v20.3.0

Fixes Argent remote simulator sessions getting stuck immediately after starting the Argent tool-server.

The latest Argent support change switched the startup path to `bunx @swmansion/argent server start ...` and awaited that process. When the server process stays in the foreground, the build step never advances to read the tool-server state file, start the ngrok tunnel, or report remote config back to the API.

This restores detached process launching for the Argent tool-server while keeping the new server/auth flow. If the state file is not created in time, the error now includes captured Argent process output to aid diagnosis.

Failing job run referenced while debugging: https://expo.dev/accounts/sjchmiela/projects/test-production/job-runs/019eda48-6467-789d-8c5e-a7ed5f4ec89d

.vscode/settings.json

@@ -5,5 +5,6 @@
     "**/*.code-search": true,
     "**/src/**/build/**": false,
     "**/src/build/**": false,
-  }
+  },
+  "js/ts.tsdk.path": "node_modules/typescript/lib"
 }

CHANGELOG.md

@@ -8,11 +8,31 @@ This is the log of notable changes to EAS CLI and related packages.
 
 ### 🎉 New features
 
+- [eas-cli] Add `eas account:audit [ACCOUNT_NAME]` command to view an account's audit logs. ([#3863](https://github.com/expo/eas-cli/pull/3863) by [@keith-kurak](https://github.com/keith-kurak))
+- [eas-cli] `eas update:view [GROUP_ID]` now also accepts a platform-specific update ID, resolving it to and displaying its update group. ([#3864](https://github.com/expo/eas-cli/pull/3864) by [@keith-kurak](https://github.com/keith-kurak))
+- [eas-cli] Add `eas integrations:posthog:connect` command. ([#3836](https://github.com/expo/eas-cli/pull/3836) by [@gwdp](https://github.com/gwdp))
+- [eas-cli] Add `eas integrations:posthog:dashboard` command. ([#3837](https://github.com/expo/eas-cli/pull/3837) by [@gwdp](https://github.com/gwdp))
+- [eas-cli] Add `eas integrations:posthog:disconnect` command. ([#3838](https://github.com/expo/eas-cli/pull/3838) by [@gwdp](https://github.com/gwdp))
+
+### 🐛 Bug fixes
+
+- [eas-cli] `eas integrations:posthog:connect` no longer aborts when `npx expo install` reports an error (for example, on a dynamic app config); it finishes writing the environment variables and prints any remaining manual steps. ([#3877](https://github.com/expo/eas-cli/pull/3877) by [@gwdp](https://github.com/gwdp))
+
+### 🧹 Chores
+
+- [eas-cli] Simplify 2FA now that SMS is no longer supported. ([#3859](https://github.com/expo/eas-cli/pull/3859) by [@wschurman](https://github.com/wschurman))
+
+## [20.2.0](https://github.com/expo/eas-cli/releases/tag/v20.2.0) - 2026-06-15
+
+### 🎉 New features
+
+- [eas-cli] Non-interactive iOS App Store and Enterprise builds can now use the App Store Connect API key stored in EAS credentials as a submission key to validate and repair provisioning profiles on Apple servers, without requiring `EXPO_ASC_*` environment variables or an interactive Apple login. ([#3805](https://github.com/expo/eas-cli/pull/3805) by [@sswrk](https://github.com/sswrk))
+- [eas-cli] Add support for non-interactive `eas update:rollback [GROUP_ID]`. The given update group must be the latest for its branch and runtime version; the previous update group is republished, or a roll back to the embedded update is published if there is none. ([#3825](https://github.com/expo/eas-cli/pull/3825) by [@quinlanj](https://github.com/quinlanj))
+
 ### 🐛 Bug fixes
 
 - [expo-cocoapods-proxy] Fix iOS worker tarball build failing on macOS Tahoe due to bundler incompatibility with RubyGems 4. ([#3824](https://github.com/expo/eas-cli/pull/3824) by [@gwdp](https://github.com/gwdp))
-
-### 🧹 Chores
+- [eas-cli] Fix `update:embedded` topic showing the `update:embedded:delete` subcommand description in the command listing. ([#3866](https://github.com/expo/eas-cli/pull/3866) by [@jc-expo](https://github.com/jc-expo))
 
 ## [20.1.0](https://github.com/expo/eas-cli/releases/tag/v20.1.0) - 2026-06-05
 

lerna.json

@@ -1,5 +1,5 @@
 {
   "npmClient": "yarn",
-  "version": "20.1.0",
+  "version": "20.3.0",
   "$schema": "node_modules/lerna/schemas/lerna-schema.json"
 }

packages/build-tools/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/build-tools",
-  "version": "20.1.0",
+  "version": "20.3.0",
   "bugs": "https://github.com/expo/eas-cli/issues",
   "license": "BUSL-1.1",
   "author": "Expo <[email protected]>",

packages/build-tools/src/__tests__/runtimeSettings.test.ts

@@ -14,10 +14,6 @@ jest.mock('../sentry', () => ({
 }));
 
 describe('runtimeSettings', () => {
-  const logger = {
-    info: jest.fn(),
-    warn: jest.fn(),
-  };
   const originalCacheUrls = {
     EAS_NPM_CACHE_URL: process.env.EAS_NPM_CACHE_URL,
     EAS_NODEJS_CACHE_URL: process.env.EAS_NODEJS_CACHE_URL,
@@ -30,8 +26,6 @@ describe('runtimeSettings', () => {
     jest.mocked(fetch).mockReset();
     jest.restoreAllMocks();
     jest.mocked(Sentry.capture).mockReset();
-    logger.info.mockReset();
-    logger.warn.mockReset();
     restoreEnv('EAS_NPM_CACHE_URL', originalCacheUrls.EAS_NPM_CACHE_URL);
     restoreEnv('EAS_NODEJS_CACHE_URL', originalCacheUrls.EAS_NODEJS_CACHE_URL);
     restoreEnv('EAS_MAVEN_CACHE_URL', originalCacheUrls.EAS_MAVEN_CACHE_URL);
@@ -41,24 +35,16 @@ describe('runtimeSettings', () => {
 
   beforeEach(async () => {
     jest.mocked(fetch).mockResolvedValue(response({}));
-    await RuntimeSettings.loadAsync({ environment: 'staging', logger: logger as any });
+    await RuntimeSettings.loadAsync({ environment: 'staging' });
     jest.mocked(fetch).mockReset();
-    logger.info.mockReset();
-    logger.warn.mockReset();
   });
 
   it('fetches runtime settings from the staging and production buckets', async () => {
     jest.mocked(fetch).mockResolvedValue(response({}));
 
-    await RuntimeSettings.loadAsync({
-      environment: 'staging',
-      logger: logger as any,
-      cacheUrlFallbacks: {
-        npm: 'https://fallback-npm.example',
-      },
-    });
-    await RuntimeSettings.loadAsync({ environment: 'production', logger: logger as any });
-    await RuntimeSettings.loadAsync({ environment: 'test', logger: logger as any });
+    await RuntimeSettings.loadAsync({ environment: 'staging' });
+    await RuntimeSettings.loadAsync({ environment: 'production' });
+    await RuntimeSettings.loadAsync({ environment: 'test' });
 
     expect(fetch).toHaveBeenNthCalledWith(
       1,
@@ -81,12 +67,11 @@ describe('runtimeSettings', () => {
     process.env.EAS_NPM_CACHE_URL = 'https://npm.example';
     jest.mocked(fetch).mockResolvedValue(response({}, 404));
 
-    await RuntimeSettings.loadAsync({ environment: 'staging', logger: logger as any });
+    await RuntimeSettings.loadAsync({ environment: 'staging' });
 
     mockProcessPlatform('linux');
     expect(RuntimeSettings.getNpmCacheUrl()).toBeNull();
     expect(RuntimeSettings.isUsingIosPrecompiledModulesEnabled()).toBe(false);
-    expect(logger.warn).toHaveBeenCalled();
     expect(Sentry.capture).toHaveBeenCalledWith('Failed to fetch worker runtime settings', {
       extras: {
         status: 404,
@@ -103,13 +88,12 @@ describe('runtimeSettings', () => {
       .mockResolvedValueOnce(response({ caches: { linux: { npm: true } } }))
       .mockResolvedValueOnce(response({ iosPrecompiledModules: 'enabled' }));
 
-    await RuntimeSettings.loadAsync({ environment: 'staging', logger: logger as any });
-    await RuntimeSettings.loadAsync({ environment: 'staging', logger: logger as any });
+    await RuntimeSettings.loadAsync({ environment: 'staging' });
+    await RuntimeSettings.loadAsync({ environment: 'staging' });
 
     mockProcessPlatform('linux');
     expect(RuntimeSettings.getNpmCacheUrl()).toBe('https://npm.example');
     expect(RuntimeSettings.isUsingIosPrecompiledModulesEnabled()).toBe(false);
-    expect(logger.warn).toHaveBeenCalled();
     expect(Sentry.capture).toHaveBeenCalledWith(
       'Failed to load worker runtime settings',
       expect.any(Error),
@@ -138,7 +122,7 @@ describe('runtimeSettings', () => {
       })
     );
 
-    await RuntimeSettings.loadAsync({ environment: 'staging', logger: logger as any });
+    await RuntimeSettings.loadAsync({ environment: 'staging' });
 
     mockProcessPlatform('linux');
     expect(RuntimeSettings.getNpmCacheUrl()).toBeNull();
@@ -163,7 +147,7 @@ describe('runtimeSettings', () => {
       })
     );
 
-    await RuntimeSettings.loadAsync({ environment: 'staging', logger: logger as any });
+    await RuntimeSettings.loadAsync({ environment: 'staging' });
 
     mockProcessPlatform('linux');
     expect(RuntimeSettings.getMavenCacheUrl()).toBe('https://maven.example');
@@ -172,50 +156,13 @@ describe('runtimeSettings', () => {
     expect(RuntimeSettings.getCocoapodsCacheUrl()).toBe('https://pods.example');
   });
 
-  it('uses cache URL fallbacks when enabled cache environment variables are not set', async () => {
-    jest.mocked(fetch).mockResolvedValue(
-      response({
-        caches: {
-          linux: { npm: true, nodejs: true, maven: true },
-          darwin: { cocoapods: true },
-        },
-      })
-    );
-
-    await RuntimeSettings.loadAsync({
-      environment: 'staging',
-      logger: logger as any,
-      cacheUrlFallbacks: {
-        npm: 'https://fallback-npm.example',
-        nodejs: 'https://fallback-node.example',
-        maven: 'https://fallback-maven.example',
-        cocoapods: 'https://fallback-pods.example',
-      },
-    });
-
-    mockProcessPlatform('linux');
-    expect(RuntimeSettings.getNpmCacheUrl()).toBe('https://fallback-npm.example');
-    expect(RuntimeSettings.getNodeJsCacheUrl()).toBe('https://fallback-node.example');
-    expect(RuntimeSettings.getMavenCacheUrl()).toBe('https://fallback-maven.example');
-    mockProcessPlatform('darwin');
-    expect(RuntimeSettings.getCocoapodsCacheUrl()).toBe('https://fallback-pods.example');
-  });
-
-  it('prefers cache URL environment variables over fallbacks', async () => {
+  it('uses job environment flags to enable cache URLs from worker environment variables', async () => {
     process.env.EAS_NPM_CACHE_URL = 'https://npm.example';
-    jest.mocked(fetch).mockResolvedValue(
-      response({
-        caches: {
-          linux: { npm: true },
-        },
-      })
-    );
 
     await RuntimeSettings.loadAsync({
-      environment: 'staging',
-      logger: logger as any,
-      cacheUrlFallbacks: {
-        npm: 'https://fallback-npm.example',
+      environment: 'test',
+      env: {
+        EAS_USE_NPM_CACHE: '1',
       },
     });
 
@@ -223,20 +170,13 @@ describe('runtimeSettings', () => {
     expect(RuntimeSettings.getNpmCacheUrl()).toBe('https://npm.example');
   });
 
-  it('does not use cache URL fallbacks when runtime settings disable caches', async () => {
-    jest.mocked(fetch).mockResolvedValue(
-      response({
-        caches: {
-          linux: { npm: false },
-        },
-      })
-    );
+  it('returns null when job env enables cache but worker env var is empty', async () => {
+    process.env.EAS_NPM_CACHE_URL = '';
 
     await RuntimeSettings.loadAsync({
-      environment: 'staging',
-      logger: logger as any,
-      cacheUrlFallbacks: {
-        npm: 'https://fallback-npm.example',
+      environment: 'test',
+      env: {
+        EAS_USE_NPM_CACHE: '1',
       },
     });
 
@@ -244,17 +184,89 @@ describe('runtimeSettings', () => {
     expect(RuntimeSettings.getNpmCacheUrl()).toBeNull();
   });
 
-  it('clears cache URL fallbacks when loading without them', async () => {
+  it('does not use cache URLs from the job environment', async () => {
+    await RuntimeSettings.loadAsync({
+      environment: 'test',
+      env: {
+        EAS_USE_NPM_CACHE: '1',
+        EAS_NPM_CACHE_URL: 'https://job-npm.example',
+      },
+    });
+
+    mockProcessPlatform('linux');
+    expect(RuntimeSettings.getNpmCacheUrl()).toBeNull();
+  });
+
+  it('does not enable cache when runtime settings explicitly disable it, even with job env flag', async () => {
+    process.env.EAS_NPM_CACHE_URL = 'https://npm.example';
+    jest.mocked(fetch).mockResolvedValue(response({ caches: { linux: { npm: false } } }));
+
+    await RuntimeSettings.loadAsync({
+      environment: 'staging',
+      env: {
+        EAS_USE_NPM_CACHE: '1',
+      },
+    });
+
+    mockProcessPlatform('linux');
+    expect(RuntimeSettings.getNpmCacheUrl()).toBeNull();
+  });
+
+  it('disables cache when EAS_BUILD_DISABLE_NPM_CACHE is set', async () => {
+    process.env.EAS_NPM_CACHE_URL = 'https://npm.example';
     jest.mocked(fetch).mockResolvedValue(response({ caches: { linux: { npm: true } } }));
 
     await RuntimeSettings.loadAsync({
       environment: 'staging',
-      logger: logger as any,
-      cacheUrlFallbacks: {
-        npm: 'https://fallback-npm.example',
+      env: {
+        EAS_BUILD_DISABLE_NPM_CACHE: '1',
+      },
+    });
+
+    mockProcessPlatform('linux');
+    expect(RuntimeSettings.getNpmCacheUrl()).toBeNull();
+  });
+
+  it('disables cache when EAS_BUILD_DISABLE_MAVEN_CACHE is set', async () => {
+    process.env.EAS_MAVEN_CACHE_URL = 'https://maven.example';
+    jest.mocked(fetch).mockResolvedValue(response({ caches: { linux: { maven: true } } }));
+
+    await RuntimeSettings.loadAsync({
+      environment: 'staging',
+      env: {
+        EAS_BUILD_DISABLE_MAVEN_CACHE: '1',
+      },
+    });
+
+    mockProcessPlatform('linux');
+    expect(RuntimeSettings.getMavenCacheUrl()).toBeNull();
+  });
+
+  it('disables cache when EAS_BUILD_DISABLE_COCOAPODS_CACHE is set', async () => {
+    process.env.EAS_COCOAPODS_CACHE_URL = 'https://pods.example';
+    jest.mocked(fetch).mockResolvedValue(response({ caches: { darwin: { cocoapods: true } } }));
+
+    await RuntimeSettings.loadAsync({
+      environment: 'staging',
+      env: {
+        EAS_BUILD_DISABLE_COCOAPODS_CACHE: '1',
+      },
+    });
+
+    mockProcessPlatform('darwin');
+    expect(RuntimeSettings.getCocoapodsCacheUrl()).toBeNull();
+  });
+
+  it('allows job environment flags to disable remotely enabled cache URLs', async () => {
+    process.env.EAS_NPM_CACHE_URL = 'https://npm.example';
+    jest.mocked(fetch).mockResolvedValue(response({ caches: { linux: { npm: true } } }));
+
+    await RuntimeSettings.loadAsync({
+      environment: 'staging',
+      env: {
+        EAS_USE_NPM_CACHE: '0',
       },
     });
-    await RuntimeSettings.loadAsync({ environment: 'staging', logger: logger as any });
 
     mockProcessPlatform('linux');
     expect(RuntimeSettings.getNpmCacheUrl()).toBeNull();
@@ -275,7 +287,7 @@ describe('runtimeSettings', () => {
     jest.mocked(fetch).mockResolvedValue(response({ caches: { linux: { npm: true } } }));
     mockProcessPlatform('darwin');
 
-    await RuntimeSettings.loadAsync({ environment: 'staging', logger: logger as any });
+    await RuntimeSettings.loadAsync({ environment: 'staging' });
 
     expect(RuntimeSettings.getNpmCacheUrl()).toBeNull();
     expect(Sentry.capture).toHaveBeenCalledWith(

packages/build-tools/src/builders/__tests__/custom.test.ts

@@ -7,6 +7,7 @@ import { createMockLogger } from '../../__tests__/utils/logger';
 import { prepareProjectSourcesAsync } from '../../common/projectSources';
 import { BuildContext } from '../../context';
 import { CustomBuildContext } from '../../customBuildContext';
+import { Datadog } from '../../datadog';
 import { findAndUploadXcodeBuildLogsAsync } from '../../ios/xcodeBuildLogs';
 import { runCustomBuildAsync } from '../custom';
 
@@ -17,6 +18,7 @@ const findAndUploadXcodeBuildLogsAsyncMock = jest.mocked(findAndUploadXcodeBuild
 
 describe(runCustomBuildAsync, () => {
   let ctx: BuildContext<BuildJob>;
+  const datadogLogSpy = jest.spyOn(Datadog, 'log');
 
   beforeEach(() => {
     const job = createTestIosJob();
@@ -27,10 +29,24 @@ describe(runCustomBuildAsync, () => {
       vol.fromJSON(
         {
           'test.yaml': `
+          functions:
+            test_function:
+              name: Test function
+              path: ./custom-function
+              shell: /bin/zsh
+              supported_platforms:
+                - darwin
+                - linux
+              inputs:
+                - name
+                - profile
+              outputs:
+                - artifact_path
           build:
             steps:
               - eas/checkout
           `,
+          'custom-function/package.json': '{}',
         },
         '/workingdir/temporary-custom-build'
       );
@@ -77,6 +93,21 @@ describe(runCustomBuildAsync, () => {
     expect(prepareProjectSourcesAsync).toHaveBeenCalledTimes(2);
   });
 
+  it('reports user-provided custom functions when parsing the custom build config', async () => {
+    await runCustomBuildAsync(ctx);
+
+    expect(datadogLogSpy).toHaveBeenCalledWith('Custom build saw user-provided function', {
+      event: 'custom_build_user_provided_function',
+      custom_function_id: 'test_function',
+      custom_function_input_count: '2',
+      custom_function_module_path: '/workingdir/temporary-custom-build/custom-function',
+      custom_function_name: 'Test function',
+      custom_function_output_count: '1',
+      custom_function_shell: '/bin/zsh',
+      custom_function_supported_runtime_platforms: 'darwin,linux',
+    });
+  });
+
   it('awaits drainPendingMetricUploads after workflow execution', async () => {
     let resolveDrain!: () => void;
     const drainSpy = jest

packages/build-tools/src/builders/custom.ts

@@ -1,5 +1,11 @@
 import { BuildJob, BuildPhase, BuildTrigger, Ios, Platform } from '@expo/eas-build-job';
-import { BuildConfigParser, BuildStepGlobalContext, StepsConfigParser, errors } from '@expo/steps';
+import {
+  BuildConfigParser,
+  BuildStepGlobalContext,
+  BuildWorkflow,
+  StepsConfigParser,
+  errors,
+} from '@expo/steps';
 import assert from 'assert';
 import fs from 'fs/promises';
 import nullthrows from 'nullthrows';
@@ -9,6 +15,7 @@ import { resolveEnvFromBuildProfileAsync } from '../common/easBuildInternal';
 import { prepareProjectSourcesAsync } from '../common/projectSources';
 import { Artifacts, BuildContext } from '../context';
 import { CustomBuildContext } from '../customBuildContext';
+import { Datadog } from '../datadog';
 import { findAndUploadXcodeBuildLogsAsync } from '../ios/xcodeBuildLogs';
 import { getEasFunctionGroups } from '../steps/easFunctionGroups';
 import { getEasFunctions } from '../steps/easFunctions';
@@ -81,6 +88,7 @@ export async function runCustomBuildAsync(ctx: BuildContext<BuildJob>): Promise<
       throw parseError;
     }
   });
+  logUserProvidedCustomFunctions(workflow);
   try {
     try {
       await workflow.executeAsync();
@@ -103,3 +111,26 @@ export async function runCustomBuildAsync(ctx: BuildContext<BuildJob>): Promise<
 
   return ctx.artifacts;
 }
+
+function logUserProvidedCustomFunctions(workflow: BuildWorkflow): void {
+  for (const buildFunction of Object.values(workflow.buildFunctions)) {
+    if (!buildFunction.customFunctionModulePath) {
+      continue;
+    }
+    Datadog.log('Custom build saw user-provided function', {
+      event: 'custom_build_user_provided_function',
+      custom_function_id: buildFunction.getFullId(),
+      custom_function_module_path: buildFunction.customFunctionModulePath,
+      custom_function_input_count: String(buildFunction.inputProviders?.length ?? 0),
+      custom_function_output_count: String(buildFunction.outputProviders?.length ?? 0),
+      ...(buildFunction.name ? { custom_function_name: buildFunction.name } : {}),
+      ...(buildFunction.shell ? { custom_function_shell: buildFunction.shell } : {}),
+      ...(buildFunction.supportedRuntimePlatforms
+        ? {
+            custom_function_supported_runtime_platforms:
+              buildFunction.supportedRuntimePlatforms.join(','),
+          }
+        : {}),
+    });
+  }
+}

packages/build-tools/src/common/__tests__/installDependencies.test.ts

@@ -0,0 +1,222 @@
+import spawn, { SpawnPromise, SpawnResult } from '@expo/turtle-spawn';
+
+import { createMockLogger } from '../../__tests__/utils/logger';
+import { Sentry } from '../../sentry';
+import { PackageManager } from '../../utils/packageManager';
+import { installDependenciesWithNpmCacheFallbackAsync } from '../installDependencies';
+
+jest.mock('@expo/turtle-spawn', () => jest.fn());
+jest.mock('../../sentry', () => ({
+  Sentry: {
+    capture: jest.fn(),
+  },
+}));
+
+describe(installDependenciesWithNpmCacheFallbackAsync, () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('retries without NPM_CONFIG_REGISTRY when npm cache install fails', async () => {
+    const logger = createMockLogger();
+    const npmCacheUrl = 'http://npm.staging.caches.eas-build.internal';
+    const error = Object.assign(
+      new Error('npm install --include=dev exited with non-zero code: 1'),
+      {
+        status: 1,
+        signal: null,
+        stdout: '',
+        stderr: `npm error request to ${npmCacheUrl}/left-pad failed, reason: getaddrinfo ENOTFOUND npm.staging.caches.eas-build.internal`,
+      }
+    );
+
+    jest
+      .mocked(spawn)
+      .mockReturnValueOnce(createSpawnPromise(Promise.reject(error)))
+      .mockReturnValueOnce(createSpawnPromise(Promise.resolve(createSpawnResult())));
+
+    await installDependenciesWithNpmCacheFallbackAsync({
+      packageManager: PackageManager.NPM,
+      env: {
+        EAS_VERBOSE: '1',
+        EAS_USE_NPM_CACHE: '1',
+        NPM_CONFIG_REGISTRY: npmCacheUrl,
+      },
+      logger,
+      cwd: '/tmp/build',
+      useFrozenLockfile: false,
+    });
+
+    expect(spawn).toHaveBeenCalledTimes(2);
+    expect(spawn).toHaveBeenNthCalledWith(1, 'npm', ['install', '--include=dev', '--verbose'], {
+      cwd: '/tmp/build',
+      logger,
+      infoCallbackFn: undefined,
+      lineTransformer: expect.any(Function),
+      env: {
+        EAS_VERBOSE: '1',
+        EAS_USE_NPM_CACHE: '1',
+        NPM_CONFIG_REGISTRY: npmCacheUrl,
+      },
+    });
+    expect(spawn).toHaveBeenNthCalledWith(2, 'npm', ['install', '--include=dev', '--verbose'], {
+      cwd: '/tmp/build',
+      logger,
+      infoCallbackFn: undefined,
+      env: {
+        EAS_VERBOSE: '1',
+        EAS_USE_NPM_CACHE: '1',
+      },
+    });
+    expect(logger.warn).toHaveBeenCalledWith(
+      `Failed to install dependencies using the npm cache registry (${npmCacheUrl}). Retrying without the npm cache registry.`
+    );
+    expect(Sentry.capture).toHaveBeenCalledWith(
+      expect.objectContaining({
+        message: 'Failed to install dependencies using npm cache registry',
+        name: 'NpmCacheRegistryInstallError',
+      }),
+      {
+        level: 'warning',
+        tags: {
+          packageManager: 'npm',
+        },
+        extras: {
+          cwd: '/tmp/build',
+          npmCacheUrl,
+          useFrozenLockfile: false,
+          originalErrorMessage: 'npm install --include=dev exited with non-zero code: 1',
+          status: 1,
+          signal: null,
+        },
+      }
+    );
+  });
+
+  it('reports non-fatal npm cache registry errors from successful installs', async () => {
+    const logger = createMockLogger();
+    const npmCacheUrl = 'http://npm.staging.caches.eas-build.internal';
+    const auditErrorLine = `npm verbose audit error FetchError: request to ${npmCacheUrl}/-/npm/v1/security/advisories/bulk failed, reason: getaddrinfo ENOTFOUND npm.staging.caches.eas-build.internal`;
+
+    jest.mocked(spawn).mockImplementationOnce((_command, _args, options: any) => {
+      options.lineTransformer(auditErrorLine);
+      options.lineTransformer(
+        `npm http cache left-pad@${npmCacheUrl}/left-pad/-/left-pad-1.3.0.tgz 0ms (cache hit)`
+      );
+      return createSpawnPromise(Promise.resolve(createSpawnResult()));
+    });
+
+    await installDependenciesWithNpmCacheFallbackAsync({
+      packageManager: PackageManager.NPM,
+      env: {
+        EAS_USE_NPM_CACHE: '1',
+        NPM_CONFIG_REGISTRY: npmCacheUrl,
+      },
+      logger,
+      cwd: '/tmp/build',
+      useFrozenLockfile: false,
+    });
+
+    expect(spawn).toHaveBeenCalledTimes(1);
+    expect(Sentry.capture).toHaveBeenCalledWith(
+      expect.objectContaining({
+        message: 'Non-fatal npm cache registry error during dependency install',
+        name: 'NpmCacheRegistryNonFatalError',
+      }),
+      {
+        level: 'warning',
+        tags: {
+          packageManager: 'npm',
+        },
+        extras: {
+          cwd: '/tmp/build',
+          npmCacheUrl,
+          useFrozenLockfile: false,
+          firstErrorLine: auditErrorLine,
+          errorLineCount: 1,
+        },
+      }
+    );
+  });
+
+  it('does not retry when install failure does not reference npm cache registry', async () => {
+    const logger = createMockLogger();
+    const error = Object.assign(
+      new Error('npm install --include=dev exited with non-zero code: 1'),
+      {
+        status: 1,
+        signal: null,
+        stdout: '',
+        stderr: 'npm error command sh -c node postinstall.js',
+      }
+    );
+
+    jest.mocked(spawn).mockReturnValueOnce(createSpawnPromise(Promise.reject(error)));
+
+    await expect(
+      installDependenciesWithNpmCacheFallbackAsync({
+        packageManager: PackageManager.NPM,
+        env: {
+          EAS_USE_NPM_CACHE: '1',
+          NPM_CONFIG_REGISTRY: 'http://npm.staging.caches.eas-build.internal',
+        },
+        logger,
+        cwd: '/tmp/build',
+        useFrozenLockfile: false,
+      })
+    ).rejects.toThrow(error);
+
+    expect(spawn).toHaveBeenCalledTimes(1);
+    expect(Sentry.capture).not.toHaveBeenCalled();
+  });
+
+  it('does not retry when EAS_USE_NPM_CACHE is not enabled', async () => {
+    const logger = createMockLogger();
+    const npmCacheUrl = 'http://npm.staging.caches.eas-build.internal';
+    const error = Object.assign(
+      new Error('npm install --include=dev exited with non-zero code: 1'),
+      {
+        status: 1,
+        signal: null,
+        stdout: '',
+        stderr: `npm error request to ${npmCacheUrl}/left-pad failed, reason: getaddrinfo ENOTFOUND npm.staging.caches.eas-build.internal`,
+      }
+    );
+
+    jest.mocked(spawn).mockReturnValueOnce(createSpawnPromise(Promise.reject(error)));
+
+    await expect(
+      installDependenciesWithNpmCacheFallbackAsync({
+        packageManager: PackageManager.NPM,
+        env: {
+          NPM_CONFIG_REGISTRY: npmCacheUrl,
+        },
+        logger,
+        cwd: '/tmp/build',
+        useFrozenLockfile: false,
+      })
+    ).rejects.toThrow(error);
+
+    expect(spawn).toHaveBeenCalledTimes(1);
+    expect(Sentry.capture).not.toHaveBeenCalled();
+  });
+});
+
+function createSpawnPromise(result: Promise<SpawnResult>): SpawnPromise<SpawnResult> {
+  return Object.assign(result, {
+    child: {
+      pid: 123,
+    },
+  }) as SpawnPromise<SpawnResult>;
+}
+
+function createSpawnResult(): SpawnResult {
+  return {
+    pid: 123,
+    output: ['', ''],
+    stdout: '',
+    stderr: '',
+    status: 0,
+    signal: null,
+  };
+}

packages/build-tools/src/common/installDependencies.ts

@@ -1,8 +1,9 @@
-import { Job } from '@expo/eas-build-job';
+import { Job, SystemError } from '@expo/eas-build-job';
 import spawn, { SpawnOptions, SpawnPromise, SpawnResult } from '@expo/turtle-spawn';
 import path from 'path';
 
 import { BuildContext } from '../context';
+import { Sentry } from '../sentry';
 import { PackageManager, findPackagerRootDir } from '../utils/packageManager';
 import { isUsingModernYarnVersion } from '../utils/project';
 
@@ -11,6 +12,7 @@ export async function installDependenciesAsync({
   env,
   logger,
   infoCallbackFn,
+  lineTransformer,
   cwd,
   useFrozenLockfile,
 }: {
@@ -19,6 +21,7 @@ export async function installDependenciesAsync({
   cwd: string;
   logger: Exclude<SpawnOptions['logger'], undefined>;
   infoCallbackFn?: SpawnOptions['infoCallbackFn'];
+  lineTransformer?: SpawnOptions['lineTransformer'];
   useFrozenLockfile: boolean;
 }): Promise<{ spawnPromise: SpawnPromise<SpawnResult> }> {
   let args: string[];
@@ -69,11 +72,92 @@ export async function installDependenciesAsync({
       cwd,
       logger,
       infoCallbackFn,
+      lineTransformer,
       env,
     }),
   };
 }
 
+export async function installDependenciesWithNpmCacheFallbackAsync({
+  packageManager,
+  env,
+  logger,
+  infoCallbackFn,
+  cwd,
+  useFrozenLockfile,
+}: {
+  packageManager: PackageManager;
+  env: Record<string, string | undefined>;
+  cwd: string;
+  logger: Exclude<SpawnOptions['logger'], undefined>;
+  infoCallbackFn?: SpawnOptions['infoCallbackFn'];
+  useFrozenLockfile: boolean;
+}): Promise<void> {
+  const npmCacheUrl = env.NPM_CONFIG_REGISTRY;
+  let firstErrorLine: string | undefined;
+  let errorLineCount = 0;
+
+  try {
+    await (
+      await installDependenciesAsync({
+        packageManager,
+        env,
+        logger,
+        infoCallbackFn,
+        lineTransformer: (line: string) => {
+          if (isNpmCacheRegistryErrorLine(line, { env, npmCacheUrl })) {
+            firstErrorLine ??= line;
+            errorLineCount += 1;
+          }
+          return line;
+        },
+        cwd,
+        useFrozenLockfile,
+      })
+    ).spawnPromise;
+
+    if (firstErrorLine) {
+      Sentry.capture(new NpmCacheRegistryNonFatalError(), {
+        level: 'warning',
+        tags: { packageManager },
+        extras: { cwd, npmCacheUrl, useFrozenLockfile, firstErrorLine, errorLineCount },
+      });
+    }
+  } catch (err: unknown) {
+    if (!isNpmCacheInstallFailure(err, { env, npmCacheUrl })) {
+      throw err;
+    }
+
+    logger.warn(
+      `Failed to install dependencies using the npm cache registry (${npmCacheUrl}). Retrying without the npm cache registry.`
+    );
+    Sentry.capture(new NpmCacheRegistryInstallError(err), {
+      level: 'warning',
+      tags: { packageManager },
+      extras: {
+        cwd,
+        npmCacheUrl,
+        useFrozenLockfile,
+        originalErrorMessage: err instanceof Error ? err.message : String(err),
+        status: err instanceof Error ? (err as any).status : undefined,
+        signal: err instanceof Error ? (err as any).signal : undefined,
+      },
+    });
+
+    const { NPM_CONFIG_REGISTRY: _NPM_CONFIG_REGISTRY, ...fallbackEnv } = env;
+    await (
+      await installDependenciesAsync({
+        packageManager,
+        env: fallbackEnv,
+        logger,
+        infoCallbackFn,
+        cwd,
+        useFrozenLockfile,
+      })
+    ).spawnPromise;
+  }
+}
+
 export function resolvePackagerDir(ctx: BuildContext<Job>): string {
   const packagerRunDir = findPackagerRootDir(ctx.getReactNativeProjectDirectory());
   if (packagerRunDir !== ctx.getReactNativeProjectDirectory()) {
@@ -87,3 +171,54 @@ export function resolvePackagerDir(ctx: BuildContext<Job>): string {
   }
   return packagerRunDir;
 }
+
+function isNpmCacheInstallFailure(
+  err: unknown,
+  { env, npmCacheUrl }: { env: Record<string, string | undefined>; npmCacheUrl: string | undefined }
+): boolean {
+  if (!isNpmCacheRegistryEnabled(env, npmCacheUrl)) {
+    return false;
+  }
+  const errorOutput = getErrorOutput(err);
+  return errorOutput.includes(npmCacheUrl);
+}
+
+function isNpmCacheRegistryErrorLine(
+  line: string,
+  { env, npmCacheUrl }: { env: Record<string, string | undefined>; npmCacheUrl: string | undefined }
+): boolean {
+  return (
+    isNpmCacheRegistryEnabled(env, npmCacheUrl) &&
+    line.includes(npmCacheUrl) &&
+    /(?:error|failed|ENOTFOUND|ECONN|ETIMEDOUT|EAI_AGAIN|FetchError)/i.test(line)
+  );
+}
+
+function isNpmCacheRegistryEnabled(
+  env: Record<string, string | undefined>,
+  npmCacheUrl: string | undefined
+): npmCacheUrl is string {
+  return env.EAS_USE_NPM_CACHE === '1' && !!npmCacheUrl;
+}
+
+function getErrorOutput(err: unknown): string {
+  if (!(err instanceof Error)) {
+    return '';
+  }
+  const { stdout, stderr } = err as Error & { stdout?: string; stderr?: string };
+  return [stdout, stderr].filter(Boolean).join('\n');
+}
+
+class NpmCacheRegistryNonFatalError extends SystemError {
+  override name = 'NpmCacheRegistryNonFatalError';
+  constructor() {
+    super('Non-fatal npm cache registry error during dependency install');
+  }
+}
+
+class NpmCacheRegistryInstallError extends SystemError {
+  override name = 'NpmCacheRegistryInstallError';
+  constructor(cause: unknown) {
+    super('Failed to install dependencies using npm cache registry', { cause });
+  }
+}

packages/build-tools/src/common/prebuild.ts

@@ -2,7 +2,10 @@ import { BuildJob } from '@expo/eas-build-job';
 import { bunyan } from '@expo/logger';
 import { SpawnOptions } from '@expo/turtle-spawn';
 
-import { installDependenciesAsync, resolvePackagerDir } from './installDependencies';
+import {
+  installDependenciesWithNpmCacheFallbackAsync,
+  resolvePackagerDir,
+} from './installDependencies';
 import { BuildContext } from '../context';
 import { runExpoCliCommand } from '../utils/project';
 
@@ -30,17 +33,14 @@ export async function prebuildAsync<TJob extends BuildJob>(
     options: spawnOptions,
     packageManager: ctx.packageManager,
   });
-  const installDependenciesSpawnPromise = (
-    await installDependenciesAsync({
-      packageManager: ctx.packageManager,
-      env: ctx.env,
-      logger,
-      cwd: resolvePackagerDir(ctx),
-      // prebuild sometimes modifies package.json, so we don't want to use frozen lockfile
-      useFrozenLockfile: false,
-    })
-  ).spawnPromise;
-  await installDependenciesSpawnPromise;
+  await installDependenciesWithNpmCacheFallbackAsync({
+    packageManager: ctx.packageManager,
+    env: ctx.env,
+    logger,
+    cwd: resolvePackagerDir(ctx),
+    // prebuild sometimes modifies package.json, so we don't want to use frozen lockfile
+    useFrozenLockfile: false,
+  });
 }
 
 function getPrebuildCommandArgs<TJob extends BuildJob>(ctx: BuildContext<TJob>): string[] {

packages/build-tools/src/runtimeSettings.ts

@@ -1,4 +1,4 @@
-import { type bunyan } from '@expo/logger';
+import { Env } from '@expo/eas-build-job';
 import fetch from 'node-fetch';
 import { z } from 'zod';
 
@@ -26,27 +26,18 @@ const RuntimeSettingsSchema = z
   })
   .partial();
 
-type CacheUrlFallbacks = {
-  npm?: string | null;
-  nodejs?: string | null;
-  maven?: string | null;
-  cocoapods?: string | null;
-};
-
 let runtimeSettings: z.infer<typeof RuntimeSettingsSchema> = {};
-let cacheUrlFallbacks: CacheUrlFallbacks = {};
+let runtimeEnvironment: Env = {};
 
 export namespace RuntimeSettings {
   export async function loadAsync({
     environment,
-    logger,
-    cacheUrlFallbacks: nextCacheUrlFallbacks = {},
+    env: nextRuntimeEnvironment = {},
   }: {
     environment: string;
-    logger: bunyan;
-    cacheUrlFallbacks?: CacheUrlFallbacks;
+    env?: Env;
   }): Promise<void> {
-    cacheUrlFallbacks = nextCacheUrlFallbacks;
+    runtimeEnvironment = nextRuntimeEnvironment;
     const url = ENVIRONMENT_TO_RUNTIME_SETTINGS_URL[environment];
     if (!url) {
       return;
@@ -58,10 +49,6 @@ export namespace RuntimeSettings {
       });
 
       if (!response.ok) {
-        logger.warn(
-          { url, status: response.status },
-          'Failed to fetch worker runtime settings, using defaults'
-        );
         Sentry.capture('Failed to fetch worker runtime settings', {
           extras: { url, status: response.status },
           level: 'warning',
@@ -84,9 +71,7 @@ export namespace RuntimeSettings {
           }
         );
       }
-      logger.info({ url, settings: runtimeSettings }, 'Loaded worker runtime settings');
     } catch (err) {
-      logger.warn({ err, url }, 'Failed to load worker runtime settings, using defaults');
       Sentry.capture(
         'Failed to load worker runtime settings',
         err instanceof Error ? err : new Error(String(err)),
@@ -103,26 +88,51 @@ export namespace RuntimeSettings {
   }
 
   export function getNpmCacheUrl(): string | null {
-    return runtimeSettings.caches?.[process.platform]?.npm
-      ? process.env.EAS_NPM_CACHE_URL || cacheUrlFallbacks.npm || null
-      : null;
+    if (runtimeEnvironment['EAS_BUILD_DISABLE_NPM_CACHE'] === '1') {
+      return null;
+    }
+    const runtimeEnabled = runtimeSettings.caches?.[process.platform]?.npm;
+    if (runtimeEnabled === false) {
+      return null;
+    }
+    const envOverride = runtimeEnvironment['EAS_USE_NPM_CACHE'];
+    const enabled = envOverride === '1' || (envOverride !== '0' && runtimeEnabled);
+    return enabled ? process.env.EAS_NPM_CACHE_URL || null : null;
   }
 
   export function getNodeJsCacheUrl(): string | null {
-    return runtimeSettings.caches?.[process.platform]?.nodejs
-      ? process.env.EAS_NODEJS_CACHE_URL || cacheUrlFallbacks.nodejs || null
-      : null;
+    const runtimeEnabled = runtimeSettings.caches?.[process.platform]?.nodejs;
+    if (runtimeEnabled === false) {
+      return null;
+    }
+    const envOverride = runtimeEnvironment['EAS_USE_NODEJS_CACHE'];
+    const enabled = envOverride === '1' || (envOverride !== '0' && runtimeEnabled);
+    return enabled ? process.env.EAS_NODEJS_CACHE_URL || null : null;
   }
 
   export function getMavenCacheUrl(): string | null {
-    return runtimeSettings.caches?.[process.platform]?.maven
-      ? process.env.EAS_MAVEN_CACHE_URL || cacheUrlFallbacks.maven || null
-      : null;
+    if (runtimeEnvironment['EAS_BUILD_DISABLE_MAVEN_CACHE'] === '1') {
+      return null;
+    }
+    const runtimeEnabled = runtimeSettings.caches?.[process.platform]?.maven;
+    if (runtimeEnabled === false) {
+      return null;
+    }
+    const envOverride = runtimeEnvironment['EAS_USE_MAVEN_CACHE'];
+    const enabled = envOverride === '1' || (envOverride !== '0' && runtimeEnabled);
+    return enabled ? process.env.EAS_MAVEN_CACHE_URL || null : null;
   }
 
   export function getCocoapodsCacheUrl(): string | null {
-    return runtimeSettings.caches?.[process.platform]?.cocoapods
-      ? process.env.EAS_COCOAPODS_CACHE_URL || cacheUrlFallbacks.cocoapods || null
-      : null;
+    if (runtimeEnvironment['EAS_BUILD_DISABLE_COCOAPODS_CACHE'] === '1') {
+      return null;
+    }
+    const runtimeEnabled = runtimeSettings.caches?.[process.platform]?.cocoapods;
+    if (runtimeEnabled === false) {
+      return null;
+    }
+    const envOverride = runtimeEnvironment['EAS_USE_COCOAPODS_CACHE'];
+    const enabled = envOverride === '1' || (envOverride !== '0' && runtimeEnabled);
+    return enabled ? process.env.EAS_COCOAPODS_CACHE_URL || null : null;
   }
 }

packages/build-tools/src/steps/easFunctions.ts

@@ -61,7 +61,7 @@ export function getEasFunctions(ctx: CustomBuildContext): BuildFunction[] {
     createInstallNodeModulesBuildFunction(),
     createPrebuildBuildFunction(),
     createReadIpaInfoBuildFunction(),
-    createDownloadBuildFunction(),
+    createDownloadBuildFunction(ctx),
     createEasExportBuildFunction(),
     createEasDeployBuildFunction(),
     createRepackBuildFunction(),

packages/build-tools/src/steps/functions/__tests__/downloadBuild.test.ts

@@ -1,4 +1,6 @@
+import { SystemError, UserError } from '@expo/eas-build-job';
 import { createLogger } from '@expo/logger';
+import { Client, CombinedError } from '@urql/core';
 import fetch, { Response } from 'node-fetch';
 import { randomUUID } from 'node:crypto';
 import fs from 'node:fs';
@@ -17,22 +19,63 @@ const APP_TAR_GZ_BUFFER = Buffer.from(
   'base64'
 );
 
+const APPLICATION_ARCHIVE_URL = `https://expo.dev/artifacts/eas/${randomUUID()}.tar.gz`;
+
+function createMockGraphqlClient({
+  applicationArchiveUrl,
+  error,
+}: {
+  applicationArchiveUrl?: string | null;
+  error?: Error;
+}): Client {
+  const toPromise = jest.fn().mockResolvedValue(
+    error
+      ? { error, data: undefined }
+      : {
+          data: {
+            builds: {
+              byId: {
+                id: randomUUID(),
+                platform: 'IOS',
+                artifacts: {
+                  applicationArchiveUrl: applicationArchiveUrl ?? null,
+                },
+              },
+            },
+          },
+        }
+  );
+
+  return {
+    query: jest.fn().mockReturnValue({ toPromise }),
+  } as unknown as Client;
+}
+
 describe('downloadBuild', () => {
-  it('should handle an archive', async () => {
+  it('downloads from applicationArchiveUrl returned by GraphQL', async () => {
+    const buildId = randomUUID();
+    const graphqlClient = createMockGraphqlClient({
+      applicationArchiveUrl: APPLICATION_ARCHIVE_URL,
+    });
+
     jest.mocked(fetch).mockResolvedValue({
       ok: true,
       body: Readable.from(APP_TAR_GZ_BUFFER),
-      url: `https://storage.googleapis.com/eas-workflows-production/artifacts/${randomUUID()}/${randomUUID()}/application-${randomUUID()}.tar.gz?X-Goog-Algorithm=GOOG4-RSA-SHA256`,
+      url: APPLICATION_ARCHIVE_URL,
     } as unknown as Response);
 
     const { artifactPath } = await downloadBuildAsync({
       logger: createLogger({ name: 'test' }),
-      buildId: randomUUID(),
-      expoApiServerURL: 'http://api.expo.test',
+      buildId,
+      graphqlClient,
       robotAccessToken: null,
       extensions: ['app'],
     });
 
+    expect(jest.mocked(fetch)).toHaveBeenCalledWith(
+      APPLICATION_ARCHIVE_URL,
+      expect.objectContaining({ headers: undefined })
+    );
     expect(artifactPath).toBeDefined();
     expect(await fs.promises.readFile(path.join(artifactPath, 'TestApp'), 'utf8')).toBe(
       'i am executable\n'
@@ -40,16 +83,21 @@ describe('downloadBuild', () => {
   });
 
   it('should handle a straight-up file', async () => {
+    const applicationArchiveUrl = `https://expo.dev/artifacts/eas/${randomUUID()}.apk`;
+    const graphqlClient = createMockGraphqlClient({
+      applicationArchiveUrl,
+    });
+
     jest.mocked(fetch).mockResolvedValue({
       ok: true,
       body: Readable.from(Buffer.from('hello')),
-      url: `https://storage.googleapis.com/eas-workflows-production/artifacts/${randomUUID()}/${randomUUID()}/application-${randomUUID()}.txt?X-Goog-Algorithm=GOOG4-RSA-SHA256`,
+      url: applicationArchiveUrl,
     } as unknown as Response);
 
     const { artifactPath } = await downloadBuildAsync({
       logger: createLogger({ name: 'test' }),
       buildId: randomUUID(),
-      expoApiServerURL: 'http://api.expo.test',
+      graphqlClient,
       robotAccessToken: null,
       extensions: ['app'],
     });
@@ -58,18 +106,114 @@ describe('downloadBuild', () => {
     expect(await fs.promises.readFile(artifactPath, 'utf-8')).toBe('hello');
   });
 
