address comments

Signed-off-by: Ash Wu <[email protected]>

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  # Keep SHA-pinned GitHub Actions fresh. Without this, pins never receive
+  # upstream security patches because tag movements no longer reach us.
+  - package-ecosystem: github-actions
+    directories:
+      - /
+      - /.github/actions/setup-mise
+      - /.github/internal-actions/setup-gcloud
+      - /.github/internal-actions/notify-slack-on-fail-or-recover
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - '*'

.github/internal-actions/notify-slack-on-fail-or-recover/action.yml

@@ -12,7 +12,7 @@ runs:
   using: 'composite'
   steps:
     - name: Get previous workflow run status
-      uses: actions/github-script@v6
+      uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
       id: run-status
       with:
         script: |
@@ -28,7 +28,7 @@ runs:
 
     - name: Send Slack Success Notification
       if: fromJSON(steps.run-status.outputs.result).previous == 'failure' && fromJSON(steps.run-status.outputs.result).current == 'success'
-      uses: rtCamp/action-slack-notify@v2
+      uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2
       env:
         SLACK_CHANNEL: ${{ inputs.channel }}
         SLACK_COLOR: good
@@ -41,7 +41,7 @@ runs:
 
     - name: Send Slack Failure Notification
       if: fromJSON(steps.run-status.outputs.result).current == 'failure'
-      uses: rtCamp/action-slack-notify@v2
+      uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2
       env:
         SLACK_CHANNEL: ${{ inputs.channel }}
         SLACK_COLOR: danger

.github/internal-actions/setup-gcloud/action.yml

@@ -4,7 +4,7 @@ runs:
   using: "composite"
   steps:
     - name: Auth gcloud
-      uses: google-github-actions/auth@v2
+      uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2
       with:
         workload_identity_provider: 'projects/321830142373/locations/global/workloadIdentityPools/github/providers/expo'
         project_id: exponentjs

.github/workflows/changelog.yml

@@ -18,7 +18,7 @@ jobs:
     name: Check CHANGELOG.md updated
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
       - name: Check if CHANGELOG.md was updated
         id: changelog-updated
         uses: tj-actions/changed-files@b1ba699b304f2083b602164e06a89b868c84f076
@@ -26,11 +26,11 @@ jobs:
           files: CHANGELOG.md
       - name: Fail if CHANGELOG.md was not updated and the "no changelog" label is absent
         if: steps.changelog-updated.outputs.any_changed == 'false' && !contains(github.event.pull_request.labels.*.name, 'no changelog')
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
         with:
           script: |
             core.setFailed('Please add a changelog entry!')
-      - uses: mshick/[email protected]
+      - uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
         if: always()
         with:
           message-id: changelog-entry-check

