorkflowsInsightsRunsOverTimeGranularity!
+              $first: Int!
+            ) {
+              app {
+                byId(appId: $appId) {
+                  id
+                  fullName
+                  workflows {
+                    id
+                    fileName
+                  }
+                  workflowsInsights {
+                    overviewMetrics(timespan: $timespan, filters: $filters) {
+                      totalRuns {
+                        currentValue
+                        previousValue
+                      }
+                      successfulRuns {
+                        currentValue
+                        previousValue
+                      }
+                      failedRuns {
+                        currentValue
+                        previousValue
+                      }
+                      activeWorkflows {
+                        currentValue
+                        previousValue
+                      }
+                    }
+                    runsOverTime(timespan: $timespan, filters: $filters, granularity: $granularity) {
+                      lineChart {
+                        labels
+                        datasets {
+                          id
+                          data
+                        }
+                      }
+                    }
+                    workflows(timespan: $timespan, filters: $filters, first: $first) {
+                      edges {
+                        node {
+                          workflowId
+                          name
+                          totalRuns
+                          successfulRuns
+                          failedRuns
+                          canceledRuns
+                          lastRunAt
+                        }
+                      }
+                      pageInfo {
+                        hasNextPage
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          `,
+          {
+            appId,
+            timespan: { start: startTime, end: endTime },
+            filters,
+            granularity,
+            first,
+          },
+          { additionalTypenames: ['App', 'AppWorkflowsInsights', 'Workflow'] }
+        )
+        .toPromise(),
+      { featureName: 'EAS Workflows insights' }
+    );
+
+    return data.app.byId;
+  },
+};

packages/eas-cli/src/graphql/types/Observe.ts

@@ -56,6 +56,38 @@ export const AppObserveErrorFragmentNode = gql`
   }
 `;
 
+export const AppObserveErrorOccurrenceFragmentNode = gql`
+  fragment AppObserveErrorOccurrenceFragment on AppObserveError {
+    id
+    timestamp
+    sessionId
+    severityNumber
+    severityText
+    type
+    message
+    source
+    fingerprint
+    isFatal
+    stacktrace
+    body
+    properties {
+      key
+      value
+      type
+    }
+    appVersion
+    appBuildNumber
+    appUpdateId
+    appEasBuildId
+    deviceOs
+    deviceOsVersion
+    deviceModel
+    environment
+    easClientId
+    countryCode
+  }
+`;
+
 export const AppObserveMetricFragmentNode = gql`
   fragment AppObserveMetricFragment on AppObserveMetric {
     id
@@ -76,6 +108,23 @@ export const AppObserveMetricFragmentNode = gql`
   }
 `;
 
+export const AppObserveErrorGroupFragmentNode = gql`
+  fragment AppObserveErrorGroupFragment on AppObserveErrorGroup {
+    fingerprint
+    exceptionType
+    exceptionMessage
+    errorSource
+    severity
+    isFatal
+    eventCount
+    uniqueUserCount
+    affectedSessionCount
+    firstSeenAt
+    lastSeenAt
+    platforms
+  }
+`;
+
 export const AppObserveAppVersionFragmentNode = gql`
   fragment AppObserveAppVersionFragment on AppObserveAppVersion {
     appVersion

packages/eas-cli/src/insights/__tests__/metrics-test.ts

@@ -0,0 +1,56 @@
+import { formatRateWithDelta, formatTrend, ratePercent, toMetricSummary } from '../metrics';
+
+function stripAnsi(text: string): string {
+  return text.replace(/\x1b\[[0-9;]*m/g, '');
+}
+
+describe(toMetricSummary, () => {
+  it('renames the server pair', () => {
+    expect(toMetricSummary({ currentValue: 3, previousValue: 4 })).toEqual({
+      current: 3,
+      previous: 4,
+    });
+  });
+});
+
+describe(ratePercent, () => {
+  it('returns 0 when there is nothing to rate', () => {
+    expect(ratePercent(0, 0)).toBe(0);
+  });
+
+  it('returns the share as a percentage', () => {
+    expect(ratePercent(3, 4)).toBe(75);
+  });
+});
+
+describe(formatTrend, () => {
+  it('is n/a when the previous period had no data', () => {
+    expect(formatTrend({ current: 10, previous: 0 })).toContain('n/a');
+  });
+
+  it('formats the percentage change with a sign', () => {
+    expect(formatTrend({ current: 125, previous: 100 })).toContain('+25.0%');
+    expect(formatTrend({ current: 50, previous: 100 })).toContain('-50.0%');
+    expect(formatTrend({ current: 100, previous: 100 })).toContain('0.0%');
+  });
+});
+
+describe(formatRateWithDelta, () => {
+  it('is n/a while there are no runs to rate', () => {
+    expect(
+      stripAnsi(formatRateWithDelta({ current: 0, previous: 50 }, { current: 0, previous: 10 }))
+    ).toBe('n/a');
+  });
+
+  it('shows the rate without a delta when the previous period had no runs', () => {
+    expect(
+      stripAnsi(formatRateWithDelta({ current: 80, previous: 0 }, { current: 10, previous: 0 }))
+    ).toBe('80.0% (n/a)');
+  });
+
+  it('shows the change in percentage points', () => {
+    expect(
+      stripAnsi(formatRateWithDelta({ current: 80, previous: 75.5 }, { current: 10, previous: 8 }))
+    ).toBe('80.0% (+4.5 pts)');
+  });
+});