+  it('throws UserError when the build has no application archive url', async () => {
+    const graphqlClient = createMockGraphqlClient({ applicationArchiveUrl: null });
+
+    await expect(
+      downloadBuildAsync({
+        logger: createLogger({ name: 'test' }),
+        buildId: randomUUID(),
+        graphqlClient,
+        robotAccessToken: null,
+        extensions: ['app'],
+      })
+    ).rejects.toMatchObject({
+      errorCode: 'EAS_DOWNLOAD_BUILD_NO_APPLICATION_ARCHIVE',
+      message: 'Build does not have an application archive url',
+    });
+
+    expect(jest.mocked(fetch)).not.toHaveBeenCalled();
+  });
+
+  it('throws SystemError when GraphQL request fails with a network error', async () => {
+    const buildId = randomUUID();
+    const graphqlClient = createMockGraphqlClient({
+      error: new CombinedError({
+        networkError: new Error('Network request failed'),
+      }),
+    });
+
+    const promise = downloadBuildAsync({
+      logger: createLogger({ name: 'test' }),
+      buildId,
+      graphqlClient,
+      robotAccessToken: null,
+      extensions: ['app'],
+    });
+
+    await expect(promise).rejects.toBeInstanceOf(SystemError);
+    await expect(promise).rejects.toMatchObject({
+      message: `Could not fetch build ${buildId}: [Network] Network request failed`,
+    });
+
+    expect(jest.mocked(fetch)).not.toHaveBeenCalled();
+  });
+
+  it('throws SystemError when GraphQL request returns 5xx', async () => {
+    const buildId = randomUUID();
+    const graphqlClient = createMockGraphqlClient({
+      error: Object.assign(new Error('Internal Server Error'), {
+        response: { status: 500 },
+      }),
+    });
+
+    const promise = downloadBuildAsync({
+      logger: createLogger({ name: 'test' }),
+      buildId,
+      graphqlClient,
+      robotAccessToken: null,
+      extensions: ['app'],
+    });
+
+    await expect(promise).rejects.toBeInstanceOf(SystemError);
+    await expect(promise).rejects.toMatchObject({
+      message: `Could not fetch build ${buildId}: Internal Server Error`,
+    });
+
+    expect(jest.mocked(fetch)).not.toHaveBeenCalled();
+  });
+
+  it('throws UserError when GraphQL returns a client error', async () => {
+    const buildId = randomUUID();
+    const graphqlClient = createMockGraphqlClient({
+      error: new CombinedError({
+        graphQLErrors: [{ message: 'Build not found' }],
+      }),
+    });
+
+    const promise = downloadBuildAsync({
+      logger: createLogger({ name: 'test' }),
+      buildId,
+      graphqlClient,
+      robotAccessToken: null,
+      extensions: ['app'],
+    });
+
+    await expect(promise).rejects.toBeInstanceOf(UserError);
+    await expect(promise).rejects.toMatchObject({
+      errorCode: 'EAS_DOWNLOAD_BUILD_FETCH_FAILED',
+      message: `Could not fetch build ${buildId}: [GraphQL] Build not found`,
+    });
+
+    expect(jest.mocked(fetch)).not.toHaveBeenCalled();
+  });
+
   it('should throw an error if no matching files are found', async () => {
+    const graphqlClient = createMockGraphqlClient({
+      applicationArchiveUrl: APPLICATION_ARCHIVE_URL,
+    });
+
     jest.mocked(fetch).mockResolvedValue({
       ok: true,
       body: Readable.from(APP_TAR_GZ_BUFFER),
-      url: `https://storage.googleapis.com/eas-workflows-production/artifacts/${randomUUID()}/${randomUUID()}/application-${randomUUID()}.tar.gz?X-Goog-Algorithm=GOOG4-RSA-SHA256`,
+      url: APPLICATION_ARCHIVE_URL,
     } as unknown as Response);
 
     await expect(
       downloadBuildAsync({
         logger: createLogger({ name: 'test' }),
         buildId: randomUUID(),
-        expoApiServerURL: 'http://api.expo.test',
+        graphqlClient,
         robotAccessToken: null,
         extensions: ['apk'],
       })
@@ -79,7 +223,11 @@ describe('downloadBuild', () => {
 
 describe('createDownloadBuildFunction', () => {
   it('should download a build', async () => {
-    const downloadBuild = createDownloadBuildFunction();
+    const buildId = randomUUID();
+    const graphqlClient = createMockGraphqlClient({
+      applicationArchiveUrl: APPLICATION_ARCHIVE_URL,
+    });
+    const downloadBuild = createDownloadBuildFunction({ graphqlClient } as any);
     const logger = createMockLogger();
 
     const buildStep = downloadBuild.createBuildStepFromFunctionCall(
@@ -92,7 +240,7 @@ describe('createDownloadBuildFunction', () => {
       }),
       {
         callInputs: {
-          build_id: randomUUID(),
+          build_id: buildId,
           extensions: ['app'],
         },
       }
@@ -105,5 +253,9 @@ describe('createDownloadBuildFunction', () => {
     } as unknown as Response);
 
     await expect(buildStep.executeAsync()).rejects.toThrow('Internal Server Error');
+    expect(jest.mocked(fetch)).toHaveBeenCalledWith(
+      APPLICATION_ARCHIVE_URL,
+      expect.objectContaining({ headers: undefined })
+    );
   });
 });

packages/build-tools/src/steps/functions/__tests__/maestroResultParser.test.ts

@@ -4,10 +4,14 @@ import { vol } from 'memfs';
 
 import {
   copyLatestAttemptXml,
+  isFileAttrRun,
+  junitFileHasFileAttrs,
   mergeJUnitReports,
+  parseFailedFlowsFromFileAttrs,
   parseFailedFlowsFromJUnit,
   parseJUnitTestCases,
   parseMaestroResults,
+  parseMaestroResultsFromFileAttrs,
 } from '../maestroResultParser';
 
 describe(parseMaestroResults, () => {
@@ -298,7 +302,169 @@ describe(parseMaestroResults, () => {
   });
 });
 
+describe(parseMaestroResultsFromFileAttrs, () => {
+  it('uses file= as the path', async () => {
+    vol.fromJSON({
+      '/junit/report.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites><testsuite>',
+        '  <testcase name="login" file=".maestro/login.yaml" status="SUCCESS" time="1.0"/>',
+        '</testsuite></testsuites>',
+      ].join('\n'),
+    });
+    const results = await parseMaestroResultsFromFileAttrs('/junit');
+    expect(results[0]).toEqual(
+      expect.objectContaining({ name: 'login', path: '.maestro/login.yaml' })
+    );
+  });
+
+  it('keeps two same-named flows separate by their file= path', async () => {
+    vol.fromJSON({
+      '/junit/report.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites><testsuite>',
+        '  <testcase name="login" file="a/login.yaml" status="SUCCESS" time="1.0"/>',
+        '  <testcase name="login" file="b/login.yaml" status="ERROR" time="1.0"><failure>x</failure></testcase>',
+        '</testsuite></testsuites>',
+      ].join('\n'),
+    });
+    const results = await parseMaestroResultsFromFileAttrs('/junit');
+    expect(results.map(r => r.path).sort()).toEqual(['a/login.yaml', 'b/login.yaml']);
+  });
+
+  it('returns per-attempt results keyed by file= across attempt files', async () => {
+    vol.fromJSON({
+      '/junit/android-maestro-junit-attempt-0.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites><testsuite>',
+        '  <testcase name="login" file="flows/login.yaml" time="1.0"><failure>x</failure></testcase>',
+        '</testsuite></testsuites>',
+      ].join('\n'),
+      '/junit/android-maestro-junit-attempt-1.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites><testsuite>',
+        '  <testcase name="login" file="flows/login.yaml" status="SUCCESS" time="1.0"/>',
+        '</testsuite></testsuites>',
+      ].join('\n'),
+    });
+    const results = await parseMaestroResultsFromFileAttrs('/junit');
+    expect(results).toEqual([
+      expect.objectContaining({ path: 'flows/login.yaml', status: 'failed', retryCount: 0 }),
+      expect.objectContaining({ path: 'flows/login.yaml', status: 'passed', retryCount: 1 }),
+    ]);
+  });
+
+  it('returns empty array when the directory does not exist', async () => {
+    const results = await parseMaestroResultsFromFileAttrs('/nope');
+    expect(results).toEqual([]);
+  });
+
+  it('skips testcases without file= instead of emitting an undefined path (contract guard)', async () => {
+    vol.fromJSON({
+      '/junit/report.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites><testsuite>',
+        '  <testcase name="a" file="a.yaml" status="SUCCESS" time="1.0"/>',
+        '  <testcase name="b" status="SUCCESS" time="1.0"/>',
+        '</testsuite></testsuites>',
+      ].join('\n'),
+    });
+    const results = await parseMaestroResultsFromFileAttrs('/junit');
+    expect(results).toEqual([expect.objectContaining({ name: 'a', path: 'a.yaml' })]);
+  });
+});
+
+describe('junitFileHasFileAttrs', () => {
+  it('returns true when every testcase has a non-empty file= attribute', async () => {
+    vol.fromJSON({
+      '/junit/report.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites><testsuite>',
+        '  <testcase name="a" file="a.yaml" status="SUCCESS" time="1.0"/>',
+        '  <testcase name="b" file="b.yaml" status="SUCCESS" time="1.0"/>',
+        '</testsuite></testsuites>',
+      ].join('\n'),
+    });
+    expect(await junitFileHasFileAttrs('/junit/report.xml')).toBe(true);
+  });
+
+  it('returns false when any testcase lacks file= (mixed report)', async () => {
+    vol.fromJSON({
+      '/junit/report.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites><testsuite>',
+        '  <testcase name="a" file="a.yaml" status="SUCCESS" time="1.0"/>',
+        '  <testcase name="b" status="SUCCESS" time="1.0"/>',
+        '</testsuite></testsuites>',
+      ].join('\n'),
+    });
+    expect(await junitFileHasFileAttrs('/junit/report.xml')).toBe(false);
+  });
+
+  it('returns false when file= is an empty string', async () => {
+    vol.fromJSON({
+      '/junit/report.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites><testsuite>',
+        '  <testcase name="a" file="" status="SUCCESS" time="1.0"/>',
+        '</testsuite></testsuites>',
+      ].join('\n'),
+    });
+    expect(await junitFileHasFileAttrs('/junit/report.xml')).toBe(false);
+  });
+
+  it('returns false for a legacy report with no file= attributes', async () => {
+    vol.fromJSON({
+      '/junit/report.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites><testsuite>',
+        '  <testcase name="a" status="SUCCESS" time="1.0"/>',
+        '</testsuite></testsuites>',
+      ].join('\n'),
+    });
+    expect(await junitFileHasFileAttrs('/junit/report.xml')).toBe(false);
+  });
+
+  it('returns false when the file cannot be read', async () => {
+    expect(await junitFileHasFileAttrs('/missing.xml')).toBe(false);
+  });
+});
+
+describe('isFileAttrRun', () => {
+  it('returns false for an empty list (an empty report is not a file-attr run)', () => {
+    expect(isFileAttrRun([])).toBe(false);
+  });
+});
+
 describe(parseJUnitTestCases, () => {
+  it('extracts the file= attribute when present', async () => {
+    vol.fromJSON({
+      '/junit/report.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites><testsuite>',
+        '  <testcase name="login" file=".maestro/login.yaml" status="SUCCESS" time="1.0"/>',
+        '</testsuite></testsuites>',
+      ].join('\n'),
+    });
+    const results = await parseJUnitTestCases('/junit');
+    expect(results[0].file).toBe('.maestro/login.yaml');
+  });
+
+  it('treats a missing or empty file= attribute as undefined', async () => {
+    vol.fromJSON({
+      '/junit/report.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites><testsuite>',
+        '  <testcase name="a" status="SUCCESS" time="1.0"/>',
+        '  <testcase name="b" file="" status="SUCCESS" time="1.0"/>',
+        '</testsuite></testsuites>',
+      ].join('\n'),
+    });
+    const results = await parseJUnitTestCases('/junit');
+    expect(results.find(r => r.name === 'a')!.file).toBeUndefined();
+    expect(results.find(r => r.name === 'b')!.file).toBeUndefined();
+  });
+
   it('parses a single testcase with SUCCESS status', async () => {
     vol.fromJSON({
       '/junit/report.xml': [
@@ -582,6 +748,100 @@ describe(parseJUnitTestCases, () => {
   });
 });
 
+describe(parseFailedFlowsFromFileAttrs, () => {
+  it('returns the failing flows by file= (duplicate names retry correctly)', async () => {
+    vol.fromJSON({
+      '/tmp/jr/attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="login" file="a/login.yaml" status="SUCCESS" time="1.0"/>
+  <testcase name="login" file="b/login.yaml" time="1.0"><failure>x</failure></testcase>
+</testsuite></testsuites>`,
+      '/proj/b/login.yaml': '',
+    });
+    const result = await parseFailedFlowsFromFileAttrs({
+      junitFile: '/tmp/jr/attempt-0.xml',
+      workingDirectory: '/proj',
+    });
+    expect(result).toEqual(['b/login.yaml']);
+  });
+
+  it('returns null when a file= path does not exist on disk (dumb retry, never legacy)', async () => {
+    vol.fromJSON({
+      '/tmp/jr/attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="gone" file="missing/flow.yaml" time="1.0"><failure>x</failure></testcase>
+</testsuite></testsuites>`,
+    });
+    const result = await parseFailedFlowsFromFileAttrs({
+      junitFile: '/tmp/jr/attempt-0.xml',
+      workingDirectory: '/proj',
+    });
+    expect(result).toBeNull();
+  });
+
+  it('returns null when the report lacks file= attributes (callers must pre-check)', async () => {
+    vol.fromJSON({
+      '/tmp/jr/attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="A" file="a.yaml" time="1.0"><failure>x</failure></testcase>
+  <testcase name="B" time="1.0"><failure>y</failure></testcase>
+</testsuite></testsuites>`,
+      '/proj/a.yaml': '',
+    });
+    const result = await parseFailedFlowsFromFileAttrs({
+      junitFile: '/tmp/jr/attempt-0.xml',
+      workingDirectory: '/proj',
+    });
+    expect(result).toBeNull();
+  });
+
+  it('dedupes repeated failing file= paths (same flow failed twice in one attempt)', async () => {
+    vol.fromJSON({
+      '/tmp/jr/attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="login" file="flows/login.yaml" time="1.0"><failure>x</failure></testcase>
+  <testcase name="login" file="flows/login.yaml" time="1.0"><failure>y</failure></testcase>
+</testsuite></testsuites>`,
+      '/proj/flows/login.yaml': '',
+    });
+    const result = await parseFailedFlowsFromFileAttrs({
+      junitFile: '/tmp/jr/attempt-0.xml',
+      workingDirectory: '/proj',
+    });
+    expect(result).toEqual(['flows/login.yaml']);
+  });
+
+  it('resolves and existence-checks an absolute file= path', async () => {
+    vol.fromJSON({
+      '/tmp/jr/attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="ext" file="/outside/flow.yaml" time="1.0"><failure>x</failure></testcase>
+</testsuite></testsuites>`,
+      '/outside/flow.yaml': '',
+    });
+    const result = await parseFailedFlowsFromFileAttrs({
+      junitFile: '/tmp/jr/attempt-0.xml',
+      workingDirectory: '/proj',
+    });
+    expect(result).toEqual(['/outside/flow.yaml']);
+  });
+
+  it('returns null when junit XML is truncated mid-tag (partial parse risk)', async () => {
+    vol.fromJSON({
+      '/tmp/jr/attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="A" file="a.yaml" time="1.0"><failure>x</failure></testcase>
+  <testcase name="B" file="b.yaml"`, // intentionally truncated mid-tag
+      '/proj/a.yaml': '',
+    });
+    const result = await parseFailedFlowsFromFileAttrs({
+      junitFile: '/tmp/jr/attempt-0.xml',
+      workingDirectory: '/proj',
+    });
+    expect(result).toBeNull();
+  });
+});
+
 describe('parseFailedFlowsFromJUnit', () => {
   it('returns the subset of input flow paths whose testcases failed', async () => {
     vol.fromJSON({
@@ -765,6 +1025,28 @@ describe('mergeJUnitReports', () => {
     expect(b.failure).toBeUndefined();
   });
 
+  it('keeps a same-named flow from an earlier attempt when keyed by file=', async () => {
+    vol.fromJSON({
+      '/tmp/r/android-maestro-junit-attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="login" file="a/login.yaml" status="SUCCESS" time="1.0"/>
+  <testcase name="login" file="b/login.yaml" time="1.0"><failure>x</failure></testcase>
+</testsuite></testsuites>`,
+      '/tmp/r/android-maestro-junit-attempt-1.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="login" file="b/login.yaml" status="SUCCESS" time="1.0"/>
+</testsuite></testsuites>`,
+    });
+
+    await mergeJUnitReports({ sourceDir: '/tmp/r', outputPath: '/tmp/final.xml' });
+
+    const out = await fs.readFile('/tmp/final.xml', 'utf-8');
+    const parsed = new XMLParser({ ignoreAttributes: false }).parse(out);
+    const testcases = parsed.testsuites.testsuite.testcase;
+    const files = testcases.map((t: any) => t['@_file']).sort();
+    expect(files).toEqual(['a/login.yaml', 'b/login.yaml']);
+  });
+
   it('throws when source directory contains no *.xml files', async () => {
     // No per-attempt JUnit files were ever written (maestro crashed before
     // producing output). Phase 3 in runMaestroTests treats this as a SystemError

packages/build-tools/src/steps/functions/__tests__/maestroTests.test.ts

@@ -273,6 +273,33 @@ describe('createMaestroTestsBuildFunction', () => {
     );
   });
 
+  it('uses the file= path on reports that carry it, without scanning flow files', async () => {
+    mockedSpawn.mockRejectedValueOnce(rejectExit1()).mockResolvedValueOnce(SPAWN_SUCCESS);
+    jest.spyOn(parser, 'junitFileHasFileAttrs').mockResolvedValue(true);
+    const discoverySpy = jest.spyOn(discovery, 'buildFlowNameToPathMap');
+    const legacyParseSpy = jest.spyOn(parser, 'parseFailedFlowsFromJUnit');
+    const newParseSpy = jest
+      .spyOn(parser, 'parseFailedFlowsFromFileAttrs')
+      .mockResolvedValue(['flows/b.yaml']);
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml', 'flows/b.yaml'],
+      retries: 1,
+      output_format: 'junit',
+      retry_failed_only: true,
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    expect(newParseSpy).toHaveBeenCalledTimes(1);
+    // The new branch needs no name→path map: no scan, no legacy parser.
+    expect(discoverySpy).not.toHaveBeenCalled();
+    expect(legacyParseSpy).not.toHaveBeenCalled();
+    const a1 = mockedSpawn.mock.calls[1][1]!;
+    expect(a1).toContain('flows/b.yaml');
+    expect(a1).not.toContain('flows/a.yaml');
+  });
+
   it('falls back to all-flows retry when nameToPath is null (duplicate flow names)', async () => {
     mockedSpawn.mockRejectedValueOnce(rejectExit1()).mockResolvedValueOnce(SPAWN_SUCCESS);
     jest.spyOn(discovery, 'buildFlowNameToPathMap').mockResolvedValue(null);
@@ -293,6 +320,44 @@ describe('createMaestroTestsBuildFunction', () => {
     );
   });
 
+  it('never scans flow files when all attempts succeed', async () => {
+    mockedSpawn.mockResolvedValue(SPAWN_SUCCESS);
+    const discoverySpy = jest.spyOn(discovery, 'buildFlowNameToPathMap');
+
+    const step = createStep({ flow_path: ['flows/a.yaml'], platform: 'android' });
+    await step.executeAsync();
+
+    expect(discoverySpy).not.toHaveBeenCalled();
+  });
+
+  it('memoizes the flow scan across retries (legacy reports)', async () => {
+    // Routing note: the step lands in the legacy arm because the real
+    // junitFileHasFileAttrs returns false — the attempt XML does not exist on
+    // the mock fs. Creating that file with file= attrs would flip the branch.
+    mockedSpawn
+      .mockRejectedValueOnce(rejectExit1())
+      .mockRejectedValueOnce(rejectExit1())
+      .mockResolvedValueOnce(SPAWN_SUCCESS);
+    const discoverySpy = jest
+      .spyOn(discovery, 'buildFlowNameToPathMap')
+      .mockResolvedValue(new Map([['a', 'flows/a.yaml']]));
+    const parseSpy = jest
+      .spyOn(parser, 'parseFailedFlowsFromJUnit')
+      .mockResolvedValue(['flows/a.yaml']);
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml'],
+      retries: 2,
+      output_format: 'junit',
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    // Two failed attempts hit the legacy branch twice; the scan runs once.
+    expect(parseSpy).toHaveBeenCalledTimes(2);
+    expect(discoverySpy).toHaveBeenCalledTimes(1);
+  });
+
   it('defaults retry_failed_only to true when omitted from inputs', async () => {
     mockedSpawn.mockRejectedValueOnce(rejectExit1()).mockResolvedValueOnce(SPAWN_SUCCESS);
     jest.spyOn(parser, 'parseFailedFlowsFromJUnit').mockResolvedValue(['flows/b.yaml']);

packages/build-tools/src/steps/functions/__tests__/reportMaestroTestResults.test.ts

@@ -3,6 +3,7 @@ import { vol } from 'memfs';
 
 import { createGlobalContextMock } from '../../../__tests__/utils/context';
 import { createMockLogger } from '../../../__tests__/utils/logger';
+import * as discovery from '../maestroFlowDiscovery';
 import { createReportMaestroTestResultsFunction } from '../reportMaestroTestResults';
 
 const JUNIT_PASS = [
@@ -43,15 +44,24 @@ describe(createReportMaestroTestResultsFunction, () => {
     } as unknown as Client;
   });
 
+  // Returns a mock logger whose child() is itself, so step-level log calls can
+  // be asserted on the returned object.
+  function createSelfChildedLogger(): ReturnType<typeof createMockLogger> {
+    const logger = createMockLogger();
+    (logger.child as jest.Mock).mockReturnValue(logger);
+    return logger;
+  }
+
   function createStep(overrides?: {
     callInputs?: Record<string, unknown>;
     staticContextContent?: Record<string, unknown>;
     env?: Record<string, string>;
+    logger?: ReturnType<typeof createMockLogger>;
   }) {
     const ctx = { graphqlClient: mockGraphqlClient };
     const fn = createReportMaestroTestResultsFunction(ctx as any);
     const globalCtx = createGlobalContextMock({
-      logger: createMockLogger(),
+      logger: overrides?.logger ?? createMockLogger(),
       projectTargetDirectory: '/root/project',
       staticContextContent: {
         expoApiServerURL: 'https://api.expo.test',
@@ -105,6 +115,54 @@ describe(createReportMaestroTestResultsFunction, () => {
     ]);
   });
 
+  it('reports both flows when two share a name but have distinct file= paths', async () => {
+    vol.fromJSON({
+      '/junit/report.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites><testsuite>',
+        '  <testcase name="login" file="a/login.yaml" status="SUCCESS" time="1.0"/>',
+        '  <testcase name="login" file="b/login.yaml" status="SUCCESS" time="1.0"/>',
+        '</testsuite></testsuites>',
+      ].join('\n'),
+    });
+    mockMutationFn.mockResolvedValue({
+      data: {
+        workflowDeviceTestCaseResult: {
+          createWorkflowDeviceTestCaseResults: [{ id: '1' }, { id: '2' }],
+        },
+      },
+    });
+    await createStep().executeAsync();
+    expect(mockGraphqlClient.mutation).toHaveBeenCalledTimes(1);
+    const [, variables] = (mockGraphqlClient.mutation as jest.Mock).mock.calls[0];
+    expect(variables.input.testCaseResults.map((r: any) => r.path).sort()).toEqual([
+      'a/login.yaml',
+      'b/login.yaml',
+    ]);
+  });
+
+  it('never scans flow files for a file= report, even when flow_path is provided', async () => {
+    vol.fromJSON({
+      '/junit/report.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites><testsuite>',
+        '  <testcase name="login" file="flows/login.yaml" status="SUCCESS" time="1.0"/>',
+        '</testsuite></testsuites>',
+      ].join('\n'),
+    });
+    const discoverySpy = jest.spyOn(discovery, 'buildFlowNameToPathMap');
+    mockMutationFn.mockResolvedValue({
+      data: {
+        workflowDeviceTestCaseResult: { createWorkflowDeviceTestCaseResults: [{ id: '1' }] },
+      },
+    });
+
+    await createStep({ callInputs: { flow_path: ['flows/login.yaml'] } }).executeAsync();
+
+    expect(mockGraphqlClient.mutation).toHaveBeenCalledTimes(1);
+    expect(discoverySpy).not.toHaveBeenCalled();
+  });
+
   it('sends tags and properties from JUnit XML', async () => {
     vol.fromJSON({
       '/junit/report.xml': [
@@ -221,7 +279,7 @@ describe(createReportMaestroTestResultsFunction, () => {
     await createStep().executeAsync();
   });
 
-  it('skips report when duplicate testcase names found', async () => {
+  it('skips report when duplicate testcase names found (legacy), advising unique names', async () => {
     vol.fromJSON({
       '/junit/report.xml': [
         '<?xml version="1.0"?>',
@@ -238,8 +296,27 @@ describe(createReportMaestroTestResultsFunction, () => {
       }),
     });
 
-    await createStep().executeAsync();
+    const logger = createSelfChildedLogger();
+    await createStep({ logger }).executeAsync();
     expect(mockGraphqlClient.mutation).not.toHaveBeenCalled();
+    expect(logger.error).toHaveBeenCalledWith(expect.stringContaining('unique name'));
+  });
+
+  it('skips report when the same flow file appears twice in one attempt, advising flow_path check', async () => {
+    vol.fromJSON({
+      '/junit/report.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites><testsuite>',
+        '  <testcase name="login" file="flows/login.yaml" status="SUCCESS" time="1.0"/>',
+        '  <testcase name="login" file="flows/login.yaml" status="SUCCESS" time="2.0"/>',
+        '</testsuite></testsuites>',
+      ].join('\n'),
+    });
+
+    const logger = createSelfChildedLogger();
+    await createStep({ logger }).executeAsync();
+    expect(mockGraphqlClient.mutation).not.toHaveBeenCalled();
+    expect(logger.error).toHaveBeenCalledWith(expect.stringContaining('flow_path entries'));
   });
 
   it('sends per-attempt results with same name but different retryCount', async () => {

packages/build-tools/src/steps/functions/__tests__/startArgentRemoteSession.test.ts

@@ -0,0 +1,58 @@
+import { SystemError } from '@expo/eas-build-job';
+import { type bunyan } from '@expo/logger';
+
+import { warnIfArgentPackageVersionCannotBeVerified } from '../startArgentRemoteSession';
+
+describe(warnIfArgentPackageVersionCannotBeVerified, () => {
+  const warn = jest.fn();
+  const logger = { warn } as unknown as bunyan;
+
+  beforeEach(() => {
+    warn.mockClear();
+  });
+
+  it('allows the default latest package version', () => {
+    expect(() =>
+      warnIfArgentPackageVersionCannotBeVerified({ packageVersion: undefined, logger })
+    ).not.toThrow();
+    expect(() =>
+      warnIfArgentPackageVersionCannotBeVerified({ packageVersion: 'latest', logger })
+    ).not.toThrow();
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  it('allows exact supported semver versions', () => {
+    expect(() =>
+      warnIfArgentPackageVersionCannotBeVerified({ packageVersion: '0.11.0', logger })
+    ).not.toThrow();
+    expect(() =>
+      warnIfArgentPackageVersionCannotBeVerified({ packageVersion: '0.11.1', logger })
+    ).not.toThrow();
+    expect(() =>
+      warnIfArgentPackageVersionCannotBeVerified({ packageVersion: 'v0.11.1', logger })
+    ).not.toThrow();
+    expect(warn).not.toHaveBeenCalled();
+  });
+
+  it('rejects exact semver versions that are too old', () => {
+    expect(() =>
+      warnIfArgentPackageVersionCannotBeVerified({ packageVersion: '0.10.9', logger })
+    ).toThrow(SystemError);
+    expect(() =>
+      warnIfArgentPackageVersionCannotBeVerified({ packageVersion: '0.10.9', logger })
+    ).toThrow(/Use "latest" or pass an exact version >= 0\.11\.0/);
+  });
+
+  it('warns for package tags or ranges that cannot be verified', () => {
+    expect(() =>
+      warnIfArgentPackageVersionCannotBeVerified({ packageVersion: 'next', logger })
+    ).not.toThrow();
+    expect(() =>
+      warnIfArgentPackageVersionCannotBeVerified({ packageVersion: '^0.11.0', logger })
+    ).not.toThrow();
+    expect(warn).toHaveBeenCalledTimes(2);
+    expect(warn).toHaveBeenCalledWith(
+      expect.stringContaining('Continuing and letting bunx resolve it.')
+    );
+  });
+});

packages/build-tools/src/steps/functions/downloadBuild.ts

@@ -1,4 +1,4 @@
-import { UserError } from '@expo/eas-build-job';
+import { SystemError, UserError } from '@expo/eas-build-job';
 import { bunyan } from '@expo/logger';
 import { asyncResult } from '@expo/results';
 import {
@@ -7,7 +7,9 @@ import {
   BuildStepInputValueTypeName,
   BuildStepOutput,
 } from '@expo/steps';
+import { Client } from '@urql/core';
 import { glob } from 'fast-glob';
+import { graphql } from 'gql.tada';
 import fetch from 'node-fetch';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -16,6 +18,7 @@ import stream from 'stream';
 import { promisify } from 'util';
 import { z } from 'zod';
 
+import { CustomBuildContext } from '../../customBuildContext';
 import { formatBytes } from '../../utils/artifacts';
 import { decompressTarAsync, isFileTarGzAsync } from '../../utils/files';
 import { retryOnDNSFailure } from '../../utils/retryOnDNSFailure';
@@ -23,7 +26,21 @@ import { pluralize } from '../../utils/strings';
 
 const streamPipeline = promisify(stream.pipeline);
 
-export function createDownloadBuildFunction(): BuildFunction {
+const BUILD_BY_ID_QUERY = graphql(`
+  query DownloadBuildByIdQuery($buildId: ID!) {
+    builds {
+      byId(buildId: $buildId) {
+        id
+        platform
+        artifacts {
+          applicationArchiveUrl
+        }
+      }
+    }
+  }
+`);
+
+export function createDownloadBuildFunction(ctx: CustomBuildContext): BuildFunction {
   return new BuildFunction({
     namespace: 'eas',
     id: 'download_build',
@@ -59,7 +76,7 @@ export function createDownloadBuildFunction(): BuildFunction {
       const { artifactPath } = await downloadBuildAsync({
         logger,
         buildId,
-        expoApiServerURL: stepsCtx.global.staticContext.expoApiServerURL,
+        graphqlClient: ctx.graphqlClient,
         robotAccessToken: stepsCtx.global.staticContext.job.secrets?.robotAccessToken ?? null,
         extensions,
       });
@@ -69,16 +86,45 @@ export function createDownloadBuildFunction(): BuildFunction {
   });
 }
 
+async function fetchApplicationArchiveUrlAsync({
+  buildId,
+  graphqlClient,
+}: {
+  buildId: string;
+  graphqlClient: Client;
+}): Promise<string> {
+  const result = await graphqlClient.query(BUILD_BY_ID_QUERY, { buildId }).toPromise();
+
+  if (result.error) {
+    const { error } = result;
+    const message = `Could not fetch build ${buildId}: ${error.message}`;
+
+    throw error.networkError || result.error.response?.status >= 500
+      ? new SystemError(message, { cause: error })
+      : new UserError('EAS_DOWNLOAD_BUILD_FETCH_FAILED', message, { cause: error });
+  }
+
+  const applicationArchiveUrl = result.data?.builds.byId?.artifacts?.applicationArchiveUrl;
+  if (!applicationArchiveUrl) {
+    throw new UserError(
+      'EAS_DOWNLOAD_BUILD_NO_APPLICATION_ARCHIVE',
+      'Build does not have an application archive url'
+    );
+  }
+
+  return applicationArchiveUrl;
+}
+
 export async function downloadBuildAsync({
   logger,
   buildId,
-  expoApiServerURL,
+  graphqlClient,
   robotAccessToken,
   extensions,
 }: {
   logger: bunyan;
   buildId: string;
-  expoApiServerURL: string;
+  graphqlClient: Client;
   robotAccessToken: string | null;
   extensions: string[];
 }): Promise<{ artifactPath: string }> {
@@ -86,12 +132,11 @@ export async function downloadBuildAsync({
     path.join(os.tmpdir(), 'download_build-downloaded-')
   );
 
-  const response = await retryOnDNSFailure(fetch)(
-    new URL(`/v2/artifacts/eas/${buildId}`, expoApiServerURL),
-    {
-      headers: robotAccessToken ? { Authorization: `Bearer ${robotAccessToken}` } : undefined,
-    }
-  );
+  const downloadUrl = await fetchApplicationArchiveUrlAsync({ buildId, graphqlClient });
+
+  const response = await retryOnDNSFailure(fetch)(downloadUrl, {
+    headers: robotAccessToken ? { Authorization: `Bearer ${robotAccessToken}` } : undefined,
+  });
 
   if (!response.ok) {
     const textResult = await asyncResult(response.text());

packages/build-tools/src/steps/functions/findAndUploadBuildArtifacts.ts

@@ -26,14 +26,14 @@ export function createFindAndUploadBuildArtifactsBuildFunction(
       try {
         await uploadApplicationArchivesAsync({ ctx, stepCtx });
       } catch (err: unknown) {
-        stepCtx.logger.error(`Failed to upload application archives.`, err);
+        stepCtx.logger.error({ err }, `Failed to upload application archives.`);
         firstError ||= err;
       }
 
       try {
         await uploadBuildArtifacts({ ctx, stepCtx });
       } catch (err: unknown) {
-        stepCtx.logger.error(`Failed to upload build artifacts.`, err);
+        stepCtx.logger.error({ err }, `Failed to upload build artifacts.`);
         firstError ||= err;
       }
 

packages/build-tools/src/steps/functions/maestroResultParser.ts

@@ -1,3 +1,4 @@
+import { asyncResult } from '@expo/results';
 import { XMLBuilder, XMLParser, XMLValidator } from 'fast-xml-parser';
 import fs from 'fs/promises';
 import path from 'path';
@@ -18,6 +19,7 @@ const ATTEMPT_PATTERN = /attempt-(\d+)/;
 
 export interface JUnitTestCaseResult {
   name: string;
+  file: string | undefined;
   status: 'passed' | 'failed';
   duration: number; // milliseconds
   errorMessage: string | null;
@@ -32,6 +34,12 @@ const xmlParser = new XMLParser({
   isArray: name => ['testsuite', 'testcase', 'property'].includes(name),
 });
 
+// A `file=` attribute counts as present only when it is a non-empty string.
+function fileAttrOf(tc: any): string | undefined {
+  const f = tc?.['@_file'];
+  return typeof f === 'string' && f.length > 0 ? f : undefined;
+}
+
 function parseJUnitContent(content: string): JUnitTestCaseResult[] {
   const results: JUnitTestCaseResult[] = [];
   try {
@@ -54,6 +62,8 @@ function parseJUnitContent(content: string): JUnitTestCaseResult[] {
           continue;
         }
 
+        const file = fileAttrOf(tc);
+
         const timeStr = tc['@_time'];
         const timeSeconds = timeStr ? parseFloat(timeStr) : 0;
         const duration = Number.isFinite(timeSeconds) ? Math.round(timeSeconds * 1000) : 0;
@@ -94,7 +104,7 @@ function parseJUnitContent(content: string): JUnitTestCaseResult[] {
           : [];
         delete properties['tags'];
 
-        results.push({ name, status, duration, errorMessage, tags, properties });
+        results.push({ name, file, status, duration, errorMessage, tags, properties });
       }
     }
   } catch {
@@ -131,6 +141,142 @@ export async function parseJUnitTestCases(junitDirectory: string): Promise<JUnit
   return perFile.flat();
 }
 
+// ---------------------------------------------------------------------------
+// Maestro >= 2.6.0 code path: every <testcase> carries a `file=` attribute with
+// its flow's own path (all-or-none per run). Callers check the report first
+// (isFileAttrRun / junitFileHasFileAttrs) and route here; the legacy name→path
+// scan is then never consulted.
+// ---------------------------------------------------------------------------
+
+export function isFileAttrRun(
+  testcases: JUnitTestCaseResult[]
+): testcases is (JUnitTestCaseResult & { file: string })[] {
+  return testcases.length > 0 && testcases.every(tc => tc.file !== undefined);
+}
+
+// Unreadable or attribute-less reports ⇒ false: the caller then takes the
+// legacy path, whose own guards degrade safely.
+export async function junitFileHasFileAttrs(junitFile: string): Promise<boolean> {
+  return isFileAttrRun(await parseJUnitFile(junitFile));
+}
+
+async function fileExists(absPath: string): Promise<boolean> {
+  return (await asyncResult(fs.stat(absPath))).ok;
+}
+
+// Group by `file=` so two same-named flows in different files stay separate.
+export async function parseMaestroResultsFromFileAttrs(
+  junitDirectory: string
+): Promise<MaestroFlowResult[]> {
+  interface JUnitEntry {
+    result: JUnitTestCaseResult;
+    sourceFile: string;
+  }
+
+  let junitEntries: string[];
+  try {
+    junitEntries = await fs.readdir(junitDirectory);
+  } catch {
+    return [];
+  }
+  const xmlFiles = junitEntries.filter(f => f.endsWith('.xml')).sort();
+
+  const entries: JUnitEntry[] = [];
+  for (const xmlFile of xmlFiles) {
+    const fileResults = await parseJUnitFile(path.join(junitDirectory, xmlFile));
+    for (const result of fileResults) {
+      entries.push({ result, sourceFile: xmlFile });
+    }
+  }
+
+  const byPath = new Map<string, JUnitEntry[]>();
+  for (const entry of entries) {
+    // Callers verify the report with isFileAttrRun/junitFileHasFileAttrs first;
+    // skip (rather than emit an undefined path) if that contract is violated.
+    const flowPath = entry.result.file;
+    if (flowPath === undefined) {
+      continue;
+    }
+    const group = byPath.get(flowPath) ?? [];
+    group.push(entry);
+    byPath.set(flowPath, group);
+  }
+
+  const results: MaestroFlowResult[] = [];
+  for (const [flowPath, group] of byPath) {
+    // retryCount is derived from each entry's source filename (`attempt-N`);
+    // a single entry from `report.xml` (no marker) collapses to attempt 0.
+    const sorted = group
+      .map(entry => {
+        const match = entry.sourceFile.match(ATTEMPT_PATTERN);
+        const attemptIndex = match ? parseInt(match[1], 10) : 0;
+        return { ...entry, attemptIndex };
+      })
+      .sort((a, b) => a.attemptIndex - b.attemptIndex);
+
+    for (const { result, attemptIndex } of sorted) {
+      results.push({
+        name: result.name,
+        path: flowPath,
+        status: result.status,
+        errorMessage: result.errorMessage,
+        duration: result.duration,
+        retryCount: attemptIndex,
+        tags: result.tags,
+        properties: result.properties,
+      });
+    }
+  }
+  return results;
+}
+
+/**
+ * Returns the `file=` paths of the failing testcases in the given attempt's
+ * JUnit file, or `null` when the result cannot be trusted (caller then falls
+ * back to dumb retry — re-run everything; never the legacy scan).
+ *
+ * Callers verify the report carries `file=` attributes first
+ * (junitFileHasFileAttrs).
+ */
+export async function parseFailedFlowsFromFileAttrs(args: {
+  junitFile: string;
+  workingDirectory: string;
+}): Promise<string[] | null> {
+  // Same hardening as the legacy parser: fast-xml-parser is lenient — a
+  // truncated XML could drop testcases, and trusting that partial failing set
+  // would skip retries for cut-off flows.
+  let content: string;
+  try {
+    content = await fs.readFile(args.junitFile, 'utf-8');
+  } catch {
+    return null;
+  }
+  if (XMLValidator.validate(content) !== true) {
+    return null;
+  }
+
+  const testcases = parseJUnitContent(content);
+  if (!isFileAttrRun(testcases)) {
+    return null;
+  }
+
+  const failing = testcases.filter(tc => tc.status === 'failed');
+  if (failing.length === 0) {
+    return [];
+  }
+
+  // Each failing testcase is self-identifying via `file=`, so duplicate flow
+  // names retry correctly. path.resolve (not join): `file=` may be absolute
+  // when the flow lives outside the working directory.
+  const paths = [...new Set(failing.map(tc => tc.file))];
+  for (const p of paths) {
+    if (!(await fileExists(path.resolve(args.workingDirectory, p)))) {
+      return null;
+    }
+  }
+  return paths;
+}
+
 export async function parseMaestroResults(
   junitDirectory: string,
   nameToPath: Map<string, string> | null
@@ -313,6 +459,13 @@ export async function mergeJUnitReports(args: {
     }
     const match = filename.match(ATTEMPT_PATTERN);
     const attemptIndex = match ? parseInt(match[1], 10) : 0;
+    // Maestro >= 2.6.0 reports: key by `file=` so two same-named flows in
+    // different files merge separately. Legacy reports keep name keying.
+    const allCases = testsuites.flatMap((suite: any) =>
+      Array.isArray(suite?.testcase) ? suite.testcase : []
+    );
+    const useFileKeys =
+      allCases.length > 0 && allCases.every((tc: any) => fileAttrOf(tc) !== undefined);
     const testcasesByName = new Map<string, unknown[]>();
     for (const suite of testsuites) {
       const cases = suite?.testcase;
@@ -324,9 +477,10 @@ export async function mergeJUnitReports(args: {
         if (typeof name !== 'string') {
           continue;
         }
-        const group = testcasesByName.get(name) ?? [];
+        const key = useFileKeys ? fileAttrOf(tc)! : name;
+        const group = testcasesByName.get(key) ?? [];
         group.push(tc);
-        testcasesByName.set(name, group);
+        testcasesByName.set(key, group);
       }
     }
     if (testcasesByName.size === 0) {

packages/build-tools/src/steps/functions/maestroTests.ts

@@ -14,7 +14,9 @@ import { z } from 'zod';
 import { buildFlowNameToPathMap } from './maestroFlowDiscovery';
 import {
   copyLatestAttemptXml,
+  junitFileHasFileAttrs,
   mergeJUnitReports,
+  parseFailedFlowsFromFileAttrs,
   parseFailedFlowsFromJUnit,
 } from './maestroResultParser';
 import { sleepAsync } from '../../utils/retry';
@@ -200,13 +202,10 @@ export function createMaestroTestsBuildFunction(): BuildFunction {
         throw new SystemError('Failed to create JUnit report directory', { cause: err });
       }
 
-      // null → duplicate flow names; retry-failed-only disabled, fall through to
-      // dumb retry (re-run everything) on failure.
-      const nameToPath = await buildFlowNameToPathMap({
-        inputFlowPaths: flowPaths,
-        projectRoot: stepCtx.workingDirectory,
-        logger,
-      });
+      // Legacy-only (Maestro < 2.6.0 reports carry no `file=` attribute): the
+      // flow scan is built lazily in the retry branch below and memoized so
+      // retries share one scan. Never runs when the report has `file=`.
+      let nameToPathPromise: Promise<Map<string, string> | null> | undefined;
 
       // Retry loop. spawn-async error shapes:
       //   ENOENT/EACCES → infra (binary missing/not executable) → SystemError.
@@ -214,7 +213,7 @@ export function createMaestroTestsBuildFunction(): BuildFunction {
       //   else (signal-only, OOM kill, unknown) → infra → SystemError, never
       //     downgraded to "tests failed".
       // Retry-failed-only (junit mode): after a failed attempt, subset to the failing
-      // flows. parseFailedFlowsFromJUnit returns null when the JUnit cannot be
+      // flows. The failed-flow parsers return null when the JUnit cannot be
       // trusted; we then fall through to dumb retry (re-run everything).
       let flowsToRun: string[] = flowPaths;
       let lastAttemptExitCode: number | null = null;
@@ -263,11 +262,26 @@ export function createMaestroTestsBuildFunction(): BuildFunction {
           break;
         }
 
-        if (retryFailedOnly && outputFormat === 'junit' && outputPath && nameToPath) {
-          const failed = await parseFailedFlowsFromJUnit({
-            junitFile: outputPath,
-            nameToPath,
-          });
+        if (retryFailedOnly && outputFormat === 'junit' && outputPath) {
+          let failed: string[] | null;
+          if (await junitFileHasFileAttrs(outputPath)) {
+            failed = await parseFailedFlowsFromFileAttrs({
+              junitFile: outputPath,
+              workingDirectory: stepCtx.workingDirectory,
+            });
+          } else {
+            // Legacy (Maestro < 2.6.0): map failed testcase names back to flow
+            // paths via the flow-file scan. DELETE this arm once the fleet is
+            // on >= 2.6.0.
+            const nameToPath = await (nameToPathPromise ??= buildFlowNameToPathMap({
+              inputFlowPaths: flowPaths,
+              projectRoot: stepCtx.workingDirectory,
+              logger,
+            }));
+            failed = nameToPath
+              ? await parseFailedFlowsFromJUnit({ junitFile: outputPath, nameToPath })
+              : null;
+          }
           if (failed !== null && failed.length > 0) {
             flowsToRun = failed;
             logger.info(

packages/build-tools/src/steps/functions/reportMaestroTestResults.ts

@@ -3,7 +3,13 @@ import { graphql } from 'gql.tada';
 import { z } from 'zod';
 
 import { buildFlowNameToPathMap } from './maestroFlowDiscovery';
-import { MaestroFlowResult, parseMaestroResults } from './maestroResultParser';
+import {
+  MaestroFlowResult,
+  isFileAttrRun,
+  parseJUnitTestCases,
+  parseMaestroResults,
+  parseMaestroResultsFromFileAttrs,
+} from './maestroResultParser';
 import { CustomBuildContext } from '../../customBuildContext';
 
 const FlowPathSchema = z.array(z.string().min(1)).min(1);
@@ -61,47 +67,64 @@ export function createReportMaestroTestResultsFunction(ctx: CustomBuildContext):
         return;
       }
 
-      const flowPathRaw = inputs.flow_path.value;
-      let nameToPath: Map<string, string> | null = null;
-      if (flowPathRaw !== undefined) {
-        const parsed = FlowPathSchema.safeParse(flowPathRaw);
-        if (parsed.success) {
-          nameToPath = await buildFlowNameToPathMap({
-            inputFlowPaths: parsed.data,
-            projectRoot: stepsCtx.workingDirectory,
-            logger,
-          });
-        } else {
-          logger.warn(
-            'Ignoring malformed flow_path input (expected a non-empty array of non-empty strings).'
-          );
-        }
-      }
-
       try {
-        const flowResults = await parseMaestroResults(junitDirectory, nameToPath);
+        // Maestro >= 2.6.0 stamps every <testcase> with its flow's path in a
+        // `file=` attribute; older reports need the legacy flow-file scan to
+        // map testcase names back to paths.
+        const usedFileAttrs = isFileAttrRun(await parseJUnitTestCases(junitDirectory));
+
+        let flowResults: MaestroFlowResult[];
+        if (usedFileAttrs) {
+          flowResults = await parseMaestroResultsFromFileAttrs(junitDirectory);
+        } else {
+          // Legacy (Maestro < 2.6.0) — DELETE this arm once the fleet is on >= 2.6.0.
+          const flowPathRaw = inputs.flow_path.value;
+          let nameToPath: Map<string, string> | null = null;
+          if (flowPathRaw !== undefined) {
+            const parsed = FlowPathSchema.safeParse(flowPathRaw);
+            if (parsed.success) {
+              nameToPath = await buildFlowNameToPathMap({
+                inputFlowPaths: parsed.data,
+                projectRoot: stepsCtx.workingDirectory,
+                logger,
+              });
+            } else {
+              logger.warn(
+                'Ignoring malformed flow_path input (expected a non-empty array of non-empty strings).'
+              );
+            }
+          }
+          flowResults = await parseMaestroResults(junitDirectory, nameToPath);
+        }
+
         if (flowResults.length === 0) {
           logger.info('No maestro test results found, skipping report');
           return;
         }
 
-        // Detect truly conflicting results: same (name, retryCount) pair means different flow files
-        // share the same name (Maestro config override), which we can't disambiguate.
-        // Same name with different retryCount is expected (per-attempt results from retries).
+        // Detect truly conflicting results: the same (path, retryCount) twice means two
+        // flow files resolved to the same path, which we can't disambiguate and the API
+        // rejects as a duplicate. Same path with different retryCount is expected
+        // (per-attempt results from retries).
         const seen = new Set<string>();
         const conflicting = new Set<string>();
         for (const r of flowResults) {
-          const key = `${r.name}:${r.retryCount}`;
+          const key = `${r.path}:${r.retryCount}`;
           if (seen.has(key)) {
-            conflicting.add(r.name);
+            conflicting.add(r.path);
           }
           seen.add(key);
         }
         if (conflicting.size > 0) {
+          const conflictList = [...conflicting].join(', ');
           logger.error(
-            `Duplicate test case names found in JUnit output: ${[...conflicting].join(
-              ', '
-            )}. Skipping report. Ensure each Maestro flow has a unique name.`
+            usedFileAttrs
+              ? `The same flow file was reported more than once in a single attempt: ` +
+                  `${conflictList}. Skipping report. Check for duplicate flow_path entries ` +
+                  `or leftover XML files in the JUnit report directory.`
+              : `Duplicate Maestro flow names found: ${conflictList}. Skipping report. ` +
+                  `Give each flow a unique name, or upgrade Maestro to >= 2.6.0 (flows are ` +
+                  `then identified by file path, so duplicate names are fine).`
           );
           return;
         }

packages/build-tools/src/steps/functions/restoreBuildCache.ts

@@ -206,16 +206,16 @@ export async function restoreGradleCacheAsync({
   }
 
   try {
-    const gradlePropertiesPath = path.join(workingDirectory, 'android', 'gradle.properties');
-    const gradlePropertiesContent = await fs.promises.readFile(gradlePropertiesPath, 'utf-8');
-    await fs.promises.writeFile(
-      gradlePropertiesPath,
-      `${gradlePropertiesContent}\n\norg.gradle.caching=true\n`
-    );
+    // Enable build cache via user-level gradle.properties.
+    // This avoids mutating android/gradle.properties which affects fingerprinting.
+    const gradleUserHome = path.join(os.homedir(), '.gradle');
+    await fs.promises.mkdir(gradleUserHome, { recursive: true });
+    const userGradlePropertiesPath = path.join(gradleUserHome, 'gradle.properties');
+    await fs.promises.appendFile(userGradlePropertiesPath, '\norg.gradle.caching=true\n');
 