.github/workflows/codemention.yml

@@ -1,5 +1,8 @@
 name: codemention
 on:
+  # pull_request_target is required so fork PRs get a write token to post the
+  # mention comment. Safe because there is no checkout — the action only reads
+  # PR metadata via the GitHub API; no fork code is fetched or executed.
   pull_request_target:
     types: [opened, synchronize, ready_for_review]
 jobs:
@@ -9,6 +12,9 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: tobyhs/[email protected]
+      # Pinned to a commit SHA (not the v1.4.0 tag) because this runs under
+      # pull_request_target with a write-scoped token — a re-pointed tag from
+      # a compromised upstream account would give the attacker repo write access.
+      - uses: tobyhs/codemention@bb6bfb2c3ff1e6fee7ee37006bbee6d114057225 # v1.4.0
         with:
           githubToken: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/issue-triage.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-20.04
     if: "${{ contains(github.event.label.name, 'incomplete issue: missing or invalid repro') }}"
     steps:
-      - uses: actions/github-script@v3
+      - uses: actions/github-script@ffc2c79a5b2490bd33e0a41c1de74b877714d736 # v3
         with:
           github-token: ${{ secrets.EXPO_BOT_GITHUB_TOKEN }}
           script: |
@@ -52,7 +52,7 @@ jobs:
     runs-on: ubuntu-20.04
     if: "${{ contains(github.event.label.name, 'incomplete issue: missing info') }}"
     steps:
-      - uses: actions/github-script@v3
+      - uses: actions/github-script@ffc2c79a5b2490bd33e0a41c1de74b877714d736 # v3
         with:
           github-token: ${{ secrets.EXPO_BOT_GITHUB_TOKEN }}
           script: |
@@ -81,7 +81,7 @@ jobs:
     runs-on: ubuntu-20.04
     if: github.event.label.name == 'issue accepted'
     steps:
-      - uses: actions/github-script@v3
+      - uses: actions/github-script@ffc2c79a5b2490bd33e0a41c1de74b877714d736 # v3
         with:
           github-token: ${{ secrets.EXPO_BOT_GITHUB_TOKEN }}
           script: |
@@ -98,7 +98,7 @@ jobs:
     runs-on: ubuntu-20.04
     if: "${{ contains(github.event.label.name, 'invalid issue: question') }}"
     steps:
-      - uses: actions/github-script@v3
+      - uses: actions/github-script@ffc2c79a5b2490bd33e0a41c1de74b877714d736 # v3
         with:
           github-token: ${{ secrets.EXPO_BOT_GITHUB_TOKEN }}
           script: |
@@ -126,7 +126,7 @@ jobs:
     runs-on: ubuntu-20.04
     if: "${{ contains(github.event.label.name, 'invalid issue: feature request') }}"
     steps:
-      - uses: actions/github-script@v3
+      - uses: actions/github-script@ffc2c79a5b2490bd33e0a41c1de74b877714d736 # v3
         with:
           github-token: ${{ secrets.EXPO_BOT_GITHUB_TOKEN }}
           script: |

.github/workflows/move-eas-build-tag.yml

@@ -29,7 +29,7 @@ jobs:
       INPUT_DRY_RUN: ${{ github.event.inputs.dry_run }}
       INPUT_STAGING_ONLY: ${{ github.event.inputs.staging_only }}
     steps:
-      - uses: actions/setup-node@v2
+      - uses: actions/setup-node@7c12f8017d5436eb855f1ed4399f037a36fbd9e8 # v2
         with:
           registry-url: "https://registry.npmjs.org/"
           scope: "expo"

.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
       upload_url: ${{ steps.create_release.outputs.upload_url }}
     steps:
       - id: create_release
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -29,7 +29,7 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - uses: ./.github/actions/setup-mise
       - name: Install dependencies
         run: yarn install --immutable
@@ -58,7 +58,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           token: ${{ secrets.EXPO_BOT_PAT }}
       - uses: ./.github/actions/setup-mise
@@ -91,7 +91,7 @@ jobs:
           cat /tmp/changelog.slack.md >> $GITHUB_ENV
           echo 'EOF' >> $GITHUB_ENV
       - name: Slack Notification
-        uses: rtCamp/action-slack-notify@v2
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2
         env:
           SLACK_CHANNEL: eas-cli
           SLACK_COLOR: ${{ job.status }}

.github/workflows/stale-issues.yml

@@ -8,7 +8,7 @@ jobs:
   close-issues:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v4
+      - uses: actions/stale@a20b814fb01b71def3bd6f56e7494d667ddf28da # v4
         with:
           ascending: false
           operations-per-run: 300

.github/workflows/test-graphql.yml

@@ -17,7 +17,7 @@ jobs:
     name: Ensure GraphQL schema and generated code is up-to-date
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
       - name: Setup tools
         uses: ./.github/actions/setup-mise
       - run: yarn install --immutable

.github/workflows/test-scripts.yml

@@ -21,7 +21,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
       - name: Setup tools
         uses: ./.github/actions/setup-mise
       - run: yarn install --immutable