packages/eas-cli/src/insights/__tests__/timeRange-test.ts

@@ -0,0 +1,56 @@
+import { resolveInsightsTimeRange } from '../timeRange';
+
+describe(resolveInsightsTimeRange, () => {
+  const now = new Date('2026-09-08T12:00:00.000Z');
+
+  beforeEach(() => {
+    jest.useFakeTimers({ now });
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+  });
+
+  it('defaults to the last 7 days', () => {
+    expect(resolveInsightsTimeRange({})).toEqual({
+      daysBack: 7,
+      startTime: '2026-09-01T12:00:00.000Z',
+      endTime: '2026-09-08T12:00:00.000Z',
+    });
+  });
+
+  it('uses --days when given', () => {
+    expect(resolveInsightsTimeRange({ days: 1 })).toEqual({
+      daysBack: 1,
+      startTime: '2026-09-07T12:00:00.000Z',
+      endTime: '2026-09-08T12:00:00.000Z',
+    });
+  });
+
+  it('uses --start and --end when both are given', () => {
+    expect(
+      resolveInsightsTimeRange({
+        start: '2026-08-01T00:00:00.000Z',
+        end: '2026-08-02T00:00:00.000Z',
+      })
+    ).toEqual({
+      daysBack: undefined,
+      startTime: '2026-08-01T00:00:00.000Z',
+      endTime: '2026-08-02T00:00:00.000Z',
+    });
+  });
+
+  it('ends now when only --start is given', () => {
+    expect(resolveInsightsTimeRange({ start: '2026-09-05T00:00:00.000Z' })).toEqual({
+      daysBack: undefined,
+      startTime: '2026-09-05T00:00:00.000Z',
+      endTime: '2026-09-08T12:00:00.000Z',
+    });
+  });
+
+  it('rejects --end without --start instead of silently ignoring it', () => {
+    expect(() => resolveInsightsTimeRange({ end: '2026-09-05T00:00:00.000Z' })).toThrow(
+      /--end requires --start/
+    );
+  });
+});

packages/eas-cli/src/insights/formatFilters.ts

@@ -0,0 +1,9 @@
+/** Entries render in the order the caller lists them. */
+export function formatAppliedFilters(
+  entries: [label: string, value: string | string[] | undefined][]
+): string {
+  return entries
+    .filter(([, value]) => (Array.isArray(value) ? value.length > 0 : Boolean(value)))
+    .map(([label, value]) => `${label}: ${Array.isArray(value) ? value.join(', ') : value}`)
+    .join('; ');
+}

packages/eas-cli/src/insights/formatRunsOverTime.ts

@@ -0,0 +1,71 @@
+import chalk from 'chalk';
+import indentString from 'indent-string';
+
+import { toDateOnly, toDateTime } from './formatTimespan';
+import renderTextTable from '../utils/renderTextTable';
+
+/** Each insights surface has its own generated enum with these values. */
+export type InsightsGranularityValue = 'MINUTE' | 'HOUR' | 'DAY';
+
+const INSIGHTS_GRANULARITY_PRESENTATION: Record<
+  InsightsGranularityValue,
+  {
+    label: string;
+    unitPlural: string;
+    columnHeader: string;
+    formatBucketStart: (isoTimestamp: string) => string;
+  }
+> = {
+  MINUTE: {
+    label: 'per minute, UTC',
+    unitPlural: 'minutes',
+    columnHeader: 'Time',
+    formatBucketStart: toDateTime,
+  },
+  HOUR: {
+    label: 'hourly, UTC',
+    unitPlural: 'hours',
+    columnHeader: 'Time',
+    formatBucketStart: toDateTime,
+  },
+  DAY: {
+    label: 'daily, UTC',
+    unitPlural: 'days',
+    columnHeader: 'Date',
+    formatBucketStart: toDateOnly,
+  },
+};
+
+/**
+ * The server fills the whole window with buckets, so a quiet project would print one zero row
+ * per period. Only the table omits them; the JSON output keeps every bucket.
+ */
+export function buildRunsOverTimeSection<Bucket extends { start: string }>(
+  buckets: Bucket[],
+  granularity: InsightsGranularityValue,
+  {
+    runs,
+    columns,
+    toRow,
+  }: { runs: (bucket: Bucket) => number; columns: string[]; toRow: (bucket: Bucket) => string[] }
+): string[] {
+  const bucketsWithRuns = buckets.filter(bucket => runs(bucket) > 0);
+  if (bucketsWithRuns.length === 0) {
+    return [];
+  }
+  const presentation = INSIGHTS_GRANULARITY_PRESENTATION[granularity];
+  const omittedNote =
+    bucketsWithRuns.length < buckets.length
+      ? `; ${presentation.unitPlural} with no runs omitted`
+      : '';
+  const table = renderTextTable(
+    [presentation.columnHeader, ...columns],
+    bucketsWithRuns.map(bucket => [presentation.formatBucketStart(bucket.start), ...toRow(bucket)])
+  );
+  return [
+    '',
+    chalk.bold(`Runs over time (${presentation.label}${omittedNote}):`),
+    '',
+    indentString(table, 2),
+  ];
+}