-    // Configure cache cleanup via init script (works with both Gradle 8 and 9,
-    // org.gradle.cache.cleanup property was removed in Gradle 9)
-    const initScriptDir = path.join(os.homedir(), '.gradle', 'init.d');
+    // Configure cache cleanup via init script.
+    // Works with both Gradle 8 and 9 (org.gradle.cache.cleanup property was removed in Gradle 9).
+    const initScriptDir = path.join(gradleUserHome, 'init.d');
     await fs.promises.mkdir(initScriptDir, { recursive: true });
     await fs.promises.writeFile(
       path.join(initScriptDir, 'eas-cache-cleanup.gradle'),

packages/build-tools/src/steps/functions/startAgentDeviceRemoteSession.ts

@@ -90,7 +90,7 @@ export function createStartAgentDeviceRemoteSessionBuildFunction(
       // on Darwin. Android sessions go without a preview URL.
       let webPreviewUrl: string | undefined;
       if (runtimePlatform === BuildRuntimePlatform.DARWIN) {
-        const { previewUrl } = await startServeSimWithTunnelAsync({
+        const { previewUrl } = await startServeSimWithTunnelAsync(ctx, {
           baseDomain: ngrokTunnelDomain,
           env,
           logger,

packages/build-tools/src/steps/functions/startArgentRemoteSession.ts

@@ -1,4 +1,5 @@
 import { SystemError } from '@expo/eas-build-job';
+import { type bunyan } from '@expo/logger';
 import {
   BuildFunction,
   BuildRuntimePlatform,
@@ -9,6 +10,7 @@ import spawn from '@expo/turtle-spawn';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import semver from 'semver';
 import { z } from 'zod';
 
 import { CustomBuildContext } from '../../customBuildContext';
@@ -24,11 +26,15 @@ import {
 } from '../utils/remoteDeviceRunSession';
 
 const ARGENT_PACKAGE_NAME = '@swmansion/argent';
+const MIN_ARGENT_REMOTE_SESSION_VERSION = '0.11.0';
 const ARGENT_STATE_FILE = path.join(os.homedir(), '.argent', 'tool-server.json');
 const XCODE_DEVELOPER_DIR = '/Applications/Xcode.app/Contents/Developer';
 const STARTUP_TIMEOUT_MS = 60_000;
 
-const ArgentToolServerStateSchema = z.object({ port: z.number() });
+const ArgentToolServerStateSchema = z.object({
+  port: z.number(),
+  token: z.string().optional(),
+});
 
 export function createStartArgentRemoteSessionBuildFunction(
   ctx: CustomBuildContext
@@ -55,6 +61,7 @@ export function createStartArgentRemoteSessionBuildFunction(
       const ngrokAuthtoken = getNgrokAuthtokenOrThrow(env);
 
       const packageVersion = inputs.package_version.value as string | undefined;
+      warnIfArgentPackageVersionCannotBeVerified({ packageVersion, logger });
       const versionSpec = packageVersion ?? 'latest';
       const { runtimePlatform } = global;
       logger.info(
@@ -69,39 +76,58 @@ export function createStartArgentRemoteSessionBuildFunction(
       // Stale state from a previous run would mask the new server's port.
       await fs.promises.rm(ARGENT_STATE_FILE, { force: true });
 
-      logger.info(`Launching ${ARGENT_PACKAGE_NAME}@${versionSpec} via bunx.`);
-      // `argent mcp` is the public entry that triggers @argent/tools-client
-      // to spawn the tool-server detached + unref'd, so the tool-server
-      // outlives this MCP process. ARGENT_IDLE_TIMEOUT_MINUTES=0 disables the
-      // 30-min idle shutdown that would otherwise tear the tunnel down.
-      spawnDetached({
+      logger.info(`Launching ${ARGENT_PACKAGE_NAME}@${versionSpec} tool-server via bunx.`);
+      const argentServer = spawnDetached({
         command: 'bunx',
-        args: [`${ARGENT_PACKAGE_NAME}@${versionSpec}`, 'mcp'],
-        env: { ...env, ARGENT_IDLE_TIMEOUT_MINUTES: '0' },
+        args: [
+          `${ARGENT_PACKAGE_NAME}@${versionSpec}`,
+          'server',
+          'start',
+          '--port',
+          '0',
+          '--idle-timeout',
+          '0',
+          '--detach',
+        ],
+        env,
       });
 
       logger.info(`Waiting for argent tool-server state at ${ARGENT_STATE_FILE}.`);
-      const { port: toolServerPort } = await waitForFileAsync({
-        filePath: ARGENT_STATE_FILE,
-        timeoutMs: STARTUP_TIMEOUT_MS,
-        description: 'argent tool-server state',
-        parse: parseArgentToolServerState,
-      });
+      let toolServerPort: number;
+      let toolServerToken: string | undefined;
+      try {
+        const toolServerState = await waitForFileAsync({
+          filePath: ARGENT_STATE_FILE,
+          timeoutMs: STARTUP_TIMEOUT_MS,
+          description: 'argent tool-server state',
+          parse: parseArgentToolServerState,
+        });
+        toolServerPort = toolServerState.port;
+        toolServerToken = toolServerState.token;
+      } catch (err) {
+        const output = argentServer.getOutput();
+        throw new SystemError(
+          `${
+            err instanceof Error ? err.message : `Timed out waiting for argent tool-server state.`
+          }${output ? `\nArgent tool-server output:\n${output}` : ''}`
+        );
+      }
       logger.info(`Argent tool-server is listening on port ${toolServerPort}.`);
 
-      const toolsUrl = await startNgrokTunnelAsync({
+      const publicToolsUrl = await startNgrokTunnelAsync({
         port: toolServerPort,
         subdomainPrefix: 'argent',
         baseDomain: ngrokTunnelDomain,
         authtoken: ngrokAuthtoken,
+        rewriteHostHeader: true,
         logger,
       });
-      logger.info(`Tunnel is ready at ${toolsUrl}.`);
+      logger.info(`Tunnel is ready at ${publicToolsUrl}.`);
 
       // serve-sim is iOS-only — Android sessions go without a preview URL.
       let webPreviewUrl: string | undefined;
       if (runtimePlatform === BuildRuntimePlatform.DARWIN) {
-        const serveSim = await startServeSimWithTunnelAsync({
+        const serveSim = await startServeSimWithTunnelAsync(ctx, {
           baseDomain: ngrokTunnelDomain,
           env,
           logger,
@@ -115,7 +141,8 @@ export function createStartArgentRemoteSessionBuildFunction(
         ctx,
         deviceRunSessionId,
         remoteConfig: {
-          toolsUrl,
+          toolsUrl: publicToolsUrl,
+          ...(toolServerToken ? { toolsAuthToken: toolServerToken } : {}),
           ...(webPreviewUrl ? { webPreviewUrl } : {}),
         },
         logger,
@@ -129,7 +156,37 @@ export function createStartArgentRemoteSessionBuildFunction(
   });
 }
 
-function parseArgentToolServerState(raw: string): { port: number } {
+export function warnIfArgentPackageVersionCannotBeVerified({
+  packageVersion,
+  logger,
+}: {
+  packageVersion: string | undefined;
+  logger: bunyan;
+}): void {
+  if (!packageVersion || packageVersion === 'latest') {
+    return;
+  }
+
+  const validVersion = semver.valid(packageVersion);
+  if (!validVersion) {
+    logger.warn(
+      `Argent remote simulator sessions require ${ARGENT_PACKAGE_NAME}@${MIN_ARGENT_REMOTE_SESSION_VERSION} or newer, ` +
+        `but package_version "${packageVersion}" is not an exact semver version that EAS can verify. ` +
+        `Continuing and letting bunx resolve it.`
+    );
+    return;
+  }
+
+  if (semver.lt(validVersion, MIN_ARGENT_REMOTE_SESSION_VERSION)) {
+    throw new SystemError(
+      `Argent remote simulator sessions require ${ARGENT_PACKAGE_NAME}@${MIN_ARGENT_REMOTE_SESSION_VERSION} or newer. ` +
+        `The requested package_version "${packageVersion}" is too old for the EAS remote-session API. ` +
+        `Use "latest" or pass an exact version >= ${MIN_ARGENT_REMOTE_SESSION_VERSION}.`
+    );
+  }
+}
+
+function parseArgentToolServerState(raw: string): { port: number; token?: string } {
   const result = ArgentToolServerStateSchema.safeParse(JSON.parse(raw));
   if (!result.success) {
     throw new SystemError(

packages/build-tools/src/steps/functions/startServeSimRemoteSession.ts

@@ -30,7 +30,7 @@ export function createStartServeSimRemoteSessionBuildFunction(
       logger.info(`Selecting Xcode developer directory: ${XCODE_DEVELOPER_DIR}.`);
       await spawn('sudo', ['xcode-select', '-s', XCODE_DEVELOPER_DIR], { env, logger });
 
-      const { previewUrl, streamUrl } = await startServeSimWithTunnelAsync({
+      const { previewUrl, streamUrl } = await startServeSimWithTunnelAsync(ctx, {
         baseDomain: ngrokTunnelDomain,
         env,
         logger,

packages/build-tools/src/steps/functions/uploadArtifact.ts

@@ -128,7 +128,7 @@ export function createUploadArtifactBuildFunction(ctx: CustomBuildContext): Buil
         }
       } catch (error) {
         if (inputs.ignore_error.value) {
-          logger.error(`Failed to upload ${artifact.type}. Ignoring error.`, error);
+          logger.error({ err: error }, `Failed to upload ${artifact.type}. Ignoring error.`);
           // Ignoring error.
           return;
         }

packages/build-tools/src/steps/utils/__tests__/remoteDeviceRunSession.test.ts

@@ -0,0 +1,154 @@
+import { bunyan } from '@expo/logger';
+import { BuildStepEnv } from '@expo/steps';
+
+import { CustomBuildContext } from '../../../customBuildContext';
+import { Sentry } from '../../../sentry';
+import { turtleFetch } from '../../../utils/turtleFetch';
+import {
+  fetchServeSimTurnArgsAsync,
+  turnIceServersToServeSimArgs,
+} from '../remoteDeviceRunSession';
+
+jest.mock('../../../utils/turtleFetch');
+jest.mock('../../../sentry');
+
+function createLoggerMock(): bunyan {
+  return {
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    debug: jest.fn(),
+  } as unknown as bunyan;
+}
+
+function createCtxMock(): CustomBuildContext {
+  return {
+    env: {
+      __API_SERVER_URL: 'https://api.expo.test',
+    },
+    job: {
+      secrets: { robotAccessToken: 'robot-token' },
+    },
+  } as unknown as CustomBuildContext;
+}
+
+function createEnvMock(): BuildStepEnv {
+  return { DEVICE_RUN_SESSION_ID: 'drs-id' } as unknown as BuildStepEnv;
+}
+
+describe(turnIceServersToServeSimArgs, () => {
+  it('returns no args for an empty ICE server list', () => {
+    expect(turnIceServersToServeSimArgs([])).toEqual([]);
+  });
+
+  it('builds --stun-url and --turn-url flags from Cloudflare ICE servers', () => {
+    expect(
+      turnIceServersToServeSimArgs([
+        { urls: ['stun:stun.cloudflare.com:3478', 'stun:stun.cloudflare.com:53'] },
+        {
+          urls: [
+            'turn:turn.cloudflare.com:3478?transport=udp',
+            'turns:turn.cloudflare.com:443?transport=tcp',
+          ],
+          username: 'user-123',
+          credential: 'cred-456',
+        },
+      ])
+    ).toEqual([
+      '--stun-url',
+      'stun:stun.cloudflare.com:3478,stun:stun.cloudflare.com:53',
+      '--turn-url',
+      'turn:turn.cloudflare.com:3478?transport=udp,turns:turn.cloudflare.com:443?transport=tcp',
+      '--turn-username',
+      'user-123',
+      '--turn-credential',
+      'cred-456',
+    ]);
+  });
+
+  it('emits only --turn-url flags when no credential-less (STUN) entry is present', () => {
+    expect(
+      turnIceServersToServeSimArgs([
+        {
+          urls: ['turns:turn.cloudflare.com:443?transport=tcp'],
+          username: 'u',
+          credential: 'c',
+        },
+      ])
+    ).toEqual([
+      '--turn-url',
+      'turns:turn.cloudflare.com:443?transport=tcp',
+      '--turn-username',
+      'u',
+      '--turn-credential',
+      'c',
+    ]);
+  });
+
+  it('emits only --stun-url when there is no credentialed TURN entry', () => {
+    expect(turnIceServersToServeSimArgs([{ urls: ['stun:stun.cloudflare.com:3478'] }])).toEqual([
+      '--stun-url',
+      'stun:stun.cloudflare.com:3478',
+    ]);
+  });
+});
+
+describe(fetchServeSimTurnArgsAsync, () => {
+  beforeEach(() => {
+    jest.mocked(turtleFetch).mockReset();
+  });
+
+  it('requests TURN ICE servers from the device run session endpoint and returns serve-sim args', async () => {
+    jest.mocked(turtleFetch).mockResolvedValue({
+      json: async () => ({
+        data: {
+          iceServers: [
+            { urls: ['stun:stun.cloudflare.com:3478'] },
+            {
+              urls: ['turns:turn.cloudflare.com:443?transport=tcp'],
+              username: 'u',
+              credential: 'c',
+            },
+          ],
+        },
+      }),
+    } as unknown as Awaited<ReturnType<typeof turtleFetch>>);
+
+    const args = await fetchServeSimTurnArgsAsync(createCtxMock(), {
+      env: createEnvMock(),
+      logger: createLoggerMock(),
+    });
+
+    expect(args).toEqual([
+      '--stun-url',
+      'stun:stun.cloudflare.com:3478',
+      '--turn-url',
+      'turns:turn.cloudflare.com:443?transport=tcp',
+      '--turn-username',
+      'u',
+      '--turn-credential',
+      'c',
+    ]);
+    expect(jest.mocked(turtleFetch)).toHaveBeenCalledWith(
+      'https://api.expo.test/v2/device-run-sessions/drs-id/turn-ice-servers',
+      'POST',
+      expect.objectContaining({
+        headers: { Authorization: 'Bearer robot-token' },
+      })
+    );
+  });
+
+  it('returns [] and warns when the request fails so serve-sim falls back to P2P/STUN', async () => {
+    jest.mocked(turtleFetch).mockRejectedValue(new Error('boom'));
+    const logger = createLoggerMock();
+
+    const args = await fetchServeSimTurnArgsAsync(createCtxMock(), {
+      env: createEnvMock(),
+      logger,
+    });
+
+    expect(args).toEqual([]);
+    expect(logger.warn).toHaveBeenCalled();
+    expect(jest.mocked(Sentry).capture).toHaveBeenCalled();
+  });
+});

packages/build-tools/src/steps/utils/remoteDeviceRunSession.ts

@@ -4,11 +4,15 @@ import { BuildStepEnv } from '@expo/steps';
 import spawn from '@expo/turtle-spawn';
 import * as ngrok from '@ngrok/ngrok';
 import { graphql } from 'gql.tada';
+import nullthrows from 'nullthrows';
+import { z } from 'zod';
 import { randomBytes } from 'node:crypto';
 import fs from 'node:fs';
 
 import { CustomBuildContext } from '../../customBuildContext';
+import { Sentry } from '../../sentry';
 import { sleepAsync } from '../../utils/retry';
+import { turtleFetch } from '../../utils/turtleFetch';
 
 const START_DEVICE_RUN_SESSION_MUTATION = graphql(`
   mutation StartDeviceRunSession($deviceRunSessionId: ID!, $remoteConfig: JSONObject!) {
@@ -60,6 +64,105 @@ export function getNgrokAuthtokenOrThrow(env: BuildStepEnv): string {
   return authtoken;
 }
 
+const TurnIceServersSchema = z.array(
+  z.object({
+    urls: z.array(z.string()),
+    username: z.string().optional(),
+    credential: z.string().optional(),
+  })
+);
+
+export type TurnIceServers = z.infer<typeof TurnIceServersSchema>;
+
+const TurnIceServersResponseSchema = z.object({
+  data: z.object({
+    iceServers: TurnIceServersSchema,
+  }),
+});
+
+/**
+ * Translate Cloudflare ICE servers into serve-sim CLI flags: `--stun-url` (the
+ * credential-less entries) and `--turn-url`/`--turn-username`/`--turn-credential`
+ * (the entry carrying the short-lived credentials).
+ */
+export function turnIceServersToServeSimArgs(iceServers: TurnIceServers): string[] {
+  const stunUrls = iceServers
+    .filter(server => !server.username && !server.credential)
+    .flatMap(server => server.urls);
+  const turnServer = iceServers.find(server => server.username && server.credential);
+
+  const args: string[] = [];
+  if (stunUrls.length > 0) {
+    args.push('--stun-url', stunUrls.join(','));
+  }
+  if (turnServer?.username && turnServer.credential && turnServer.urls.length > 0) {
+    args.push(
+      '--turn-url',
+      turnServer.urls.join(','),
+      '--turn-username',
+      turnServer.username,
+      '--turn-credential',
+      turnServer.credential
+    );
+  }
+  return args;
+}
+
+/**
+ * Fetch short-lived Cloudflare TURN ICE servers for this job run from www
+ * (minted on demand, mirroring how the worker fetches project clone URLs) and
+ * translate them into serve-sim CLI flags.
+ *
+ * Best-effort: on any failure we log and return [] so serve-sim falls back to
+ * its built-in P2P/STUN behavior. The credential is passed to serve-sim as a
+ * process arg and deliberately not logged (turtle-spawn never logs argv and the
+ * worker is single-tenant).
+ */
+export async function fetchServeSimTurnArgsAsync(
+  ctx: CustomBuildContext,
+  { env, logger }: { env: BuildStepEnv; logger: bunyan }
+): Promise<string[]> {
+  try {
+    const deviceRunSessionId = getDeviceRunSessionIdOrThrow(env);
+    const expoApiServerUrl = nullthrows(ctx.env.__API_SERVER_URL, '__API_SERVER_URL is not set');
+    const robotAccessToken = nullthrows(
+      ctx.job.secrets?.robotAccessToken,
+      'robot access token is not set'
+    );
+
+    const response = await turtleFetch(
+      new URL(
+        `/v2/device-run-sessions/${deviceRunSessionId}/turn-ice-servers`,
+        expoApiServerUrl
+      ).toString(),
+      'POST',
+      {
+        headers: {
+          Authorization: `Bearer ${robotAccessToken}`,
+        },
+        timeout: 5000,
+        retries: 1,
+        logger,
+      }
+    );
+
+    const { data } = TurnIceServersResponseSchema.parse(await response.json());
+    const args = turnIceServersToServeSimArgs(data.iceServers);
+    if (args.length > 0) {
+      logger.info('Configured serve-sim with Cloudflare TURN ICE servers.');
+    }
+    return args;
+  } catch (err) {
+    const error = err instanceof Error ? err : new Error(String(err));
+    Sentry.capture('Could not fetch Cloudflare TURN ICE servers', error, { level: 'warning' });
+    logger.warn(
+      { err: error },
+      'Could not fetch Cloudflare TURN ICE servers; serve-sim will fall back to P2P/STUN.'
+    );
+    return [];
+  }
+}
+
 export async function uploadRemoteSessionConfigAsync({
   ctx,
   deviceRunSessionId,
@@ -120,18 +223,22 @@ export function spawnDetached({
   return { getOutput: () => output };
 }
 
-export async function startServeSimWithTunnelAsync({
-  baseDomain,
-  env,
-  logger,
-  timeoutMs,
-}: {
-  baseDomain: string;
-  env: BuildStepEnv;
-  logger: bunyan;
-  timeoutMs: number;
-}): Promise<{ previewUrl: string; streamUrl: string }> {
+export async function startServeSimWithTunnelAsync(
+  ctx: CustomBuildContext,
+  {
+    baseDomain,
+    env,
+    logger,
+    timeoutMs,
+  }: {
+    baseDomain: string;
+    env: BuildStepEnv;
+    logger: bunyan;
+    timeoutMs: number;
+  }
+): Promise<{ previewUrl: string; streamUrl: string }> {
   logger.info('Launching serve-sim with tunnel.');
+  const turnArgs = await fetchServeSimTurnArgsAsync(ctx, { env, logger });
   const serveSim = spawnDetached({
     command: 'npx',
     args: [
@@ -147,6 +254,7 @@ export async function startServeSimWithTunnelAsync({
       '0.55',
       '--codec',
       'webrtc',
+      ...turnArgs,
     ],
     env,
   });
@@ -188,19 +296,26 @@ export async function startNgrokTunnelAsync({
   subdomainPrefix,
   baseDomain,
   authtoken,
+  rewriteHostHeader,
   logger,
 }: {
   port: number;
   subdomainPrefix: string;
   baseDomain: string;
   authtoken: string;
+  rewriteHostHeader?: boolean;
   logger: bunyan;
 }): Promise<string> {
   const domain = `${subdomainPrefix}-${randomBytes(8).toString('hex')}.${baseDomain}`;
   logger.info(`Starting ngrok tunnel ${domain} -> http://localhost:${port}.`);
   // Run the ngrok agent in-process via the SDK; it keeps the session alive until
   // the process exits, and the step blocks forever to hold it open.
-  const listener = await ngrok.forward({ addr: port, authtoken, domain });
+  const listener = await ngrok.forward({
+    addr: port,
+    authtoken,
+    domain,
+    ...(rewriteHostHeader ? { request_header_add: [`Host:localhost:${port}`] } : {}),
+  });
   const url = listener.url();
   if (!url) {
     throw new SystemError(`ngrok tunnel for ${domain} did not return a public URL.`);

packages/eas-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eas-cli",
-  "version": "20.1.0",
+  "version": "20.3.0",
   "description": "EAS command line tool",
   "keywords": [
     "cli",
@@ -224,6 +224,9 @@
       "update": {
         "description": "manage individual updates"
       },
+      "update:embedded": {
+        "description": "manage embedded updates registered with EAS Update"
+      },
       "webhook": {
         "description": "manage webhooks"
       },

packages/eas-cli/src/commandUtils/posthog.ts

@@ -0,0 +1,22 @@
+import chalk from 'chalk';
+
+import { PostHogProjectData } from '../graphql/types/PostHogConnection';
+import Log, { link } from '../log';
+
+export function getPostHogProjectDashboardUrl(project: PostHogProjectData): string {
+  const host = project.posthogHost.replace(/\/$/, '');
+  return `${host}/project/${encodeURIComponent(project.posthogProjectIdentifier)}`;
+}
+
+export function formatPostHogProject(project: PostHogProjectData): string {
+  return [
+    `${chalk.bold('Name')}: ${project.posthogProjectName}`,
+    `${chalk.bold('Host')}: ${project.posthogHost}`,
+    `${chalk.bold('Region')}: ${project.posthogOrganizationConnection.posthogRegion}`,
+    `${chalk.bold('Dashboard')}: ${link(getPostHogProjectDashboardUrl(project), { dim: false })}`,
+  ].join('\n');
+}
+
+export function logNoPostHogProject(projectName: string): void {
+  Log.warn(`No PostHog project is linked to Expo app ${chalk.bold(projectName)} on EAS.`);
+}

packages/eas-cli/src/commands/account/audit.ts

@@ -0,0 +1,149 @@
+import { Args, Flags } from '@oclif/core';
+
+import EasCommand from '../../commandUtils/EasCommand';
+import { EASNonInteractiveFlag, EasJsonOnlyFlag } from '../../commandUtils/flags';
+import { getLimitFlagWithCustomValues } from '../../commandUtils/pagination';
+import { AuditLogFragment } from '../../graphql/generated';
+import { AuditLogQuery } from '../../graphql/queries/AuditLogQuery';
+import Log from '../../log';
+import { ora } from '../../ora';
+import { confirmAsync, selectAsync } from '../../prompts';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
+import renderTextTable from '../../utils/renderTextTable';
+
+const AUDIT_LOGS_LIMIT = 50;
+
+export default class AccountAudit extends EasCommand {
+  static override description = 'view the audit logs for an account';
+
+  static override args = {
+    ACCOUNT_NAME: Args.string({
+      description:
+        'Account name to view audit logs for. If not provided, the account will be selected interactively (or defaults to the only account if there is just one)',
+    }),
+  };
+
+  static override flags = {
+    limit: getLimitFlagWithCustomValues({ defaultTo: AUDIT_LOGS_LIMIT, limit: 100 }),
+    after: Flags.string({
+      description:
+        'Cursor for pagination. Use the endCursor from a previous query to fetch the next page.',
+    }),
+    ...EasJsonOnlyFlag,
+    ...EASNonInteractiveFlag,
+  };
+
+  static override contextDefinition = {
+    ...this.ContextOptions.LoggedIn,
+  };
+
+  async runAsync(): Promise<void> {
+    const {
+      args: { ACCOUNT_NAME: accountName },
+      flags: { limit, after, json: jsonFlag, 'non-interactive': nonInteractive },
+    } = await this.parse(AccountAudit);
+
+    const json = jsonFlag || nonInteractive;
+    if (json) {
+      enableJsonOutput();
+    }
+
+    const {
+      loggedIn: { graphqlClient, actor },
+    } = await this.getContextAsync(AccountAudit, { nonInteractive });
+
+    const pageSize = limit ?? AUDIT_LOGS_LIMIT;
+
+    let targetAccount: { id: string; name: string };
+    const availableAccounts = actor.accounts.map(a => a.name).join(', ');
+    if (accountName) {
+      const found = actor.accounts.find(a => a.name === accountName);
+      if (!found) {
+        throw new Error(
+          `Account "${accountName}" not found or you don't have access. Available accounts: ${availableAccounts}`
+        );
+      }
+      targetAccount = found;
+    } else if (nonInteractive) {
+      throw new Error(
+        'ACCOUNT_NAME argument must be provided when running in `--non-interactive` mode.'
+      );
+    } else if (actor.accounts.length === 1) {
+      targetAccount = actor.accounts[0];
+    } else {
+      targetAccount = await selectAsync(
+        'Select account to view audit logs for:',
+        actor.accounts.map(account => ({
+          title: account.name,
+          value: account,
+        }))
+      );
+    }
+
+    if (json) {
+      const spinner = ora(`Fetching audit logs for account ${targetAccount.name}`).start();
+      try {
+        const connection = await AuditLogQuery.getAllForAccountAsync(
+          graphqlClient,
+          targetAccount.id,
+          {
+            first: pageSize,
+            after,
+          }
+        );
+        spinner.stop();
+        printJsonOnlyOutput({
+          auditLogs: connection.edges.map(edge => edge.node),
+          pageInfo: connection.pageInfo,
+        });
+      } catch (error) {
+        spinner.fail(`Failed to fetch audit logs for account ${targetAccount.name}`);
+        throw error;
+      }
+      return;
+    }
+
+    let cursor = after;
+    do {
+      const spinner = ora(`Fetching audit logs for account ${targetAccount.name}`).start();
+      const connection = await AuditLogQuery.getAllForAccountAsync(
+        graphqlClient,
+        targetAccount.id,
+        {
+          first: pageSize,
+          after: cursor,
+        }
+      );
+      spinner.stop();
+
+      const logs = connection.edges.map(edge => edge.node);
+      renderPageOfAuditLogs(logs);
+
+      if (!connection.pageInfo.hasNextPage) {
+        break;
+      }
+      cursor = connection.pageInfo.endCursor ?? undefined;
+    } while (cursor && (await confirmAsync({ message: 'Load more audit logs?' })));
+  }
+}
+
+function renderPageOfAuditLogs(logs: AuditLogFragment[]): void {
+  if (logs.length === 0) {
+    Log.log('No audit logs found.');
+    return;
+  }
+
+  Log.log(
+    renderTextTable(
+      ['Date', 'Actor', 'Action', 'Entity', 'Message'],
+      logs.map(log => [
+        new Date(log.createdAt).toLocaleString(),
+        log.actor?.displayName ?? 'Unknown',
+        log.targetEntityMutationType,
+        log.targetEntityTypePublicName,
+        log.websiteMessage,
+      ])
+    )
+  );
+  Log.addNewLineIfNone();
+}

packages/eas-cli/src/commands/integrations/posthog/__tests__/connect.test.ts

@@ -0,0 +1,658 @@
+import spawnAsync from '@expo/spawn-async';
+import * as fs from 'fs-extra';
+
+import { getMockOclifConfig } from '../../../../__tests__/commands/utils';
+import { ExpoGraphqlClient } from '../../../../commandUtils/context/contextUtils/createGraphqlClient';
+import { testProjectId } from '../../../../credentials/__tests__/fixtures-constants';
+import {
+  EnvironmentVariableScope,
+  EnvironmentVariableVisibility,
+  PostHogRegion,
+  Role,
+} from '../../../../graphql/generated';
+import { EnvironmentVariableMutation } from '../../../../graphql/mutations/EnvironmentVariableMutation';
+import { PostHogMutation } from '../../../../graphql/mutations/PostHogMutation';
+import { EnvironmentVariablesQuery } from '../../../../graphql/queries/EnvironmentVariablesQuery';
+import { PostHogQuery } from '../../../../graphql/queries/PostHogQuery';
+import {
+  PostHogOrganizationConnectionData,
+  PostHogProjectData,
+} from '../../../../graphql/types/PostHogConnection';
+import Log from '../../../../log';
+import { createOrModifyExpoConfigAsync } from '../../../../project/expoConfig';
+import { getOwnerAccountForProjectIdAsync } from '../../../../project/projectUtils';
+import { confirmAsync, promptAsync, selectAsync } from '../../../../prompts';
+import { Actor } from '../../../../user/User';
+import { printJsonOnlyOutput } from '../../../../utils/json';
+import IntegrationsPostHogConnect from '../connect';
+
+jest.mock('@expo/spawn-async');
+jest.mock('fs-extra');
+jest.mock('../../../../project/expoConfig');
+jest.mock('../../../../graphql/queries/PostHogQuery');
+jest.mock('../../../../graphql/queries/EnvironmentVariablesQuery');
+jest.mock('../../../../graphql/mutations/PostHogMutation');
+jest.mock('../../../../graphql/mutations/EnvironmentVariableMutation');
+jest.mock('../../../../project/projectUtils');
+jest.mock('../../../../prompts');
+jest.mock('../../../../log');
+jest.mock('../../../../utils/json');
+jest.mock('../../../../ora', () => ({
+  ora: () => ({
+    start: jest.fn().mockReturnThis(),
+    succeed: jest.fn().mockReturnThis(),
+    fail: jest.fn().mockReturnThis(),
+  }),
+}));
+
+describe(IntegrationsPostHogConnect, () => {
+  const graphqlClient = {} as ExpoGraphqlClient;
+  const mockConfig = getMockOclifConfig();
+  const testAccountId = 'test-account-id';
+  const testAccountName = 'testuser';
+
+  const mockActor: Actor = {
+    __typename: 'User',
+    id: 'test-user-id',
+    username: testAccountName,
+    email: '[email protected]',
+    featureGates: {},
+    isExpoAdmin: false,
+    primaryAccount: { id: testAccountId, name: testAccountName, ownerUserActor: null, users: [] },
+    preferences: { onboarding: null },
+    accounts: [],
+  };
+
+  const mockAccount = {
+    id: testAccountId,
+    name: testAccountName,
+    ownerUserActor: { id: 'test-user-id', username: testAccountName },
+    users: [{ role: Role.Owner, actor: { id: 'test-user-id' } }],
+  };
+
+  const mockConnection: PostHogOrganizationConnectionData = {
+    id: 'connection-1',
+    posthogOrganizationIdentifier: 'org-123',
+    posthogOrganizationName: 'Test Org',
+    posthogRegion: PostHogRegion.Us,
+    createdAt: '2024-01-01T00:00:00.000Z',
+    updatedAt: '2024-01-01T00:00:00.000Z',
+  };
+
+  const mockProject: PostHogProjectData = {
+    id: 'project-1',
+    posthogProjectIdentifier: '467657',
+    posthogProjectName: 'testapp',
+    posthogProjectToken: 'phc_public_key',
+    posthogHost: 'https://us.posthog.com',
+    createdAt: '2024-01-01T00:00:00.000Z',
+    updatedAt: '2024-01-01T00:00:00.000Z',
+    posthogOrganizationConnection: mockConnection,
+  };
+
+  function createCommand(argv: string[], actor: Actor = mockActor): IntegrationsPostHogConnect {
+    const command = new IntegrationsPostHogConnect(argv, mockConfig);
+    jest.spyOn(command as any, 'getContextAsync').mockReturnValue({
+      privateProjectConfig: {
+        projectId: testProjectId,
+        exp: { name: 'testapp', slug: 'testapp', plugins: [] },
+        projectDir: '/test/project',
+      },
+      loggedIn: { graphqlClient, actor },
+    } as never);
+    return command;
+  }
+
+  // Helper: which features the interactive multiselect returns.
+  function mockFeatureSelection(features: string[]): void {
+    jest.mocked(promptAsync).mockImplementation((async (opts: any) => {
+      if (opts.name === 'features') {
+        return { features };
+      }
+      if (opts.name === 'apiKey') {
+        return { apiKey: 'phx_personal_key' };
+      }
+      return {};
+    }) as any);
+  }
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+    jest.spyOn(Log, 'log').mockImplementation(() => {});
+    jest.spyOn(Log, 'warn').mockImplementation(() => {});
+    jest.spyOn(Log, 'error').mockImplementation(() => {});
+    jest.spyOn(Log, 'withTick').mockImplementation(() => {});
+    jest.spyOn(Log, 'addNewLineIfNone').mockImplementation(() => {});
+    jest.spyOn(Log, 'newLine').mockImplementation(() => {});
+
+    jest.mocked(getOwnerAccountForProjectIdAsync).mockResolvedValue(mockAccount as any);
+    jest.mocked(selectAsync).mockResolvedValue(PostHogRegion.Us);
+    jest.mocked(confirmAsync).mockResolvedValue(true);
+    jest.mocked(spawnAsync).mockResolvedValue({} as any);
+    jest.mocked(fs.pathExists).mockResolvedValue(false as never);
+    jest.mocked(fs.writeFile).mockResolvedValue(undefined as never);
+    jest.mocked(createOrModifyExpoConfigAsync).mockResolvedValue({ type: 'success' } as any);
+    // Default: reuse an existing connection + project.
+    jest
+      .mocked(PostHogQuery.getPostHogOrganizationConnectionByAccountIdAsync)
+      .mockResolvedValue(mockConnection);
+    jest.mocked(PostHogQuery.getPostHogProjectByAppIdAsync).mockResolvedValue(mockProject);
+    jest.mocked(PostHogMutation.createPostHogAccountRequestAsync).mockResolvedValue(mockConnection);
+    jest.mocked(PostHogMutation.setupPostHogProjectAsync).mockResolvedValue(mockProject);
+    jest.mocked(EnvironmentVariablesQuery.byAppIdAsync).mockResolvedValue([]);
+    jest.mocked(EnvironmentVariableMutation.createForAppAsync).mockResolvedValue({
+      id: 'env-var-1',
+      scope: EnvironmentVariableScope.Project,
+    } as any);
+    mockFeatureSelection(['analytics', 'session-replay', 'error-tracking']);
+  });
+
+  it('sets up all features: installs SDK + replay pkg, adds plugin, writes EXPO_PUBLIC_ + POSTHOG_CLI_ vars', async () => {
+    await createCommand([]).runAsync();
+
+    const installArgs = jest.mocked(spawnAsync).mock.calls[0][1];
+    expect(installArgs).toContain('posthog-react-native');
+    expect(installArgs).toContain('posthog-react-native-session-replay');
+    expect(createOrModifyExpoConfigAsync).toHaveBeenCalled();
+    expect(fs.writeFile).toHaveBeenCalled();
+
+    const createdNames = jest
+      .mocked(EnvironmentVariableMutation.createForAppAsync)
+      .mock.calls.map(call => call[1].name);
+    expect(createdNames).toEqual(
+      expect.arrayContaining([
+        'EXPO_PUBLIC_POSTHOG_API_KEY',
+        'EXPO_PUBLIC_POSTHOG_HOST',
+        'POSTHOG_CLI_API_KEY',
+        'POSTHOG_CLI_PROJECT_ID',
+        'POSTHOG_CLI_HOST',
+      ])
+    );
+    const cliKeyVar = jest
+      .mocked(EnvironmentVariableMutation.createForAppAsync)
+      .mock.calls.find(call => call[1].name === 'POSTHOG_CLI_API_KEY');
+    expect(cliKeyVar?.[1].visibility).toBe(EnvironmentVariableVisibility.Sensitive);
+    // The pasted personal key flows through verbatim — to EAS and to .env.local.
+    expect(cliKeyVar?.[1].value).toBe('phx_personal_key');
+    const written = jest.mocked(fs.writeFile).mock.calls[0][1] as string;
+    expect(written).toContain('POSTHOG_CLI_API_KEY=phx_personal_key');
+  });
+
+  it('asks for features only after provisioning (fast-forward ordering)', async () => {
+    jest
+      .mocked(PostHogQuery.getPostHogOrganizationConnectionByAccountIdAsync)
+      .mockResolvedValue(null);
+    jest.mocked(PostHogQuery.getPostHogProjectByAppIdAsync).mockResolvedValue(null);
+    let provisionedBeforePrompt = false;
+    jest.mocked(promptAsync).mockImplementation((async (opts: any) => {
+      if (opts.name === 'features') {
+        provisionedBeforePrompt =
+          jest.mocked(PostHogMutation.createPostHogAccountRequestAsync).mock.calls.length > 0 &&
+          jest.mocked(PostHogMutation.setupPostHogProjectAsync).mock.calls.length > 0;
+        return { features: ['analytics'] };
+      }
+      return {};
+    }) as any);
+
+    await createCommand(['--region', 'US']).runAsync();
+
+    expect(provisionedBeforePrompt).toBe(true);
+  });
+
+  it('analytics only: no replay pkg, no CLI vars, no key prompt', async () => {
+    mockFeatureSelection(['analytics']);
+
+    await createCommand([]).runAsync();
+
+    expect(jest.mocked(spawnAsync).mock.calls[0][1]).not.toContain(
+      'posthog-react-native-session-replay'
+    );
+    const createdNames = jest
+      .mocked(EnvironmentVariableMutation.createForAppAsync)
+      .mock.calls.map(call => call[1].name);
+    expect(createdNames).toEqual(['EXPO_PUBLIC_POSTHOG_API_KEY', 'EXPO_PUBLIC_POSTHOG_HOST']);
+    expect(promptAsync).not.toHaveBeenCalledWith(expect.objectContaining({ name: 'apiKey' }));
+  });
+
+  it('adds the config plugin and public env vars for session-replay-only (analytics deselected)', async () => {
+    mockFeatureSelection(['session-replay']);
+
+    await createCommand([]).runAsync();
+
+    // The plugin wires native modules replay needs, so it must be added even without analytics.
+    expect(createOrModifyExpoConfigAsync).toHaveBeenCalled();
+    expect(jest.mocked(spawnAsync).mock.calls[0][1]).toContain(
+      'posthog-react-native-session-replay'
+    );
+    // The public key + host initialize the SDK for any feature, so they're still written.
+    const createdNames = jest
+      .mocked(EnvironmentVariableMutation.createForAppAsync)
+      .mock.calls.map(call => call[1].name);
+    expect(createdNames).toEqual(['EXPO_PUBLIC_POSTHOG_API_KEY', 'EXPO_PUBLIC_POSTHOG_HOST']);
+  });
+
+  it('captures the install child output so --json stdout stays clean', async () => {
+    await createCommand(['--json', '--posthog-cli-api-key', 'phx_x']).runAsync();
+
+    expect(jest.mocked(spawnAsync).mock.calls[0][2]).not.toHaveProperty('stdio');
+  });
+
+  it('non-interactive defaults: analytics + replay, error tracking auto-skipped', async () => {
+    await createCommand(['--non-interactive']).runAsync();
+
+    expect(promptAsync).not.toHaveBeenCalled();
+    const createdNames = jest
+      .mocked(EnvironmentVariableMutation.createForAppAsync)
+      .mock.calls.map(call => call[1].name);
+    expect(createdNames).not.toContain('POSTHOG_CLI_API_KEY');
+    expect(Log.warn).toHaveBeenCalledWith(expect.stringContaining('Skipping error tracking'));
+    // Session replay defaults on, so its package is still installed.
+    expect(jest.mocked(spawnAsync).mock.calls[0][1]).toContain(
+      'posthog-react-native-session-replay'
+    );
+  });
+
+  it('non-interactive --error-tracking without a key fails before any provisioning', async () => {
+    jest
+      .mocked(PostHogQuery.getPostHogOrganizationConnectionByAccountIdAsync)
+      .mockResolvedValue(null);
+
+    await expect(
+      createCommand(['--non-interactive', '--error-tracking']).runAsync()
+    ).rejects.toThrow(/personal API key in non-interactive/);
+
+    expect(PostHogMutation.createPostHogAccountRequestAsync).not.toHaveBeenCalled();
+  });
+
+  it('non-interactive --error-tracking with --posthog-cli-api-key sets up CLI vars without prompting', async () => {
+    await createCommand([
+      '--non-interactive',
+      '--error-tracking',
+      '--posthog-cli-api-key',
+      'phx_from_flag',
+    ]).runAsync();
+
+    expect(promptAsync).not.toHaveBeenCalled();
+    const cliKeyVar = jest
+      .mocked(EnvironmentVariableMutation.createForAppAsync)
+      .mock.calls.find(call => call[1].name === 'POSTHOG_CLI_API_KEY');
+    expect(cliKeyVar?.[1].value).toBe('phx_from_flag');
+  });
+
+  it('treats a whitespace-only --posthog-cli-api-key as absent (fails like no key)', async () => {
+    await expect(
+      createCommand([
+        '--non-interactive',
+        '--error-tracking',
+        '--posthog-cli-api-key',
+        '   ',
+      ]).runAsync()
+    ).rejects.toThrow(/personal API key in non-interactive/);
+  });
+
+  it('surfaces a manual plugin step and still writes env vars when the app config is dynamic', async () => {
+    mockFeatureSelection(['analytics']);
+    jest.mocked(createOrModifyExpoConfigAsync).mockResolvedValue({
+      type: 'warn',
+      message: 'Cannot automatically write to dynamic config',
+    } as any);
+
+    await createCommand([]).runAsync();
+
+    expect(Log.warn).toHaveBeenCalledWith(
+      expect.stringContaining('Add "posthog-react-native/expo" to the "plugins"')
+    );
+    expect(EnvironmentVariableMutation.createForAppAsync).toHaveBeenCalled();
+    expect(fs.writeFile).toHaveBeenCalled();
+  });
+
+  it('surfaces the plugin manual step (without a cause) when the config write fails', async () => {
+    mockFeatureSelection(['analytics']);
+    jest.mocked(createOrModifyExpoConfigAsync).mockResolvedValue({ type: 'fail' } as any);
+
+    await createCommand([]).runAsync();
+
+    expect(Log.warn).toHaveBeenCalledWith(
+      expect.stringContaining('Add "posthog-react-native/expo" to the "plugins"')
+    );
+    expect(EnvironmentVariableMutation.createForAppAsync).toHaveBeenCalled();
+  });
+
+  it('reuses an existing connection + project without provisioning', async () => {
+    await createCommand([]).runAsync();
+
+    expect(PostHogMutation.createPostHogAccountRequestAsync).not.toHaveBeenCalled();
+    expect(PostHogMutation.setupPostHogProjectAsync).not.toHaveBeenCalled();
+  });
+
+  it('surfaces the existing-account dead-end without provisioning a project', async () => {
+    jest
+      .mocked(PostHogQuery.getPostHogOrganizationConnectionByAccountIdAsync)
+      .mockResolvedValue(null);
+    jest.mocked(PostHogQuery.getPostHogProjectByAppIdAsync).mockResolvedValue(null);
+    jest.mocked(PostHogMutation.createPostHogAccountRequestAsync).mockRejectedValue(
+      Object.assign(new Error('You already have a PostHog account.'), {
+        graphQLErrors: [{ extensions: { errorCode: 'POSTHOG_EXISTING_USER_NOT_SUPPORTED_ERROR' } }],
+      })
+    );
+
+    await expect(createCommand(['--region', 'US']).runAsync()).rejects.toThrow(
+      'You already have a PostHog account.'
+    );
+
+    // Fails (non-zero exit) without provisioning a project or writing any config.
+    expect(PostHogMutation.setupPostHogProjectAsync).not.toHaveBeenCalled();
+    expect(EnvironmentVariableMutation.createForAppAsync).not.toHaveBeenCalled();
+    expect(fs.writeFile).not.toHaveBeenCalled();
+  });
+
+  it('emits JSON output with --json', async () => {
+    await createCommand(['--json', '--posthog-cli-api-key', 'phx_x']).runAsync();
+
+    expect(printJsonOnlyOutput).toHaveBeenCalledWith(
+      expect.objectContaining({
+        project: expect.objectContaining({ apiKey: 'phc_public_key' }),
+        // --json supplies the key, so error tracking is on and its vars are reported.
+        features: expect.objectContaining({ analytics: true, errorTracking: true }),
+        dashboardUrl: expect.any(String),
+        environmentVariables: expect.arrayContaining([
+          'EXPO_PUBLIC_POSTHOG_API_KEY',
+          'POSTHOG_CLI_API_KEY',
+          'POSTHOG_CLI_PROJECT_ID',
+          'POSTHOG_CLI_HOST',
+        ]),
+      })
+    );
+  });
+
+  it('requires --region in non-interactive mode when provisioning', async () => {
+    jest
+      .mocked(PostHogQuery.getPostHogOrganizationConnectionByAccountIdAsync)
+      .mockResolvedValue(null);
+
+    await expect(createCommand(['--non-interactive']).runAsync()).rejects.toThrow(
+      /region is required in non-interactive/
+    );
+  });
+
+  it('warns when --region differs from the already-connected region', async () => {
+    await createCommand(['--region', 'EU']).runAsync();
+
+    expect(Log.warn).toHaveBeenCalledWith(expect.stringContaining('already connected to PostHog'));
+  });
+
+  it('provisions a new connection and project when none exist', async () => {
+    jest
+      .mocked(PostHogQuery.getPostHogOrganizationConnectionByAccountIdAsync)
+      .mockResolvedValue(null);
+    jest.mocked(PostHogQuery.getPostHogProjectByAppIdAsync).mockResolvedValue(null);
+    mockFeatureSelection(['analytics']);
+
+    await createCommand(['--region', 'US']).runAsync();
+
+    expect(PostHogMutation.createPostHogAccountRequestAsync).toHaveBeenCalledWith(graphqlClient, {
+      accountId: testAccountId,
+      region: PostHogRegion.Us,
+    });
+    expect(PostHogMutation.setupPostHogProjectAsync).toHaveBeenCalledWith(graphqlClient, {
+      appId: testProjectId,
+      posthogOrganizationConnectionId: mockConnection.id,
+    });
+  });
+
+  it('rethrows a non-dead-end provisioning failure', async () => {
+    jest
+      .mocked(PostHogQuery.getPostHogOrganizationConnectionByAccountIdAsync)
+      .mockResolvedValue(null);
+    jest
+      .mocked(PostHogMutation.createPostHogAccountRequestAsync)
+      .mockRejectedValue(new Error('network down'));
+
+    await expect(createCommand(['--region', 'US']).runAsync()).rejects.toThrow('network down');
+  });
+
+  it('rethrows when project setup fails', async () => {
+    jest.mocked(PostHogQuery.getPostHogProjectByAppIdAsync).mockResolvedValue(null);
+    jest
+      .mocked(PostHogMutation.setupPostHogProjectAsync)
+      .mockRejectedValue(new Error('setup failed'));
+
+    await expect(createCommand([]).runAsync()).rejects.toThrow('setup failed');
+  });
+
+  it('honors explicit --no-session-replay without showing the feature multiselect', async () => {
+    await createCommand(['--no-session-replay']).runAsync();
+
+    expect(promptAsync).not.toHaveBeenCalledWith(expect.objectContaining({ name: 'features' }));
+    expect(jest.mocked(spawnAsync).mock.calls[0][1]).not.toContain(
+      'posthog-react-native-session-replay'
+    );
+  });
+
+  it('prompts for a personal API key and validates it', async () => {
+    await createCommand([]).runAsync();
+
+    const apiKeyPrompt = jest
+      .mocked(promptAsync)
+      .mock.calls.map(call => call[0])
+      .find((opts: any) => opts.name === 'apiKey') as any;
+    expect(apiKeyPrompt).toBeDefined();
+    expect(apiKeyPrompt.validate('')).toBe('Personal API key cannot be empty');
+    expect(apiKeyPrompt.validate('phx_real')).toBe(true);
+  });
+
+  it('continues (does not abort) and still writes env vars when SDK installation fails', async () => {
+    mockFeatureSelection(['analytics']);
+    jest.mocked(spawnAsync).mockRejectedValue(new Error('npm exploded'));
+
+    await createCommand([]).runAsync();
+
+    // Install failure is non-fatal: provisioning + env vars still happen, with a manual follow-up.
+    expect(EnvironmentVariableMutation.createForAppAsync).toHaveBeenCalled();
+    expect(fs.writeFile).toHaveBeenCalled();
+    expect(Log.warn).toHaveBeenCalledWith(expect.stringContaining('npx expo install'));
+  });
+
+  it('on a dynamic config, surfaces only the plugin step (not a reinstall step) when expo install reports the dynamic-config error', async () => {
+    mockFeatureSelection(['analytics']);
+    jest.mocked(spawnAsync).mockRejectedValue(
+      Object.assign(new Error('Process exited with non-zero code: 1'), {
+        stdout: 'Cannot automatically write to dynamic config at: app.config.js\n',
+        stderr: '',
+      })
+    );
+    jest.mocked(createOrModifyExpoConfigAsync).mockResolvedValue({
+      type: 'warn',
+      message: 'Cannot automatically write to dynamic config at: app.config.js',
+    } as any);
+
+    await createCommand([]).runAsync();
+
+    expect(EnvironmentVariableMutation.createForAppAsync).toHaveBeenCalled();
+    expect(Log.warn).toHaveBeenCalledWith(
+      expect.stringContaining('Add "posthog-react-native/expo" to the "plugins"')
+    );
+    expect(Log.warn).not.toHaveBeenCalledWith(expect.stringContaining("didn't install"));
+  });
+
+  it('skips the config plugin when it is already configured', async () => {
+    mockFeatureSelection(['analytics']);
+    const command = createCommand([]);
+    jest.spyOn(command as any, 'getContextAsync').mockReturnValue({
+      privateProjectConfig: {
+        projectId: testProjectId,
+        exp: { name: 'testapp', slug: 'testapp', plugins: ['posthog-react-native/expo'] },
+        projectDir: '/test/project',
+      },
+      loggedIn: { graphqlClient, actor: mockActor },
+    } as never);
+
+    await command.runAsync();
+
+    expect(createOrModifyExpoConfigAsync).not.toHaveBeenCalled();
+  });
+
+  it('does nothing local when no features are selected (no install, no writes)', async () => {
+    mockFeatureSelection([]);
+
+    await createCommand([]).runAsync();
+
+    expect(spawnAsync).not.toHaveBeenCalled();
+    expect(createOrModifyExpoConfigAsync).not.toHaveBeenCalled();
+    expect(fs.writeFile).not.toHaveBeenCalled();
+    expect(EnvironmentVariableMutation.createForAppAsync).not.toHaveBeenCalled();
+    expect(Log.warn).toHaveBeenCalledWith(expect.stringContaining('No PostHog features selected'));
+    // Doesn't falsely claim the SDK is wired up when nothing was configured.
+    expect(Log.log).not.toHaveBeenCalledWith(expect.stringContaining('PostHog is connected!'));
+    expect(Log.warn).toHaveBeenCalledWith(expect.stringContaining('Re-run to add'));
+  });
+
+  it('merges into an existing .env.local, replacing matching keys and appending new ones', async () => {
+    mockFeatureSelection(['analytics']);
+    jest.mocked(fs.pathExists).mockResolvedValue(true as never);
+    jest
+      .mocked(fs.readFile)
+      .mockResolvedValue('EXPO_PUBLIC_POSTHOG_API_KEY=old_value\nOTHER=keep' as never);
+
+    await createCommand([]).runAsync();
+
+    const written = jest.mocked(fs.writeFile).mock.calls[0][1] as string;
+    expect(written).toContain('EXPO_PUBLIC_POSTHOG_API_KEY=phc_public_key');
+    expect(written).toContain('OTHER=keep');
+    expect(written).toContain('EXPO_PUBLIC_POSTHOG_HOST=https://us.posthog.com');
+  });
+
+  it('prompts for a region interactively when provisioning without --region', async () => {
+    jest
+      .mocked(PostHogQuery.getPostHogOrganizationConnectionByAccountIdAsync)
+      .mockResolvedValue(null);
+    jest.mocked(PostHogQuery.getPostHogProjectByAppIdAsync).mockResolvedValue(null);
+    mockFeatureSelection(['analytics']);
+
+    await createCommand([]).runAsync();
+
+    expect(selectAsync).toHaveBeenCalledWith('Select a PostHog region', expect.any(Array));
+    expect(PostHogMutation.createPostHogAccountRequestAsync).toHaveBeenCalledWith(graphqlClient, {
+      accountId: testAccountId,
+      region: PostHogRegion.Us,
+    });
+  });
+
+  it('skips .env.local when the user declines to overwrite a conflict', async () => {
+    mockFeatureSelection(['analytics']);
+    jest.mocked(fs.pathExists).mockResolvedValue(true as never);
+    jest.mocked(fs.readFile).mockResolvedValue('EXPO_PUBLIC_POSTHOG_API_KEY=old_value\n' as never);
+    jest.mocked(confirmAsync).mockResolvedValue(false);
+
+    await createCommand([]).runAsync();
+
+    expect(fs.writeFile).not.toHaveBeenCalled();
+    expect(Log.warn).toHaveBeenCalledWith(expect.stringContaining('Skipped updating'));
+  });
+
+  it('--overwrite writes .env.local without prompting on a conflict', async () => {
+    mockFeatureSelection(['analytics']);
+    jest.mocked(fs.pathExists).mockResolvedValue(true as never);
+    jest.mocked(fs.readFile).mockResolvedValue('EXPO_PUBLIC_POSTHOG_API_KEY=old_value\n' as never);
+
+    await createCommand(['--overwrite']).runAsync();
+
+    expect(confirmAsync).not.toHaveBeenCalled();
+    const written = jest.mocked(fs.writeFile).mock.calls[0][1] as string;
+    expect(written).toContain('EXPO_PUBLIC_POSTHOG_API_KEY=phc_public_key');
+  });
+
+  it('non-interactively skips an existing .env.local key without --overwrite', async () => {
+    jest.mocked(fs.pathExists).mockResolvedValue(true as never);
+    jest.mocked(fs.readFile).mockResolvedValue('EXPO_PUBLIC_POSTHOG_API_KEY=old_value\n' as never);
+
+    await createCommand(['--non-interactive']).runAsync();
+
+    expect(confirmAsync).not.toHaveBeenCalled();
+    expect(fs.writeFile).not.toHaveBeenCalled();
+    expect(Log.warn).toHaveBeenCalledWith(expect.stringContaining('pass --overwrite to replace'));
+  });
+
+  it('non-interactively overwrites an existing .env.local key with --overwrite', async () => {
+    jest.mocked(fs.pathExists).mockResolvedValue(true as never);
+    jest.mocked(fs.readFile).mockResolvedValue('EXPO_PUBLIC_POSTHOG_API_KEY=old_value\n' as never);
+
+    await createCommand(['--non-interactive', '--overwrite']).runAsync();
+
+    expect(confirmAsync).not.toHaveBeenCalled();
+    const written = jest.mocked(fs.writeFile).mock.calls[0][1] as string;
+    expect(written).toContain('EXPO_PUBLIC_POSTHOG_API_KEY=phc_public_key');
+  });
+
+  it('writes a personal API key containing $ verbatim (no replacement-pattern expansion)', async () => {
+    const command = createCommand([]);
+    const merged = (command as any).mergeEnvContent('POSTHOG_CLI_API_KEY=old\n', {
+      POSTHOG_CLI_API_KEY: 'phx_a$2b$&c',
+    });
+    expect(merged).toContain('POSTHOG_CLI_API_KEY=phx_a$2b$&c');
+  });
+
+  it('updates an existing EAS environment variable with --overwrite', async () => {
+    mockFeatureSelection(['analytics']);
+    jest
+      .mocked(EnvironmentVariablesQuery.byAppIdAsync)
+      .mockResolvedValue([{ id: 'existing-1', scope: EnvironmentVariableScope.Project }] as any);
+    jest
+      .mocked(EnvironmentVariableMutation.updateAsync)
+      .mockResolvedValue({ id: 'existing-1' } as any);
+
+    await createCommand(['--overwrite']).runAsync();
+
+    expect(EnvironmentVariableMutation.updateAsync).toHaveBeenCalled();
+    expect(EnvironmentVariableMutation.createForAppAsync).not.toHaveBeenCalled();
+  });
+
+  it('honors explicit --error-tracking interactively and detects an array-form plugin', async () => {
+    const command = createCommand(['--error-tracking', '--posthog-cli-api-key', 'phx_flag']);
+    jest.spyOn(command as any, 'getContextAsync').mockReturnValue({
+      privateProjectConfig: {
+        projectId: testProjectId,
+        exp: { name: 'testapp', slug: 'testapp', plugins: [['expo-router', {}]] },
+        projectDir: '/test/project',
+      },
+      loggedIn: { graphqlClient, actor: mockActor },
+    } as never);
+
+    await command.runAsync();
+
+    expect(promptAsync).not.toHaveBeenCalledWith(expect.objectContaining({ name: 'features' }));
+    const cliKeyVar = jest
+      .mocked(EnvironmentVariableMutation.createForAppAsync)
+      .mock.calls.find(call => call[1].name === 'POSTHOG_CLI_API_KEY');
+    expect(cliKeyVar?.[1].value).toBe('phx_flag');
+    expect(createOrModifyExpoConfigAsync).toHaveBeenCalled();
+  });
+
+  it('skips an existing EAS environment variable non-interactively without --overwrite', async () => {
+    jest
+      .mocked(EnvironmentVariablesQuery.byAppIdAsync)
+      .mockResolvedValue([{ id: 'existing-1', scope: EnvironmentVariableScope.Project }] as any);
+
+    await createCommand(['--non-interactive', '--region', 'US']).runAsync();
+
+    expect(EnvironmentVariableMutation.updateAsync).not.toHaveBeenCalled();
+    expect(Log.warn).toHaveBeenCalledWith(
+      expect.stringContaining('pass --overwrite to replace it')
+    );
+  });
+
+  it('skips an existing EAS environment variable when overwrite is declined', async () => {
+    mockFeatureSelection(['analytics']);
+    jest
+      .mocked(EnvironmentVariablesQuery.byAppIdAsync)
+      .mockResolvedValue([{ id: 'existing-1', scope: EnvironmentVariableScope.Project }] as any);
+    jest.mocked(confirmAsync).mockResolvedValue(false);
+
+    await createCommand([]).runAsync();
+
+    expect(EnvironmentVariableMutation.updateAsync).not.toHaveBeenCalled();
+    expect(Log.warn).toHaveBeenCalledWith(
+      expect.stringContaining('Skipped updating EAS environment variable')
+    );
+  });
+});