.github/workflows/test.yml

@@ -21,7 +21,7 @@ jobs:
             coverage: true
     name: Test with Node ${{ matrix.node }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
       - name: Setup tools
         uses: ./.github/actions/setup-mise
         env:
@@ -66,7 +66,7 @@ jobs:
         working-directory: ./scripts
         env:
           YARN_ENABLE_HARDENED_MODE: ${{ matrix.coverage == true && '1' || '0' }}
-      - uses: codecov/codecov-action@v1
+      - uses: codecov/codecov-action@29386c70ef20e286228c72b668a06fd0e8399192 # v1
         if: ${{ matrix.coverage }}
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -79,7 +79,7 @@ jobs:
     name: Notify Slack
     if: ${{ github.ref == 'refs/heads/main' && always() }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
       - name: Notify Slack
         uses: ./.github/internal-actions/notify-slack-on-fail-or-recover
         with:

.github/workflows/trigger-release.yml

@@ -22,7 +22,7 @@ jobs:
       INPUT_VERSION: ${{ github.event.inputs.version }}
       INPUT_DRY_RUN: ${{ github.event.inputs.dry_run }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: main
           fetch-depth: 0

.yarnrc.yml

@@ -1,2 +1,9 @@
 defaultSemverRangePrefix: ''
 nodeLinker: node-modules
+
+npmMinimalAgeGate: 2d
+
+npmPreapprovedPackages:
+  - '@expo/*'
+  - 'eslint-plugin-universe'
+  - 'oxlint-config-universe'

CHANGELOG.md

@@ -8,10 +8,168 @@ This is the log of notable changes to EAS CLI and related packages.
 
 ### 🎉 New features
 
+- [build-tools] Auto-upload embedded bundle after build when `EAS_UPDATE_EXPERIMENTAL_UPLOAD_EMBEDDED_BUNDLE` is set. ([#3767](https://github.com/expo/eas-cli/pull/3767) by [@gwdp](https://github.com/gwdp))
+
 ### 🐛 Bug fixes
 