packages/eas-cli/src/commands/integrations/posthog/__tests__/dashboard.test.ts

@@ -0,0 +1,160 @@
+import openBrowserAsync from 'better-opn';
+
+import { getMockOclifConfig } from '../../../../__tests__/commands/utils';
+import { ExpoGraphqlClient } from '../../../../commandUtils/context/contextUtils/createGraphqlClient';
+import { testProjectId } from '../../../../credentials/__tests__/fixtures-constants';
+import { PostHogRegion } from '../../../../graphql/generated';
+import { PostHogQuery } from '../../../../graphql/queries/PostHogQuery';
+import {
+  PostHogOrganizationConnectionData,
+  PostHogProjectData,
+} from '../../../../graphql/types/PostHogConnection';
+import Log from '../../../../log';
+import { ora } from '../../../../ora';
+import { printJsonOnlyOutput } from '../../../../utils/json';
+import IntegrationsPostHogDashboard from '../dashboard';
+
+jest.mock('better-opn');
+jest.mock('../../../../graphql/queries/PostHogQuery');
+jest.mock('../../../../log');
+jest.mock('../../../../utils/json');
+jest.mock('../../../../ora', () => ({
+  ora: jest.fn(() => ({
+    start: jest.fn().mockReturnThis(),
+    succeed: jest.fn().mockReturnThis(),
+    fail: jest.fn().mockReturnThis(),
+  })),
+}));
+
+describe(IntegrationsPostHogDashboard, () => {
+  const graphqlClient = {} as ExpoGraphqlClient;
+  const mockConfig = getMockOclifConfig();
+
+  const mockConnection: PostHogOrganizationConnectionData = {
+    id: 'connection-1',
+    posthogOrganizationIdentifier: 'org-123',
+    posthogOrganizationName: 'Test Org',
+    posthogRegion: PostHogRegion.Us,
+    createdAt: '2024-01-01T00:00:00.000Z',
+    updatedAt: '2024-01-01T00:00:00.000Z',
+  };
+
+  const mockProject: PostHogProjectData = {
+    id: 'project-1',
+    posthogProjectIdentifier: 'res-123',
+    posthogProjectName: 'Test Project',
+    posthogProjectToken: 'phc_public_key',
+    posthogHost: 'https://us.posthog.com',
+    createdAt: '2024-01-01T00:00:00.000Z',
+    updatedAt: '2024-01-01T00:00:00.000Z',
+    posthogOrganizationConnection: mockConnection,
+  };
+
+  function createCommand(argv: string[] = []): IntegrationsPostHogDashboard {
+    const command = new IntegrationsPostHogDashboard(argv, mockConfig);
+    jest.spyOn(command as any, 'getContextAsync').mockReturnValue({
+      privateProjectConfig: {
+        projectId: testProjectId,
+        exp: { slug: 'testapp' },
+      },
+      loggedIn: { graphqlClient },
+    } as never);
+    return command;
+  }
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+    jest.spyOn(Log, 'warn').mockImplementation(() => {});
+    jest.spyOn(Log, 'log').mockImplementation(() => {});
+    jest.mocked(PostHogQuery.getPostHogProjectByAppIdAsync).mockResolvedValue(mockProject);
+    jest.mocked(openBrowserAsync).mockResolvedValue({} as never);
+    jest.mocked(ora).mockReturnValue({
+      start: jest.fn().mockReturnThis(),
+      succeed: jest.fn().mockReturnThis(),
+      fail: jest.fn().mockReturnThis(),
+    } as any);
+  });
+
+  it('opens the linked PostHog project dashboard', async () => {
+    await createCommand().runAsync();
+
+    expect(openBrowserAsync).toHaveBeenCalledWith('https://us.posthog.com/project/res-123');
+  });
+
+  it('normalizes a trailing-slash host and percent-encodes the project identifier', async () => {
+    jest.mocked(PostHogQuery.getPostHogProjectByAppIdAsync).mockResolvedValue({
+      ...mockProject,
+      posthogHost: 'https://us.posthog.com/',
+      posthogProjectIdentifier: 'team a/b',
+    });
+
+    await createCommand().runAsync();
+
+    expect(openBrowserAsync).toHaveBeenCalledWith('https://us.posthog.com/project/team%20a%2Fb');
+  });
+
+  it('logs an empty state when no project link exists', async () => {
+    jest.mocked(PostHogQuery.getPostHogProjectByAppIdAsync).mockResolvedValue(null);
+
+    await createCommand().runAsync();
+
+    expect(openBrowserAsync).not.toHaveBeenCalled();
+    expect(Log.warn).toHaveBeenCalledWith(
+      expect.stringContaining('No PostHog project is linked to Expo app')
+    );
+  });
+
+  it('fails the spinner when the browser cannot be opened', async () => {
+    jest.mocked(openBrowserAsync).mockResolvedValue(false);
+    const spinner = {
+      start: jest.fn().mockReturnThis(),
+      succeed: jest.fn().mockReturnThis(),
+      fail: jest.fn().mockReturnThis(),
+    };
+    jest.mocked(ora).mockReturnValue(spinner as any);
+
+    await createCommand().runAsync();
+
+    expect(spinner.fail).toHaveBeenCalledWith(
+      expect.stringContaining('Unable to open a web browser')
+    );
+  });
+
+  it('prints the dashboard URL in non-interactive mode without opening a browser', async () => {
+    await createCommand(['--non-interactive']).runAsync();
+
+    expect(openBrowserAsync).not.toHaveBeenCalled();
+    expect(Log.log).toHaveBeenCalledWith('https://us.posthog.com/project/res-123');
+  });
+
+  it('emits the dashboard URL as JSON with --json', async () => {
+    await createCommand(['--json']).runAsync();
+
+    expect(openBrowserAsync).not.toHaveBeenCalled();
+    expect(printJsonOnlyOutput).toHaveBeenCalledWith({
+      dashboardUrl: 'https://us.posthog.com/project/res-123',
+    });
+  });
+
+  it('emits a null dashboardUrl as JSON when no project is linked', async () => {
+    jest.mocked(PostHogQuery.getPostHogProjectByAppIdAsync).mockResolvedValue(null);
+
+    await createCommand(['--json']).runAsync();
+
+    expect(openBrowserAsync).not.toHaveBeenCalled();
+    expect(printJsonOnlyOutput).toHaveBeenCalledWith({ dashboardUrl: null });
+  });
+
+  it('fails the spinner and rethrows when opening the browser throws', async () => {
+    jest.mocked(openBrowserAsync).mockRejectedValue(new Error('no browser'));
+    const spinner = {
+      start: jest.fn().mockReturnThis(),
+      succeed: jest.fn().mockReturnThis(),
+      fail: jest.fn().mockReturnThis(),
+    };
+    jest.mocked(ora).mockReturnValue(spinner as any);
+
+    await expect(createCommand().runAsync()).rejects.toThrow('no browser');
+    expect(spinner.fail).toHaveBeenCalled();
+  });
+});

packages/eas-cli/src/commands/integrations/posthog/__tests__/disconnect.test.ts

@@ -0,0 +1,158 @@
+import { getMockOclifConfig } from '../../../../__tests__/commands/utils';
+import { ExpoGraphqlClient } from '../../../../commandUtils/context/contextUtils/createGraphqlClient';
+import { testProjectId } from '../../../../credentials/__tests__/fixtures-constants';
+import { PostHogRegion } from '../../../../graphql/generated';
+import { PostHogMutation } from '../../../../graphql/mutations/PostHogMutation';
+import { PostHogQuery } from '../../../../graphql/queries/PostHogQuery';
+import {
+  PostHogOrganizationConnectionData,
+  PostHogProjectData,
+} from '../../../../graphql/types/PostHogConnection';
+import Log from '../../../../log';
+import { confirmAsync } from '../../../../prompts';
+import { printJsonOnlyOutput } from '../../../../utils/json';
+import IntegrationsPostHogDisconnect from '../disconnect';
+
+jest.mock('../../../../graphql/queries/PostHogQuery');
+jest.mock('../../../../graphql/mutations/PostHogMutation');
+jest.mock('../../../../prompts');
+jest.mock('../../../../log');
+jest.mock('../../../../utils/json');
+jest.mock('../../../../ora', () => ({
+  ora: () => ({
+    start: jest.fn().mockReturnThis(),
+    succeed: jest.fn().mockReturnThis(),
+    fail: jest.fn().mockReturnThis(),
+  }),
+}));
+
+describe(IntegrationsPostHogDisconnect, () => {
+  const graphqlClient = {} as ExpoGraphqlClient;
+  const mockConfig = getMockOclifConfig();
+
+  const mockConnection: PostHogOrganizationConnectionData = {
+    id: 'connection-1',
+    posthogOrganizationIdentifier: 'org-123',
+    posthogOrganizationName: 'Test Org',
+    posthogRegion: PostHogRegion.Us,
+    createdAt: '2024-01-01T00:00:00.000Z',
+    updatedAt: '2024-01-01T00:00:00.000Z',
+  };
+
+  const mockProject: PostHogProjectData = {
+    id: 'project-1',
+    posthogProjectIdentifier: 'res-123',
+    posthogProjectName: 'Test Project',
+    posthogProjectToken: 'phc_public_key',
+    posthogHost: 'https://us.posthog.com',
+    createdAt: '2024-01-01T00:00:00.000Z',
+    updatedAt: '2024-01-01T00:00:00.000Z',
+    posthogOrganizationConnection: mockConnection,
+  };
+
+  function createCommand(argv: string[]): IntegrationsPostHogDisconnect {
+    const command = new IntegrationsPostHogDisconnect(argv, mockConfig);
+    jest.spyOn(command as any, 'getContextAsync').mockReturnValue({
+      privateProjectConfig: {
+        projectId: testProjectId,
+        exp: { slug: 'testapp' },
+      },
+      loggedIn: { graphqlClient },
+    } as never);
+    return command;
+  }
+
+  beforeEach(() => {
+    jest.resetAllMocks();
+    jest.spyOn(Log, 'log').mockImplementation(() => {});
+    jest.spyOn(Log, 'warn').mockImplementation(() => {});
+    jest.spyOn(Log, 'error').mockImplementation(() => {});
+    jest.spyOn(Log, 'addNewLineIfNone').mockImplementation(() => {});
+    jest.spyOn(Log, 'newLine').mockImplementation(() => {});
+    jest.mocked(PostHogQuery.getPostHogProjectByAppIdAsync).mockResolvedValue(mockProject);
+    jest.mocked(PostHogMutation.deletePostHogProjectAsync).mockResolvedValue(mockProject.id);
+    jest.mocked(confirmAsync).mockResolvedValue(true);
+  });
+
+  it('removes the project link after confirmation', async () => {
+    await createCommand([]).runAsync();
+
+    expect(PostHogMutation.deletePostHogProjectAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      mockProject.id
+    );
+  });
+
+  it('skips the prompt with --yes', async () => {
+    await createCommand(['--yes']).runAsync();
+
+    expect(confirmAsync).not.toHaveBeenCalled();
+    expect(PostHogMutation.deletePostHogProjectAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      mockProject.id
+    );
+  });
+
+  it('does nothing when the user declines confirmation', async () => {
+    jest.mocked(confirmAsync).mockResolvedValue(false);
+
+    await createCommand([]).runAsync();
+
+    expect(PostHogMutation.deletePostHogProjectAsync).not.toHaveBeenCalled();
+  });
+
+  it('deletes after a warning in non-interactive mode, noting PostHog data is preserved', async () => {
+    await createCommand(['--non-interactive']).runAsync();
+
+    expect(confirmAsync).not.toHaveBeenCalled();
+    expect(Log.warn).toHaveBeenCalledWith(
+      expect.stringContaining('does not delete the project on PostHog')
+    );
+    expect(PostHogMutation.deletePostHogProjectAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      mockProject.id
+    );
+  });
+
+  it('logs an empty state when no project link exists', async () => {
+    jest.mocked(PostHogQuery.getPostHogProjectByAppIdAsync).mockResolvedValue(null);
+
+    await createCommand([]).runAsync();
+
+    expect(PostHogMutation.deletePostHogProjectAsync).not.toHaveBeenCalled();
+    expect(Log.warn).toHaveBeenCalledWith(
+      expect.stringContaining('No PostHog project is linked to Expo app')
+    );
+  });
+
+  it('emits JSON output with --json and skips the prompt', async () => {
+    await createCommand(['--json']).runAsync();
+
+    expect(confirmAsync).not.toHaveBeenCalled();
+    expect(PostHogMutation.deletePostHogProjectAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      mockProject.id
+    );
+    expect(printJsonOnlyOutput).toHaveBeenCalledWith({
+      id: mockProject.id,
+      name: mockProject.posthogProjectName,
+    });
+  });
+
+  it('emits a null id as JSON when no project is linked', async () => {
+    jest.mocked(PostHogQuery.getPostHogProjectByAppIdAsync).mockResolvedValue(null);
+
+    await createCommand(['--json']).runAsync();
+
+    expect(PostHogMutation.deletePostHogProjectAsync).not.toHaveBeenCalled();
+    expect(printJsonOnlyOutput).toHaveBeenCalledWith({ id: null });
+  });
+
+  it('rethrows when the delete mutation fails', async () => {
+    jest
+      .mocked(PostHogMutation.deletePostHogProjectAsync)
+      .mockRejectedValue(new Error('delete boom'));
+
+    await expect(createCommand(['--yes']).runAsync()).rejects.toThrow('delete boom');
+  });
+});

packages/eas-cli/src/commands/integrations/posthog/connect.ts

@@ -0,0 +1,568 @@
+import { ExpoConfig } from '@expo/config';
+import spawnAsync from '@expo/spawn-async';
+import { Flags } from '@oclif/core';
+import chalk from 'chalk';
+import dotenv from 'dotenv';
+import * as fs from 'fs-extra';
+import path from 'path';
+
+import { DefaultEnvironment } from '../../../build/utils/environment';
+import EasCommand from '../../../commandUtils/EasCommand';
+import { ExpoGraphqlClient } from '../../../commandUtils/context/contextUtils/createGraphqlClient';
+import {
+  EasNonInteractiveAndJsonFlags,
+  resolveNonInteractiveAndJsonFlags,
+} from '../../../commandUtils/flags';
+import { getPostHogProjectDashboardUrl } from '../../../commandUtils/posthog';
+import {
+  EnvironmentSecretType,
+  EnvironmentVariableScope,
+  EnvironmentVariableVisibility,
+  PostHogRegion,
+} from '../../../graphql/generated';
+import { EnvironmentVariableMutation } from '../../../graphql/mutations/EnvironmentVariableMutation';
+import { PostHogMutation } from '../../../graphql/mutations/PostHogMutation';
+import { EnvironmentVariablesQuery } from '../../../graphql/queries/EnvironmentVariablesQuery';
+import { PostHogQuery } from '../../../graphql/queries/PostHogQuery';
+import { PostHogProjectData } from '../../../graphql/types/PostHogConnection';
+import Log, { link } from '../../../log';
+import { ora } from '../../../ora';
+import { createOrModifyExpoConfigAsync } from '../../../project/expoConfig';
+import { getOwnerAccountForProjectIdAsync } from '../../../project/projectUtils';
+import { Choice, confirmAsync, promptAsync, selectAsync } from '../../../prompts';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../../utils/json';
+
+const POSTHOG_REGIONS = [
+  { title: 'United States (US)', value: PostHogRegion.Us },
+  { title: 'European Union (EU)', value: PostHogRegion.Eu },
+];
+
+const EAS_POSTHOG_ENVIRONMENTS = [
+  DefaultEnvironment.Production,
+  DefaultEnvironment.Preview,
+  DefaultEnvironment.Development,
+];
+
+const SDK_PACKAGES = [
+  'posthog-react-native',
+  'expo-file-system',
+  'expo-application',
+  'expo-device',
+  'expo-localization',
+];
+const SESSION_REPLAY_PACKAGE = 'posthog-react-native-session-replay';
+const CONFIG_PLUGIN = 'posthog-react-native/expo';
+
+const EAS_POSTHOG_API_KEY_ENV_VAR_NAME = 'EXPO_PUBLIC_POSTHOG_API_KEY';
+const EAS_POSTHOG_HOST_ENV_VAR_NAME = 'EXPO_PUBLIC_POSTHOG_HOST';
+const POSTHOG_CLI_API_KEY_ENV_VAR_NAME = 'POSTHOG_CLI_API_KEY';
+const POSTHOG_CLI_PROJECT_ID_ENV_VAR_NAME = 'POSTHOG_CLI_PROJECT_ID';
+const POSTHOG_CLI_HOST_ENV_VAR_NAME = 'POSTHOG_CLI_HOST';
+
+const PERSONAL_API_KEY_SETTINGS_PATH = '/settings/user-api-keys';
+const ERROR_TRACKING_NEEDS_KEY_MESSAGE = `Error tracking needs a PostHog personal API key in non-interactive mode. Pass --posthog-cli-api-key (create one in PostHog under Settings → Personal API keys (${PERSONAL_API_KEY_SETTINGS_PATH}) with the "Source map upload" preset), or drop --error-tracking.`;
+
+type Features = { analytics: boolean; sessionReplay: boolean; errorTracking: boolean };
+type EnvVar = { name: string; value: string; visibility: EnvironmentVariableVisibility };
+
+function getSpawnErrorOutput(error: unknown): string {
+  const { stdout, stderr } = (error ?? {}) as { stdout?: string; stderr?: string };
+  return `${stdout ?? ''}${stderr ?? ''}`;
+}
+
+export default class IntegrationsPostHogConnect extends EasCommand {
+  static override description = 'connect PostHog to your Expo project';
+
+  static override contextDefinition = {
+    ...this.ContextOptions.ProjectConfig,
+  };
+
+  static override flags = {
+    ...EasNonInteractiveAndJsonFlags,
+    region: Flags.string({
+      description: 'PostHog region',
+      options: POSTHOG_REGIONS.map(r => r.value),
+    }),
+    'session-replay': Flags.boolean({
+      allowNo: true,
+      description: 'Set up PostHog session replay (default: yes)',
+    }),
+    'error-tracking': Flags.boolean({
+      allowNo: true,
+      description: 'Set up PostHog error tracking / source maps (requires a personal API key)',
+    }),
+    'posthog-cli-api-key': Flags.string({
+      description:
+        'PostHog personal API key for error-tracking source-map uploads (enables error tracking non-interactively)',
+    }),
+    overwrite: Flags.boolean({
+      description: 'Overwrite existing PostHog environment variables without prompting',
+      default: false,
+    }),
+  };
+
+  async runAsync(): Promise<void> {
+    const { flags } = await this.parse(IntegrationsPostHogConnect);
+    const { region: regionFlag, overwrite } = flags;
+    const cliApiKeyFlag =
+      (flags['posthog-cli-api-key'] ?? process.env[POSTHOG_CLI_API_KEY_ENV_VAR_NAME])?.trim() ||
+      undefined;
+    const { json: jsonFlag, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
+    if (jsonFlag) {
+      enableJsonOutput();
+    }
+
+    if (nonInteractive && flags['error-tracking'] === true && !cliApiKeyFlag) {
+      throw new Error(ERROR_TRACKING_NEEDS_KEY_MESSAGE);
+    }
+
+    const {
+      privateProjectConfig: { projectId, exp, projectDir },
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(IntegrationsPostHogConnect, {
+      nonInteractive,
+      withServerSideEnvironment: null,
+    });
+
+    const account = await getOwnerAccountForProjectIdAsync(graphqlClient, projectId);
+
+    let connection = await PostHogQuery.getPostHogOrganizationConnectionByAccountIdAsync(
+      graphqlClient,
+      account.id
+    );
+    if (connection) {
+      if (regionFlag && regionFlag !== connection.posthogRegion) {
+        Log.warn(
+          `This account is already connected to PostHog in the ${connection.posthogRegion} region; --region ${regionFlag} is ignored. An account has a single PostHog organization and its region can't be changed.`
+        );
+      }
+      Log.withTick(
+        `Using existing PostHog organization ${chalk.bold(connection.posthogOrganizationName)} (${connection.posthogRegion})`
+      );
+    } else {
+      const region = await this.resolveRegionAsync(regionFlag, nonInteractive);
+      const spinner = ora('Creating PostHog organization').start();
+      try {
+        connection = await PostHogMutation.createPostHogAccountRequestAsync(graphqlClient, {
+          accountId: account.id,
+          region,
+        });
+        spinner.succeed(
+          `Created PostHog organization ${chalk.bold(connection.posthogOrganizationName)}`
+        );
+      } catch (error) {
+        spinner.fail('Failed to create PostHog organization');
+        throw error;
+      }
+    }
+
+    let project = await PostHogQuery.getPostHogProjectByAppIdAsync(graphqlClient, projectId);
+    if (project) {
+      Log.withTick(`Using existing PostHog project ${chalk.bold(project.posthogProjectName)}`);
+    } else {
+      const spinner = ora('Setting up PostHog project').start();
+      try {
+        project = await PostHogMutation.setupPostHogProjectAsync(graphqlClient, {
+          appId: projectId,
+          posthogOrganizationConnectionId: connection.id,
+        });
+        spinner.succeed(`Created PostHog project ${chalk.bold(project.posthogProjectName)}`);
+      } catch (error) {
+        spinner.fail('Failed to set up PostHog project');
+        throw error;
+      }
+    }
+
+    const features = await this.resolveFeaturesAsync(flags, cliApiKeyFlag, nonInteractive);
+    const anyFeatureSelected =
+      features.analytics || features.sessionReplay || features.errorTracking;
+
+    const envVars: EnvVar[] = [];
+    if (anyFeatureSelected) {
+      envVars.push(
+        {
+          name: EAS_POSTHOG_API_KEY_ENV_VAR_NAME,
+          value: project.posthogProjectToken,
+          visibility: EnvironmentVariableVisibility.Public,
+        },
+        {
+          name: EAS_POSTHOG_HOST_ENV_VAR_NAME,
+          value: project.posthogHost,
+          visibility: EnvironmentVariableVisibility.Public,
+        }
+      );
+    }
+    if (features.errorTracking) {
+      const cliApiKey = await this.resolveCliApiKeyAsync(cliApiKeyFlag, project.posthogHost);
+      envVars.push(
+        {
+          name: POSTHOG_CLI_API_KEY_ENV_VAR_NAME,
+          value: cliApiKey,
+          visibility: EnvironmentVariableVisibility.Sensitive,
+        },
+        {
+          name: POSTHOG_CLI_PROJECT_ID_ENV_VAR_NAME,
+          value: project.posthogProjectIdentifier,
+          visibility: EnvironmentVariableVisibility.Public,
+        },
+        {
+          name: POSTHOG_CLI_HOST_ENV_VAR_NAME,
+          value: project.posthogHost,
+          visibility: EnvironmentVariableVisibility.Public,
+        }
+      );
+    }
+
+    const manualSteps: string[] = [];
+    if (anyFeatureSelected) {
+      const packages = [...SDK_PACKAGES];
+      if (features.sessionReplay) {
+        packages.push(SESSION_REPLAY_PACKAGE);
+      }
+      const installResult = await this.installSdkPackagesAsync(projectDir, packages, jsonFlag);
+      if (installResult === 'failed') {
+        manualSteps.push(
+          `The PostHog SDK packages didn't install. Run npx expo install ${packages.join(' ')} from your project directory.`
+        );
+      }
+      const pluginManualStep = await this.addConfigPluginAsync(projectDir, exp);
+      if (pluginManualStep) {
+        manualSteps.push(pluginManualStep);
+      }
+    }
+
+    await this.writeEnvLocalAsync(projectDir, envVars, nonInteractive, overwrite);
+    await Promise.all(
+      envVars.map(envVar =>
+        this.upsertEasEnvVarAsync(graphqlClient, projectId, envVar, nonInteractive, overwrite)
+      )
+    );
+
+    if (jsonFlag) {
+      printJsonOnlyOutput({
+        organizationConnection: {
+          id: connection.id,
+          name: connection.posthogOrganizationName,
+          region: connection.posthogRegion,
+        },
+        project: {
+          id: project.id,
+          name: project.posthogProjectName,
+          apiKey: project.posthogProjectToken,
+          host: project.posthogHost,
+        },
+        features,
+        dashboardUrl: getPostHogProjectDashboardUrl(project),
+        environmentVariables: envVars.map(v => v.name),
+        manualSteps,
+      });
+      return;
+    }
+
+    if (!anyFeatureSelected) {
+      Log.addNewLineIfNone();
+      Log.log(chalk.green('PostHog project created.'));
+      Log.newLine();
+      Log.log(
+        `${chalk.bold('Dashboard')}: ${link(getPostHogProjectDashboardUrl(project), { dim: false })}`
+      );
+      Log.newLine();
+      Log.warn(
+        'No PostHog features selected, so no SDK, config plugin, or environment variables were set up. Re-run to add analytics, session replay, or error tracking.'
+      );
+      return;
+    }
+
+    this.printNextSteps(project, features, manualSteps);
+  }
+
+  private async resolveFeaturesAsync(
+    flags: { 'session-replay'?: boolean; 'error-tracking'?: boolean },
+    cliApiKey: string | undefined,
+    nonInteractive: boolean
+  ): Promise<Features> {
+    const sessionReplayFlag = flags['session-replay'];
+    const errorTrackingFlag = flags['error-tracking'];
+    const hasCliApiKey = !!cliApiKey;
+
+    if (nonInteractive) {
+      const errorTracking = errorTrackingFlag ?? hasCliApiKey;
+      if (errorTrackingFlag === undefined && !hasCliApiKey) {
+        Log.warn(
+          'Skipping error tracking (source maps) — it needs a personal API key. Re-run interactively, or pass --posthog-cli-api-key to enable it non-interactively.'
+        );
+      }
+      return { analytics: true, sessionReplay: sessionReplayFlag ?? true, errorTracking };
+    }
+
+    if (sessionReplayFlag !== undefined || errorTrackingFlag !== undefined) {
+      return {
+        analytics: true,
+        sessionReplay: sessionReplayFlag ?? true,
+        errorTracking: errorTrackingFlag ?? true,
+      };
+    }
+
+    const { features } = await promptAsync({
+      type: 'multiselect',
+      name: 'features',
+      message: 'PostHog features to set up',
+      choices: [
+        { title: 'Analytics', value: 'analytics', selected: true },
+        { title: 'Session replay', value: 'session-replay', selected: true },
+        {
+          title: 'Error tracking (source maps) — requires a personal API key',
+          value: 'error-tracking',
+          selected: true,
+        },
+      ] satisfies Choice[],
+      instructions: false,
+      min: 0,
+    });
+    const selected = new Set<string>(features as string[]);
+    return {
+      analytics: selected.has('analytics'),
+      sessionReplay: selected.has('session-replay'),
+      errorTracking: selected.has('error-tracking'),
+    };
+  }
+
+  private async resolveCliApiKeyAsync(
+    cliApiKey: string | undefined,
+    host: string
+  ): Promise<string> {
+    if (cliApiKey) {
+      return cliApiKey;
+    }
+    const settingsUrl = `${host.replace(/\/$/, '')}${PERSONAL_API_KEY_SETTINGS_PATH}`;
+    const { apiKey } = await promptAsync({
+      type: 'password',
+      name: 'apiKey',
+      message: `Paste a PostHog personal API key for source-map uploads.\nCreate one at ${settingsUrl} using the "Source map upload" preset.`,
+      validate: (value: string) => (value.trim() ? true : 'Personal API key cannot be empty'),
+    });
+    return apiKey.trim();
+  }
+
+  private async resolveRegionAsync(
+    flagValue: string | undefined,
+    nonInteractive: boolean
+  ): Promise<PostHogRegion> {
+    const flagRegion = POSTHOG_REGIONS.find(r => r.value === flagValue);
+    if (flagRegion) {
+      return flagRegion.value;
+    }
+    if (nonInteractive) {
+      throw new Error(
+        'A PostHog region is required in non-interactive mode. Pass --region US or --region EU. The region sets data residency and cannot be changed after connecting.'
+      );
+    }
+    return await selectAsync('Select a PostHog region', POSTHOG_REGIONS);
+  }
+
+  private async installSdkPackagesAsync(
+    projectDir: string,
+    packages: string[],
+    jsonFlag: boolean
+  ): Promise<'installed' | 'failed'> {
+    const spinner = jsonFlag ? null : ora('Installing the PostHog SDK packages').start();
+    try {
+      await spawnAsync('npx', ['expo', 'install', ...packages], { cwd: projectDir });
+      spinner?.succeed('Installed the PostHog SDK packages');
+      return 'installed';
+    } catch (error) {
+      const output = getSpawnErrorOutput(error);
+      Log.debug(output || error);
+      if (output.includes('Cannot automatically write to dynamic config')) {
+        spinner?.succeed('Installed the PostHog SDK packages');
+        return 'installed';
+      }
+      spinner?.fail('Failed to install the PostHog SDK packages');
+      return 'failed';
+    }
+  }
+
+  private async addConfigPluginAsync(projectDir: string, exp: ExpoConfig): Promise<string | null> {
+    const plugins = exp.plugins ?? [];
+    const alreadyAdded = plugins.some(p => (Array.isArray(p) ? p[0] : p) === CONFIG_PLUGIN);
+    if (alreadyAdded) {
+      Log.withTick(`Config plugin ${chalk.bold(CONFIG_PLUGIN)} is already configured`);
+      return null;
+    }
+
+    const modification = await createOrModifyExpoConfigAsync(
+      projectDir,
+      { plugins: [...plugins, CONFIG_PLUGIN] },
+      { skipSDKVersionRequirement: true }
+    );
+    if (modification.type === 'success') {
+      Log.withTick(`Added the ${chalk.bold(CONFIG_PLUGIN)} config plugin`);
+      return null;
+    }
+    if (modification.type === 'warn') {
+      return `${modification.message} Add ${JSON.stringify(CONFIG_PLUGIN)} to the "plugins" array in your app config.`;
+    }
+    return `Add ${JSON.stringify(CONFIG_PLUGIN)} to the "plugins" array in your app config.`;
+  }
+
+  private async writeEnvLocalAsync(
+    projectDir: string,
+    envVars: EnvVar[],
+    nonInteractive: boolean,
+    overwrite: boolean
+  ): Promise<void> {
+    if (envVars.length === 0) {
+      return;
+    }
+    const envPath = path.join(projectDir, '.env.local');
+    let rawContent = '';
+    if (await fs.pathExists(envPath)) {
+      rawContent = await fs.readFile(envPath, 'utf8');
+      const existing = dotenv.parse(rawContent);
+      const conflicts = envVars.filter(v => existing[v.name] !== undefined);
+      if (conflicts.length > 0 && !overwrite) {
+        if (nonInteractive) {
+          Log.warn(
+            `.env.local already defines ${conflicts
+              .map(v => v.name)
+              .join(', ')}; skipped (pass --overwrite to replace).`
+          );
+          return;
+        }
+        const confirmed = await confirmAsync({
+          message: `.env.local already defines ${conflicts
+            .map(v => v.name)
+            .join(', ')}. Overwrite with the PostHog values?`,
+        });
+        if (!confirmed) {
+          Log.warn(`Skipped updating ${chalk.bold('.env.local')}.`);
+          return;
+        }
+      }
+    }
+
+    const updatedContent = this.mergeEnvContent(
+      rawContent,
+      Object.fromEntries(envVars.map(v => [v.name, v.value]))
+    );
+    await fs.writeFile(envPath, updatedContent);
+    Log.withTick(`Wrote PostHog config to ${chalk.bold('.env.local')}`);
+  }
+
+  private mergeEnvContent(rawContent: string, newVars: Record<string, string>): string {
+    let content = rawContent;
+    const keysToAdd: Record<string, string> = { ...newVars };
+    for (const [key, value] of Object.entries(newVars)) {
+      const regex = new RegExp(`^${key}=.*$`, 'm');
+      if (regex.test(content)) {
+        content = content.replace(regex, () => `${key}=${value}`);
+        delete keysToAdd[key];
+      }
+    }
+    const remaining = Object.entries(keysToAdd);
+    if (remaining.length > 0) {
+      if (content.length > 0 && !content.endsWith('\n')) {
+        content += '\n';
+      }
+      for (const [key, value] of remaining) {
+        content += `${key}=${value}\n`;
+      }
+    }
+    return content;
+  }
+
+  private async upsertEasEnvVarAsync(
+    graphqlClient: ExpoGraphqlClient,
+    projectId: string,
+    envVar: EnvVar,
+    nonInteractive: boolean,
+    overwrite: boolean
+  ): Promise<void> {
+    const existingVariables = await EnvironmentVariablesQuery.byAppIdAsync(graphqlClient, {
+      appId: projectId,
+      filterNames: [envVar.name],
+    });
+    const existingProjectVariable = existingVariables.find(
+      variable => variable.scope === EnvironmentVariableScope.Project
+    );
+
+    if (existingProjectVariable) {
+      const shouldOverwrite =
+        overwrite ||
+        (!nonInteractive &&
+          (await confirmAsync({
+            message: `EAS already has an ${envVar.name} environment variable for this project. Overwrite it?`,
+          })));
+      if (!shouldOverwrite) {
+        Log.warn(
+          `Skipped updating EAS environment variable ${chalk.bold(envVar.name)}${
+            nonInteractive ? ' (pass --overwrite to replace it)' : ''
+          }.`
+        );
+        return;
+      }
+      await EnvironmentVariableMutation.updateAsync(graphqlClient, {
+        id: existingProjectVariable.id,
+        name: envVar.name,
+        value: envVar.value,
+        environments: EAS_POSTHOG_ENVIRONMENTS,
+        visibility: envVar.visibility,
+        type: EnvironmentSecretType.String,
+      });
+      Log.withTick(`Updated EAS environment variable ${chalk.bold(envVar.name)} for builds`);
+      return;
+    }
+
+    await EnvironmentVariableMutation.createForAppAsync(
+      graphqlClient,
+      {
+        name: envVar.name,
+        value: envVar.value,
+        environments: EAS_POSTHOG_ENVIRONMENTS,
+        visibility: envVar.visibility,
+        type: EnvironmentSecretType.String,
+      },
+      projectId
+    );
+    Log.withTick(`Created EAS environment variable ${chalk.bold(envVar.name)} for builds`);
+  }
+
+  private printNextSteps(
+    project: PostHogProjectData,
+    features: Features,
+    manualSteps: string[]
+  ): void {
+    Log.addNewLineIfNone();
+    Log.log(chalk.green('PostHog is connected!'));
+    Log.newLine();
+    Log.log(
+      `${chalk.bold('Dashboard')}: ${link(getPostHogProjectDashboardUrl(project), { dim: false })}`
+    );
+    Log.newLine();
+    Log.log('Next steps:');
+    const steps: string[] = [
+      `Wrap your app in ${chalk.cyan('<PostHogProvider>')} following our guide (${chalk.cyan('https://docs.expo.dev/guides/using-posthog')}).`,
+    ];
+    if (features.sessionReplay) {
+      steps.push(
+        `Enable session replay in the provider options (the ${chalk.bold(SESSION_REPLAY_PACKAGE)} package is installed).`
+      );
+    }
+    if (features.errorTracking) {
+      steps.push(
+        `Error-tracking source maps: your ${chalk.bold('POSTHOG_CLI_*')} env vars are set. Wrap ${chalk.bold('metro.config.js')} with ${chalk.cyan('getPostHogExpoConfig')} (see ${chalk.cyan('https://docs.expo.dev/guides/using-posthog#source-maps')}); uploads then run automatically on EAS Build, and via ${chalk.cyan('posthog-cli hermes upload')} for EAS Update.`
+      );
+    }
+    steps.forEach((step, index) => {
+      Log.log(`  ${index + 1}. ${step}`);
+    });
+
+    if (manualSteps.length > 0) {
+      Log.newLine();
+      Log.warn('Finish setup manually:');
+      manualSteps.forEach(step => {
+        Log.warn(`  • ${step}`);
+      });
+    }
+  }
+}