 ### 🧹 Chores
 
+## [20.0.0](https://github.com/expo/eas-cli/releases/tag/v20.0.0) - 2026-05-29
+
+### 🛠 Breaking changes
+
+- [eas-cli] Rename observe commands: `observe:logs` → `observe:events` (events emitted via `logEvent`), previous `observe:events` → `observe:metrics` (individual performance metric samples), previous `observe:metrics` → `observe:metrics-summary` (aggregated stats by app version). ([#3778](https://github.com/expo/eas-cli/pull/3778) by [@kadikraman](https://github.com/kadikraman))
+
+### 🎉 New features
+
+- [eas-cli] `eas go` now prompts to select an Expo SDK version interactively when `--sdk-version` is not provided. ([#3768](https://github.com/expo/eas-cli/pull/3768) by [@gwdp](https://github.com/gwdp))
+- [eas-cli] Add `eas update:embedded:upload` command. ([#3720](https://github.com/expo/eas-cli/pull/3720) by [@gwdp](https://github.com/gwdp))
+
+### 🐛 Bug fixes
+
+- [build-tools] Fix `eas/start_ios_simulator` hanging on Xcode 26.4 by writing the readiness screenshot to a temp file instead of `/dev/null`. ([#3794](https://github.com/expo/eas-cli/pull/3794) by [@gwdp](https://github.com/gwdp))
+- [build-tools] Disable `apsd` in the iOS Simulator after boot to stop a push-registration log storm that pegs `diagnosticd` CPU for the lifetime of the Simulator. ([#3795](https://github.com/expo/eas-cli/pull/3795) by [@gwdp](https://github.com/gwdp))
+
+## [19.1.0](https://github.com/expo/eas-cli/releases/tag/v19.1.0) - 2026-05-25
+
+### 🎉 New features
+
+- [eas-cli] Add `--refresh-ad-hoc-provisioning-profile` flag to refresh managed ad-hoc provisioning profiles from App Store Connect before gathering build credentials in non-interactive mode. ([#3716](https://github.com/expo/eas-cli/pull/3716) by [@sswrk](https://github.com/sswrk))
+- [eas-build-job] Add optional `refreshAdHocProvisioningProfile` field to iOS build jobs. ([#3717](https://github.com/expo/eas-cli/pull/3717) by [@sswrk](https://github.com/sswrk))
+- [build-tools] Pass `refreshAdHocProvisioningProfile` through `eas build:internal` for git-based integration builds. ([#3770](https://github.com/expo/eas-cli/pull/3770) by [@sswrk](https://github.com/sswrk))
+
+## [19.0.8](https://github.com/expo/eas-cli/releases/tag/v19.0.8) - 2026-05-21
+
+### 🐛 Bug fixes
+
+- [eas-cli] `eas go` now pre-selects the SDK version from the current project's `app.json` or `app.config.js` when available. ([#3776](https://github.com/expo/eas-cli/pull/3776) by [@gwdp](https://github.com/gwdp))
+
+## [19.0.7](https://github.com/expo/eas-cli/releases/tag/v19.0.7) - 2026-05-21
+
+## [19.0.6](https://github.com/expo/eas-cli/releases/tag/v19.0.6) - 2026-05-21
+
+### 🐛 Bug fixes
+
+- [build-tools] Update the minimum Expo version required for iOS precompiled modules to 55.0.26. ([#3771](https://github.com/expo/eas-cli/pull/3771) by [@chrfalch](https://github.com/chrfalch))
+
+## [19.0.5](https://github.com/expo/eas-cli/releases/tag/v19.0.5) - 2026-05-20
+
+### 🐛 Bug fixes
+
+- [eas-cli] Improve Sentry diagnostics for managed iOS entitlements config fallback. ([#3763](https://github.com/expo/eas-cli/pull/3763) by [@sjchmiela](https://github.com/sjchmiela))
+
+## [19.0.4](https://github.com/expo/eas-cli/releases/tag/v19.0.4) - 2026-05-20
+
+## [19.0.1](https://github.com/expo/eas-cli/releases/tag/v19.0.1) - 2026-05-19
+
+### 🐛 Bug fixes
+
+- [eas-cli] Disable dotenv loading when resolving managed iOS entitlements. ([#3752](https://github.com/expo/eas-cli/pull/3752) by [@sjchmiela](https://github.com/sjchmiela))
+- [eas-cli] Restore the bundled config fallback for managed iOS entitlements introspection. ([#3753](https://github.com/expo/eas-cli/pull/3753) by [@sjchmiela](https://github.com/sjchmiela))
+
+## [19.0.0](https://github.com/expo/eas-cli/releases/tag/v19.0.0) - 2026-05-19
+
+### 🛠 Breaking changes
+
+- [eas-cli] Make browser-based authentication the default for `eas login`. Use `--no-browser` for CLI-based login. ([#3746](https://github.com/expo/eas-cli/pull/3746) by [@byronkarlen](https://github.com/byronkarlen))