packages/eas-cli/src/commands/integrations/posthog/dashboard.ts

@@ -0,0 +1,80 @@
+import openBrowserAsync from 'better-opn';
+
+import EasCommand from '../../../commandUtils/EasCommand';
+import {
+  EasNonInteractiveAndJsonFlags,
+  resolveNonInteractiveAndJsonFlags,
+} from '../../../commandUtils/flags';
+import { getPostHogProjectDashboardUrl, logNoPostHogProject } from '../../../commandUtils/posthog';
+import { PostHogQuery } from '../../../graphql/queries/PostHogQuery';
+import Log from '../../../log';
+import { ora } from '../../../ora';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../../utils/json';
+
+export default class IntegrationsPostHogDashboard extends EasCommand {
+  static override description = 'open the PostHog dashboard for the linked PostHog project';
+
+  static override flags = {
+    ...EasNonInteractiveAndJsonFlags,
+  };
+
+  static override contextDefinition = {
+    ...this.ContextOptions.ProjectConfig,
+  };
+
+  async runAsync(): Promise<void> {
+    const { flags } = await this.parse(IntegrationsPostHogDashboard);
+    const { json: jsonFlag, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
+    if (jsonFlag) {
+      enableJsonOutput();
+    }
+
+    const {
+      privateProjectConfig: { projectId, exp },
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(IntegrationsPostHogDashboard, {
+      nonInteractive,
+      withServerSideEnvironment: null,
+    });
+
+    const posthogProject = await PostHogQuery.getPostHogProjectByAppIdAsync(
+      graphqlClient,
+      projectId
+    );
+
+    if (!posthogProject) {
+      if (jsonFlag) {
+        printJsonOnlyOutput({ dashboardUrl: null });
+      } else {
+        logNoPostHogProject(exp.slug);
+      }
+      return;
+    }
+
+    const dashboardUrl = getPostHogProjectDashboardUrl(posthogProject);
+
+    if (jsonFlag) {
+      printJsonOnlyOutput({ dashboardUrl });
+      return;
+    }
+
+    if (nonInteractive) {
+      Log.log(dashboardUrl);
+      return;
+    }
+
+    const failedMessage = `Unable to open a web browser. PostHog dashboard is available at: ${dashboardUrl}`;
+    const spinner = ora(`Opening ${dashboardUrl}`).start();
+    try {
+      const opened = await openBrowserAsync(dashboardUrl);
+      if (opened) {
+        spinner.succeed(`Opened ${dashboardUrl}`);
+      } else {
+        spinner.fail(failedMessage);
+      }
+    } catch (error) {
+      spinner.fail(failedMessage);
+      throw error;
+    }
+  }
+}

packages/eas-cli/src/commands/integrations/posthog/disconnect.ts

@@ -0,0 +1,100 @@
+import { Flags } from '@oclif/core';
+import chalk from 'chalk';
+
+import EasCommand from '../../../commandUtils/EasCommand';
+import {
+  EasNonInteractiveAndJsonFlags,
+  resolveNonInteractiveAndJsonFlags,
+} from '../../../commandUtils/flags';
+import { formatPostHogProject, logNoPostHogProject } from '../../../commandUtils/posthog';
+import { PostHogMutation } from '../../../graphql/mutations/PostHogMutation';
+import { PostHogQuery } from '../../../graphql/queries/PostHogQuery';
+import Log from '../../../log';
+import { ora } from '../../../ora';
+import { confirmAsync } from '../../../prompts';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../../utils/json';
+
+export default class IntegrationsPostHogDisconnect extends EasCommand {
+  static override description =
+    'remove the PostHog project link for the current Expo app from EAS servers';
+
+  static override flags = {
+    ...EasNonInteractiveAndJsonFlags,
+    yes: Flags.boolean({
+      char: 'y',
+      description: 'Skip confirmation prompt',
+      default: false,
+    }),
+  };
+
+  static override contextDefinition = {
+    ...this.ContextOptions.ProjectConfig,
+  };
+
+  async runAsync(): Promise<void> {
+    const { flags } = await this.parse(IntegrationsPostHogDisconnect);
+    const { yes } = flags;
+    const { json: jsonFlag, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
+    if (jsonFlag) {
+      enableJsonOutput();
+    }
+
+    const {
+      privateProjectConfig: { projectId, exp },
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(IntegrationsPostHogDisconnect, {
+      nonInteractive,
+      withServerSideEnvironment: null,
+    });
+
+    const posthogProject = await PostHogQuery.getPostHogProjectByAppIdAsync(
+      graphqlClient,
+      projectId
+    );
+
+    if (!posthogProject) {
+      if (jsonFlag) {
+        printJsonOnlyOutput({ id: null });
+      } else {
+        logNoPostHogProject(exp.slug);
+      }
+      return;
+    }
+
+    if (!jsonFlag) {
+      Log.addNewLineIfNone();
+      Log.log(formatPostHogProject(posthogProject));
+      Log.newLine();
+    }
+
+    if (!nonInteractive && !yes) {
+      const confirmed = await confirmAsync({
+        message:
+          'Remove this PostHog project link from EAS servers? This does not delete the project on PostHog.',
+      });
+      if (!confirmed) {
+        Log.warn('Canceled removal of the PostHog project link.');
+        return;
+      }
+    } else if (!jsonFlag) {
+      Log.warn(
+        'Removing the PostHog project link from EAS servers. This does not delete the project on PostHog.'
+      );
+    }
+
+    const spinner = jsonFlag ? null : ora('Removing PostHog project link').start();
+    try {
+      await PostHogMutation.deletePostHogProjectAsync(graphqlClient, posthogProject.id);
+      spinner?.succeed(
+        `Removed PostHog project ${chalk.bold(posthogProject.posthogProjectName)} from EAS servers`
+      );
+    } catch (error) {
+      spinner?.fail('Failed to remove PostHog project link');
+      throw error;
+    }
+
+    if (jsonFlag) {
+      printJsonOnlyOutput({ id: posthogProject.id, name: posthogProject.posthogProjectName });
+    }
+  }
+}

packages/eas-cli/src/commands/simulator/start.ts

@@ -62,6 +62,11 @@ export default class SimulatorStart extends EasCommand {
       description:
         'Version of the package backing the device run session (e.g. "0.1.3-alpha.3"). Defaults to "latest" when omitted.',
     }),
+    'max-duration-minutes': Flags.integer({
+      description:
+        'Maximum duration of the device run session in minutes before it is automatically stopped. Only customizable on paid plans. Defaults to a value derived from the job run priority when omitted.',
+      min: 0,
+    }),
     force: Flags.boolean({
       description:
         '[default: true] Create a new device session even when an existing simulator session is present in the environment.',
@@ -125,6 +130,7 @@ export default class SimulatorStart extends EasCommand {
         platform,
         type: DEVICE_RUN_SESSION_TYPE_BY_FLAG_VALUE[flags.type],
         packageVersion: flags['package-version'],
+        maxRunTimeMinutes: flags['max-duration-minutes'],
       });
       deviceRunSessionId = session.id;
       const jobRunId = nullthrows(session.turtleJobRun?.id, 'Expected device run session to start');

packages/eas-cli/src/commands/update/__tests__/rollback.test.ts

@@ -0,0 +1,314 @@
+import { AppJSONConfig, ExpoConfig, PackageJSONConfig, getConfig } from '@expo/config';
+import { DirectoryJSON, vol } from 'memfs';
+import { instance, mock } from 'ts-mockito';
+
+import { getMockOclifConfig } from '../../../__tests__/commands/utils';
+import LoggedInContextField from '../../../commandUtils/context/LoggedInContextField';
+import { PrivateProjectConfigContextField } from '../../../commandUtils/context/PrivateProjectConfigContextField';
+import { ExpoGraphqlClient } from '../../../commandUtils/context/contextUtils/createGraphqlClient';
+import FeatureGateEnvOverrides from '../../../commandUtils/gating/FeatureGateEnvOverrides';
+import FeatureGating from '../../../commandUtils/gating/FeatureGating';
+import { jester } from '../../../credentials/__tests__/fixtures-constants';
+import { UpdateFragment } from '../../../graphql/generated';
+import { AppQuery } from '../../../graphql/queries/AppQuery';
+import { UpdateQuery } from '../../../graphql/queries/UpdateQuery';
+import UpdateRepublish from '../republish';
+import UpdateRollBackToEmbedded from '../roll-back-to-embedded';
+import UpdateRollback from '../rollback';
+
+const projectRoot = '/test-project';
+const commandOptions = getMockOclifConfig({ root: projectRoot });
+
+const updateStub: UpdateFragment = {
+  id: 'update-1234',
+  group: 'group-source',
+  branch: { id: 'branch-1234', name: 'main' },
+  message: 'source message',
+  runtimeVersion: 'exposdk:47.0.0',
+  platform: 'ios',
+  gitCommitHash: 'commit',
+  isGitWorkingTreeDirty: false,
+  manifestFragment: JSON.stringify({ fake: 'manifest' }),
+  isRollBackToEmbedded: false,
+  manifestPermalink: 'https://expo.dev/fake/manifest/link',
+  codeSigningInfo: null,
+  createdAt: '2022-01-01T12:00:00Z',
+};
+
+jest.mock('fs');
+jest.mock('@expo/config');
+jest.mock('../../../commandUtils/context/contextUtils/getProjectIdAsync');
+jest.mock('../../../graphql/queries/AppQuery');
+jest.mock('../../../graphql/queries/UpdateQuery');
+
+describe(UpdateRollback.name, () => {
+  beforeEach(() => {
+    jest.spyOn(UpdateRepublish, 'run').mockResolvedValue(undefined as any);
+    jest.spyOn(UpdateRollBackToEmbedded, 'run').mockResolvedValue(undefined as any);
+  });
+
+  afterEach(() => {
+    vol.reset();
+    jest.restoreAllMocks();
+    jest.resetAllMocks();
+  });
+
+  it('errors in non-interactive mode when no group ID is provided', async () => {
+    const flags = ['--non-interactive'];
+    mockTestProject();
+
+    await expect(new UpdateRollback(flags, commandOptions).run()).rejects.toThrow(
+      'The update group ID argument is required in non-interactive mode.'
+    );
+
+    expect(UpdateRepublish.run).not.toHaveBeenCalled();
+    expect(UpdateRollBackToEmbedded.run).not.toHaveBeenCalled();
+  });
+
+  it('republishes the previous update group when the source group is the latest', async () => {
+    const flags = ['group-source', '--non-interactive'];
+    mockTestProject();
+
+    jest
+      .mocked(UpdateQuery.viewUpdateGroupAsync)
+      .mockResolvedValue([{ ...updateStub, group: 'group-source' }]);
+
+    // Most-recent-first: the source group is the latest, the previous group follows.
+    jest
+      .mocked(UpdateQuery.viewUpdateGroupsPaginatedOnBranchAsync)
+      .mockResolvedValue([
+        [{ ...updateStub, group: 'group-source', message: 'source message' }],
+        [{ ...updateStub, group: 'group-previous', message: 'previous message' }],
+      ]);
+
+    await new UpdateRollback(flags, commandOptions).run();
+
+    expect(UpdateRollBackToEmbedded.run).not.toHaveBeenCalled();
+    expect(UpdateRepublish.run).toHaveBeenCalledWith([
+      '--group',
+      'group-previous',
+      '--message',
+      'Roll back to "previous message" (group: group-previous)',
+      '--non-interactive',
+      '--platform',
+      'all',
+    ]);
+  });
+
+  it('rolls back to embedded when the source group is the only update for its runtime version', async () => {
+    const flags = ['group-source', '--non-interactive'];
+    mockTestProject();
+
+    jest
+      .mocked(UpdateQuery.viewUpdateGroupAsync)
+      .mockResolvedValue([{ ...updateStub, group: 'group-source' }]);
+
+    // Only the source group exists for this runtime version -> no previous group.
+    jest
+      .mocked(UpdateQuery.viewUpdateGroupsPaginatedOnBranchAsync)
+      .mockResolvedValue([[{ ...updateStub, group: 'group-source', message: 'source message' }]]);
+
+    await new UpdateRollback(flags, commandOptions).run();
+
+    expect(UpdateRepublish.run).not.toHaveBeenCalled();
+    expect(UpdateRollBackToEmbedded.run).toHaveBeenCalledWith([
+      '--branch',
+      'main',
+      '--runtime-version',
+      'exposdk:47.0.0',
+      '--message',
+      'Roll back to embedded',
+      '--non-interactive',
+      '--platform',
+      'all',
+    ]);
+  });
+
+  it('forwards --message, --platform, and --private-key-path to the republish path', async () => {
+    const flags = [
+      'group-source',
+      '--non-interactive',
+      '--message',
+      'custom rollback message',
+      '--platform',
+      'ios',
+      '--private-key-path',
+      './keys/private-key.pem',
+    ];
+    mockTestProject();
+
+    jest
+      .mocked(UpdateQuery.viewUpdateGroupAsync)
+      .mockResolvedValue([{ ...updateStub, group: 'group-source' }]);
+
+    jest
+      .mocked(UpdateQuery.viewUpdateGroupsPaginatedOnBranchAsync)
+      .mockResolvedValue([
+        [{ ...updateStub, group: 'group-source', message: 'source message' }],
+        [{ ...updateStub, group: 'group-previous', message: 'previous message' }],
+      ]);
+
+    await new UpdateRollback(flags, commandOptions).run();
+
+    expect(UpdateRepublish.run).toHaveBeenCalledWith([
+      '--group',
+      'group-previous',
+      '--message',
+      'custom rollback message',
+      '--non-interactive',
+      '--platform',
+      'ios',
+      '--private-key-path',
+      './keys/private-key.pem',
+    ]);
+  });
+
+  it('forwards --json to the republish path', async () => {
+    const flags = ['group-source', '--json', '--non-interactive'];
+    mockTestProject();
+
+    jest
+      .mocked(UpdateQuery.viewUpdateGroupAsync)
+      .mockResolvedValue([{ ...updateStub, group: 'group-source' }]);
+
+    jest
+      .mocked(UpdateQuery.viewUpdateGroupsPaginatedOnBranchAsync)
+      .mockResolvedValue([
+        [{ ...updateStub, group: 'group-source', message: 'source message' }],
+        [{ ...updateStub, group: 'group-previous', message: 'previous message' }],
+      ]);
+
+    await new UpdateRollback(flags, commandOptions).run();
+
+    expect(UpdateRepublish.run).toHaveBeenCalledWith(expect.arrayContaining(['--json']));
+  });
+
+  it('forwards --platform and --private-key-path to the embedded rollback path', async () => {
+    const flags = [
+      'group-source',
+      '--non-interactive',
+      '--platform',
+      'ios',
+      '--private-key-path',
+      './keys/private-key.pem',
+    ];
+    mockTestProject();
+
+    jest
+      .mocked(UpdateQuery.viewUpdateGroupAsync)
+      .mockResolvedValue([{ ...updateStub, group: 'group-source' }]);
+
+    // No previous group -> roll back to embedded.
+    jest
+      .mocked(UpdateQuery.viewUpdateGroupsPaginatedOnBranchAsync)
+      .mockResolvedValue([[{ ...updateStub, group: 'group-source', message: 'source message' }]]);
+
+    await new UpdateRollback(flags, commandOptions).run();
+
+    expect(UpdateRepublish.run).not.toHaveBeenCalled();
+    expect(UpdateRollBackToEmbedded.run).toHaveBeenCalledWith([
+      '--branch',
+      'main',
+      '--runtime-version',
+      'exposdk:47.0.0',
+      '--message',
+      'Roll back to embedded',
+      '--non-interactive',
+      '--platform',
+      'ios',
+      '--private-key-path',
+      './keys/private-key.pem',
+    ]);
+  });
+
+  it('errors when the source group is not the latest update for its runtime version', async () => {
+    const flags = ['group-source', '--non-interactive'];
+    mockTestProject();
+
+    jest
+      .mocked(UpdateQuery.viewUpdateGroupAsync)
+      .mockResolvedValue([{ ...updateStub, group: 'group-source' }]);
+
+    // A newer group is the latest for this runtime version, so the source group is stale.
+    jest
+      .mocked(UpdateQuery.viewUpdateGroupsPaginatedOnBranchAsync)
+      .mockResolvedValue([
+        [{ ...updateStub, group: 'group-newer', message: 'newer message' }],
+        [{ ...updateStub, group: 'group-source', message: 'source message' }],
+      ]);
+
+    await expect(new UpdateRollback(flags, commandOptions).run()).rejects.toThrow(
+      'Update group "group-source" is not the latest update on branch "main" for runtime version "exposdk:47.0.0" (the latest is "group-newer"). Only the latest update can be rolled back.'
+    );
+
+    expect(UpdateRepublish.run).not.toHaveBeenCalled();
+    expect(UpdateRollBackToEmbedded.run).not.toHaveBeenCalled();
+  });
+});
+
+function mockTestProject({
+  configuredProjectId = '1234',
+  extraManifest,
+  extraVol,
+}: {
+  configuredProjectId?: string;
+  extraManifest?: Partial<ExpoConfig>;
+  extraVol?: DirectoryJSON;
+} = {}): void {
+  const packageJSON: PackageJSONConfig = {
+    name: 'testing123',
+    version: '0.1.0',
+    description: 'fake description',
+    main: 'index.js',
+  };
+
+  const appJSON: AppJSONConfig = {
+    expo: {
+      name: 'testing 123',
+      version: '0.1.0',
+      slug: 'testing-123',
+      sdkVersion: '33.0.0',
+      owner: jester.accounts[0].name,
+      extra: {
+        eas: {
+          projectId: configuredProjectId,
+        },
+      },
+      ...extraManifest,
+    },
+  };
+
+  vol.fromJSON(
+    {
+      'package.json': JSON.stringify(packageJSON),
+      'app.json': JSON.stringify(appJSON),
+      ...extraVol,
+    },
+    projectRoot
+  );
+
+  const mockManifest = { exp: appJSON.expo };
+  const graphqlClient = instance(mock<ExpoGraphqlClient>({}));
+
+  jest.mocked(getConfig).mockReturnValue(mockManifest as any);
+  jest.spyOn(PrivateProjectConfigContextField.prototype, 'getValueAsync').mockResolvedValue({
+    exp: mockManifest.exp,
+    projectDir: projectRoot,
+    projectId: configuredProjectId,
+  });
+
+  jest.spyOn(LoggedInContextField.prototype, 'getValueAsync').mockResolvedValue({
+    actor: jester,
+    featureGating: new FeatureGating({}, new FeatureGateEnvOverrides()),
+    graphqlClient,
+    authenticationInfo: { accessToken: null, sessionSecret: '1234' },
+  });
+
+  jest.mocked(AppQuery.byIdAsync).mockResolvedValue({
+    id: '1234',
+    slug: 'testing-123',
+    name: 'testing-123',
+    fullName: '@jester/testing-123',
+    ownerAccount: jester.accounts[0],
+  });
+}

packages/eas-cli/src/commands/update/__tests__/view.test.ts

@@ -7,7 +7,7 @@ import { enableJsonOutput, printJsonOnlyOutput } from '../../../utils/json';
 import UpdateView from '../view';
 
 jest.mock('../../../graphql/queries/UpdateQuery', () => ({
-  UpdateQuery: { viewUpdateGroupAsync: jest.fn() },
+  UpdateQuery: { viewUpdateGroupAsync: jest.fn(), viewByUpdateAsync: jest.fn() },
 }));
 jest.mock('../../../graphql/queries/UpdateInsightsQuery', () => ({
   UpdateInsightsQuery: { viewUpdateGroupInsightsAsync: jest.fn() },
@@ -16,6 +16,7 @@ jest.mock('../../../log');
 jest.mock('../../../utils/json');
 
 const mockViewUpdateGroupAsync = jest.mocked(UpdateQuery.viewUpdateGroupAsync);
+const mockViewByUpdateAsync = jest.mocked(UpdateQuery.viewByUpdateAsync);
 const mockViewUpdateGroupInsightsAsync = jest.mocked(
   UpdateInsightsQuery.viewUpdateGroupInsightsAsync
 );
@@ -155,4 +156,42 @@ describe(UpdateView, () => {
     expect(arg.insights).toBeDefined();
     expect(arg.insights.platforms[0].totals.installs).toBe(990);
   });
+
+  it('does not look up a single update when the ID resolves as a group', async () => {
+    const command = createCommand(['group-1']);
+    await command.runAsync();
+    expect(mockViewUpdateGroupAsync).toHaveBeenCalledWith(graphqlClient, { groupId: 'group-1' });
+    expect(mockViewByUpdateAsync).not.toHaveBeenCalled();
+  });
+
+  it('resolves a platform-specific update ID to its group', async () => {
+    mockViewUpdateGroupAsync.mockReset();
+    mockViewUpdateGroupAsync
+      .mockRejectedValueOnce(new Error('Could not find any updates with group ID: "u1"'))
+      .mockResolvedValueOnce(updateGroup);
+    mockViewByUpdateAsync.mockResolvedValue({ ...updateGroup[0], group: 'group-1' });
+
+    const command = createCommand(['u1', '--insights']);
+    await command.runAsync();
+
+    expect(mockViewByUpdateAsync).toHaveBeenCalledWith(graphqlClient, { updateId: 'u1' });
+    expect(mockViewUpdateGroupAsync).toHaveBeenLastCalledWith(graphqlClient, {
+      groupId: 'group-1',
+    });
+    expect(mockViewUpdateGroupInsightsAsync).toHaveBeenCalledWith(
+      graphqlClient,
+      expect.objectContaining({ groupId: 'group-1' })
+    );
+  });
+
+  it('surfaces the original group lookup error when the ID matches neither a group nor an update', async () => {
+    mockViewUpdateGroupAsync.mockReset();
+    mockViewUpdateGroupAsync.mockRejectedValue(
+      new Error('Could not find any updates with group ID: "bogus"')
+    );
+    mockViewByUpdateAsync.mockRejectedValue(new Error('update not found'));
+
+    const command = createCommand(['bogus']);
+    await expect(command.runAsync()).rejects.toThrow(/Could not find any updates with group ID/);
+  });
 });

packages/eas-cli/src/commands/update/rollback.ts

@@ -1,41 +1,188 @@
-import { Flags } from '@oclif/core';
+import { Args, Flags } from '@oclif/core';
 
 import UpdateRepublish from './republish';
 import UpdateRollBackToEmbedded from './roll-back-to-embedded';
 import EasCommand from '../../commandUtils/EasCommand';
+import { ExpoGraphqlClient } from '../../commandUtils/context/contextUtils/createGraphqlClient';
+import {
+  EasNonInteractiveAndJsonFlags,
+  resolveNonInteractiveAndJsonFlags,
+} from '../../commandUtils/flags';
+import { UpdateQuery } from '../../graphql/queries/UpdateQuery';
 import { promptAsync } from '../../prompts';
 
-export default class UpdateRollback extends EasCommand {
-  static override description =
-    'Roll back to an embedded update or an existing update. Users wishing to run this command non-interactively should instead execute "eas update:republish" or "eas update:roll-back-to-embedded".';
+const defaultRollbackPlatforms = ['android', 'ios'] as const;
 
-  static override flags = {
-    'private-key-path': Flags.string({
-      description: `File containing the PEM-encoded private key corresponding to the certificate in expo-updates' configuration. Defaults to a file named "private-key.pem" in the certificate's directory. Only relevant if you are using code signing: https://docs.expo.dev/eas-update/code-signing/`,
+type SourceUpdateGroup = {
+  groupId: string;
+  branchName: string;
+  runtimeVersion: string;
+};
+
+type PreviousUpdateGroup = {
+  groupId: string;
+  message: string | null;
+};
+
+export default class UpdateRollback extends EasCommand {
+  static override description = 'roll back to an embedded update or an existing update';
+
+  static override args = {
+    groupId: Args.string({
+      description:
+        'The ID of the update group to roll back. Must be the latest update for its branch and runtime version. The update group published before it is republished; if there is none, a roll back to the embedded update is published. Required in non-interactive mode.',
       required: false,
     }),
   };
 
+  static override flags = {
+    message: Flags.string({
+      char: 'm',
+      description: 'Short message describing the rollback update',
+      required: false,
+    }),
+    platform: Flags.option({
+      char: 'p',
+      options: [...defaultRollbackPlatforms, 'all'] as const,
+      default: 'all',
+      required: false,
+    })(),
+    'private-key-path': Flags.string({
+      description: `File containing the PEM-encoded private key corresponding to the certificate in expo-updates' configuration. Defaults to a file named "private-key.pem" in the certificate's directory. Only relevant if you are using code signing: https://docs.expo.dev/eas-update/code-signing/`,
+      required: false,
+    }),
+    ...EasNonInteractiveAndJsonFlags,
+  };
+
+  static override contextDefinition = {
+    ...this.ContextOptions.ProjectConfig,
+    ...this.ContextOptions.LoggedIn,
+  };
+
   async runAsync(): Promise<void> {
-    const { flags } = await this.parse(UpdateRollback);
-
-    const { choice } = await promptAsync({
-      type: 'select',
-      message: 'Which type of update would you like to roll back to?',
-      name: 'choice',
-      choices: [
-        { title: 'Published Update', value: 'published' },
-        { title: 'Embedded Update', value: 'embedded' },
-      ],
-    });
-
+    const { args, flags } = await this.parse(UpdateRollback);
+    const { json, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
+    const groupId = args.groupId;
+    const platform = flags.platform;
+    const messageArg = flags.message;
     const privateKeyPathArg = flags['private-key-path']
       ? ['--private-key-path', flags['private-key-path']]
       : [];
-    if (choice === 'published') {
-      await UpdateRepublish.run(privateKeyPathArg);
+
+    if (!groupId) {
+      if (nonInteractive) {
+        throw new Error('The update group ID argument is required in non-interactive mode.');
+      }
+
+      const { choice } = await promptAsync({
+        type: 'select',
+        message: 'Which type of update would you like to roll back to?',
+        name: 'choice',
+        choices: [
+          { title: 'Published Update', value: 'published' },
+          { title: 'Embedded Update', value: 'embedded' },
+        ],
+      });
+
+      if (choice === 'published') {
+        await UpdateRepublish.run(privateKeyPathArg);
+      } else {
+        await UpdateRollBackToEmbedded.run(privateKeyPathArg);
+      }
+      return;
+    }
+
+    const {
+      loggedIn: { graphqlClient },
+      privateProjectConfig: { projectId },
+    } = await this.getContextAsync(UpdateRollback, {
+      nonInteractive,
+      withServerSideEnvironment: null,
+    });
+
+    const sourceGroup = await getSourceUpdateGroupAsync(graphqlClient, groupId);
+    const previousGroup = await getPreviousUpdateGroupAsync(graphqlClient, projectId, sourceGroup);
+
+    const commonArgs = [
+      '--non-interactive',
+      '--platform',
+      platform,
+      ...privateKeyPathArg,
+      ...(json ? ['--json'] : []),
+    ];
+
+    if (previousGroup) {
+      const message =
+        messageArg ??
+        `Roll back to "${previousGroup.message ?? ''}" (group: ${previousGroup.groupId})`;
+      await UpdateRepublish.run([
+        '--group',
+        previousGroup.groupId,
+        '--message',
+        message,
+        ...commonArgs,
+      ]);
     } else {
-      await UpdateRollBackToEmbedded.run(privateKeyPathArg);
+      const message = messageArg ?? 'Roll back to embedded';
+      await UpdateRollBackToEmbedded.run([
+        '--branch',
+        sourceGroup.branchName,
+        '--runtime-version',
+        sourceGroup.runtimeVersion,
+        '--message',
+        message,
+        ...commonArgs,
+      ]);
     }
   }
 }
+
+async function getSourceUpdateGroupAsync(
+  graphqlClient: ExpoGraphqlClient,
+  groupId: string
+): Promise<SourceUpdateGroup> {
+  // viewUpdateGroupAsync throws if no updates are found for the group ID.
+  const updateGroup = await UpdateQuery.viewUpdateGroupAsync(graphqlClient, { groupId });
+  const arbitraryUpdate = updateGroup[0];
+  return {
+    groupId,
+    branchName: arbitraryUpdate.branch.name,
+    runtimeVersion: arbitraryUpdate.runtimeVersion,
+  };
+}
+
+async function getPreviousUpdateGroupAsync(
+  graphqlClient: ExpoGraphqlClient,
+  projectId: string,
+  sourceGroup: SourceUpdateGroup
+): Promise<PreviousUpdateGroup | null> {
+  // Clients on a given runtime version are served the latest update group on the branch,
+  // so a rollback is only meaningful when the source group is that latest group. Fetch the
+  // two most recent groups for the runtime version (returned most-recent-first): the first
+  // must be the source group, and the second (if any) is the update to roll back to.
+  const latestGroups = await UpdateQuery.viewUpdateGroupsPaginatedOnBranchAsync(graphqlClient, {
+    appId: projectId,
+    branchName: sourceGroup.branchName,
+    first: 2,
+    filter: { runtimeVersions: [sourceGroup.runtimeVersion] },
+  });
+
+  const latestGroup = latestGroups[0];
+  if (!latestGroup?.length || latestGroup[0].group !== sourceGroup.groupId) {
+    throw new Error(
+      `Update group "${sourceGroup.groupId}" is not the latest update on branch "${
+        sourceGroup.branchName
+      }" for runtime version "${sourceGroup.runtimeVersion}"${
+        latestGroup?.length ? ` (the latest is "${latestGroup[0].group}")` : ''
+      }. Only the latest update can be rolled back.`
+    );
+  }
+
+  // Source group is the only update for this runtime version: roll back to embedded.
+  const previousGroup = latestGroups[1];
+  if (!previousGroup?.length) {
+    return null;
+  }
+
+  return { groupId: previousGroup[0].group, message: previousGroup[0].message ?? null };
+}

packages/eas-cli/src/commands/update/view.ts

@@ -3,6 +3,8 @@ import chalk from 'chalk';
 
 import EasCommand from '../../commandUtils/EasCommand';
 import { EasJsonOnlyFlag } from '../../commandUtils/flags';
+import { ExpoGraphqlClient } from '../../commandUtils/context/contextUtils/createGraphqlClient';
+import { UpdateFragment } from '../../graphql/generated';
 import { UpdateInsightsQuery } from '../../graphql/queries/UpdateInsightsQuery';
 import { UpdateQuery } from '../../graphql/queries/UpdateQuery';
 import { resolveInsightsTimeRange } from '../../insights/timeRange';
@@ -26,7 +28,7 @@ export default class UpdateView extends EasCommand {
   static override args = {
     groupId: Args.string({
       required: true,
-      description: 'The ID of an update group.',
+      description: 'The ID of an update group, or the ID of a platform-specific update.',
     }),
   };
 
@@ -58,7 +60,7 @@ export default class UpdateView extends EasCommand {
 
   async runAsync(): Promise<void> {
     const {
-      args: { groupId },
+      args: { groupId: idArg },
       flags: { json: jsonFlag, insights: insightsFlag, days, start, end },
     } = await this.parse(UpdateView);
 
@@ -74,7 +76,10 @@ export default class UpdateView extends EasCommand {
       enableJsonOutput();
     }
 
-    const updatesByGroup = await UpdateQuery.viewUpdateGroupAsync(graphqlClient, { groupId });
+    const { groupId, updatesByGroup } = await UpdateView.resolveUpdateGroupAsync(
+      graphqlClient,
+      idArg
+    );
 
     let insightsSummary: UpdateInsightsSummary | null = null;
     if (insightsFlag) {
@@ -112,4 +117,34 @@ export default class UpdateView extends EasCommand {
       }
     }
   }
+
+  /**
+   * Resolves the provided ID into an update group and its updates. The ID may be either an
+   * update group ID or the ID of a single platform-specific update. We first try to look it up
+   * as a group; if no updates are found, we fall back to resolving it as a platform-specific
+   * update and then fetch the group that update belongs to.
+   */
+  private static async resolveUpdateGroupAsync(
+    graphqlClient: ExpoGraphqlClient,
+    id: string
+  ): Promise<{ groupId: string; updatesByGroup: UpdateFragment[] }> {
+    try {
+      const updatesByGroup = await UpdateQuery.viewUpdateGroupAsync(graphqlClient, { groupId: id });
+      return { groupId: id, updatesByGroup };
+    } catch (groupError) {
+      let update: UpdateFragment | undefined;
+      try {
+        update = await UpdateQuery.viewByUpdateAsync(graphqlClient, { updateId: id });
+      } catch {
+        // The ID is neither a valid update group nor a valid platform-specific update; surface
+        // the original group lookup error since the group ID is the primary input.
+        throw groupError;
+      }
+
+      const updatesByGroup = await UpdateQuery.viewUpdateGroupAsync(graphqlClient, {
+        groupId: update.group,
+      });
+      return { groupId: update.group, updatesByGroup };
+    }
+  }
 }

packages/eas-cli/src/credentials/ios/actions/AscApiKeyUtils.ts

@@ -5,7 +5,9 @@ import path from 'path';
 import { UserRole } from '@expo/apple-utils';
 
 import { formatAppleTeam } from './AppleTeamFormatting';
+import { ExpoGraphqlClient } from '../../../commandUtils/context/contextUtils/createGraphqlClient';
 import { AccountFragment, AppStoreConnectApiKeyFragment } from '../../../graphql/generated';
+import { AppStoreConnectApiKeyQuery } from '../../../graphql/queries/AppStoreConnectApiKeyQuery';
 import Log, { learnMore } from '../../../log';
 import { confirmAsync, promptAsync, selectAsync } from '../../../prompts';
 import { fromNow } from '../../../utils/date';
@@ -14,7 +16,11 @@ import {
   getCredentialsFromUserAsync,
   shouldAutoGenerateCredentialsAsync,
 } from '../../utils/promptForCredentials';
+import { getAscApiKeyForAppSubmissionsAsync } from '../api/GraphqlClient';
+import { AppLookupParams } from '../api/graphql/types/AppLookupParams';
 import { AscApiKey } from '../appstore/Credentials.types';
+import { AppleTeamType, AuthenticationMode } from '../appstore/authenticateTypes';
+import { hasAscEnvVars } from '../appstore/resolveCredentials';
 import {
   AscApiKeyPath,
   MinimalAscApiKey,
@@ -277,3 +283,78 @@ export function formatAscApiKey(ascApiKey: AppStoreConnectApiKeyFragment): strin
   line += chalk.gray(`\n    Updated: ${fromNow(new Date(updatedAt))} ago`);
   return line;
 }
+
+export async function resolveAscApiKeyForAppCredentialsAsync({
+  graphqlClient,
+  app,
+}: {
+  graphqlClient: ExpoGraphqlClient;
+  app: AppLookupParams;
+}): Promise<{
+  ascApiKey: MinimalAscApiKey;
+  teamId?: string;
+  teamName?: string;
+} | null> {
+  const ascKeyFragment = await getAscApiKeyForAppSubmissionsAsync(graphqlClient, app);
+  if (!ascKeyFragment) {
+    return null;
+  }
+  const fullKey = await AppStoreConnectApiKeyQuery.getByIdAsync(graphqlClient, ascKeyFragment.id);
+  return {
+    ascApiKey: {
+      keyP8: fullKey.keyP8,
+      keyId: fullKey.keyIdentifier,
+      issuerId: fullKey.issuerIdentifier,
+    },
+    teamId: ascKeyFragment.appleTeam?.appleTeamIdentifier,
+    teamName: ascKeyFragment.appleTeam?.appleTeamName ?? undefined,
+  };
+}
+
+/**
+ * Best-effort helper that populates `ctx.appStore.authCtx` in non-interactive mode
+ * by loading an App Store Connect API key (from env vars, or by fetching the app's
+ * stored key from the www GraphQL API).
+ *
+ * Returns true if `ctx.appStore.authCtx` is set after the call, false otherwise.
+ * Never throws.
+ */
+export async function tryAuthenticateAppStoreWithEasAscApiKeyAsync(
+  ctx: CredentialsContext,
+  app: AppLookupParams,
+  teamType: AppleTeamType
+): Promise<boolean> {
+  if (ctx.appStore.authCtx) {
+    return true;
+  }
+  try {
+    if (hasAscEnvVars()) {
+      await ctx.appStore.ensureAuthenticatedAsync({
+        mode: AuthenticationMode.API_KEY,
+        teamType,
+      });
+      return !!ctx.appStore.authCtx;
+    }
+    const resolvedKey = await resolveAscApiKeyForAppCredentialsAsync({
+      graphqlClient: ctx.graphqlClient,
+      app,
+    });
+    if (!resolvedKey) {
+      return false;
+    }
+    Log.log('Using App Store Connect API Key from EAS credentials service.');
+    await ctx.appStore.ensureAuthenticatedAsync({
+      mode: AuthenticationMode.API_KEY,
+      ascApiKey: resolvedKey.ascApiKey,
+      teamId: resolvedKey.teamId,
+      teamName: resolvedKey.teamName,
+      teamType,
+    });
+    return !!ctx.appStore.authCtx;
+  } catch (err: any) {
+    Log.warn(
+      `Failed to authenticate with the App Store Connect API key from EAS credentials service: ${err.message ?? err}`
+    );
+    return false;
+  }
+}

packages/eas-cli/src/credentials/ios/actions/ConfigureProvisioningProfile.ts

@@ -16,7 +16,7 @@ import {
 import { AppleProvisioningProfileMutationResult } from '../api/graphql/mutations/AppleProvisioningProfileMutation';
 import { AppLookupParams } from '../api/graphql/types/AppLookupParams';
 import { ProvisioningProfileStoreInfo } from '../appstore/Credentials.types';
-import { AuthCtx, AuthenticationMode } from '../appstore/authenticateTypes';
+import { AuthCtx } from '../appstore/authenticateTypes';
 import { Target } from '../types';
 
 export class ConfigureProvisioningProfile {
@@ -34,12 +34,9 @@ export class ConfigureProvisioningProfile {
       throw new ForbidCredentialModificationError(
         'Remove the --freeze-credentials flag to configure a Provisioning Profile.'
       );
-    } else if (
-      ctx.nonInteractive &&
-      ctx.appStore.defaultAuthenticationMode !== AuthenticationMode.API_KEY
-    ) {
+    } else if (ctx.nonInteractive && !ctx.appStore.authCtx) {
       throw new InsufficientAuthenticationNonInteractiveError(
-        `In order to configure your Provisioning Profile, authentication with an ASC API key is required in non-interactive mode. ${learnMore(
+        `In order to configure your Provisioning Profile, authentication with an ASC API key is required in non-interactive mode. Either set the EXPO_ASC_API_KEY_PATH/EXPO_ASC_KEY_ID/EXPO_ASC_ISSUER_ID environment variables, or configure an App Store Connect API Key for submissions for bundle identifier ${this.app.bundleIdentifier} on EAS. ${learnMore(
           'https://docs.expo.dev/build/building-on-ci/#optional-provide-an-asc-api-token-for-your-apple-team'
         )}`
       );

packages/eas-cli/src/credentials/ios/actions/CreateProvisioningProfile.ts

@@ -14,7 +14,7 @@ import { askForUserProvidedAsync } from '../../utils/promptForCredentials';
 import { AppleProvisioningProfileMutationResult } from '../api/graphql/mutations/AppleProvisioningProfileMutation';
 import { AppLookupParams } from '../api/graphql/types/AppLookupParams';
 import { ProvisioningProfile } from '../appstore/Credentials.types';
-import { AuthCtx, AuthenticationMode } from '../appstore/authenticateTypes';
+import { AuthCtx } from '../appstore/authenticateTypes';
 import { provisioningProfileSchema } from '../credentials';
 import { Target } from '../types';
 
@@ -30,12 +30,9 @@ export class CreateProvisioningProfile {
       throw new ForbidCredentialModificationError(
         'Run this command again without the --freeze-credentials flag in order to generate a new Provisioning Profile.'
       );
-    } else if (
-      ctx.nonInteractive &&
-      ctx.appStore.defaultAuthenticationMode !== AuthenticationMode.API_KEY
-    ) {
+    } else if (ctx.nonInteractive && !ctx.appStore.authCtx) {
       throw new InsufficientAuthenticationNonInteractiveError(
-        `In order to generate a new Provisioning Profile, authentication with an ASC API key is required in non-interactive mode. ${learnMore(
+        `In order to generate a new Provisioning Profile, authentication with an ASC API key is required in non-interactive mode. Either set the EXPO_ASC_API_KEY_PATH/EXPO_ASC_KEY_ID/EXPO_ASC_ISSUER_ID environment variables, or configure an App Store Connect API Key for submissions for bundle identifier ${this.app.bundleIdentifier} on EAS. ${learnMore(
           'https://docs.expo.dev/build/building-on-ci/#optional-provide-an-asc-api-token-for-your-apple-team'
         )}`
       );

packages/eas-cli/src/credentials/ios/actions/SetUpAdhocProvisioningProfile.ts

@@ -11,6 +11,7 @@ import {
   filterDevicesForApplePlatform,
   formatDeviceLabel,
 } from './DeviceUtils';
+import { resolveAscApiKeyForAppCredentialsAsync } from './AscApiKeyUtils';
 import { SetUpDistributionCertificate } from './SetUpDistributionCertificate';
 import DeviceCreateAction, { RegistrationMethod } from '../../../devices/actions/create/action';
 import {
@@ -22,8 +23,6 @@ import {
   IosAppBuildCredentialsFragment,
   IosDistributionType,
 } from '../../../graphql/generated';
-import { ExpoGraphqlClient } from '../../../commandUtils/context/contextUtils/createGraphqlClient';
-import { AppStoreConnectApiKeyQuery } from '../../../graphql/queries/AppStoreConnectApiKeyQuery';
 import Log from '../../../log';
 import { getApplePlatformFromTarget } from '../../../project/ios/target';
 import {
@@ -35,13 +34,11 @@ import {
 import differenceBy from '../../../utils/expodash/differenceBy';
 import { CredentialsContext } from '../../context';
 import { MissingCredentialsNonInteractiveError } from '../../errors';
-import { getAscApiKeyForAppSubmissionsAsync } from '../api/GraphqlClient';
 import { AppLookupParams } from '../api/graphql/types/AppLookupParams';
 import { AppleTeamType, AuthenticationMode } from '../appstore/authenticateTypes';
 import { ProvisioningProfile } from '../appstore/Credentials.types';
 import { ApplePlatform } from '../appstore/constants';
 import { hasAscEnvVars } from '../appstore/resolveCredentials';
-import { MinimalAscApiKey } from '../credentials';
 import { Target } from '../types';
 import { validateProvisioningProfileAsync } from '../validators/validateProvisioningProfile';
 
@@ -424,6 +421,7 @@ export class SetUpAdhocProvisioningProfile {
       );
     }
 
+    Log.log('Using App Store Connect API Key from EAS credentials service.');
     await ctx.appStore.ensureAuthenticatedAsync({
       mode: AuthenticationMode.API_KEY,
       ascApiKey: resolvedKey.ascApiKey,
@@ -436,35 +434,6 @@ export class SetUpAdhocProvisioningProfile {
   }
 }
 
-async function resolveAscApiKeyForAppCredentialsAsync({
-  graphqlClient,
-  app,
-}: {
-  graphqlClient: ExpoGraphqlClient;
-  app: AppLookupParams;
-}): Promise<{
-  ascApiKey: MinimalAscApiKey;
-  teamId?: string;
-  teamName?: string;
-} | null> {
-  const ascKeyFragment = await getAscApiKeyForAppSubmissionsAsync(graphqlClient, app);
-  if (!ascKeyFragment) {
-    return null;
-  }
-
-  Log.log('Using App Store Connect API Key from EAS credentials service.');
-  const fullKey = await AppStoreConnectApiKeyQuery.getByIdAsync(graphqlClient, ascKeyFragment.id);
-  return {
-    ascApiKey: {
-      keyP8: fullKey.keyP8,
-      keyId: fullKey.keyIdentifier,
-      issuerId: fullKey.issuerIdentifier,
-    },
-    teamId: ascKeyFragment.appleTeam?.appleTeamIdentifier,
-    teamName: ascKeyFragment.appleTeam?.appleTeamName ?? undefined,
-  };
-}
-
 export function doUDIDsMatch(udidsA: string[], udidsB: string[]): boolean {
   const setA = new Set(udidsA);
   const setB = new Set(udidsB);

packages/eas-cli/src/credentials/ios/actions/SetUpProvisioningProfile.ts

@@ -1,5 +1,6 @@
 import nullthrows from 'nullthrows';
 
+import { tryAuthenticateAppStoreWithEasAscApiKeyAsync } from './AscApiKeyUtils';
 import {
   assignBuildCredentialsAsync,
   getBuildCredentialsAsync,
@@ -15,7 +16,7 @@ import {
   IosAppBuildCredentialsFragment,
   IosDistributionType,
 } from '../../../graphql/generated';
-import { learnMore } from '../../../log';
+import Log, { learnMore } from '../../../log';
 import { getApplePlatformFromTarget } from '../../../project/ios/target';
 import { confirmAsync } from '../../../prompts';
 import { CredentialsContext } from '../../context';
@@ -25,7 +26,8 @@ import {
 } from '../../errors';
 import { AppLookupParams } from '../api/graphql/types/AppLookupParams';
 import { ProvisioningProfileStoreInfo } from '../appstore/Credentials.types';
-import { AuthenticationMode } from '../appstore/authenticateTypes';
+import { resolveAppleTeamTypeFromEnvironment } from '../appstore/resolveCredentials';
+import { AppleTeamType } from '../appstore/authenticateTypes';
 import { Target } from '../types';
 import { validateProvisioningProfileAsync } from '../validators/validateProvisioningProfile';
 
@@ -102,8 +104,28 @@ export class SetUpProvisioningProfile {
       this.app,
       this.distributionType
     ).runAsync(ctx);
+    if (ctx.nonInteractive && !ctx.appStore.authCtx) {
+      await tryAuthenticateAppStoreWithEasAscApiKeyAsync(
+        ctx,
+        this.app,
+        this.resolveTeamTypeForAuthentication()
+      );
+    }
 
-    const areBuildCredentialsSetup = await this.areBuildCredentialsSetupAsync(ctx);
+    let areBuildCredentialsSetup: boolean;
+    try {
+      areBuildCredentialsSetup = await this.areBuildCredentialsSetupAsync(ctx);
+    } catch (error: any) {
+      if (ctx.nonInteractive) {
+        Log.warn(
+          'Skipping Provisioning Profile validation on Apple servers due to an unexpected validation error. Continuing with local validation result.'
+        );
+        Log.debug('Provisioning profile validation on Apple servers failed:', error);
+        areBuildCredentialsSetup = true;
+      } else {
+        throw error;
+      }
+    }
     if (areBuildCredentialsSetup) {
       return nullthrows(await getBuildCredentialsAsync(ctx, this.app, this.distributionType));
     }
@@ -111,12 +133,11 @@ export class SetUpProvisioningProfile {
       throw new ForbidCredentialModificationError(
         'Provisioning profile is not configured correctly. Remove the --freeze-credentials flag to configure it.'
       );
-    } else if (
-      ctx.nonInteractive &&
-      ctx.appStore.defaultAuthenticationMode !== AuthenticationMode.API_KEY
-    ) {
+    }
+
+    if (ctx.nonInteractive && !ctx.appStore.authCtx) {
       throw new InsufficientAuthenticationNonInteractiveError(
-        `In order to configure your Provisioning Profile, authentication with an ASC API key is required in non-interactive mode. ${learnMore(
+        `In order to configure your Provisioning Profile, authentication with an ASC API key is required in non-interactive mode. Either set the EXPO_ASC_API_KEY_PATH/EXPO_ASC_KEY_ID/EXPO_ASC_ISSUER_ID environment variables, or configure an App Store Connect API Key for submissions for bundle identifier ${this.app.bundleIdentifier} on EAS. ${learnMore(
           'https://docs.expo.dev/build/building-on-ci/#optional-provide-an-asc-api-token-for-your-apple-team'
         )}`
       );
@@ -167,6 +188,24 @@ export class SetUpProvisioningProfile {
     return updatedProfile;
   }
 
+  /**
+   * The team type determines `team.inHouse`, which in turn selects the Apple profile
+   * type used for every subsequent profile lookup and creation (IOS_APP_INHOUSE for
+   * enterprise vs IOS_APP_STORE otherwise). We derive it from the distribution
+   * type, which is exactly what the requested operation needs: enterprise
+   * builds require an in-house team, other distribution types don't.
+   * A genuine team/distribution mismatch is rejected by Apple regardless of this value.
+   */
+  private getDerivedTeamTypeForAuthentication(): AppleTeamType {
+    return this.distributionType === IosDistributionType.Enterprise
+      ? AppleTeamType.IN_HOUSE
+      : AppleTeamType.COMPANY_OR_ORGANIZATION;
+  }
+
+  private resolveTeamTypeForAuthentication(): AppleTeamType {
+    return resolveAppleTeamTypeFromEnvironment() ?? this.getDerivedTeamTypeForAuthentication();
+  }
+
   private getCurrentProfileStoreInfo(
     profiles: ProvisioningProfileStoreInfo[],
     currentProfile: AppleProvisioningProfileFragment

packages/eas-cli/src/credentials/ios/actions/__tests__/SetUpProvisioningProfile-test.ts

@@ -19,8 +19,9 @@ import {
   ForbidCredentialModificationError,
   InsufficientAuthenticationNonInteractiveError,
 } from '../../../errors';
-import { AuthenticationMode } from '../../appstore/authenticateTypes';
+import { AppleTeamType, AuthenticationMode } from '../../appstore/authenticateTypes';
 import { validateProvisioningProfileAsync } from '../../validators/validateProvisioningProfile';
+import { tryAuthenticateAppStoreWithEasAscApiKeyAsync } from '../AscApiKeyUtils';
 import { getAppLookupParamsFromContextAsync } from '../BuildCredentialsUtils';
 import { SetUpProvisioningProfile } from '../SetUpProvisioningProfile';
 
@@ -30,11 +31,15 @@ jest.mock('../SetUpDistributionCertificate');
 jest.mock('../ConfigureProvisioningProfile');
 jest.mock('../CreateProvisioningProfile');
 jest.mock('../../validators/validateProvisioningProfile');
+jest.mock('../AscApiKeyUtils');
 jest.mock('../../../../graphql/queries/AppQuery');
 
 describe('SetUpProvisioningProfile', () => {
   beforeEach(() => {
+    delete process.env.EXPO_APPLE_TEAM_TYPE;
     jest.mocked(AppQuery.byIdAsync).mockResolvedValue(testAppQueryByIdResponse);
+    jest.mocked(tryAuthenticateAppStoreWithEasAscApiKeyAsync).mockReset();
+    jest.mocked(tryAuthenticateAppStoreWithEasAscApiKeyAsync).mockResolvedValue(false);
   });
 
   const testCases = ['NON_INTERACTIVE', 'INTERACTIVE'];
@@ -262,4 +267,270 @@ describe('SetUpProvisioningProfile', () => {
     // expect provisioning profile not to be deleted on expo servers
     expect(jest.mocked(ctx.ios.deleteProvisioningProfilesAsync).mock.calls.length).toBe(0);
   });
+
+  it('auto-authenticates before validation in nonInteractive mode when credentials are already valid', async () => {
+    let authAttemptedBeforeValidation = false;
+    jest
+      .mocked(tryAuthenticateAppStoreWithEasAscApiKeyAsync)
+      .mockImplementation(async authedCtx => {
+        authAttemptedBeforeValidation = true;
+        (authedCtx.appStore as any).authCtx = testAuthCtx;
+        return true;
+      });
+    jest.mocked(validateProvisioningProfileAsync).mockImplementation(async () => {
+      expect(authAttemptedBeforeValidation).toBe(true);
+      return true;
+    });
+    const ctx = createCtxMock({
+      nonInteractive: true,
+      appStore: {
+        ...getAppstoreMock(),
+        authCtx: undefined,
+      },
+      ios: {
+        ...getNewIosApiMock(),
+        getIosAppCredentialsWithBuildCredentialsAsync: jest.fn(
+          () => testCommonIosAppCredentialsFragment
+        ),
+      },
+    });
+    const appLookupParams = await getAppLookupParamsFromContextAsync(
+      ctx,
+      findApplicationTarget(testTargets)
+    );
+    const setupProvisioningProfileAction = new SetUpProvisioningProfile(
+      appLookupParams,
+      testTarget,
+      IosDistributionType.AppStore
+    );
+    await setupProvisioningProfileAction.runAsync(ctx);
+
+    expect(jest.mocked(tryAuthenticateAppStoreWithEasAscApiKeyAsync).mock.calls).toEqual([
+      [ctx, appLookupParams, AppleTeamType.COMPANY_OR_ORGANIZATION],
+    ]);
+    expect(jest.mocked(ctx.ios.createOrUpdateIosAppBuildCredentialsAsync).mock.calls.length).toBe(
+      0
+    );
+    expect(jest.mocked(ctx.ios.deleteProvisioningProfilesAsync).mock.calls.length).toBe(0);
+  });
+
+  it('uses best-effort validation when Apple validation fails in nonInteractive mode', async () => {
+    jest.mocked(validateProvisioningProfileAsync).mockImplementation(async () => {
+      throw new Error('Apple API request failed');
+    });
+    const ctx = createCtxMock({
+      nonInteractive: true,
+      appStore: {
+        ...getAppstoreMock(),
+        authCtx: testAuthCtx,
+      },
+      ios: {
+        ...getNewIosApiMock(),
+        getIosAppCredentialsWithBuildCredentialsAsync: jest.fn(
+          () => testCommonIosAppCredentialsFragment
+        ),
+      },
+    });
+    const appLookupParams = await getAppLookupParamsFromContextAsync(
+      ctx,
+      findApplicationTarget(testTargets)
+    );
+    const setupProvisioningProfileAction = new SetUpProvisioningProfile(
+      appLookupParams,
+      testTarget,
+      IosDistributionType.AppStore
+    );
+
+    await expect(setupProvisioningProfileAction.runAsync(ctx)).resolves.toEqual(
+      testCommonIosAppCredentialsFragment.iosAppBuildCredentialsList[0]
+    );
+
+    expect(jest.mocked(tryAuthenticateAppStoreWithEasAscApiKeyAsync).mock.calls.length).toBe(0);
+    expect(jest.mocked(ctx.ios.createOrUpdateIosAppBuildCredentialsAsync).mock.calls.length).toBe(
+      0
+    );
+    expect(jest.mocked(ctx.ios.deleteProvisioningProfilesAsync).mock.calls.length).toBe(0);
+  });
+
+  it('rethrows Apple validation failures in interactive mode', async () => {
+    jest.mocked(validateProvisioningProfileAsync).mockImplementation(async () => {
+      throw new Error('Apple API request failed');
+    });
+    const ctx = createCtxMock({
+      nonInteractive: false,
+      appStore: {
+        ...getAppstoreMock(),
+        authCtx: testAuthCtx,
+      },
+      ios: {
+        ...getNewIosApiMock(),
+        getIosAppCredentialsWithBuildCredentialsAsync: jest.fn(
+          () => testCommonIosAppCredentialsFragment
+        ),
+      },
+    });
+    const appLookupParams = await getAppLookupParamsFromContextAsync(
+      ctx,
+      findApplicationTarget(testTargets)
+    );
+    const setupProvisioningProfileAction = new SetUpProvisioningProfile(
+      appLookupParams,
+      testTarget,
+      IosDistributionType.AppStore
+    );
+
+    await expect(setupProvisioningProfileAction.runAsync(ctx)).rejects.toThrow(
+      'Apple API request failed'
+    );
+    expect(jest.mocked(ctx.ios.createOrUpdateIosAppBuildCredentialsAsync).mock.calls.length).toBe(
+      0
+    );
+    expect(jest.mocked(ctx.ios.deleteProvisioningProfilesAsync).mock.calls.length).toBe(0);
+  });
+
+  it('repairs the Provisioning Profile in nonInteractive mode after auto-authenticating with the EAS-stored ASC API key', async () => {
+    jest.mocked(validateProvisioningProfileAsync).mockImplementation(async () => false);
+    const appstoreMock = getAppstoreMock();
+    const ctx = createCtxMock({
+      nonInteractive: true,
+      appStore: {
+        ...appstoreMock,
+        defaultAuthenticationMode: AuthenticationMode.USER,
+        authCtx: undefined,
+        ensureAuthenticatedAsync: jest.fn(() => testAuthCtx),
+        listProvisioningProfilesAsync: jest.fn(() => [
+          {
+            provisioningProfileId: nullthrows(
+              testCommonIosAppCredentialsFragment.iosAppBuildCredentialsList[0].provisioningProfile
+            ).developerPortalIdentifier,
+          },
+        ]),
+      },
+      ios: {
+        ...getNewIosApiMock(),
+        getIosAppCredentialsWithBuildCredentialsAsync: jest.fn(
+          () => testCommonIosAppCredentialsFragment
+        ),
+        createOrGetExistingAppleAppIdentifierAsync: jest.fn(() => testAppleAppIdentifierFragment),
+        createOrUpdateIosAppBuildCredentialsAsync: jest.fn(
+          () => testIosAppBuildCredentialsFragment
+        ),
+      },
+    });
+    jest
+      .mocked(tryAuthenticateAppStoreWithEasAscApiKeyAsync)
+      .mockImplementation(async authedCtx => {
+        (authedCtx.appStore as any).authCtx = testAuthCtx;
+        return true;
+      });
+
+    const appLookupParams = await getAppLookupParamsFromContextAsync(
+      ctx,
+      findApplicationTarget(testTargets)
+    );
+    const setupProvisioningProfileAction = new SetUpProvisioningProfile(
+      appLookupParams,
+      testTarget,
+      IosDistributionType.AppStore
+    );
+    await setupProvisioningProfileAction.runAsync(ctx);
+
+    // expect we attempted to auto-authenticate with the EAS-stored ASC API key
+    expect(jest.mocked(tryAuthenticateAppStoreWithEasAscApiKeyAsync).mock.calls).toEqual([
+      [ctx, appLookupParams, AppleTeamType.COMPANY_OR_ORGANIZATION],
+    ]);
+    // expect build credentials to be created or updated on expo servers
+    expect(jest.mocked(ctx.ios.createOrUpdateIosAppBuildCredentialsAsync).mock.calls.length).toBe(
+      1
+    );
+    // expect provisioning profile not to be deleted on expo servers (it still exists on Apple)
+    expect(jest.mocked(ctx.ios.deleteProvisioningProfilesAsync).mock.calls.length).toBe(0);
+  });
+
+  it('passes IN_HOUSE team type for enterprise profiles when auto-authenticating in nonInteractive mode', async () => {
+    jest.mocked(validateProvisioningProfileAsync).mockImplementation(async () => false);
+    const appstoreMock = getAppstoreMock();
+    const ctx = createCtxMock({
+      nonInteractive: true,
+      appStore: {
+        ...appstoreMock,
+        defaultAuthenticationMode: AuthenticationMode.USER,
+        authCtx: undefined,
+      },
+    });
+
+    const appLookupParams = await getAppLookupParamsFromContextAsync(
+      ctx,
+      findApplicationTarget(testTargets)
+    );
+    const setupProvisioningProfileAction = new SetUpProvisioningProfile(
+      appLookupParams,
+      testTarget,
+      IosDistributionType.Enterprise
+    );
+    await expect(setupProvisioningProfileAction.runAsync(ctx)).rejects.toThrowError(
+      InsufficientAuthenticationNonInteractiveError
+    );
+
+    expect(jest.mocked(tryAuthenticateAppStoreWithEasAscApiKeyAsync).mock.calls).toEqual([
+      [ctx, appLookupParams, AppleTeamType.IN_HOUSE],
+    ]);
+  });
+
+  it('uses EXPO_APPLE_TEAM_TYPE over derived team type when auto-authenticating in nonInteractive mode', async () => {
+    process.env.EXPO_APPLE_TEAM_TYPE = AppleTeamType.IN_HOUSE;
+    jest.mocked(validateProvisioningProfileAsync).mockImplementation(async () => false);
+    const appstoreMock = getAppstoreMock();
+    const ctx = createCtxMock({
+      nonInteractive: true,
+      appStore: {
+        ...appstoreMock,
+        defaultAuthenticationMode: AuthenticationMode.USER,
+        authCtx: undefined,
+      },
+    });
+
+    const appLookupParams = await getAppLookupParamsFromContextAsync(
+      ctx,
+      findApplicationTarget(testTargets)
+    );
+    const setupProvisioningProfileAction = new SetUpProvisioningProfile(
+      appLookupParams,
+      testTarget,
+      IosDistributionType.AppStore
+    );
+    await expect(setupProvisioningProfileAction.runAsync(ctx)).rejects.toThrowError(
+      InsufficientAuthenticationNonInteractiveError
+    );
+
+    expect(jest.mocked(tryAuthenticateAppStoreWithEasAscApiKeyAsync).mock.calls).toEqual([
+      [ctx, appLookupParams, AppleTeamType.IN_HOUSE],
+    ]);
+  });
+
+  it('errors in nonInteractive mode when the profile needs regeneration but no Apple authentication can be established', async () => {
+    jest.mocked(validateProvisioningProfileAsync).mockImplementation(async () => false);
+    // tryAuthenticate fails to establish auth (default mock returns false and leaves authCtx unset).
+    const ctx = createCtxMock({
+      nonInteractive: true,
+    });
+    const appLookupParams = await getAppLookupParamsFromContextAsync(
+      ctx,
+      findApplicationTarget(testTargets)
+    );
+    const setupProvisioningProfileAction = new SetUpProvisioningProfile(
+      appLookupParams,
+      testTarget,
+      IosDistributionType.AppStore
+    );
+    await expect(setupProvisioningProfileAction.runAsync(ctx)).rejects.toThrowError(
+      InsufficientAuthenticationNonInteractiveError
+    );
+
+    expect(jest.mocked(tryAuthenticateAppStoreWithEasAscApiKeyAsync).mock.calls.length).toBe(1);
+    expect(jest.mocked(ctx.ios.createOrUpdateIosAppBuildCredentialsAsync).mock.calls.length).toBe(
+      0
+    );
+    expect(jest.mocked(ctx.ios.deleteProvisioningProfilesAsync).mock.calls.length).toBe(0);
+  });
 });

packages/eas-cli/src/credentials/ios/appstore/__tests__/resolveCredentials-test.ts

@@ -6,6 +6,7 @@ import { promptAsync } from '../../../../prompts';
 import { AppleTeamType } from '../authenticateTypes';
 import * as Keychain from '../keychain';
 import {
+  resolveAppleTeamTypeFromEnvironment,
   resolveAppleTeamAsync,
   resolveAscApiKeyAsync,
   resolveUserCredentialsAsync,
@@ -73,6 +74,17 @@ const testTeam = {
   teamName: 'test-name',
   teamType: AppleTeamType.IN_HOUSE,
 };
+describe(resolveAppleTeamTypeFromEnvironment, () => {
+  it('returns undefined when EXPO_APPLE_TEAM_TYPE is not set', () => {
+    expect(resolveAppleTeamTypeFromEnvironment()).toBeUndefined();
+  });
+
+  it('returns parsed team type when EXPO_APPLE_TEAM_TYPE is set', () => {
+    process.env.EXPO_APPLE_TEAM_TYPE = AppleTeamType.COMPANY_OR_ORGANIZATION;
+    expect(resolveAppleTeamTypeFromEnvironment()).toBe(AppleTeamType.COMPANY_OR_ORGANIZATION);
+  });
+});
+
 describe(resolveAppleTeamAsync, () => {
   it(`uses option overrides over environment variables`, async () => {
     process.env.EXPO_APPLE_TEAM_ID = 'not supposed to be here';

packages/eas-cli/src/credentials/ios/appstore/resolveCredentials.ts

@@ -118,7 +118,7 @@ function assertAppleTeamType(maybeTeamType: any): AppleTeamType {
   return maybeTeamType;
 }
 
-function resolveAppleTeamTypeFromEnvironment(): AppleTeamType | undefined {
+export function resolveAppleTeamTypeFromEnvironment(): AppleTeamType | undefined {
   if (!process.env.EXPO_APPLE_TEAM_TYPE) {
     return undefined;
   }

packages/eas-cli/src/graphql/generated.ts

@@ -168,6 +168,8 @@ export type Account = {
   /** Owning UserActor of this account if personal account */
   ownerUserActor?: Maybe<UserActor>;
   pendingSentryInstallation?: Maybe<PendingSentryInstallation>;
+  /** PostHog organization connection for this account */
+  posthogOrganizationConnection?: Maybe<PostHogOrganizationConnection>;
   profileImageUrl: Scalars['String']['output'];
   pushSecurityEnabled: Scalars['Boolean']['output'];
   requireTwoFactor: Scalars['Boolean']['output'];
@@ -1192,6 +1194,7 @@ export type AndroidAppCredentialsMutationCreateAndroidAppCredentialsArgs = {
 
 
 export type AndroidAppCredentialsMutationCreateFcmV1CredentialArgs = {
+  accountId?: InputMaybe<Scalars['ID']['input']>;
   androidAppCredentialsId: Scalars['String']['input'];
   credential: Scalars['String']['input'];
 };
@@ -1347,6 +1350,8 @@ export type AndroidJobOverridesInput = {
 
 export type AndroidJobSecretsInput = {
   buildCredentials?: InputMaybe<AndroidJobBuildCredentialsInput>;
+  /** @deprecated Robot access token is no longer needed as it's generated server-side and injected into the builder environment automatically. */
+  robotAccessToken?: InputMaybe<Scalars['String']['input']>;
 };
 
 export type AndroidJobVersionInput = {
@@ -1374,6 +1379,8 @@ export type AndroidKeystoreInput = {
   keyAlias: Scalars['String']['input'];
   keyPassword?: InputMaybe<Scalars['String']['input']>;
   keystorePassword: Scalars['String']['input'];
+  /** @deprecated Type will be automatically inferred from keystore content. */
+  type?: InputMaybe<AndroidKeystoreType>;
 };
 
 export type AndroidKeystoreMutation = {
@@ -1483,7 +1490,7 @@ export type App = Project & {
    * @deprecated Classic updates have been deprecated.
    */
   icon?: Maybe<AppIcon>;
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   iconUrl?: Maybe<Scalars['String']['output']>;
   id: Scalars['ID']['output'];
   /** App query field for querying EAS Insights about this app */
@@ -1501,7 +1508,7 @@ export type App = Project & {
   /** @deprecated 'likes' have been deprecated. */
   isLikedByMe: Scalars['Boolean']['output'];
   lastDeletionAttemptTime?: Maybe<Scalars['DateTime']['output']>;
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   lastPublishedTime: Scalars['DateTime']['output'];
   /** Time of the last user activity (update, branch, submission). */
   latestActivity: Scalars['DateTime']['output'];
@@ -1521,18 +1528,19 @@ export type App = Project & {
   name: Scalars['String']['output'];
   observe: AppObserve;
   ownerAccount: Account;
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   packageName: Scalars['String']['output'];
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   packageUsername: Scalars['String']['output'];
   /**
    * android.playStoreUrl field from most recent classic update manifest
    * @deprecated Classic updates have been deprecated.
    */
   playStoreUrl?: Maybe<Scalars['String']['output']>;
+  posthogProject?: Maybe<PostHogProject>;
   /** @deprecated No longer supported */
   privacy: Scalars['String']['output'];
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   privacySetting: AppPrivacy;
   profileImageUrl?: Maybe<Scalars['String']['output']>;
   /**
@@ -1592,7 +1600,7 @@ export type App = Project & {
   usageMetrics: AppUsageMetrics;
   /** @deprecated Use ownerAccount.name instead */
   username: Scalars['String']['output'];
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   users?: Maybe<Array<Maybe<User>>>;
   vexoApp?: Maybe<VexoApp>;
   /** Notification preferences of the viewer for this app */
@@ -1622,6 +1630,7 @@ export type AppActivityTimelineProjectActivitiesArgs = {
   createdBefore?: InputMaybe<Scalars['DateTime']['input']>;
   filterChannels?: InputMaybe<Array<Scalars['String']['input']>>;
   filterPlatforms?: InputMaybe<Array<AppPlatform>>;
+  filterReleaseChannels?: InputMaybe<Array<Scalars['String']['input']>>;
   filterTypes?: InputMaybe<Array<ActivityTimelineProjectActivityType>>;
   limit: Scalars['Int']['input'];
 };
@@ -2081,7 +2090,7 @@ export type AppFingerprintsConnection = {
 
 export type AppIcon = {
   __typename?: 'AppIcon';
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   colorPalette?: Maybe<Scalars['JSON']['output']>;
   originalUrl: Scalars['String']['output'];
   primaryColor?: Maybe<Scalars['String']['output']>;
@@ -2095,6 +2104,8 @@ export type AppInfoInput = {
 export type AppInput = {
   accountId: Scalars['ID']['input'];
   appInfo?: InputMaybe<AppInfoInput>;
+  /** @deprecated Field no longer supported */
+  privacy?: InputMaybe<AppPrivacy>;
   projectName: Scalars['String']['input'];
 };
 
@@ -2130,7 +2141,7 @@ export type AppMutation = {
   __typename?: 'AppMutation';
   /** Create an app */
   createApp: App;
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   grantAccess?: Maybe<App>;
   /** Remove profile image (icon) for the app. Do nothing if there's no profile image associated. */
   removeProfileImage: App;
@@ -3137,6 +3148,8 @@ export type AppWithGithubRepositoryInput = {
   accountId: Scalars['ID']['input'];
   appInfo?: InputMaybe<AppInfoInput>;
   installationIdentifier?: InputMaybe<Scalars['String']['input']>;
+  /** @deprecated Field no longer supported */
+  privacy?: InputMaybe<AppPrivacy>;
   projectName: Scalars['String']['input'];
 };
 
@@ -3616,6 +3629,7 @@ export enum AppsFilter {
 
 export type ArgentRunSessionRemoteConfig = {
   __typename?: 'ArgentRunSessionRemoteConfig';
+  toolsAuthToken?: Maybe<Scalars['String']['output']>;
   toolsUrl: Scalars['String']['output'];
   /**
    * URL of the web preview surface for the session. Null when web previews are
@@ -4102,7 +4116,11 @@ export type BuildArtifacts = {
 };
 
 export type BuildCacheInput = {
+  /** @deprecated We don't cache anything by default anymore */
+  cacheDefaultPaths?: InputMaybe<Scalars['Boolean']['input']>;
   clear?: InputMaybe<Scalars['Boolean']['input']>;
+  /** @deprecated We use paths now since there is no default caching anymore */
+  customPaths?: InputMaybe<Array<InputMaybe<Scalars['String']['input']>>>;
   disabled?: InputMaybe<Scalars['Boolean']['input']>;
   key?: InputMaybe<Scalars['String']['input']>;
   paths?: InputMaybe<Array<Scalars['String']['input']>>;
@@ -4174,6 +4192,8 @@ export type BuildMetadataInput = {
   appIdentifier?: InputMaybe<Scalars['String']['input']>;
   appName?: InputMaybe<Scalars['String']['input']>;
   appVersion?: InputMaybe<Scalars['String']['input']>;
+  /** @deprecated Use job.mode instead. */
+  buildMode?: InputMaybe<BuildMode>;
   buildProfile?: InputMaybe<Scalars['String']['input']>;
   channel?: InputMaybe<Scalars['String']['input']>;
   cliVersion?: InputMaybe<Scalars['String']['input']>;
@@ -4199,6 +4219,8 @@ export type BuildMetadataInput = {
   runWithNoWaitFlag?: InputMaybe<Scalars['Boolean']['input']>;
   runtimeVersion?: InputMaybe<Scalars['String']['input']>;
   sdkVersion?: InputMaybe<Scalars['String']['input']>;
+  /** @deprecated Unused. */
+  selectedImage?: InputMaybe<Scalars['String']['input']>;
   simulator?: InputMaybe<Scalars['Boolean']['input']>;
   trackingContext?: InputMaybe<Scalars['JSONObject']['input']>;
   username?: InputMaybe<Scalars['String']['input']>;
@@ -4364,7 +4386,7 @@ export enum BuildPhase {
   StartBuild = 'START_BUILD',
   Unknown = 'UNKNOWN',
   UploadApplicationArchive = 'UPLOAD_APPLICATION_ARCHIVE',
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   UploadArtifacts = 'UPLOAD_ARTIFACTS',
   UploadBuildArtifacts = 'UPLOAD_BUILD_ARTIFACTS'
 }
@@ -4893,6 +4915,11 @@ export type CreateIosSubmissionInput = {
   submittedBuildId?: InputMaybe<Scalars['ID']['input']>;
 };
 
+export type CreatePostHogAccountRequestInput = {
+  accountId: Scalars['ID']['input'];
+  region: PostHogRegion;
+};
+
 export type CreateSentryProjectInput = {
   appId: Scalars['ID']['input'];
   sentryProjectId: Scalars['String']['input'];
@@ -4902,6 +4929,8 @@ export type CreateSentryProjectInput = {
 export type CreateSharedEnvironmentVariableInput = {
   environments?: InputMaybe<Array<Scalars['EnvironmentVariableEnvironment']['input']>>;
   fileName?: InputMaybe<Scalars['String']['input']>;
+  /** @deprecated Whether the variable is global is now governed by its scope - account / app. */
+  isGlobal?: InputMaybe<Scalars['Boolean']['input']>;
   name: Scalars['String']['input'];
   overwrite?: InputMaybe<Scalars['Boolean']['input']>;
   type?: InputMaybe<EnvironmentSecretType>;
@@ -6295,6 +6324,8 @@ export enum EntityTypeName {
   IosAppCredentialsEntity = 'IosAppCredentialsEntity',
   LogRocketOrganizationEntity = 'LogRocketOrganizationEntity',
   LogRocketProjectEntity = 'LogRocketProjectEntity',
+  PostHogOrganizationConnectionEntity = 'PostHogOrganizationConnectionEntity',
+  PostHogProjectEntity = 'PostHogProjectEntity',
   UserInvitationEntity = 'UserInvitationEntity',
   UserPermissionEntity = 'UserPermissionEntity',
   VexoAccountConnectionEntity = 'VexoAccountConnectionEntity',
@@ -6535,6 +6566,123 @@ export type EstimatedUsagePlatformDetail = {
   value: Scalars['Float']['output'];
 };
 
+export type ExitInterviewBeginChatTurnInput = {
+  accountId: Scalars['ID']['input'];
+};
+
+export type ExitInterviewBeginChatTurnResult = {
+  __typename?: 'ExitInterviewBeginChatTurnResult';
+  ok: Scalars['Boolean']['output'];
+};
+
+export type ExitInterviewCompleteInput = {
+  accountId: Scalars['ID']['input'];
+  conversationId: Scalars['ID']['input'];
+  messages: Array<ExitInterviewMessageInput>;
+  outcome: ExitInterviewOutcome;
+  /**
+   * Optional classification tags. Present when the website's tagging call
+   * succeeded; omitted when it failed or when the user dismissed without
+   * engaging. When present, drives the conversation-tagged event and the
+   * tagged Slack notification.
+   */
+  tags?: InputMaybe<ExitInterviewTagsInput>;
+};
+
+export type ExitInterviewCompleteResult = {
+  __typename?: 'ExitInterviewCompleteResult';
+  success: Scalars['Boolean']['output'];
+};
+
+export type ExitInterviewFeedbackInput = {
+  accountId: Scalars['ID']['input'];
+  conversationId: Scalars['ID']['input'];
+  feedback: Scalars['String']['input'];
+  outcome: ExitInterviewOutcome;
+};
+
+export type ExitInterviewFeedbackResult = {
+  __typename?: 'ExitInterviewFeedbackResult';
+  success: Scalars['Boolean']['output'];
+};
+
+export type ExitInterviewMessageInput = {
+  content: Scalars['String']['input'];
+  role: ExitInterviewMessageRole;
+};
+
+export enum ExitInterviewMessageRole {
+  Assistant = 'ASSISTANT',
+  User = 'USER'
+}
+
+export type ExitInterviewMutation = {
+  __typename?: 'ExitInterviewMutation';
+  /**
+   * Gate a chat turn before the website route calls OpenAI. Enforces
+   * authorization (account admin), eligibility (active paid subscription,
+   * not cancelling), and a per-user rate limit (30 turns/hour). The
+   * website's /api/exit-interview/chat route calls this server-to-server
+   * on every turn; failures map to HTTP 4xx and abort the stream before
+   * any OpenAI tokens are spent.
+   */
+  beginChatTurn: ExitInterviewBeginChatTurnResult;
+  /**
+   * Mark a treatment-variant exit-interview chat conversation complete. Emits
+   * the conversation-completed event to RudderStack with the full transcript.
+   * If the transcript carries at least one server-signed assistant turn (i.e.
+   * the user actually engaged the bot), fans out the raw transcript to Slack.
+   * If the client also provides tags, emits a separate conversation-tagged
+   * event and a tagged Slack notification. Control-variant one-shot feedback
+   * goes through submitFeedback.
+   */
+  complete: ExitInterviewCompleteResult;
+  /**
+   * Record a control-variant one-shot feedback submission. Emits the
+   * feedback-submitted event to RudderStack. No Slack notification, no
+   * tagging — those pipelines are scoped to the treatment chat flow via
+   * complete.
+   */
+  submitFeedback: ExitInterviewFeedbackResult;
+};
+
+
+export type ExitInterviewMutationBeginChatTurnArgs = {
+  input: ExitInterviewBeginChatTurnInput;
+};
+
+
+export type ExitInterviewMutationCompleteArgs = {
+  input: ExitInterviewCompleteInput;
+};
+
+
+export type ExitInterviewMutationSubmitFeedbackArgs = {
+  input: ExitInterviewFeedbackInput;
+};
+
+export enum ExitInterviewOutcome {
+  CancelledImmediately = 'CANCELLED_IMMEDIATELY',
+  ContinuedToStripe = 'CONTINUED_TO_STRIPE',
+  Dismissed = 'DISMISSED',
+  KeptPlan = 'KEPT_PLAN'
+}
+
+/**
+ * Tags produced by the website's churn-classification step. The website runs
+ * this synchronously before calling complete, then forwards the structured
+ * result. Allowed category / sentiment values are enforced by the resolver.
+ */
+export type ExitInterviewTagsInput = {
+  actionableInsight: Scalars['Boolean']['input'];
+  category: Scalars['String']['input'];
+  competitorMention?: InputMaybe<Scalars['String']['input']>;
+  confidence?: InputMaybe<Scalars['String']['input']>;
+  productArea?: InputMaybe<Scalars['String']['input']>;
+  sentiment: Scalars['String']['input'];
+  summary?: InputMaybe<Scalars['String']['input']>;
+};
+
 export enum Experiment {
   Orbit = 'ORBIT'
 }
@@ -7494,6 +7642,8 @@ export type IosJobOverridesInput = {
 
 export type IosJobSecretsInput = {
   buildCredentials?: InputMaybe<Array<InputMaybe<IosJobTargetCredentialsInput>>>;
+  /** @deprecated Robot access token is no longer needed as it's generated server-side and injected into the builder environment automatically. */
+  robotAccessToken?: InputMaybe<Scalars['String']['input']>;
 };
 
 export type IosJobTargetCredentialsInput = {
@@ -7540,7 +7690,7 @@ export type JobRun = {
   __typename?: 'JobRun';
   app: App;
   artifacts: Array<WorkflowArtifact>;
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   childJobRun?: Maybe<JobRun>;
   createdAt: Scalars['DateTime']['output'];
   displayName?: Maybe<Scalars['String']['output']>;
@@ -8127,10 +8277,80 @@ export type PinnedDashboardView = {
 
 export type PlanEnablement = Concurrencies | EasTotalPlanEnablement;
 
+export type PostHogIntegrationQuery = {
+  __typename?: 'PostHogIntegrationQuery';
+  clientIdentifier: Scalars['String']['output'];
+};
+
+export type PostHogOrganizationConnection = {
+  __typename?: 'PostHogOrganizationConnection';
+  account: Account;
+  createdAt: Scalars['DateTime']['output'];
+  id: Scalars['ID']['output'];
+  posthogOrganizationIdentifier: Scalars['String']['output'];
+  posthogOrganizationName: Scalars['String']['output'];
+  posthogProjects: Array<PostHogProject>;
+  posthogRegion: PostHogRegion;
+  updatedAt: Scalars['DateTime']['output'];
+};
+
+export type PostHogOrganizationConnectionMutation = {
+  __typename?: 'PostHogOrganizationConnectionMutation';
+  createPostHogAccountRequest: PostHogOrganizationConnection;
+  /** Removes the Expo-side connection only; the PostHog organization is preserved. */
+  deletePostHogOrganizationConnection: Scalars['ID']['output'];
+};
+
+
+export type PostHogOrganizationConnectionMutationCreatePostHogAccountRequestArgs = {
+  input: CreatePostHogAccountRequestInput;
+};
+
+
+export type PostHogOrganizationConnectionMutationDeletePostHogOrganizationConnectionArgs = {
+  id: Scalars['ID']['input'];
+};
+
+export type PostHogProject = {
+  __typename?: 'PostHogProject';
+  app: App;
+  createdAt: Scalars['DateTime']['output'];
+  id: Scalars['ID']['output'];
+  posthogHost: Scalars['String']['output'];
+  posthogOrganizationConnection: PostHogOrganizationConnection;
+  posthogProjectIdentifier: Scalars['String']['output'];
+  posthogProjectName: Scalars['String']['output'];
+  posthogProjectToken: Scalars['String']['output'];
+  updatedAt: Scalars['DateTime']['output'];
+};
+
+export type PostHogProjectMutation = {
+  __typename?: 'PostHogProjectMutation';
+  /** Removes the Expo-side project link only; the PostHog project is preserved. */
+  deletePostHogProject: Scalars['ID']['output'];
+  /** Provisions a PostHog project for the app; the project name is derived from the app. */
+  setupPostHogProject: PostHogProject;
+};
+
+
+export type PostHogProjectMutationDeletePostHogProjectArgs = {
+  id: Scalars['ID']['input'];
+};
+
+
+export type PostHogProjectMutationSetupPostHogProjectArgs = {
+  input: SetupPostHogProjectInput;
+};
+
+export enum PostHogRegion {
+  Eu = 'EU',
+  Us = 'US'
+}
+
 export type Project = {
   description: Scalars['String']['output'];
   fullName: Scalars['String']['output'];
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   iconUrl?: Maybe<Scalars['String']['output']>;
   id: Scalars['ID']['output'];
   name: Scalars['String']['output'];
@@ -8201,6 +8421,8 @@ export type PublishUpdateGroupInput = {
   message?: InputMaybe<Scalars['String']['input']>;
   rollBackToEmbeddedInfoGroup?: InputMaybe<UpdateRollBackToEmbeddedGroup>;
   rolloutInfoGroup?: InputMaybe<UpdateRolloutInfoGroup>;
+  /** @deprecated Use fingerprintInfoGroup instead */
+  runtimeFingerprintSource?: InputMaybe<FingerprintSourceInput>;
   runtimeVersion: Scalars['String']['input'];
   turtleJobRunId?: InputMaybe<Scalars['String']['input']>;
   updateInfoGroup?: InputMaybe<UpdateInfoGroup>;
@@ -8448,6 +8670,8 @@ export type RootMutation = {
   environmentSecret: EnvironmentSecretMutation;
   /** Mutations that create and delete EnvironmentVariables */
   environmentVariable: EnvironmentVariableMutation;
+  /** Mutations for the exit-interview chat shown when a user cancels their plan. */
+  exitInterview: ExitInterviewMutation;
   /** Mutations that modify App fingerprints */
   fingerprint: FingerprintMutation;
   /** Mutations that utilize services facilitated by the GitHub App */
@@ -8480,6 +8704,8 @@ export type RootMutation = {
   me: MeMutation;
   /** Notification preference management */
   notificationPreference: NotificationPreferenceMutation;
+  posthogOrganizationConnection: PostHogOrganizationConnectionMutation;
+  posthogProject: PostHogProjectMutation;
   /** Mutations that create, update, and delete Robots */
   robot: RobotMutation;
   /** Mutations for Sentry installations */
@@ -8488,6 +8714,7 @@ export type RootMutation = {
   sentryProject: SentryProjectMutation;
   /** Mutations that modify an EAS Submit submission */
   submission: SubmissionMutation;
+  tunnels: TunnelsMutation;
   turtleBrownfieldArtifacts: TurtleBrownfieldArtifactMutation;
   update: UpdateMutation;
   updateBranch: UpdateBranchMutation;
@@ -8626,6 +8853,8 @@ export type RootQuery = {
    * this is the appropriate top-level query object
    */
   meUserActor?: Maybe<UserActor>;
+  /** Top-level query object for querying PostHog Integration information. */
+  posthogIntegration: PostHogIntegrationQuery;
   /** @deprecated Snacks and apps should be queried separately */
   project: ProjectQuery;
   /** Top-level query object for querying Runtimes. */
@@ -8818,7 +9047,7 @@ export type SsoUser = Actor & UserActor & {
   /** Coalesced project activity for all apps belonging to all accounts this user belongs to. Only resolves for the viewer. */
   activityTimelineProjectActivities: Array<ActivityTimelineProjectActivity>;
   appCount: Scalars['Int']['output'];
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   appetizeCode?: Maybe<Scalars['String']['output']>;
   /**
    * Apps this user has published. If this user is the viewer, this field returns the apps the user has access to.
@@ -8841,16 +9070,16 @@ export type SsoUser = Actor & UserActor & {
   fullName?: Maybe<Scalars['String']['output']>;
   /** GitHub account linked to a user */
   githubUser?: Maybe<GitHubUser>;
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   githubUsername?: Maybe<Scalars['String']['output']>;
   id: Scalars['ID']['output'];
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   industry?: Maybe<Scalars['String']['output']>;
   isExpoAdmin: Scalars['Boolean']['output'];
   isStaffModeEnabled: Scalars['Boolean']['output'];
   lastDeletionAttemptTime?: Maybe<Scalars['DateTime']['output']>;
   lastName?: Maybe<Scalars['String']['output']>;
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   location?: Maybe<Scalars['String']['output']>;
   pinnedApps: Array<App>;
   pinnedDashboardViews: Array<PinnedDashboardView>;
@@ -8862,7 +9091,7 @@ export type SsoUser = Actor & UserActor & {
   profilePhoto: Scalars['String']['output'];
   /** Snacks associated with this account */
   snacks: Array<Snack>;
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   twitterUsername?: Maybe<Scalars['String']['output']>;
   username: Scalars['String']['output'];
   websiteNotificationsPaginated: WebsiteNotificationsConnection;
@@ -8908,7 +9137,15 @@ export type SsoUserWebsiteNotificationsPaginatedArgs = {
 
 export type SsoUserDataInput = {
   firstName?: InputMaybe<Scalars['String']['input']>;
+  /** @deprecated Field no longer supported */
+  githubUsername?: InputMaybe<Scalars['String']['input']>;
+  /** @deprecated Field no longer supported */
+  industry?: InputMaybe<Scalars['String']['input']>;
   lastName?: InputMaybe<Scalars['String']['input']>;
+  /** @deprecated Field no longer supported */
+  location?: InputMaybe<Scalars['String']['input']>;
+  /** @deprecated Field no longer supported */
+  twitterUsername?: InputMaybe<Scalars['String']['input']>;
 };
 
 export type SecondFactorBooleanResult = {
@@ -8920,7 +9157,6 @@ export type SecondFactorDeviceConfiguration = {
   isPrimary: Scalars['Boolean']['input'];
   method: SecondFactorMethod;
   name: Scalars['String']['input'];
-  smsPhoneNumber?: InputMaybe<Scalars['String']['input']>;
 };
 
 export type SecondFactorDeviceConfigurationResult = {
@@ -8939,7 +9175,10 @@ export type SecondFactorInitiationResult = {
 export enum SecondFactorMethod {
   /** Google Authenticator (TOTP) */
   Authenticator = 'AUTHENTICATOR',
-  /** SMS */
+  /**
+   * SMS
+   * @deprecated No longer supported
+   */
   Sms = 'SMS'
 }
 
@@ -9043,6 +9282,11 @@ export type SetupConvexProjectResult = {
   deployKey: Scalars['String']['output'];
 };
 
+export type SetupPostHogProjectInput = {
+  appId: Scalars['ID']['input'];
+  posthogOrganizationConnectionId: Scalars['ID']['input'];
+};
+
 export type SizeBreakdownCategory = {
   __typename?: 'SizeBreakdownCategory';
   assetCount: Scalars['Int']['output'];
@@ -9059,7 +9303,7 @@ export type Snack = Project & {
   /** Has the Snack been run without errors */
   hasBeenRunSuccessfully?: Maybe<Scalars['Boolean']['output']>;
   hashId: Scalars['String']['output'];
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   iconUrl?: Maybe<Scalars['String']['output']>;
   id: Scalars['ID']['output'];
   /** Draft status, which is true when the Snack was not saved explicitly, but auto-saved */
@@ -9410,6 +9654,23 @@ export type TimelineActivityFilterInput = {
   types?: InputMaybe<Array<ActivityTimelineProjectActivityType>>;
 };
 
+export type TunnelSignedUrlResult = {
+  __typename?: 'TunnelSignedUrlResult';
+  label: Scalars['ID']['output'];
+  url: Scalars['String']['output'];
+};
+
+export type TunnelsMutation = {
+  __typename?: 'TunnelsMutation';
+  /** Create a signed tunnel URL for an account */
+  createSignedTunnelUrl: TunnelSignedUrlResult;
+};
+
+
+export type TunnelsMutationCreateSignedTunnelUrlArgs = {
+  accountId: Scalars['ID']['input'];
+};
+
 export type TurtleBrownfieldArtifactMutation = {
   __typename?: 'TurtleBrownfieldArtifactMutation';
   createTurtleBrownfieldArtifact: CreateBrownfieldArtifactResult;
@@ -9829,6 +10090,8 @@ export type UpdateEnvironmentVariableInput = {
   environments?: InputMaybe<Array<Scalars['EnvironmentVariableEnvironment']['input']>>;
   fileName?: InputMaybe<Scalars['String']['input']>;
   id: Scalars['ID']['input'];
+  /** @deprecated You cannot change whether the variable is global. */
+  isGlobal?: InputMaybe<Scalars['Boolean']['input']>;
   name?: InputMaybe<Scalars['String']['input']>;
   type?: InputMaybe<EnvironmentSecretType>;
   value?: InputMaybe<Scalars['String']['input']>;
@@ -9978,6 +10241,8 @@ export type UpdateVexoAppInput = {
 export type UpdatesFilter = {
   platform?: InputMaybe<AppPlatform>;
   runtimeVersions?: InputMaybe<Array<Scalars['String']['input']>>;
+  /** @deprecated Use runtimeVersions instead. */
+  sdkVersions?: InputMaybe<Array<Scalars['String']['input']>>;
 };
 
 export type UpdatesFilterV2 = {
@@ -10092,7 +10357,7 @@ export type User = Actor & UserActor & {
   /** Coalesced project activity for all apps belonging to all accounts this user belongs to. Only resolves for the viewer. */
   activityTimelineProjectActivities: Array<ActivityTimelineProjectActivity>;
   appCount: Scalars['Int']['output'];
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   appetizeCode?: Maybe<Scalars['String']['output']>;
   /**
    * Apps this user has published
@@ -10117,25 +10382,27 @@ export type User = Actor & UserActor & {
   fullName?: Maybe<Scalars['String']['output']>;
   /** GitHub account linked to a user */
   githubUser?: Maybe<GitHubUser>;
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   githubUsername?: Maybe<Scalars['String']['output']>;
   hasPassword: Scalars['Boolean']['output'];
   /** Whether this user has any pending user invitations. Only resolves for the viewer. */
   hasPendingUserInvitations: Scalars['Boolean']['output'];
   id: Scalars['ID']['output'];
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   industry?: Maybe<Scalars['String']['output']>;
   isExpoAdmin: Scalars['Boolean']['output'];
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   isLegacy: Scalars['Boolean']['output'];
   isSecondFactorAuthenticationEnabled: Scalars['Boolean']['output'];
   isStaffModeEnabled: Scalars['Boolean']['output'];
   lastDeletionAttemptTime?: Maybe<Scalars['DateTime']['output']>;
   lastName?: Maybe<Scalars['String']['output']>;
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   location?: Maybe<Scalars['String']['output']>;
   newEmailPendingVerification?: Maybe<Scalars['String']['output']>;
   oAuthIdentities: Array<OAuthIdentity>;
+  /** Registered passkey credentials */
+  passkeyCredentials: Array<UserPasskeyCredential>;
   /** Pending UserInvitations for this user. Only resolves for the viewer. */
   pendingUserInvitations: Array<UserInvitation>;
   pinnedApps: Array<App>;
@@ -10150,7 +10417,7 @@ export type User = Actor & UserActor & {
   secondFactorDevices: Array<UserSecondFactorDevice>;
   /** Snacks associated with this account */
   snacks: Array<Snack>;
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   twitterUsername?: Maybe<Scalars['String']['output']>;
   username: Scalars['String']['output'];
   websiteNotificationsPaginated: WebsiteNotificationsConnection;
@@ -10205,7 +10472,7 @@ export type UserActor = {
    */
   activityTimelineProjectActivities: Array<ActivityTimelineProjectActivity>;
   appCount: Scalars['Int']['output'];
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   appetizeCode?: Maybe<Scalars['String']['output']>;
   /**
    * Apps this user has published
@@ -10232,16 +10499,16 @@ export type UserActor = {
   fullName?: Maybe<Scalars['String']['output']>;
   /** GitHub account linked to a user */
   githubUser?: Maybe<GitHubUser>;
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   githubUsername?: Maybe<Scalars['String']['output']>;
   id: Scalars['ID']['output'];
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   industry?: Maybe<Scalars['String']['output']>;
   isExpoAdmin: Scalars['Boolean']['output'];
   isStaffModeEnabled: Scalars['Boolean']['output'];
   lastDeletionAttemptTime?: Maybe<Scalars['DateTime']['output']>;
   lastName?: Maybe<Scalars['String']['output']>;
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   location?: Maybe<Scalars['String']['output']>;
   pinnedApps: Array<App>;
   preferences: UserPreferences;
@@ -10252,7 +10519,7 @@ export type UserActor = {
   profilePhoto: Scalars['String']['output'];
   /** Snacks associated with this user's personal account */
   snacks: Array<Snack>;
-  /** @deprecated No longer supported */
+  /** @deprecated Field no longer supported */
   twitterUsername?: Maybe<Scalars['String']['output']>;
   username: Scalars['String']['output'];
   websiteNotificationsPaginated: WebsiteNotificationsConnection;
@@ -10498,12 +10765,22 @@ export type UserDashboardViewPinMutationUnpinDashboardViewArgs = {
 };
 
 export type UserDataInput = {
+  /** @deprecated Field no longer supported */
+  appetizeCode?: InputMaybe<Scalars['String']['input']>;
   email?: InputMaybe<Scalars['String']['input']>;
   firstName?: InputMaybe<Scalars['String']['input']>;
   fullName?: InputMaybe<Scalars['String']['input']>;
+  /** @deprecated Field no longer supported */
+  githubUsername?: InputMaybe<Scalars['String']['input']>;
   id?: InputMaybe<Scalars['ID']['input']>;
+  /** @deprecated Field no longer supported */
+  industry?: InputMaybe<Scalars['String']['input']>;
   lastName?: InputMaybe<Scalars['String']['input']>;
+  /** @deprecated Field no longer supported */
+  location?: InputMaybe<Scalars['String']['input']>;
   profilePhoto?: InputMaybe<Scalars['String']['input']>;
+  /** @deprecated Field no longer supported */
+  twitterUsername?: InputMaybe<Scalars['String']['input']>;
   username?: InputMaybe<Scalars['String']['input']>;
 };
 
@@ -10516,6 +10793,7 @@ export enum UserEntityTypeName {
   PasswordEntity = 'PasswordEntity',
   SsoUserEntity = 'SSOUserEntity',
   UserEntity = 'UserEntity',
+  UserPasskeyCredentialEntity = 'UserPasskeyCredentialEntity',
   UserPermissionEntity = 'UserPermissionEntity',
   UserSecondFactorBackupCodesEntity = 'UserSecondFactorBackupCodesEntity',
   UserSecondFactorDeviceEntity = 'UserSecondFactorDeviceEntity'
@@ -10645,6 +10923,21 @@ export type UserLogNameTypeMapping = {
   typeName: UserEntityTypeName;
 };
 
+/** A passkey credential belonging to a User */
+export type UserPasskeyCredential = {
+  __typename?: 'UserPasskeyCredential';
+  /**
+   * Authenticator Attestation Globally Unique Identifier — identifies the authenticator model
+   * (e.g., 1Password, iCloud Keychain). See https://passkeydeveloper.github.io/passkey-authenticator-aaguids/explorer/
+   */
+  aaguid?: Maybe<Scalars['ID']['output']>;
+  createdAt: Scalars['DateTime']['output'];
+  credentialDeviceType: Scalars['String']['output'];
+  id: Scalars['ID']['output'];
+  lastUsedAt?: Maybe<Scalars['DateTime']['output']>;
+  name: Scalars['String']['output'];
+};
+
 export type UserPermission = {
   __typename?: 'UserPermission';
   actor: Actor;
@@ -11440,6 +11733,11 @@ export type WorkflowArtifact = {
   filename: Scalars['String']['output'];
   id: Scalars['ID']['output'];
   jobRun: JobRun;
+  /**
+   * Opaque JSON attached by the worker at upload time (e.g. the Maestro test screenshot
+   * flow/attempt mapping). Interpretation is owned by the client.
+   */
+  metadata?: Maybe<Scalars['JSONObject']['output']>;
   name: Scalars['String']['output'];
   storageType: WorkflowArtifactStorageType;
   updatedAt: Scalars['DateTime']['output'];
@@ -11757,6 +12055,14 @@ export type WorkflowJob = {
   approvals: Array<WorkflowJobApproval>;
   createdAt: Scalars['DateTime']['output'];
   credentialsAppleDeviceRegistrationRequest?: Maybe<AppleDeviceRegistrationRequest>;
+  /**
+   * All test case attempt rows produced by this job's own execution (turtle job
+   * run), ordered by path then retryCount. Unlike deviceTestCaseResults and
+   * allDeviceTestCaseResults, this never includes rows from other jobs in the
+   * workflow retry chain.
+   */
+  deviceTestCaseResultAttempts: Array<WorkflowDeviceTestCaseResult>;
+  /** @deprecated Use deviceTestCaseResultAttempts instead */
   deviceTestCaseResults: Array<WorkflowDeviceTestCaseResult>;
   environment?: Maybe<Scalars['String']['output']>;
   errors: Array<WorkflowJobError>;
@@ -12095,6 +12401,7 @@ export enum WorkflowRunTriggerEventType {
   GithubPullRequestReopened = 'GITHUB_PULL_REQUEST_REOPENED',
   GithubPullRequestSynchronize = 'GITHUB_PULL_REQUEST_SYNCHRONIZE',
   GithubPush = 'GITHUB_PUSH',
+  GithubRefDelete = 'GITHUB_REF_DELETE',
   Manual = 'MANUAL',
   RepackExpoGo = 'REPACK_EXPO_GO',
   Schedule = 'SCHEDULE'
@@ -12946,6 +13253,27 @@ export type CreateLocalBuildMutationVariables = Exact<{
 
 export type CreateLocalBuildMutation = { __typename?: 'RootMutation', build: { __typename?: 'BuildMutation', createLocalBuild: { __typename?: 'CreateBuildResult', build: { __typename?: 'Build', id: string, status: BuildStatus, platform: AppPlatform, logFiles: Array<string>, channel?: string | null, distribution?: DistributionType | null, iosEnterpriseProvisioning?: BuildIosEnterpriseProvisioning | null, buildProfile?: string | null, sdkVersion?: string | null, appVersion?: string | null, appBuildVersion?: string | null, runtimeVersion?: string | null, gitCommitHash?: string | null, gitCommitMessage?: string | null, initialQueuePosition?: number | null, queuePosition?: number | null, estimatedWaitTimeLeftSeconds?: number | null, priority: BuildPriority, createdAt: any, updatedAt: any, message?: string | null, completedAt?: any | null, expirationDate?: any | null, isForIosSimulator: boolean, error?: { __typename?: 'BuildError', errorCode: string, message: string, docsUrl?: string | null } | null, artifacts?: { __typename?: 'BuildArtifacts', buildUrl?: string | null, xcodeBuildLogsUrl?: string | null, applicationArchiveUrl?: string | null, buildArtifactsUrl?: string | null } | null, fingerprint?: { __typename?: 'Fingerprint', id: string, hash: string } | null, initiatingActor?: { __typename: 'PartnerActor', id: string, displayName: string } | { __typename: 'Robot', id: string, displayName: string } | { __typename: 'SSOUser', id: string, displayName: string } | { __typename: 'User', id: string, displayName: string } | null, project: { __typename: 'App', id: string, name: string, slug: string, ownerAccount: { __typename?: 'Account', id: string, name: string } } | { __typename: 'Snack', id: string, name: string, slug: string }, metrics?: { __typename?: 'BuildMetrics', buildWaitTime?: number | null, buildQueueTime?: number | null, buildDuration?: number | null } | null } } } };
 
+export type CreatePostHogAccountRequestMutationVariables = Exact<{
+  input: CreatePostHogAccountRequestInput;
+}>;
+
+
+export type CreatePostHogAccountRequestMutation = { __typename?: 'RootMutation', posthogOrganizationConnection: { __typename?: 'PostHogOrganizationConnectionMutation', createPostHogAccountRequest: { __typename?: 'PostHogOrganizationConnection', id: string, posthogOrganizationIdentifier: string, posthogOrganizationName: string, posthogRegion: PostHogRegion, createdAt: any, updatedAt: any } } };
+
+export type SetupPostHogProjectMutationVariables = Exact<{
+  input: SetupPostHogProjectInput;
+}>;
+
+
+export type SetupPostHogProjectMutation = { __typename?: 'RootMutation', posthogProject: { __typename?: 'PostHogProjectMutation', setupPostHogProject: { __typename?: 'PostHogProject', id: string, posthogProjectIdentifier: string, posthogProjectName: string, posthogProjectToken: string, posthogHost: string, createdAt: any, updatedAt: any, posthogOrganizationConnection: { __typename?: 'PostHogOrganizationConnection', id: string, posthogOrganizationIdentifier: string, posthogOrganizationName: string, posthogRegion: PostHogRegion, createdAt: any, updatedAt: any } } } };
+
+export type DeletePostHogProjectMutationVariables = Exact<{
+  id: Scalars['ID']['input'];
+}>;
+
+
+export type DeletePostHogProjectMutation = { __typename?: 'RootMutation', posthogProject: { __typename?: 'PostHogProjectMutation', deletePostHogProject: string } };
+
 export type GetSignedUploadMutationVariables = Exact<{
   contentTypes: Array<Scalars['String']['input']> | Scalars['String']['input'];
 }>;
@@ -13195,6 +13523,17 @@ export type GetAssetSignedUrlsQueryVariables = Exact<{
 
 export type GetAssetSignedUrlsQuery = { __typename?: 'RootQuery', asset: { __typename?: 'AssetQuery', signedUrls: Array<{ __typename?: 'AssetSignedUrlResult', storageKey: string, url: string, headers?: any | null }> } };
 
+export type AuditLogsByAccountQueryVariables = Exact<{
+  accountId: Scalars['String']['input'];
+  first?: InputMaybe<Scalars['Int']['input']>;
+  after?: InputMaybe<Scalars['String']['input']>;
+  last?: InputMaybe<Scalars['Int']['input']>;
+  before?: InputMaybe<Scalars['String']['input']>;
+}>;
+
+
+export type AuditLogsByAccountQuery = { __typename?: 'RootQuery', account: { __typename?: 'AccountQuery', byId: { __typename?: 'Account', id: string, auditLogsPaginated: { __typename?: 'AuditLogConnection', edges: Array<{ __typename?: 'AuditLogEdge', cursor: string, node: { __typename?: 'AuditLog', id: string, createdAt: any, websiteMessage: string, targetEntityTypePublicName: string, targetEntityMutationType: TargetEntityMutationType, actor?: { __typename?: 'PartnerActor', id: string, displayName: string } | { __typename?: 'Robot', id: string, displayName: string } | { __typename?: 'SSOUser', id: string, displayName: string } | { __typename?: 'User', id: string, displayName: string } | null } }>, pageInfo: { __typename?: 'PageInfo', hasNextPage: boolean, hasPreviousPage: boolean, startCursor?: string | null, endCursor?: string | null } } } } };
+
 export type BackgroundJobReceiptByIdQueryVariables = Exact<{
   id: Scalars['ID']['input'];
 }>;
@@ -13349,7 +13688,7 @@ export type DeviceRunSessionByIdQueryVariables = Exact<{
 }>;
 
 
-export type DeviceRunSessionByIdQuery = { __typename?: 'RootQuery', deviceRunSessions: { __typename?: 'DeviceRunSessionQuery', byId: { __typename?: 'DeviceRunSession', id: string, status: DeviceRunSessionStatus, type: DeviceRunSessionType, app: { __typename?: 'App', id: string, slug: string, ownerAccount: { __typename?: 'Account', id: string, name: string } }, remoteConfig?: { __typename: 'AgentDeviceRunSessionRemoteConfig', agentDeviceRemoteSessionUrl: string, agentDeviceRemoteSessionToken: string, webPreviewUrl?: string | null } | { __typename: 'ArgentRunSessionRemoteConfig', toolsUrl: string, webPreviewUrl?: string | null } | { __typename: 'ServeSimRunSessionRemoteConfig', previewUrl: string, streamUrl: string } | null, turtleJobRun?: { __typename?: 'JobRun', id: string, status: JobRunStatus } | null } } };
+export type DeviceRunSessionByIdQuery = { __typename?: 'RootQuery', deviceRunSessions: { __typename?: 'DeviceRunSessionQuery', byId: { __typename?: 'DeviceRunSession', id: string, status: DeviceRunSessionStatus, type: DeviceRunSessionType, app: { __typename?: 'App', id: string, slug: string, ownerAccount: { __typename?: 'Account', id: string, name: string } }, remoteConfig?: { __typename: 'AgentDeviceRunSessionRemoteConfig', agentDeviceRemoteSessionUrl: string, agentDeviceRemoteSessionToken: string, webPreviewUrl?: string | null } | { __typename: 'ArgentRunSessionRemoteConfig', toolsUrl: string, toolsAuthToken?: string | null, webPreviewUrl?: string | null } | { __typename: 'ServeSimRunSessionRemoteConfig', previewUrl: string, streamUrl: string } | null, turtleJobRun?: { __typename?: 'JobRun', id: string, status: JobRunStatus } | null } } };
 
 export type DeviceRunSessionsByAppIdQueryVariables = Exact<{
   appId: Scalars['String']['input'];
@@ -13511,6 +13850,20 @@ export type AppObserveNavigationRoutesQueryVariables = Exact<{
 
 export type AppObserveNavigationRoutesQuery = { __typename?: 'RootQuery', app: { __typename?: 'AppQuery', byId: { __typename?: 'App', id: string, observe: { __typename?: 'AppObserve', navigationRoutes: { __typename?: 'AppObserveNavigationRoutesConnection', pageInfo: { __typename?: 'PageInfo', hasNextPage: boolean, hasPreviousPage: boolean, endCursor?: string | null }, edges: Array<{ __typename?: 'AppObserveNavigationRouteEdge', cursor: string, node: { __typename?: 'AppObserveNavigationRoute', routeName: string, coldTtr: { __typename?: 'AppObserveNavigationStat', count: number, median?: number | null, p90?: number | null }, warmTtr: { __typename?: 'AppObserveNavigationStat', count: number, median?: number | null, p90?: number | null }, tti: { __typename?: 'AppObserveNavigationStat', count: number, median?: number | null, p90?: number | null } } }> } } } } };
 
+export type PostHogOrganizationConnectionByAccountIdQueryVariables = Exact<{
+  accountId: Scalars['String']['input'];
+}>;
+
+
+export type PostHogOrganizationConnectionByAccountIdQuery = { __typename?: 'RootQuery', account: { __typename?: 'AccountQuery', byId: { __typename?: 'Account', id: string, posthogOrganizationConnection?: { __typename?: 'PostHogOrganizationConnection', id: string, posthogOrganizationIdentifier: string, posthogOrganizationName: string, posthogRegion: PostHogRegion, createdAt: any, updatedAt: any } | null } } };
+
+export type PostHogProjectByAppIdQueryVariables = Exact<{
+  appId: Scalars['String']['input'];
+}>;
+
+
+export type PostHogProjectByAppIdQuery = { __typename?: 'RootQuery', app: { __typename?: 'AppQuery', byId: { __typename?: 'App', id: string, posthogProject?: { __typename?: 'PostHogProject', id: string, posthogProjectIdentifier: string, posthogProjectName: string, posthogProjectToken: string, posthogHost: string, createdAt: any, updatedAt: any, posthogOrganizationConnection: { __typename?: 'PostHogOrganizationConnection', id: string, posthogOrganizationIdentifier: string, posthogOrganizationName: string, posthogRegion: PostHogRegion, createdAt: any, updatedAt: any } } | null } } };
+
 export type GetAssetMetadataQueryVariables = Exact<{
   storageKeys: Array<Scalars['String']['input']> | Scalars['String']['input'];
 }>;
@@ -13589,6 +13942,19 @@ export type ViewUpdateGroupsOnBranchQueryVariables = Exact<{
 
 export type ViewUpdateGroupsOnBranchQuery = { __typename?: 'RootQuery', app: { __typename?: 'AppQuery', byId: { __typename?: 'App', id: string, updateBranchByName?: { __typename?: 'UpdateBranch', id: string, updateGroups: Array<Array<{ __typename?: 'Update', id: string, group: string, message?: string | null, createdAt: any, runtimeVersion: string, platform: string, manifestFragment: string, isRollBackToEmbedded: boolean, manifestPermalink: string, gitCommitHash?: string | null, isGitWorkingTreeDirty: boolean, environment?: any | null, rolloutPercentage?: number | null, manifestHostOverride?: string | null, assetHostOverride?: string | null, actor?: { __typename: 'PartnerActor', username: string, id: string } | { __typename: 'Robot', firstName?: string | null, id: string } | { __typename: 'SSOUser', username: string, id: string } | { __typename: 'User', username: string, id: string } | null, branch: { __typename?: 'UpdateBranch', id: string, name: string }, codeSigningInfo?: { __typename?: 'CodeSigningInfo', keyid: string, sig: string, alg: string } | null, rolloutControlUpdate?: { __typename?: 'Update', id: string, group: string } | null, fingerprint?: { __typename?: 'Fingerprint', id: string, hash: string, debugInfoUrl?: string | null, source?: { __typename?: 'FingerprintSource', type: FingerprintSourceType, bucketKey: string, isDebugFingerprint?: boolean | null } | null } | null }>> } | null } } };
 
+export type ViewUpdateGroupsPaginatedOnBranchQueryVariables = Exact<{
+  appId: Scalars['String']['input'];
+  branchName: Scalars['String']['input'];
+  first?: InputMaybe<Scalars['Int']['input']>;
+  last?: InputMaybe<Scalars['Int']['input']>;
+  after?: InputMaybe<Scalars['String']['input']>;
+  before?: InputMaybe<Scalars['String']['input']>;
+  filter?: InputMaybe<UpdatesFilterV2>;
+}>;
+
+
+export type ViewUpdateGroupsPaginatedOnBranchQuery = { __typename?: 'RootQuery', app: { __typename?: 'AppQuery', byId: { __typename?: 'App', id: string, updateBranchByName?: { __typename?: 'UpdateBranch', id: string, updateGroupsPaginated: { __typename?: 'UpdateGroupsConnection', edges: Array<{ __typename?: 'UpdateGroupEdge', node: Array<{ __typename?: 'Update', id: string, group: string, message?: string | null, createdAt: any, runtimeVersion: string, platform: string, manifestFragment: string, isRollBackToEmbedded: boolean, manifestPermalink: string, gitCommitHash?: string | null, isGitWorkingTreeDirty: boolean, environment?: any | null, rolloutPercentage?: number | null, manifestHostOverride?: string | null, assetHostOverride?: string | null, actor?: { __typename: 'PartnerActor', username: string, id: string } | { __typename: 'Robot', firstName?: string | null, id: string } | { __typename: 'SSOUser', username: string, id: string } | { __typename: 'User', username: string, id: string } | null, branch: { __typename?: 'UpdateBranch', id: string, name: string }, codeSigningInfo?: { __typename?: 'CodeSigningInfo', keyid: string, sig: string, alg: string } | null, rolloutControlUpdate?: { __typename?: 'Update', id: string, group: string } | null, fingerprint?: { __typename?: 'Fingerprint', id: string, hash: string, debugInfoUrl?: string | null, source?: { __typename?: 'FingerprintSource', type: FingerprintSourceType, bucketKey: string, isDebugFingerprint?: boolean | null } | null } | null }> }> } } | null } } };
+
 export type ViewUpdateGroupsOnAppQueryVariables = Exact<{
   appId: Scalars['String']['input'];
   limit: Scalars['Int']['input'];
@@ -13695,6 +14061,8 @@ export type AccountUsageMetricFragment = { __typename?: 'AccountUsageMetric', id
 
 export type AppFragment = { __typename?: 'App', id: string, name: string, fullName: string, slug: string, ownerAccount: { __typename?: 'Account', id: string, name: string, ownerUserActor?: { __typename?: 'SSOUser', id: string, username: string } | { __typename?: 'User', id: string, username: string } | null, users: Array<{ __typename?: 'UserPermission', role: Role, actor: { __typename?: 'PartnerActor', id: string } | { __typename?: 'Robot', id: string } | { __typename?: 'SSOUser', id: string } | { __typename?: 'User', id: string } }> }, githubRepository?: { __typename?: 'GitHubRepository', id: string, metadata: { __typename?: 'GitHubRepositoryMetadata', id: string, githubRepoOwnerName: string, githubRepoName: string } } | null };
 
+export type AuditLogFragment = { __typename?: 'AuditLog', id: string, createdAt: any, websiteMessage: string, targetEntityTypePublicName: string, targetEntityMutationType: TargetEntityMutationType, actor?: { __typename?: 'PartnerActor', id: string, displayName: string } | { __typename?: 'Robot', id: string, displayName: string } | { __typename?: 'SSOUser', id: string, displayName: string } | { __typename?: 'User', id: string, displayName: string } | null };
+
 export type BackgroundJobReceiptDataFragment = { __typename?: 'BackgroundJobReceipt', id: string, state: BackgroundJobState, tries: number, willRetry: boolean, resultId?: string | null, resultType: BackgroundJobResultType, resultData?: any | null, errorCode?: string | null, errorMessage?: string | null, createdAt: any, updatedAt: any };
 
 export type BuildFragment = { __typename?: 'Build', id: string, status: BuildStatus, platform: AppPlatform, logFiles: Array<string>, channel?: string | null, distribution?: DistributionType | null, iosEnterpriseProvisioning?: BuildIosEnterpriseProvisioning | null, buildProfile?: string | null, sdkVersion?: string | null, appVersion?: string | null, appBuildVersion?: string | null, runtimeVersion?: string | null, gitCommitHash?: string | null, gitCommitMessage?: string | null, initialQueuePosition?: number | null, queuePosition?: number | null, estimatedWaitTimeLeftSeconds?: number | null, priority: BuildPriority, createdAt: any, updatedAt: any, message?: string | null, completedAt?: any | null, expirationDate?: any | null, isForIosSimulator: boolean, error?: { __typename?: 'BuildError', errorCode: string, message: string, docsUrl?: string | null } | null, artifacts?: { __typename?: 'BuildArtifacts', buildUrl?: string | null, xcodeBuildLogsUrl?: string | null, applicationArchiveUrl?: string | null, buildArtifactsUrl?: string | null } | null, fingerprint?: { __typename?: 'Fingerprint', id: string, hash: string } | null, initiatingActor?: { __typename: 'PartnerActor', id: string, displayName: string } | { __typename: 'Robot', id: string, displayName: string } | { __typename: 'SSOUser', id: string, displayName: string } | { __typename: 'User', id: string, displayName: string } | null, project: { __typename: 'App', id: string, name: string, slug: string, ownerAccount: { __typename?: 'Account', id: string, name: string } } | { __typename: 'Snack', id: string, name: string, slug: string }, metrics?: { __typename?: 'BuildMetrics', buildWaitTime?: number | null, buildQueueTime?: number | null, buildDuration?: number | null } | null };
@@ -13725,6 +14093,10 @@ export type AppObserveEventFragment = { __typename?: 'AppObserveEvent', id: stri
 
 export type AppObserveAppVersionFragment = { __typename?: 'AppObserveAppVersion', appVersion: string, firstSeenAt: any, eventCount: number, uniqueUserCount: number, buildNumbers: Array<{ __typename?: 'AppObserveAppBuildNumber', appBuildNumber: string, firstSeenAt: any, eventCount: number, uniqueUserCount: number, easBuilds: Array<{ __typename?: 'AppObserveAppEasBuild', easBuildId: string, firstSeenAt: any, eventCount: number, uniqueUserCount: number }> }>, updates: Array<{ __typename?: 'AppObserveAppUpdate', appUpdateId: string, firstSeenAt: any, eventCount: number, uniqueUserCount: number, easBuilds: Array<{ __typename?: 'AppObserveAppEasBuild', easBuildId: string, firstSeenAt: any, eventCount: number, uniqueUserCount: number }> }>, metrics: Array<{ __typename?: 'AppObserveAppVersionMetric', metricName: string, eventCount: number, statistics: { __typename?: 'AppObserveVersionMarkerStatistics', min?: number | null, max?: number | null, median?: number | null, average?: number | null, p80?: number | null, p90?: number | null, p99?: number | null } }> };
 
+export type PostHogOrganizationConnectionFragment = { __typename?: 'PostHogOrganizationConnection', id: string, posthogOrganizationIdentifier: string, posthogOrganizationName: string, posthogRegion: PostHogRegion, createdAt: any, updatedAt: any };
+
+export type PostHogProjectFragment = { __typename?: 'PostHogProject', id: string, posthogProjectIdentifier: string, posthogProjectName: string, posthogProjectToken: string, posthogHost: string, createdAt: any, updatedAt: any, posthogOrganizationConnection: { __typename?: 'PostHogOrganizationConnection', id: string, posthogOrganizationIdentifier: string, posthogOrganizationName: string, posthogRegion: PostHogRegion, createdAt: any, updatedAt: any } };
+
 export type RuntimeFragment = { __typename?: 'Runtime', id: string, version: string };
 
 export type StatuspageServiceFragment = { __typename?: 'StatuspageService', id: string, name: StatuspageServiceName, status: StatuspageServiceStatus, incidents: Array<{ __typename?: 'StatuspageIncident', id: string, status: StatuspageIncidentStatus, name: string, impact: StatuspageIncidentImpact, shortlink: string }> };

packages/eas-cli/src/graphql/mutations/PostHogMutation.ts

@@ -0,0 +1,117 @@
+import { print } from 'graphql';
+import gql from 'graphql-tag';
+
+import { ExpoGraphqlClient } from '../../commandUtils/context/contextUtils/createGraphqlClient';
+import { withErrorHandlingAsync } from '../client';
+import { CreatePostHogAccountRequestInput, SetupPostHogProjectInput } from '../generated';
+import {
+  PostHogOrganizationConnectionData,
+  PostHogOrganizationConnectionFragmentNode,
+  PostHogProjectData,
+  PostHogProjectFragmentNode,
+} from '../types/PostHogConnection';
+
+type CreatePostHogAccountRequestMutation = {
+  posthogOrganizationConnection: {
+    createPostHogAccountRequest: PostHogOrganizationConnectionData;
+  };
+};
+
+type CreatePostHogAccountRequestMutationVariables = {
+  input: CreatePostHogAccountRequestInput;
+};
+
+type SetupPostHogProjectMutation = {
+  posthogProject: {
+    setupPostHogProject: PostHogProjectData;
+  };
+};
+
+type SetupPostHogProjectMutationVariables = {
+  input: SetupPostHogProjectInput;
+};
+
+type DeletePostHogProjectMutation = {
+  posthogProject: {
+    deletePostHogProject: string;
+  };
+};
+
+type DeletePostHogProjectMutationVariables = {
+  id: string;
+};
+
+export const PostHogMutation = {
+  async createPostHogAccountRequestAsync(
+    graphqlClient: ExpoGraphqlClient,
+    input: CreatePostHogAccountRequestInput
+  ): Promise<PostHogOrganizationConnectionData> {
+    const data = await withErrorHandlingAsync(
+      graphqlClient
+        .mutation<
+          CreatePostHogAccountRequestMutation,
+          CreatePostHogAccountRequestMutationVariables
+        >(
+          gql`
+            mutation CreatePostHogAccountRequest($input: CreatePostHogAccountRequestInput!) {
+              posthogOrganizationConnection {
+                createPostHogAccountRequest(input: $input) {
+                  id
+                  ...PostHogOrganizationConnectionFragment
+                }
+              }
+            }
+            ${print(PostHogOrganizationConnectionFragmentNode)}
+          `,
+          { input }
+        )
+        .toPromise()
+    );
+    return data.posthogOrganizationConnection.createPostHogAccountRequest;
+  },
+
+  async setupPostHogProjectAsync(
+    graphqlClient: ExpoGraphqlClient,
+    input: SetupPostHogProjectInput
+  ): Promise<PostHogProjectData> {
+    const data = await withErrorHandlingAsync(
+      graphqlClient
+        .mutation<SetupPostHogProjectMutation, SetupPostHogProjectMutationVariables>(
+          gql`
+            mutation SetupPostHogProject($input: SetupPostHogProjectInput!) {
+              posthogProject {
+                setupPostHogProject(input: $input) {
+                  id
+                  ...PostHogProjectFragment
+                }
+              }
+            }
+            ${print(PostHogOrganizationConnectionFragmentNode)}
+            ${print(PostHogProjectFragmentNode)}
+          `,
+          { input }
+        )
+        .toPromise()
+    );
+    return data.posthogProject.setupPostHogProject;
+  },
+
+  async deletePostHogProjectAsync(graphqlClient: ExpoGraphqlClient, id: string): Promise<string> {
+    const data = await withErrorHandlingAsync(
+      graphqlClient
+        .mutation<DeletePostHogProjectMutation, DeletePostHogProjectMutationVariables>(
+          gql`
+            mutation DeletePostHogProject($id: ID!) {
+              posthogProject {
+                deletePostHogProject(id: $id)
+              }
+            }
+          `,
+          { id },
+          { additionalTypenames: ['App', 'PostHogProject'] }
+        )
+        .toPromise()
+    );
+    return data.posthogProject.deletePostHogProject;
+  },
+};

packages/eas-cli/src/graphql/queries/AuditLogQuery.ts

@@ -0,0 +1,73 @@
+import { print } from 'graphql';
+import gql from 'graphql-tag';
+
+import { ExpoGraphqlClient } from '../../commandUtils/context/contextUtils/createGraphqlClient';
+import { Connection, QueryParams } from '../../utils/relay';
+import { withErrorHandlingAsync } from '../client';
+import {
+  AuditLogFragment,
+  AuditLogsByAccountQuery,
+  AuditLogsByAccountQueryVariables,
+} from '../generated';
+import { AuditLogFragmentNode } from '../types/AuditLog';
+
+export const AuditLogQuery = {
+  async getAllForAccountAsync(
+    graphqlClient: ExpoGraphqlClient,
+    accountId: string,
+    queryParams: QueryParams
+  ): Promise<Connection<AuditLogFragment>> {
+    const data = await withErrorHandlingAsync(
+      graphqlClient
+        .query<AuditLogsByAccountQuery, AuditLogsByAccountQueryVariables>(
+          gql`
+            query AuditLogsByAccount(
+              $accountId: String!
+              $first: Int
+              $after: String
+              $last: Int
+              $before: String
+            ) {
+              account {
+                byId(accountId: $accountId) {
+                  id
+                  auditLogsPaginated(
+                    first: $first
+                    after: $after
+                    last: $last
+                    before: $before
+                  ) {
+                    edges {
+                      cursor
+                      node {
+                        id
+                        ...AuditLogFragment
+                      }
+                    }
+                    pageInfo {
+                      hasNextPage
+                      hasPreviousPage
+                      startCursor
+                      endCursor
+                    }
+                  }
+                }
+              }
+            }
+            ${print(AuditLogFragmentNode)}
+          `,
+          {
+            accountId,
+            first: queryParams.first,
+            after: queryParams.after,
+            last: queryParams.last,
+            before: queryParams.before,
+          },
+          { additionalTypenames: ['AuditLog'] }
+        )
+        .toPromise()
+    );
+
+    return data.account.byId.auditLogsPaginated;
+  },
+};

packages/eas-cli/src/graphql/queries/DeviceRunSessionQuery.ts

@@ -42,6 +42,7 @@ export const DeviceRunSessionQuery = {
                     }
                     ... on ArgentRunSessionRemoteConfig {
                       toolsUrl
+                      toolsAuthToken
                       webPreviewUrl
                     }
                     ... on ServeSimRunSessionRemoteConfig {

packages/eas-cli/src/graphql/queries/PostHogQuery.ts

@@ -0,0 +1,103 @@
+import { print } from 'graphql';
+import gql from 'graphql-tag';
+
+import { ExpoGraphqlClient } from '../../commandUtils/context/contextUtils/createGraphqlClient';
+import { withErrorHandlingAsync } from '../client';
+import {
+  PostHogOrganizationConnectionData,
+  PostHogOrganizationConnectionFragmentNode,
+  PostHogProjectData,
+  PostHogProjectFragmentNode,
+} from '../types/PostHogConnection';
+
+type PostHogOrganizationConnectionByAccountIdQuery = {
+  account: {
+    byId: {
+      id: string;
+      posthogOrganizationConnection?: PostHogOrganizationConnectionData | null;
+    };
+  };
+};
+
+type PostHogOrganizationConnectionByAccountIdQueryVariables = {
+  accountId: string;
+};
+
+type PostHogProjectByAppIdQuery = {
+  app: {
+    byId: {
+      id: string;
+      posthogProject?: PostHogProjectData | null;
+    };
+  };
+};
+
+type PostHogProjectByAppIdQueryVariables = {
+  appId: string;
+};
+
+export const PostHogQuery = {
+  async getPostHogOrganizationConnectionByAccountIdAsync(
+    graphqlClient: ExpoGraphqlClient,
+    accountId: string
+  ): Promise<PostHogOrganizationConnectionData | null> {
+    const data = await withErrorHandlingAsync(
+      graphqlClient
+        .query<
+          PostHogOrganizationConnectionByAccountIdQuery,
+          PostHogOrganizationConnectionByAccountIdQueryVariables
+        >(
+          gql`
+            query PostHogOrganizationConnectionByAccountId($accountId: String!) {
+              account {
+                byId(accountId: $accountId) {
+                  id
+                  posthogOrganizationConnection {
+                    id
+                    ...PostHogOrganizationConnectionFragment
+                  }
+                }
+              }
+            }
+            ${print(PostHogOrganizationConnectionFragmentNode)}
+          `,
+          { accountId },
+          { additionalTypenames: ['PostHogOrganizationConnection'] }
+        )
+        .toPromise()
+    );
+
+    return data.account.byId.posthogOrganizationConnection ?? null;
+  },
+
+  async getPostHogProjectByAppIdAsync(
+    graphqlClient: ExpoGraphqlClient,
+    appId: string
+  ): Promise<PostHogProjectData | null> {
+    const data = await withErrorHandlingAsync(
+      graphqlClient
+        .query<PostHogProjectByAppIdQuery, PostHogProjectByAppIdQueryVariables>(
+          gql`
+            query PostHogProjectByAppId($appId: String!) {
+              app {
+                byId(appId: $appId) {
+                  id
+                  posthogProject {
+                    id
+                    ...PostHogProjectFragment
+                  }
+                }
+              }
+            }
+            ${print(PostHogOrganizationConnectionFragmentNode)}
+            ${print(PostHogProjectFragmentNode)}
+          `,
+          { appId },
+          { additionalTypenames: ['App', 'PostHogProject'] }
+        )
+        .toPromise()
+    );
+
+    return data.app.byId.posthogProject ?? null;
+  },
+};

packages/eas-cli/src/graphql/queries/UpdateQuery.ts

@@ -11,6 +11,8 @@ import {
   ViewUpdateGroupsOnAppQueryVariables,
   ViewUpdateGroupsOnBranchQuery,
   ViewUpdateGroupsOnBranchQueryVariables,
+  ViewUpdateGroupsPaginatedOnBranchQuery,
+  ViewUpdateGroupsPaginatedOnBranchQueryVariables,
   ViewUpdatesByGroupQuery,
   ViewUpdatesByGroupQueryVariables,
 } from '../generated';
@@ -96,6 +98,80 @@ export const UpdateQuery = {
 
     return branch.updateGroups;
   },
+  async viewUpdateGroupsPaginatedOnBranchAsync(
+    graphqlClient: ExpoGraphqlClient,
+    {
+      appId,
+      branchName,
+      first,
+      last,
+      after,
+      before,
+      filter,
+    }: ViewUpdateGroupsPaginatedOnBranchQueryVariables
+  ): Promise<UpdateFragment[][]> {
+    const response = await withErrorHandlingAsync(
+      graphqlClient
+        .query<
+          ViewUpdateGroupsPaginatedOnBranchQuery,
+          ViewUpdateGroupsPaginatedOnBranchQueryVariables
+        >(
+          gql`
+            query ViewUpdateGroupsPaginatedOnBranch(
+              $appId: String!
+              $branchName: String!
+              $first: Int
+              $last: Int
+              $after: String
+              $before: String
+              $filter: UpdatesFilterV2
+            ) {
+              app {
+                byId(appId: $appId) {
+                  id
+                  updateBranchByName(name: $branchName) {
+                    id
+                    updateGroupsPaginated(
+                      first: $first
+                      last: $last
+                      after: $after
+                      before: $before
+                      filter: $filter
+                    ) {
+                      edges {
+                        node {
+                          id
+                          ...UpdateFragment
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+            ${print(UpdateFragmentNode)}
+          `,
+          {
+            appId,
+            branchName,
+            first,
+            last,
+            after,
+            before,
+            filter,
+          },
+          { additionalTypenames: ['Update'] }
+        )
+        .toPromise()
+    );
+    const branch = response.app.byId.updateBranchByName;
+
+    if (!branch) {
+      throw new Error(`Could not find branch "${branchName}"`);
+    }
+
+    return branch.updateGroupsPaginated.edges.map(edge => edge.node);
+  },
   async viewUpdateGroupsOnAppAsync(
     graphqlClient: ExpoGraphqlClient,
     { limit, offset, appId, filter }: ViewUpdateGroupsOnAppQueryVariables

packages/eas-cli/src/graphql/queries/__tests__/AuditLogQuery-test.ts

@@ -0,0 +1,47 @@
+import { anything, capture, instance, mock, when } from 'ts-mockito';
+
+import { ExpoGraphqlClient } from '../../../commandUtils/context/contextUtils/createGraphqlClient';
+import { AuditLogQuery } from '../AuditLogQuery';
+
+describe(AuditLogQuery.getAllForAccountAsync.name, () => {
+  it('returns the audit log connection for an account and forwards pagination params', async () => {
+    const connection = {
+      edges: [
+        {
+          cursor: 'cursor-1',
+          node: {
+            id: 'audit-log-id',
+            createdAt: '2026-05-21T17:43:32.433Z',
+            websiteMessage: 'Created a new Project',
+            targetEntityTypePublicName: 'Project',
+            targetEntityMutationType: 'CREATE',
+            actor: { id: 'actor-id', displayName: 'tester' },
+          },
+        },
+      ],
+      pageInfo: {
+        hasNextPage: false,
+        hasPreviousPage: false,
+        startCursor: 'cursor-1',
+        endCursor: 'cursor-1',
+      },
+    };
+
+    const graphqlClientMock = mock<ExpoGraphqlClient>();
+    when(graphqlClientMock.query(anything(), anything(), anything())).thenReturn({
+      toPromise: () =>
+        Promise.resolve({ data: { account: { byId: { auditLogsPaginated: connection } } } }),
+    } as any);
+    const graphqlClient = instance(graphqlClientMock);
+
+    const result = await AuditLogQuery.getAllForAccountAsync(graphqlClient, 'account-id', {
+      first: 10,
+      after: 'cursor-0',
+    });
+
+    expect(result).toBe(connection);
+
+    const [, variables] = capture<any, any, any>(graphqlClientMock.query as any).first();
+    expect(variables).toMatchObject({ accountId: 'account-id', first: 10, after: 'cursor-0' });
+  });
+});

packages/eas-cli/src/graphql/types/AuditLog.ts

@@ -0,0 +1,15 @@
+import gql from 'graphql-tag';
+
+export const AuditLogFragmentNode = gql`
+  fragment AuditLogFragment on AuditLog {
+    id
+    createdAt
+    websiteMessage
+    targetEntityTypePublicName
+    targetEntityMutationType
+    actor {
+      id
+      displayName
+    }
+  }
+`;

packages/eas-cli/src/graphql/types/PostHogConnection.ts

@@ -0,0 +1,53 @@
+import gql from 'graphql-tag';
+
+import { PostHogOrganizationConnection, PostHogProject } from '../generated';
+
+export type PostHogOrganizationConnectionData = Pick<
+  PostHogOrganizationConnection,
+  | 'id'
+  | 'posthogOrganizationIdentifier'
+  | 'posthogOrganizationName'
+  | 'posthogRegion'
+  | 'createdAt'
+  | 'updatedAt'
+>;
+
+export type PostHogProjectData = Pick<
+  PostHogProject,
+  | 'id'
+  | 'posthogProjectIdentifier'
+  | 'posthogProjectName'
+  | 'posthogProjectToken'
+  | 'posthogHost'
+  | 'createdAt'
+  | 'updatedAt'
+> & {
+  posthogOrganizationConnection: PostHogOrganizationConnectionData;
+};
+
+export const PostHogOrganizationConnectionFragmentNode = gql`
+  fragment PostHogOrganizationConnectionFragment on PostHogOrganizationConnection {
+    id
+    posthogOrganizationIdentifier
+    posthogOrganizationName
+    posthogRegion
+    createdAt
+    updatedAt
+  }
+`;
+
+export const PostHogProjectFragmentNode = gql`
+  fragment PostHogProjectFragment on PostHogProject {
+    id
+    posthogProjectIdentifier
+    posthogProjectName
+    posthogProjectToken
+    posthogHost
+    createdAt
+    updatedAt
+    posthogOrganizationConnection {
+      id
+      ...PostHogOrganizationConnectionFragment
+    }
+  }
+`;

packages/eas-cli/src/simulator/utils.ts

@@ -31,6 +31,10 @@ export function getRemoteSessionEnvironmentVariables(
         AGENT_DEVICE_DAEMON_AUTH_TOKEN: remoteConfig.agentDeviceRemoteSessionToken,
       };
     case 'ArgentRunSessionRemoteConfig':
+      return {
+        ARGENT_TOOLS_URL: remoteConfig.toolsUrl,
+        ...(remoteConfig.toolsAuthToken ? { ARGENT_AUTH_TOKEN: remoteConfig.toolsAuthToken } : {}),
+      };
     case 'ServeSimRunSessionRemoteConfig':
       return {};
   }
@@ -70,11 +74,33 @@ export function formatRemoteSessionInstructions(
       return lines.join('\n');
     }
     case 'ArgentRunSessionRemoteConfig': {
-      const lines = [
-        '🔑 Open the following URL to access the Argent tools for this session:',
-        '',
-        remoteConfig.toolsUrl,
-      ];
+      const environmentVariables = getRemoteSessionEnvironmentVariables(remoteConfig);
+      const lines =
+        configType === 'dotenv'
+          ? [
+              '🔑 Run the following to link your local Argent client to this simulator session:',
+              '',
+              [
+                'argent',
+                'link',
+                `'${remoteConfig.toolsUrl}'`,
+                remoteConfig.toolsAuthToken
+                  ? `--token '${remoteConfig.toolsAuthToken}'`
+                  : undefined,
+                '--yes',
+              ]
+                .filter(Boolean)
+                .join(' '),
+              '',
+              'Restart your editor after linking so its Argent MCP process uses the remote session.',
+            ]
+          : [
+              '🔑 Run the following in your shell to attach Argent to this simulator session:',
+              '',
+              ...Object.entries(environmentVariables).map(
+                ([key, value]) => `export ${key}='${value}'`
+              ),
+            ];
       if (remoteConfig.webPreviewUrl) {
         lines.push(
           '',

packages/eas-cli/src/user/SessionManager.ts

@@ -1,6 +1,5 @@
 import JsonFile from '@expo/json-file';
 import { Errors } from '@oclif/core';
-import assert from 'assert';
 import chalk from 'chalk';
 import nullthrows from 'nullthrows';
 
@@ -13,7 +12,7 @@ import { createGraphqlClient } from '../commandUtils/context/contextUtils/create
 import { CurrentUserQuery } from '../graphql/generated';
 import { UserQuery } from '../graphql/queries/UserQuery';
 import Log, { learnMore } from '../log';
-import { promptAsync, selectAsync } from '../prompts';
+import { promptAsync } from '../prompts';
 import { getStateJsonPath } from '../utils/paths';
 
 type UserSettingsData = {
@@ -29,18 +28,6 @@ type SessionData = {
   currentConnection: 'Username-Password-Authentication' | 'Browser-Flow-Authentication';
 };
 
-export enum UserSecondFactorDeviceMethod {
-  AUTHENTICATOR = 'authenticator',
-  SMS = 'sms',
-}
-
-type SecondFactorDevice = {
-  id: string;
-  method: UserSecondFactorDeviceMethod;
-  sms_phone_number: string | null;
-  is_primary: boolean;
-};
-
 export type LoggedInAuthenticationInfo =
   | {
       accessToken: string;
@@ -205,11 +192,7 @@ export default class SessionManager {
       });
     } catch (e) {
       if (e instanceof ApiV2Error && e.expoApiV2ErrorCode === 'ONE_TIME_PASSWORD_REQUIRED') {
-        await this.retryUsernamePasswordAuthWithOTPAsync(
-          username,
-          password,
-          e.expoApiV2ErrorMetadata as any
-        );
+        await this.retryUsernamePasswordAuthWithOTPAsync(username, password);
       } else {
         throw e;
       }
@@ -245,11 +228,8 @@ export default class SessionManager {
   /**
    * Prompt for an OTP with the option to cancel the question by answering empty (pressing return key).
    */
-  private async promptForOTPAsync(cancelBehavior: 'cancel' | 'menu'): Promise<string | null> {
-    const enterMessage =
-      cancelBehavior === 'cancel'
-        ? `press ${chalk.bold('Enter')} to cancel`
-        : `press ${chalk.bold('Enter')} for more options`;
+  private async promptForOTPAsync(): Promise<string | null> {
+    const enterMessage = `press ${chalk.bold('Enter')} to cancel`;
     const { otp } = await promptAsync({
       type: 'text',
       name: 'otp',
@@ -263,122 +243,14 @@ export default class SessionManager {
   }
 
   /**
-   * Prompt for user to choose a backup OTP method. If selected method is SMS, a request
-   * for a new OTP will be sent to that method. Then, prompt for the OTP, and retry the user login.
-   */
-  private async promptForBackupOTPAsync(
-    username: string,
-    password: string,
-    secondFactorDevices: SecondFactorDevice[]
-  ): Promise<string | null> {
-    const nonPrimarySecondFactorDevices = secondFactorDevices.filter(device => !device.is_primary);
-
-    if (nonPrimarySecondFactorDevices.length === 0) {
-      throw new Error(
-        'No other second-factor devices set up. Ensure you have set up and certified a backup device.'
-      );
-    }
-
-    const hasAuthenticatorSecondFactorDevice = nonPrimarySecondFactorDevices.find(
-      device => device.method === UserSecondFactorDeviceMethod.AUTHENTICATOR
-    );
-
-    const smsNonPrimarySecondFactorDevices = nonPrimarySecondFactorDevices.filter(
-      device => device.method === UserSecondFactorDeviceMethod.SMS
-    );
-
-    const authenticatorChoiceSentinel = -1;
-    const cancelChoiceSentinel = -2;
-
-    const deviceChoices = smsNonPrimarySecondFactorDevices.map((device, idx) => ({
-      title: device.sms_phone_number!,
-      value: idx,
-    }));
-
-    if (hasAuthenticatorSecondFactorDevice) {
-      deviceChoices.push({
-        title: 'Authenticator',
-        value: authenticatorChoiceSentinel,
-      });
-    }
-
-    deviceChoices.push({
-      title: 'Cancel',
-      value: cancelChoiceSentinel,
-    });
-
-    const selectedValue = await selectAsync('Select a second-factor device:', deviceChoices);
-    if (selectedValue === cancelChoiceSentinel) {
-      return null;
-    } else if (selectedValue === authenticatorChoiceSentinel) {
-      return await this.promptForOTPAsync('cancel');
-    }
-
-    const device = smsNonPrimarySecondFactorDevices[selectedValue];
-
-    // this is a logged-out endpoint
-    const apiV2Client = new ApiV2Client({ accessToken: null, sessionSecret: null });
-    await apiV2Client.postAsync('auth/send-sms-otp', {
-      body: {
-        username,
-        password,
-        secondFactorDeviceID: device.id,
-      },
-    });
-
-    return await this.promptForOTPAsync('cancel');
-  }
-
-  /**
-   * Handle the special case error indicating that a second-factor is required for
-   * authentication.
-   *
-   * There are three cases we need to handle:
-   * 1. User's primary second-factor device was SMS, OTP was automatically sent by the server to that
-   *    device already. In this case we should just prompt for the SMS OTP (or backup code), which the
-   *    user should be receiving shortly. We should give the user a way to cancel and the prompt and move
-   *    to case 3 below.
-   * 2. User's primary second-factor device is authenticator. In this case we should prompt for authenticator
-   *    OTP (or backup code) and also give the user a way to cancel and move to case 3 below.
-   * 3. User doesn't have a primary device or doesn't have access to their primary device. In this case
-   *    we should show a picker of the SMS devices that they can have an OTP code sent to, and when
-   *    the user picks one we show a prompt() for the sent OTP.
+   * Handle the special case error indicating that a second-factor is required for authentication.
    */
   private async retryUsernamePasswordAuthWithOTPAsync(
     username: string,
-    password: string,
-    metadata: {
-      secondFactorDevices?: SecondFactorDevice[];
-      smsAutomaticallySent?: boolean;
-    }
+    password: string
   ): Promise<void> {
-    const { secondFactorDevices, smsAutomaticallySent } = metadata;
-    assert(
-      secondFactorDevices !== undefined && smsAutomaticallySent !== undefined,
-      `Malformed OTP error metadata: ${metadata}`
-    );
-
-    const primaryDevice = secondFactorDevices.find(device => device.is_primary);
-    let otp: string | null = null;
-
-    if (smsAutomaticallySent) {
-      assert(primaryDevice, 'OTP should only automatically be sent when there is a primary device');
-      Log.log(
-        `One-time password was sent to the phone number ending in ${primaryDevice.sms_phone_number}.`
-      );
-      otp = await this.promptForOTPAsync('menu');
-    }
-
-    if (primaryDevice?.method === UserSecondFactorDeviceMethod.AUTHENTICATOR) {
-      Log.log('One-time password from authenticator required.');
-      otp = await this.promptForOTPAsync('menu');
-    }
-
-    // user bailed on case 1 or 2, wants to move to case 3
-    if (!otp) {
-      otp = await this.promptForBackupOTPAsync(username, password, secondFactorDevices);
-    }
-
+    Log.log('One-time password from authenticator required.');
+    const otp = await this.promptForOTPAsync();
     if (!otp) {
       throw new Error('Cancelled login');
     }

packages/eas-cli/src/user/__tests__/SessionManager-test.ts

@@ -6,9 +6,9 @@ import { ApiV2Error } from '../../ApiV2Error';
 import { AnalyticsWithOrchestration } from '../../analytics/AnalyticsManager';
 import { ApiV2Client } from '../../api';
 import Log from '../../log';
-import { promptAsync, selectAsync } from '../../prompts';
+import { promptAsync } from '../../prompts';
 import { getStateJsonPath } from '../../utils/paths';
-import SessionManager, { UserSecondFactorDeviceMethod } from '../SessionManager';
+import SessionManager from '../SessionManager';
 import { fetchSessionSecretAndUserAsync } from '../fetchSessionSecretAndUser';
 import { fetchSessionSecretAndUserFromBrowserAuthFlowAsync } from '../fetchSessionSecretAndUserFromBrowserAuthFlow';
 
@@ -275,17 +275,6 @@ describe(SessionManager, () => {
           throw new ApiV2Error({
             message: 'An OTP is required',
             code: 'ONE_TIME_PASSWORD_REQUIRED',
-            metadata: {
-              secondFactorDevices: [
-                {
-                  id: 'p0',
-                  is_primary: true,
-                  method: UserSecondFactorDeviceMethod.SMS,
-                  sms_phone_number: 'testphone',
-                },
-              ],
-              smsAutomaticallySent: true,
-            },
           });
         })
         .mockResolvedValueOnce({
@@ -298,18 +287,7 @@ describe(SessionManager, () => {
 
       expect(sessionManagerRetryUsernamePasswordAuthWithOTPAsyncSpy).toHaveBeenCalledWith(
         'hello',
-        'world',
-        {
-          secondFactorDevices: [
-            {
-              id: 'p0',
-              is_primary: true,
-              method: UserSecondFactorDeviceMethod.SMS,
-              sms_phone_number: 'testphone',
-            },
-          ],
-          smsAutomaticallySent: true,
-        }
+        'world'
       );
     });
 
@@ -383,7 +361,7 @@ describe(SessionManager, () => {
   });
 
   describe('retryUsernamePasswordAuthWithOTPAsync', () => {
-    it('shows SMS OTP prompt when SMS is primary and code was automatically sent', async () => {
+    it('shows authenticator OTP prompt', async () => {
       jest
         .mocked(promptAsync)
         .mockImplementationOnce(async () => ({ otp: 'hello' }))
@@ -393,246 +371,24 @@ describe(SessionManager, () => {
       const sessionManager = new SessionManager(analytics);
       const sessionManagerLoginAsyncSpy = jest.spyOn(sessionManager as any, 'loginAsync');
 
-      await sessionManager['retryUsernamePasswordAuthWithOTPAsync']('blah', 'blah', {
-        secondFactorDevices: [
-          {
-            id: 'p0',
-            is_primary: true,
-            method: UserSecondFactorDeviceMethod.SMS,
-            sms_phone_number: 'testphone',
-          },
-        ],
-        smsAutomaticallySent: true,
-      });
-
-      expect(Log.log).toHaveBeenCalledWith(
-        'One-time password was sent to the phone number ending in testphone.'
-      );
-
-      expect(sessionManagerLoginAsyncSpy).toHaveBeenCalledTimes(1);
-    });
-
-    it('shows authenticator OTP prompt when authenticator is primary', async () => {
-      jest
-        .mocked(promptAsync)
-        .mockImplementationOnce(async () => ({ otp: 'hello' }))
-        .mockImplementation(() => {
-          throw new Error("shouldn't happen");
-        });
-      const sessionManager = new SessionManager(analytics);
-      const sessionManagerLoginAsyncSpy = jest.spyOn(sessionManager as any, 'loginAsync');
-
-      await sessionManager['retryUsernamePasswordAuthWithOTPAsync']('blah', 'blah', {
-        secondFactorDevices: [
-          {
-            id: 'p0',
-            is_primary: true,
-            method: UserSecondFactorDeviceMethod.AUTHENTICATOR,
-            sms_phone_number: null,
-          },
-        ],
-        smsAutomaticallySent: false,
-      });
+      await sessionManager['retryUsernamePasswordAuthWithOTPAsync']('blah', 'blah');
 
       expect(Log.log).toHaveBeenCalledWith('One-time password from authenticator required.');
       expect(sessionManagerLoginAsyncSpy).toHaveBeenCalledTimes(1);
     });
 
-    it('shows menu when user bails on primary', async () => {
-      jest
-        .mocked(promptAsync)
-        .mockImplementationOnce(async () => ({ otp: null }))
-        .mockImplementationOnce(async () => ({ otp: 'hello' })) // second time it is prompted after selecting backup code
-        .mockImplementation(() => {
-          throw new Error("shouldn't happen");
-        });
-
-      jest
-        .mocked(selectAsync)
-        .mockImplementationOnce(async () => -1)
-        .mockImplementation(() => {
-          throw new Error("shouldn't happen");
-        });
-      const sessionManager = new SessionManager(analytics);
-
-      const sessionManagerLoginAsyncSpy = jest.spyOn(sessionManager as any, 'loginAsync');
-
-      await sessionManager['retryUsernamePasswordAuthWithOTPAsync']('blah', 'blah', {
-        secondFactorDevices: [
-          {
-            id: 'p0',
-            is_primary: true,
-            method: UserSecondFactorDeviceMethod.AUTHENTICATOR,
-            sms_phone_number: null,
-          },
-          {
-            id: 'p2',
-            is_primary: false,
-            method: UserSecondFactorDeviceMethod.AUTHENTICATOR,
-            sms_phone_number: null,
-          },
-        ],
-        smsAutomaticallySent: false,
-      });
-
-      expect(jest.mocked(selectAsync).mock.calls.length).toEqual(1);
-      expect(sessionManagerLoginAsyncSpy).toHaveBeenCalledTimes(1);
-    });
-
-    it('shows a warning when when user bails on primary and does not have any secondary set up', async () => {
+    it('exits when user bails', async () => {
       jest
         .mocked(promptAsync)
         .mockImplementationOnce(async () => ({ otp: null }))
         .mockImplementation(() => {
           throw new Error("shouldn't happen");
         });
+
       const sessionManager = new SessionManager(analytics);
 
       await expect(
-        sessionManager['retryUsernamePasswordAuthWithOTPAsync']('blah', 'blah', {
-          secondFactorDevices: [
-            {
-              id: 'p0',
-              is_primary: true,
-              method: UserSecondFactorDeviceMethod.AUTHENTICATOR,
-              sms_phone_number: null,
-            },
-          ],
-          smsAutomaticallySent: false,
-        })
-      ).rejects.toThrowError(
-        'No other second-factor devices set up. Ensure you have set up and certified a backup device.'
-      );
-    });
-
-    it('prompts for authenticator OTP when user selects authenticator secondary', async () => {
-      jest
-        .mocked(promptAsync)
-        .mockImplementationOnce(async () => ({ otp: null }))
-        .mockImplementationOnce(async () => ({ otp: 'hello' })) // second time it is prompted after selecting backup code
-        .mockImplementation(() => {
-          throw new Error("shouldn't happen");
-        });
-
-      jest
-        .mocked(selectAsync)
-        .mockImplementationOnce(async () => -1)
-        .mockImplementation(() => {
-          throw new Error("shouldn't happen");
-        });
-      const sessionManager = new SessionManager(analytics);
-
-      await sessionManager['retryUsernamePasswordAuthWithOTPAsync']('blah', 'blah', {
-        secondFactorDevices: [
-          {
-            id: 'p0',
-            is_primary: true,
-            method: UserSecondFactorDeviceMethod.AUTHENTICATOR,
-            sms_phone_number: null,
-          },
-          {
-            id: 'p2',
-            is_primary: false,
-            method: UserSecondFactorDeviceMethod.AUTHENTICATOR,
-            sms_phone_number: null,
-          },
-        ],
-        smsAutomaticallySent: false,
-      });
-
-      expect(jest.mocked(promptAsync).mock.calls.length).toBe(2); // first OTP, second OTP
-    });
-
-    it('requests SMS OTP and prompts for SMS OTP when user selects SMS secondary', async () => {
-      jest
-        .mocked(promptAsync)
-        .mockImplementationOnce(async () => ({ otp: null }))
-        .mockImplementationOnce(async () => ({ otp: 'hello' })) // second time it is prompted after selecting backup code
-        .mockImplementation(() => {
-          throw new Error("shouldn't happen");
-        });
-
-      jest
-        .mocked(selectAsync)
-        .mockImplementationOnce(async () => 0)
-        .mockImplementation(() => {
-          throw new Error("shouldn't happen");
-        });
-
-      jest.mocked(fetchSessionSecretAndUserAsync).mockResolvedValue({
-        sessionSecret: 'SESSION_SECRET',
-        id: 'USER_ID',
-        username: 'USERNAME',
-      });
-      const apiV2PostSpy = jest.spyOn(ApiV2Client.prototype, 'postAsync');
-
-      const sessionManager = new SessionManager(analytics);
-      await sessionManager['retryUsernamePasswordAuthWithOTPAsync']('blah', 'blah', {
-        secondFactorDevices: [
-          {
-            id: 'p0',
-            is_primary: true,
-            method: UserSecondFactorDeviceMethod.AUTHENTICATOR,
-            sms_phone_number: null,
-          },
-          {
-            id: 'p2',
-            is_primary: false,
-            method: UserSecondFactorDeviceMethod.SMS,
-            sms_phone_number: 'wat',
-          },
-        ],
-        smsAutomaticallySent: false,
-      });
-
-      expect(jest.mocked(promptAsync).mock.calls.length).toBe(2); // first OTP, second OTP
-
-      expect(apiV2PostSpy.mock.calls[0]).toEqual([
-        'auth/send-sms-otp',
-        {
-          body: {
-            username: 'blah',
-            password: 'blah',
-            secondFactorDeviceID: 'p2',
-          },
-        },
-      ]);
-    });
-
-    it('exits when user bails on primary and backup', async () => {
-      jest
-        .mocked(promptAsync)
-        .mockImplementationOnce(async () => ({ otp: null }))
-        .mockImplementation(() => {
-          throw new Error("shouldn't happen");
-        });
-
-      jest
-        .mocked(selectAsync)
-        .mockImplementationOnce(async () => -2)
-        .mockImplementation(() => {
-          throw new Error("shouldn't happen");
-        });
-      const sessionManager = new SessionManager(analytics);
-
-      await expect(
-        sessionManager['retryUsernamePasswordAuthWithOTPAsync']('blah', 'blah', {
-          secondFactorDevices: [
-            {
-              id: 'p0',
-              is_primary: true,
-              method: UserSecondFactorDeviceMethod.AUTHENTICATOR,
-              sms_phone_number: null,
-            },
-            {
-              id: 'p2',
-              is_primary: false,
-              method: UserSecondFactorDeviceMethod.AUTHENTICATOR,
-              sms_phone_number: null,
-            },
-          ],
-          smsAutomaticallySent: false,
-        })
+        sessionManager['retryUsernamePasswordAuthWithOTPAsync']('blah', 'blah')
       ).rejects.toThrowError('Cancelled login');
     });
   });

packages/local-build-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eas-cli-local-build-plugin",
-  "version": "20.1.0",
+  "version": "20.3.0",
   "description": "Tool for running EAS compatible builds on a local machine.",
   "bugs": "https://github.com/expo/eas-cli/issues",
   "license": "BUSL-1.1",
@@ -26,7 +26,7 @@
     "clean": "rimraf node_modules dist coverage \"*.tsbuildinfo\""
   },
   "dependencies": {
-    "@expo/build-tools": "20.1.0",
+    "@expo/build-tools": "20.3.0",
     "@expo/eas-build-job": "20.1.0",
     "@expo/logger": "20.0.0",
     "@expo/spawn-async": "^1.7.2",

packages/worker/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/worker",
-  "version": "20.1.0",
+  "version": "20.3.0",
   "private": true,
   "scripts": {
     "start": "yarn watch",
@@ -19,7 +19,7 @@
   },
   "dependencies": {
     "@babel/core": "7.24.7",
-    "@expo/build-tools": "20.1.0",
+    "@expo/build-tools": "20.3.0",
     "@expo/config-plugins": "55.0.7",
     "@expo/config-types": "55.0.5",
     "@expo/downloader": "20.0.0",

packages/worker/src/__unit__/config.test.ts

@@ -1,40 +0,0 @@
-describe('config', () => {
-  const originalEnvironment = process.env.ENVIRONMENT;
-  const originalWorkerRuntimeConfigBase64 = process.env.WORKER_RUNTIME_CONFIG_BASE64;
-
-  afterEach(() => {
-    restoreEnv('ENVIRONMENT', originalEnvironment);
-    restoreEnv('WORKER_RUNTIME_CONFIG_BASE64', originalWorkerRuntimeConfigBase64);
-    jest.resetModules();
-  });
-
-  it('parses cache URL fallbacks from worker runtime config', () => {
-    process.env.ENVIRONMENT = 'staging';
-    process.env.WORKER_RUNTIME_CONFIG_BASE64 = Buffer.from(
-      JSON.stringify({
-        buildId: 'build-id',
-        npmCacheUrl: 'https://npm-cache.example',
-        nodeJsCacheUrl: 'https://node-cache.example',
-        mavenCacheUrl: 'https://maven-cache.example',
-        cocoapodsCacheUrl: 'https://cocoapods-cache.example',
-      })
-    ).toString('base64');
-
-    jest.isolateModules(() => {
-      const config = require('../config').default;
-
-      expect(config.npmCacheUrl).toBe('https://npm-cache.example');
-      expect(config.nodeJsCacheUrl).toBe('https://node-cache.example');
-      expect(config.mavenCacheUrl).toBe('https://maven-cache.example');
-      expect(config.cocoapodsCacheUrl).toBe('https://cocoapods-cache.example');
-    });
-  });
-});
-
-function restoreEnv(key: string, value: string | undefined): void {
-  if (value === undefined) {
-    delete process.env[key];
-  } else {
-    process.env[key] = value;
-  }
-}

packages/worker/src/__unit__/context.test.ts

@@ -0,0 +1,87 @@
+import { RuntimeSettings } from '@expo/build-tools';
+import { Platform, Workflow } from '@expo/eas-build-job';
+
+import config from '../config';
+import { createBuildContext } from '../context';
+import { getBuildEnv } from '../env';
+import { prepareRuntimeEnvironmentConfigFiles } from '../runtimeEnvironment';
+
+jest.mock('../env', () => ({
+  getBuildEnv: jest.fn(() => ({
+    __API_SERVER_URL: 'http://api.expo.test',
+    PATH: '/usr/bin',
+  })),
+}));
+jest.mock('../runtimeEnvironment', () => ({
+  prepareRuntimeEnvironmentConfigFiles: jest.fn(async () => {}),
+}));
+
+describe(createBuildContext.name, () => {
+  const childLogger = {
+    error: jest.fn(),
+    info: jest.fn(),
+    warn: jest.fn(),
+  } as any;
+  const buildLogger = {
+    child: jest.fn(() => childLogger),
+  } as any;
+  const baseOptions = {
+    logBuffer: { getLogs: () => [], getPhaseLogs: () => [] },
+    analytics: {} as any,
+    metadata: {},
+    projectId: 'project-id',
+    buildId: 'build-id',
+    buildLogger,
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    jest.spyOn(RuntimeSettings, 'loadAsync').mockResolvedValue();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('loads runtime settings with the job environment before creating build env', async () => {
+    const env = { EAS_USE_NPM_CACHE: '1' };
+
+    await createBuildContext({
+      ...baseOptions,
+      job: {
+        platform: Platform.IOS,
+        type: Workflow.GENERIC,
+        secrets: { environmentSecrets: [] },
+        builderEnvironment: { env },
+        environment: 'preview',
+      } as any,
+    });
+
+    expect(RuntimeSettings.loadAsync).toHaveBeenCalledWith({
+      environment: config.env,
+      env,
+    });
+    expect(prepareRuntimeEnvironmentConfigFiles).toHaveBeenCalled();
+    expect(jest.mocked(RuntimeSettings.loadAsync).mock.invocationCallOrder[0]).toBeLessThan(
+      jest.mocked(getBuildEnv).mock.invocationCallOrder[0]
+    );
+  });
+
+  it('loads runtime settings without job env when the job has no builder environment', async () => {
+    await createBuildContext({
+      ...baseOptions,
+      job: {
+        platform: Platform.ANDROID,
+        type: Workflow.GENERIC,
+        secrets: { environmentSecrets: [] },
+      } as any,
+    });
+
+    expect(RuntimeSettings.loadAsync).toHaveBeenCalledWith(
+      expect.objectContaining({
+        environment: config.env,
+        env: undefined,
+      })
+    );
+  });
+});

packages/worker/src/__unit__/env.test.ts

@@ -18,6 +18,7 @@ describe(getBuildEnv.name, () => {
     NVM_NODEJS_ORG_MIRROR: process.env.NVM_NODEJS_ORG_MIRROR,
     EAS_BUILD_MAVEN_CACHE_URL: process.env.EAS_BUILD_MAVEN_CACHE_URL,
     EAS_BUILD_COCOAPODS_CACHE_URL: process.env.EAS_BUILD_COCOAPODS_CACHE_URL,
+    NPM_CONFIG_REGISTRY: process.env.NPM_CONFIG_REGISTRY,
   };
 
   beforeEach(() => {
@@ -26,6 +27,7 @@ describe(getBuildEnv.name, () => {
     delete process.env.NVM_NODEJS_ORG_MIRROR;
     delete process.env.EAS_BUILD_MAVEN_CACHE_URL;
     delete process.env.EAS_BUILD_COCOAPODS_CACHE_URL;
+    delete process.env.NPM_CONFIG_REGISTRY;
     jest.spyOn(RuntimeSettings, 'getNpmCacheUrl').mockReturnValue(null);
     jest.spyOn(RuntimeSettings, 'getNodeJsCacheUrl').mockReturnValue(null);
     jest.spyOn(RuntimeSettings, 'getMavenCacheUrl').mockReturnValue(null);
@@ -44,6 +46,7 @@ describe(getBuildEnv.name, () => {
     restoreEnv('NVM_NODEJS_ORG_MIRROR', originalCacheUrls.NVM_NODEJS_ORG_MIRROR);
     restoreEnv('EAS_BUILD_MAVEN_CACHE_URL', originalCacheUrls.EAS_BUILD_MAVEN_CACHE_URL);
     restoreEnv('EAS_BUILD_COCOAPODS_CACHE_URL', originalCacheUrls.EAS_BUILD_COCOAPODS_CACHE_URL);
+    restoreEnv('NPM_CONFIG_REGISTRY', originalCacheUrls.NPM_CONFIG_REGISTRY);
     mockProcessPlatform(originalPlatform);
     jest.restoreAllMocks();
   });
@@ -196,6 +199,7 @@ describe(getBuildEnv.name, () => {
     });
 
     expect(env.NPM_CACHE_URL).toBeUndefined();
+    expect(env.NPM_CONFIG_REGISTRY).toBeUndefined();
     expect(env.NVM_NODEJS_ORG_MIRROR).toBeUndefined();
     expect(env.EAS_BUILD_NPM_CACHE_URL).toBeUndefined();
     expect(env.EAS_BUILD_MAVEN_CACHE_URL).toBeUndefined();
@@ -228,6 +232,7 @@ describe(getBuildEnv.name, () => {
     });
 
     expect(env.NPM_CACHE_URL).toBeUndefined();
+    expect(env.NPM_CONFIG_REGISTRY).toBeUndefined();
     expect(env.NVM_NODEJS_ORG_MIRROR).toBeUndefined();
     expect(env.EAS_BUILD_NPM_CACHE_URL).toBeUndefined();
     expect(env.EAS_BUILD_COCOAPODS_CACHE_URL).toBeUndefined();
@@ -264,6 +269,7 @@ describe(getBuildEnv.name, () => {
     });
 
     expect(env.NPM_CACHE_URL).toBe('https://npm.example');
+    expect(env.NPM_CONFIG_REGISTRY).toBe('https://npm.example');
     expect(env.EAS_BUILD_NPM_CACHE_URL).toBe('https://npm.example');
     expect(env.NVM_NODEJS_ORG_MIRROR).toBe('https://node.example');
     expect(env.EAS_BUILD_MAVEN_CACHE_URL).toBe('https://maven.example');

packages/worker/src/__unit__/runtimeEnvironment.test.ts

@@ -89,7 +89,7 @@ describe('prepareRuntimeEnvironment', () => {
 
       await prepareRuntimeEnvironmentConfigFiles();
 
-      expect(spawn).toHaveBeenCalledWith('npm', [
+      expect(spawn).not.toHaveBeenCalledWith('npm', [
         'config',
         'set',
         'registry',

packages/worker/src/__unit__/service.test.ts

@@ -26,7 +26,7 @@ jest.mock('../build', () => ({
   build: jest.fn(),
 }));
 jest.mock('../context', () => ({
-  createBuildContext: jest.fn(() => ({ job: {} })),
+  createBuildContext: jest.fn(async () => ({ job: {} })),
 }));
 jest.mock('../config', () => {
   const actual = jest.requireActual('../config').default;
@@ -111,7 +111,7 @@ describe('BuildService Datadog setup', () => {
   beforeEach(() => {
     jest.clearAllMocks();
     buildMock.mockResolvedValue({});
-    createBuildContextMock.mockReturnValue({ job: {} } as any);
+    createBuildContextMock.mockResolvedValue({ job: {} } as any);
     createBuildLoggerWithSecretsFilterMock.mockResolvedValue({
       logger: buildLogger,
       cleanUp: jest.fn(async () => {}),

packages/worker/src/__unit__/upload.test.ts

@@ -1,11 +1,10 @@
 import { BuildContext, GCS } from '@expo/build-tools';
-import { Job } from '@expo/eas-build-job';
+import { Job, errors } from '@expo/eas-build-job';
 import { bunyan } from '@expo/logger';
 import { randomBytes, randomUUID } from 'crypto';
 import { vol } from 'memfs';
 import { Response } from 'node-fetch';
 
-import config from '../config';
 import {
   uploadApplicationArchiveAsync,
   uploadBuildArtifactsAsync,
@@ -59,7 +58,14 @@ describe(uploadApplicationArchiveAsync.name, () => {
         buildId: 'buildId',
         logger: ctx.logger,
       })
-    ).rejects.toThrow('env variables are not set');
+    ).rejects.toMatchObject({
+      errorCode: errors.ErrorCode.SERVER_ERROR,
+      trackingCode: 'EAS_BUILD_UPLOAD_APPLICATION_ARCHIVE_FAILED',
+      message: 'Failed to upload application archive.',
+      cause: expect.objectContaining({
+        message: expect.stringContaining('env variables are not set'),
+      }),
+    });
 
     ctx.env.__WORKFLOW_JOB_ID = randomUUID();
 
@@ -69,7 +75,14 @@ describe(uploadApplicationArchiveAsync.name, () => {
         buildId: 'buildId',
         logger: ctx.logger,
       })
-    ).rejects.toThrow('robot access token is not set');
+    ).rejects.toMatchObject({
+      errorCode: errors.ErrorCode.SERVER_ERROR,
+      trackingCode: 'EAS_BUILD_UPLOAD_APPLICATION_ARCHIVE_FAILED',
+      message: 'Failed to upload application archive.',
+      cause: expect.objectContaining({
+        message: expect.stringContaining('robot access token is not set'),
+      }),
+    });
   });
 
   it('should upload the application archive', async () => {
@@ -151,6 +164,9 @@ describe(uploadApplicationArchiveAsync.name, () => {
         headers: {
           Authorization: `Bearer ${ctx.job.secrets!.robotAccessToken}`,
         },
+        retries: 2,
+        retryIntervalMs: 1000,
+        logger: ctx.logger,
       })
     );
     expect(turtleFetchMock).toHaveBeenNthCalledWith(
@@ -162,84 +178,81 @@ describe(uploadApplicationArchiveAsync.name, () => {
         headers: {
           Authorization: `Bearer ${ctx.job.secrets!.robotAccessToken}`,
         },
+        retries: 2,
+        retryIntervalMs: 1000,
+        logger: ctx.logger,
       })
     );
   });
 
-  describe('with signed upload url provided via config', () => {
-    beforeAll(() => {
-      config.gcsSignedUploadUrlForApplicationArchive = {
-        url: 'https://upload.url/from-config',
-        headers: {
-          authorization: 'test-signed-upload-authorization',
-        },
-      };
-    });
-    afterAll(() => {
-      config.gcsSignedUploadUrlForApplicationArchive = null;
+  it('should throw a system error if the application archive upload fails', async () => {
+    vol.fromJSON({
+      './artifact.ipa': JSON.stringify(randomBytes(20)),
     });
+    const workflowJobId = randomUUID();
 
-    it('should fall back to signed upload URL if upload session fails', async () => {
-      vol.fromJSON({
-        './artifact.ipa': JSON.stringify(randomBytes(20)),
-      });
-      const workflowJobId = randomUUID();
-
-      // @ts-expect-error
-      const ctx: BuildContext<Job> = {
-        env: {
-          __WORKFLOW_JOB_ID: workflowJobId,
+    // @ts-expect-error
+    const ctx: BuildContext<Job> = {
+      env: {
+        __WORKFLOW_JOB_ID: workflowJobId,
+      },
+      job: {
+        secrets: {
+          robotAccessToken: 'fake-token',
         },
-        job: {
-          secrets: {
-            robotAccessToken: 'fake-token',
-          },
-        } as Job,
-        logger: mockLogger,
-      };
+      } as Job,
+      logger: mockLogger,
+    };
 
-      turtleFetchMock.mockImplementation(async () => {
-        return {
-          json: async () => ({
-            data: {
-              bucketKey: 'test/bucketKey',
-              url: 'https://upload.url/from-www',
-              headers: {
-                authorization: 'test-signed-upload-authorization',
-              },
-              storageType: 'GCS',
+    const bucketKey = `test/${randomUUID()}/artifact.ipa`;
+    const uploadUrl = `https://upload.url/${randomUUID()}`;
+    const testSignedUploadAuthorization = randomUUID();
+    const uploadError = new Error('upload failed');
+
+    turtleFetchMock.mockImplementation(async () => {
+      return {
+        ok: true,
+        status: 200,
+        json: async () => ({
+          data: {
+            bucketKey,
+            url: uploadUrl,
+            headers: {
+              authorization: testSignedUploadAuthorization,
             },
-          }),
-          ok: true,
-        } as unknown as Response;
-      });
-
-      // GCS fails to upload to upload session from www.
-      jest.mocked(GCS.uploadWithSignedUrl).mockImplementation(async ({ signedUrl }) => {
-        if (signedUrl.url === 'https://upload.url/from-www') {
-          throw new Error('upload failed');
-        }
-        return signedUrl.url;
-      });
+            storageType: 'GCS',
+          },
+        }),
+      } as Response;
+    });
+    jest.mocked(GCS.uploadWithSignedUrl).mockRejectedValueOnce(uploadError);
 
+    let thrownError: unknown;
+    try {
       await uploadApplicationArchiveAsync(ctx, {
         artifactPaths: ['./artifact.ipa'],
         buildId: randomUUID(),
         logger: ctx.logger,
       });
+    } catch (err) {
+      thrownError = err;
+    }
 
-      expect(GCS.uploadWithSignedUrl).toHaveBeenCalledWith(
-        expect.objectContaining({
-          signedUrl: {
-            url: 'https://upload.url/from-config',
-            headers: {
-              authorization: 'test-signed-upload-authorization',
-            },
-          },
-        })
-      );
-
-      expect(turtleFetchMock).toHaveBeenCalledTimes(1);
+    expect(thrownError).toBeInstanceOf(errors.SystemError);
+    expect(thrownError).toMatchObject({
+      errorCode: errors.ErrorCode.SERVER_ERROR,
+      trackingCode: 'EAS_BUILD_UPLOAD_APPLICATION_ARCHIVE_FAILED',
+      message: 'Failed to upload application archive.',
+      buildPhase: undefined,
+      metadata: expect.objectContaining({
+        filename: expect.stringMatching(/^application-.*\.ipa$/),
+        size: expect.any(Number),
+        url: uploadUrl,
+        headers: {
+          authorization: testSignedUploadAuthorization,
+        },
+      }),
+      cause: uploadError,
     });
   });
 });
@@ -263,7 +276,14 @@ describe(uploadBuildArtifactsAsync.name, () => {
         buildId: 'buildId',
         logger: ctx.logger,
       })
-    ).rejects.toThrow('env variables are not set');
+    ).rejects.toMatchObject({
+      errorCode: errors.ErrorCode.SERVER_ERROR,
+      trackingCode: 'EAS_BUILD_UPLOAD_BUILD_ARTIFACTS_FAILED',
+      message: 'Failed to upload build artifacts.',
+      cause: expect.objectContaining({
+        message: expect.stringContaining('env variables are not set'),
+      }),
+    });
     ctx.env.__WORKFLOW_JOB_ID = randomUUID();
     await expect(
       uploadBuildArtifactsAsync(ctx, {
@@ -271,7 +291,14 @@ describe(uploadBuildArtifactsAsync.name, () => {
         buildId: 'buildId',
         logger: ctx.logger,
       })
-    ).rejects.toThrow('robot access token is not set');
+    ).rejects.toMatchObject({
+      errorCode: errors.ErrorCode.SERVER_ERROR,
+      trackingCode: 'EAS_BUILD_UPLOAD_BUILD_ARTIFACTS_FAILED',
+      message: 'Failed to upload build artifacts.',
+      cause: expect.objectContaining({
+        message: expect.stringContaining('robot access token is not set'),
+      }),
+    });
   });
 
   it('should upload the build artifacts', async () => {
@@ -348,6 +375,9 @@ describe(uploadBuildArtifactsAsync.name, () => {
         headers: {
           Authorization: `Bearer ${ctx.job.secrets!.robotAccessToken}`,
         },
+        retries: 2,
+        retryIntervalMs: 1000,
+        logger: ctx.logger,
       })
     );
     expect(turtleFetchMock).toHaveBeenNthCalledWith(
@@ -359,96 +389,83 @@ describe(uploadBuildArtifactsAsync.name, () => {
         headers: {
           Authorization: `Bearer ${ctx.job.secrets!.robotAccessToken}`,
         },
+        retries: 2,
+        retryIntervalMs: 1000,
+        logger: ctx.logger,
       })
     );
   });
 
-  describe('with signed upload url provided via config', () => {
-    beforeAll(() => {
-      config.gcsSignedUploadUrlForBuildArtifacts = {
-        url: 'https://upload.url/from-config',
-        headers: {
-          authorization: 'test-signed-upload-authorization',
-        },
-      };
+  it('should throw a system error if the build artifacts upload fails', async () => {
+    vol.fromJSON({
+      './video.mp4': JSON.stringify(randomBytes(20)),
     });
-    afterAll(() => {
-      config.gcsSignedUploadUrlForBuildArtifacts = null;
-    });
-
-    it('should fall back to signed upload URL if upload session fails', async () => {
-      vol.fromJSON({
-        './video.mp4': JSON.stringify(randomBytes(20)),
-      });
-      const workflowJobId = randomUUID();
-
-      // @ts-expect-error
-      const ctx: BuildContext<Job> = {
-        env: {
-          __WORKFLOW_JOB_ID: workflowJobId,
+    const workflowJobId = randomUUID();
+    // @ts-expect-error
+    const ctx: BuildContext<Job> = {
+      env: {
+        __WORKFLOW_JOB_ID: workflowJobId,
+      },
+      job: {
+        secrets: {
+          robotAccessToken: 'fake-token',
         },
-        job: {
-          secrets: {
-            robotAccessToken: 'fake-token',
-          },
-        } as Job,
-        logger: mockLogger,
-      };
-
-      turtleFetchMock.mockImplementation(async () => {
-        return {
-          json: async () => ({
-            data: {
-              bucketKey: 'test/bucketKey',
-              url: 'https://upload.url/from-www',
-              headers: {
-                authorization: 'test-signed-upload-authorization',
-              },
-              storageType: 'GCS',
+      } as Job,
+      logger: mockLogger,
+    };
+    const bucketKey = `test/${randomUUID()}/artifact.ipa`;
+    const uploadUrl = `https://upload.url/${randomUUID()}`;
+    const testSignedUploadAuthorization = randomUUID();
+    const uploadError = new Error('upload failed');
+    turtleFetchMock.mockImplementation(async () => {
+      return {
+        ok: true,
+        status: 200,
+        json: async () => ({
+          data: {
+            bucketKey,
+            url: uploadUrl,
+            headers: {
+              authorization: testSignedUploadAuthorization,
             },
-          }),
-          ok: true,
-        } as unknown as Response;
-      });
-
-      // GCS fails to upload to upload session from www.
-      jest.mocked(GCS.uploadWithSignedUrl).mockImplementation(async ({ signedUrl }) => {
-        if (signedUrl.url === 'https://upload.url/from-www') {
-          throw new Error('upload failed');
-        }
-        return signedUrl.url;
-      });
+            storageType: 'GCS',
+          },
+        }),
+      } as Response;
+    });
+    jest.mocked(GCS.uploadWithSignedUrl).mockRejectedValueOnce(uploadError);
 
+    let thrownError: unknown;
+    try {
       await uploadBuildArtifactsAsync(ctx, {
         artifactPaths: ['./video.mp4'],
         buildId: randomUUID(),
         logger: ctx.logger,
       });
+    } catch (err) {
+      thrownError = err;
+    }
 
-      expect(GCS.uploadWithSignedUrl).toHaveBeenCalledWith(
-        expect.objectContaining({
-          signedUrl: {
-            url: 'https://upload.url/from-config',
-            headers: {
-              authorization: 'test-signed-upload-authorization',
-            },
-          },
-        })
-      );
-
-      expect(turtleFetchMock).toHaveBeenCalledTimes(1);
+    expect(thrownError).toBeInstanceOf(errors.SystemError);
+    expect(thrownError).toMatchObject({
+      errorCode: errors.ErrorCode.SERVER_ERROR,
+      trackingCode: 'EAS_BUILD_UPLOAD_BUILD_ARTIFACTS_FAILED',
+      message: 'Failed to upload build artifacts.',
+      buildPhase: undefined,
+      metadata: expect.objectContaining({
+        filename: expect.stringMatching(/^artifacts-.*\.mp4$/),
+        size: expect.any(Number),
+        url: uploadUrl,
+        headers: {
+          authorization: testSignedUploadAuthorization,
+        },
+      }),
+      cause: uploadError,
     });
   });
 });
 
 describe('with signed upload url provided via www', () => {
-  beforeAll(() => {
-    config.gcsSignedUploadUrlForBuildArtifacts = null;
-  });
-  afterAll(() => {
-    config.gcsSignedUploadUrlForBuildArtifacts = null;
-  });
-
   it('should use www signed upload url', async () => {
     vol.fromJSON({
       './video.mp4': JSON.stringify(randomBytes(20)),
@@ -533,6 +550,9 @@ describe('with signed upload url provided via www', () => {
         headers: {
           Authorization: `Bearer ${ctx.job.secrets!.robotAccessToken}`,
         },
+        retries: 2,
+        retryIntervalMs: 1000,
+        logger: ctx.logger,
       })
     );
     expect(turtleFetchMock).toHaveBeenNthCalledWith(
@@ -544,6 +564,9 @@ describe('with signed upload url provided via www', () => {
         headers: {
           Authorization: `Bearer ${ctx.job.secrets!.robotAccessToken}`,
         },
+        retries: 2,
+        retryIntervalMs: 1000,
+        logger: ctx.logger,
       })
     );
   });
@@ -622,6 +645,9 @@ describe(uploadWorkflowArtifactAsync.name, () => {
         headers: {
           Authorization: `Bearer ${ctx.job.secrets!.robotAccessToken}`,
         },
+        retries: 2,
+        retryIntervalMs: 1000,
+        logger: ctx.logger,
       })
     );
   });

packages/worker/src/config.ts

@@ -63,17 +63,6 @@ export default {
       defaultValue: null,
     }),
   },
-  gcsSignedUploadUrlForApplicationArchive: env<GCS.SignedUrl | null>(
-    'WORKER_RUNTIME_CONFIG_BASE64',
-    {
-      transform: createBase64EnvTransformer('gcsSignedUploadUrlForApplicationArchive'),
-      defaultValue: null,
-    }
-  ),
-  gcsSignedUploadUrlForBuildArtifacts: env<GCS.SignedUrl | null>('WORKER_RUNTIME_CONFIG_BASE64', {
-    transform: createBase64EnvTransformer('gcsSignedUploadUrlForBuildArtifacts'),
-    defaultValue: null,
-  }),
   workingdir: env('WORKINGDIR', { defaultValue: path.join(__dirname, '../workingdir') }),
   sentry: {
     dsn: env('SENTRY_DSN', { defaultValue: '' }),
@@ -82,22 +71,6 @@ export default {
     dataPlaneURL: env<string | null>('RUDDERSTACK_DATA_PLANE_URL', { defaultValue: null }),
     writeKey: env<string | null>('RUDDERSTACK_WRITE_KEY', { defaultValue: null }),
   },
-  npmCacheUrl: env<string | null>('WORKER_RUNTIME_CONFIG_BASE64', {
-    transform: createBase64EnvTransformer('npmCacheUrl'),
-    defaultValue: null,
-  }),
-  nodeJsCacheUrl: env<string | null>('WORKER_RUNTIME_CONFIG_BASE64', {
-    transform: createBase64EnvTransformer('nodeJsCacheUrl'),
-    defaultValue: null,
-  }),
-  mavenCacheUrl: env<string | null>('WORKER_RUNTIME_CONFIG_BASE64', {
-    transform: createBase64EnvTransformer('mavenCacheUrl'),
-    defaultValue: null,
-  }),
-  cocoapodsCacheUrl: env<string | null>('WORKER_RUNTIME_CONFIG_BASE64', {
-    transform: createBase64EnvTransformer('cocoapodsCacheUrl'),
-    defaultValue: null,
-  }),
   runMetricsServer: env<boolean | null>('WORKER_RUNTIME_CONFIG_BASE64', {
     transform: createBase64EnvTransformer('runMetricsServer'),
     defaultValue: null,

packages/worker/src/context.ts

@@ -1,4 +1,4 @@
-import { BuildContext, BuildContextOptions, LogBuffer } from '@expo/build-tools';
+import { BuildContext, BuildContextOptions, LogBuffer, RuntimeSettings } from '@expo/build-tools';
 import { Job, ManagedArtifactType, Metadata, Platform } from '@expo/eas-build-job';
 import { bunyan } from '@expo/logger';
 import assert from 'assert';
@@ -8,6 +8,7 @@ import config from './config';
 import { getBuildEnv } from './env';
 import { Analytics } from './external/analytics';
 import { uploadXcodeBuildLogs } from './ios/xcodeLogs';
+import { prepareRuntimeEnvironmentConfigFiles } from './runtimeEnvironment';
 import sentry from './sentry';
 import {
   uploadApplicationArchiveAsync,
@@ -16,7 +17,7 @@ import {
   uploadWorkflowArtifactAsync,
 } from './upload';
 
-export function createBuildContext<TJob extends Job>({
+export async function createBuildContext<TJob extends Job>({
   job,
   logBuffer,
   analytics,
@@ -32,9 +33,14 @@ export function createBuildContext<TJob extends Job>({
   projectId: string;
   buildId: string;
   buildLogger: bunyan;
-}): BuildContext<TJob> {
-  const env = getBuildEnv({ job, projectId, metadata, buildId });
+}): Promise<BuildContext<TJob>> {
   const childLogger = buildLogger.child({ buildId });
+  await RuntimeSettings.loadAsync({
+    environment: config.env,
+    env: job.builderEnvironment?.env,
+  });
+  await prepareRuntimeEnvironmentConfigFiles();
+  const env = getBuildEnv({ job, projectId, metadata, buildId });
 
   const uploadArtifact: BuildContextOptions['uploadArtifact'] = async ({ artifact, logger }) => {
     const { paths, type } = artifact;

packages/worker/src/env.ts

@@ -42,6 +42,7 @@ export function getBuildEnv({
   const cocoapodsCacheUrl = RuntimeSettings.getCocoapodsCacheUrl();
 
   setEnv(env, 'NPM_CACHE_URL', npmCacheUrl);
+  setEnv(env, 'NPM_CONFIG_REGISTRY', npmCacheUrl);
   setEnv(env, 'NVM_NODEJS_ORG_MIRROR', nodeJsCacheUrl);
   setEnv(env, 'EAS_BUILD_NPM_CACHE_URL', npmCacheUrl);
   setEnv(env, 'EAS_BUILD_PROFILE', metadata.buildProfile);

packages/worker/src/external/turtle.ts

@@ -24,10 +24,6 @@ export namespace Worker {
   type JobRunWorkerRuntimeConfig = {
     gcsSignedUploadUrlForLogs: GCS.SignedUrl;
 
-    nodeJsCacheUrl: string | undefined;
-    npmCacheUrl: string | undefined;
-    mavenCacheUrl: string | undefined;
-    cocoapodsCacheUrl: string | undefined;
     runMetricsServer: boolean;
 
     type: 'jobRun';
@@ -35,17 +31,11 @@ export namespace Worker {
   };
 
   type BuildWorkerRuntimeConfig = {
-    gcsSignedUploadUrlForApplicationArchive: GCS.SignedUrl | null;
-    gcsSignedUploadUrlForBuildArtifacts: GCS.SignedUrl | null;
     gcsSignedUploadUrlForLogs: GCS.SignedUrl;
     gcsSignedUploadUrlForXcodeBuildLogs?: GCS.SignedUrl;
     gcsSignedUploadUrlForBuildCache?: GCS.SignedUrl;
     gcsSignedBuildCacheDownloadUrl?: string;
 
-    nodeJsCacheUrl: string | undefined;
-    npmCacheUrl: string | undefined;
-    mavenCacheUrl: string | undefined;
-    cocoapodsCacheUrl: string | undefined;
     runMetricsServer: boolean;
 
     type?: never;

packages/worker/src/main.ts

@@ -1,25 +1,11 @@
-import { RuntimeSettings } from '@expo/build-tools';
-
 import config from './config';
 import logger from './logger';
 import { startServer } from './metricsServer';
-import { prepareRuntimeEnvironmentConfigFiles } from './runtimeEnvironment';
 import sentry from './sentry';
 import { prepareWorkingdir } from './workingdir';
 import startWsServer from './ws';
 
 async function main(): Promise<void> {
-  await RuntimeSettings.loadAsync({
-    environment: config.env,
-    logger,
-    cacheUrlFallbacks: {
-      npm: config.npmCacheUrl,
-      nodejs: config.nodeJsCacheUrl,
-      maven: config.mavenCacheUrl,
-      cocoapods: config.cocoapodsCacheUrl,
-    },
-  });
-  await prepareRuntimeEnvironmentConfigFiles();
   await prepareWorkingdir();
   startWsServer();
   if (config.runMetricsServer) {

packages/worker/src/runtimeEnvironment.ts

@@ -27,8 +27,6 @@ export async function prepareRuntimeEnvironmentConfigFiles(): Promise<void> {
   const mavenCacheUrl = RuntimeSettings.getMavenCacheUrl();
 
   if (npmCacheUrl) {
-    // create ~/.npmrc
-    await spawn('npm', ['config', 'set', 'registry', npmCacheUrl]);
     // create ~/.yarnrc.yml
     await templateFile(
       path.join(__dirname, '../src/templates/yarnrc.yml'),

packages/worker/src/service.ts

@@ -292,7 +292,7 @@ export default class BuildService {
         });
       }
 
-      const ctx = createBuildContext({
+      const ctx = await createBuildContext({
         job,
         logBuffer,
         analytics,

packages/worker/src/upload.ts

@@ -1,5 +1,5 @@
 import { BuildContext, GCS } from '@expo/build-tools';
-import { ArchiveSourceType } from '@expo/eas-build-job';
+import { ArchiveSourceType, errors } from '@expo/eas-build-job';
 import { bunyan } from '@expo/logger';
 import { asyncResult } from '@expo/results';
 import fs from 'fs-extra';
@@ -13,6 +13,9 @@ import { Analytics, Event } from './external/analytics';
 import sentry from './sentry';
 import { TurtleFetchError, turtleFetch } from './utils/turtleFetch';
 
+const UPLOAD_API_REQUEST_RETRIES = 2;
+const UPLOAD_API_REQUEST_RETRY_INTERVAL_MS = 1000;
+
 class ErrorWithMetadata extends Error {
   constructor(
     message: string,
@@ -65,39 +68,19 @@ export async function uploadApplicationArchiveAsync(
     return { filename: null };
   } catch (err: any) {
     // Otherwise, we log the error and proceed to upload to Launcher's upload URL.
-    const msg = 'Upload to upload session failed';
-    logger.error({ err, filename, size }, msg);
-    sentry.capture(msg, err, {
-      extras: {
+    logger.error({ err, filename, size }, 'Upload to upload session failed');
+
+    throw new errors.SystemError('Failed to upload application archive.', {
+      trackingCode: 'EAS_BUILD_UPLOAD_APPLICATION_ARCHIVE_FAILED',
+      metadata: {
         filename,
         size,
         ...uploadSession,
         ...(err instanceof ErrorWithMetadata ? err.metadata : {}),
       },
-    });
-
-    // Lack of `gcsSignedUploadUrlForApplicationArchive` means we're being run by workflow-orchestration.
-    if (!config.gcsSignedUploadUrlForApplicationArchive) {
-      throw new Error(`Failed to upload application archive: ${err?.message}\n${err?.stack}`, {
-        cause: err,
-      });
-    }
-  }
-
-  try {
-    await GCS.uploadWithSignedUrl({
-      signedUrl: config.gcsSignedUploadUrlForApplicationArchive,
-      srcGeneratorAsync: async () => {
-        return fs.createReadStream(localPath);
-      },
-    });
-  } catch (err: any) {
-    throw new Error(`Failed to upload application archive: ${err?.message}\n${err?.stack}`, {
       cause: err,
     });
   }
-
-  return { filename };
 }
 
 export async function uploadBuildArtifactsAsync(
@@ -140,39 +123,18 @@ export async function uploadBuildArtifactsAsync(
     // The saved artifact has the right filename, we don't need Launcher to rename or store it.
     return { filename: null };
   } catch (err: any) {
-    // Lack of `gcsSignedUploadUrlForBuildArtifacts` means we're being run by workflow-orchestration.
-    if (!config.gcsSignedUploadUrlForBuildArtifacts) {
-      throw new Error(`Failed to upload build artifact: ${err?.message}\n${err?.stack}`, {
-        cause: err,
-      });
-    }
+    logger.error({ err, filename, size }, 'Upload to upload session failed');
 
-    // Otherwise, we log the error and proceed to upload to Launcher's upload URL.
-    const msg = 'Upload to upload session failed';
-    logger.error({ err, filename, size }, msg);
-    sentry.capture(msg, err, {
-      extras: {
+    throw new errors.SystemError('Failed to upload build artifacts.', {
+      trackingCode: 'EAS_BUILD_UPLOAD_BUILD_ARTIFACTS_FAILED',
+      metadata: {
         filename,
         size,
         ...uploadSession,
       },
-    });
-  }
-
-  try {
-    await GCS.uploadWithSignedUrl({
-      signedUrl: config.gcsSignedUploadUrlForBuildArtifacts,
-      srcGeneratorAsync: async () => {
-        return fs.createReadStream(localPath);
-      },
-    });
-  } catch (err: any) {
-    throw new Error(`Failed to upload build artifact: ${err?.message}\n${err?.stack}`, {
       cause: err,
     });
   }
-
-  return { filename };
 }
 
 export async function uploadWorkflowArtifactAsync(
@@ -308,6 +270,9 @@ async function createUploadSessionAsync(
             Authorization: `Bearer ${robotAccessToken}`,
           },
           shouldThrowOnNotOk: false,
+          retries: UPLOAD_API_REQUEST_RETRIES,
+          retryIntervalMs: UPLOAD_API_REQUEST_RETRY_INTERVAL_MS,
+          logger: ctx.logger,
         }
       )
     );
@@ -322,6 +287,9 @@ async function createUploadSessionAsync(
             Authorization: `Bearer ${robotAccessToken}`,
           },
           shouldThrowOnNotOk: false,
+          retries: UPLOAD_API_REQUEST_RETRIES,
+          retryIntervalMs: UPLOAD_API_REQUEST_RETRY_INTERVAL_MS,
+          logger: ctx.logger,
         }
       )
     );
@@ -429,6 +397,9 @@ async function saveArtifactAsync(
           headers: {
             Authorization: `Bearer ${robotAccessToken}`,
           },
+          retries: UPLOAD_API_REQUEST_RETRIES,
+          retryIntervalMs: UPLOAD_API_REQUEST_RETRY_INTERVAL_MS,
+          logger: ctx.logger,
         }
       )
     );
@@ -442,6 +413,9 @@ async function saveArtifactAsync(
           headers: {
             Authorization: `Bearer ${robotAccessToken}`,
           },
+          retries: UPLOAD_API_REQUEST_RETRIES,
+          retryIntervalMs: UPLOAD_API_REQUEST_RETRY_INTERVAL_MS,
+          logger: ctx.logger,
         }
       )
     );

yarn.lock

@@ -2856,7 +2856,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@expo/build-tools@npm:20.1.0, @expo/build-tools@workspace:packages/build-tools":
+"@expo/build-tools@npm:20.3.0, @expo/build-tools@workspace:packages/build-tools":
   version: 0.0.0-use.local
   resolution: "@expo/build-tools@workspace:packages/build-tools"
   dependencies:
@@ -3558,7 +3558,7 @@ __metadata:
   resolution: "@expo/worker@workspace:packages/worker"
   dependencies:
     "@babel/core": "npm:7.24.7"
-    "@expo/build-tools": "npm:20.1.0"
+    "@expo/build-tools": "npm:20.3.0"
     "@expo/config-plugins": "npm:55.0.7"
     "@expo/config-types": "npm:55.0.5"
     "@expo/downloader": "npm:20.0.0"
@@ -11100,7 +11100,7 @@ __metadata:
   version: 0.0.0-use.local
   resolution: "eas-cli-local-build-plugin@workspace:packages/local-build-plugin"
   dependencies:
-    "@expo/build-tools": "npm:20.1.0"
+    "@expo/build-tools": "npm:20.3.0"
     "@expo/eas-build-job": "npm:20.1.0"
     "@expo/logger": "npm:20.0.0"
     "@expo/spawn-async": "npm:^1.7.2"