+
+### 🎉 New features
+
+- [eas-cli] Allow command `observe:routes` to filter results to specific route names. ([#3744](https://github.com/expo/eas-cli/pull/3744) by [@douglowder](https://github.com/douglowder))
+
+### 🐛 Bug fixes
+
+- [eas-cli] Check that `expo` is resolvable before assuming it's installed ([#3748](https://github.com/expo/eas-cli/pull/3748) by [@kitten](https://github.com/kitten))
+
+### 🧹 Chores
+
+- [worker] Report build phase durations stats. ([#3732](https://github.com/expo/eas-cli/pull/3732) by [@gwdp](https://github.com/gwdp))
+
+## [18.13.1](https://github.com/expo/eas-cli/releases/tag/v18.13.1) - 2026-05-18
+
+### 🎉 New features
+
+- [eas-cli] Send the installed `expo` package version in build metadata. ([#3725](https://github.com/expo/eas-cli/pull/3725) by [@sjchmiela](https://github.com/sjchmiela))
+
+### 🐛 Bug fixes
+
+- [eas-cli] Prevent `npx` invocations that can be unreliable and fail when retrieving entitlements or project configs ([#3282](https://github.com/expo/eas-cli/pull/3282) by [@kitten](https://github.com/kitten))
+
+## [18.13.0](https://github.com/expo/eas-cli/releases/tag/v18.13.0) - 2026-05-14
+
+### 🎉 New features
+
+- [eas-cli] New command `observe:routes` for navigation metrics. ([#3730](https://github.com/expo/eas-cli/pull/3730) by [@douglowder](https://github.com/douglowder))
+
+### 🧹 Chores
+
+- [eas-cli] Refactor observe commands to extract common flag definitions. ([#3731](https://github.com/expo/eas-cli/pull/3731) by [@douglowder](https://github.com/douglowder))
+
+## [18.12.3](https://github.com/expo/eas-cli/releases/tag/v18.12.3) - 2026-05-13
+
+## [18.12.2](https://github.com/expo/eas-cli/releases/tag/v18.12.2) - 2026-05-12
+
+### 🐛 Bug fixes
+
+- [eas-cli] Fix `eas go` to use server-side project setup and support multiple Expo Go SDK versions. ([#3657](https://github.com/expo/eas-cli/pull/3657) by [@gwdp](https://github.com/gwdp))
+
+### 🧹 Chores
+
+- [ci] Audit GitHub Actions workflows: harden `pull_request_target` usage, pin all external actions to commit SHAs, and add Dependabot to refresh them. ([#3718](https://github.com/expo/eas-cli/pull/3718) by [@brentvatne](https://github.com/brentvatne))
+
+## [18.12.1](https://github.com/expo/eas-cli/releases/tag/v18.12.1) - 2026-05-12
+
+## [18.12.0](https://github.com/expo/eas-cli/releases/tag/v18.12.0) - 2026-05-12
+
+### 🎉 New features
+
+- [eas-cli] Automatically save the Convex deployment URL as an EAS environment variable when connecting a Convex project. ([#3685](https://github.com/expo/eas-cli/pull/3685) by [@fiberjw](https://github.com/fiberjw))
+
+### 🐛 Bug fixes
+
+- [build-tools] Update the minimum Expo version required for iOS precompiled modules. ([#3677](https://github.com/expo/eas-cli/pull/3677) by [@sjchmiela](https://github.com/sjchmiela))
+- [eas-cli] recommend that users read the docs after connecting Convex ([#3683](https://github.com/expo/eas-cli/pull/3683) by [@fiberjw](https://github.com/fiberjw))
+
+## [18.11.0](https://github.com/expo/eas-cli/releases/tag/v18.11.0) - 2026-05-05
+
+### 🎉 New features
+
+- [eas-cli] Add `--simulator` to `eas build:dev` and `eas build:run` to select which iOS simulator to install and run builds on. ([#3637](https://github.com/expo/eas-cli/pull/3637) by [@mmichels-brex](https://github.com/mmichels-brex))
+
+### 🐛 Bug fixes
+
+- [eas-cli] Fix Convex team invite output after skipped or unnecessary invitations. ([#3672](https://github.com/expo/eas-cli/pull/3672) by [@fiberjw](https://github.com/fiberjw))
+- Make directories marked as read-only writable when creating a tar, to prevent the cross-filesystem issues when extracting the tar. ([#3489](https://github.com/expo/eas-cli/pull/3489) by [@sswrk](https://github.com/sswrk))
+
+## [18.10.0](https://github.com/expo/eas-cli/releases/tag/v18.10.0) - 2026-05-04
+
+### 🎉 New features
+
+- [eas-cli] Add `eas integrations:convex` commands to manage Convex integrations for EAS projects. ([#3575](https://github.com/expo/eas-cli/pull/3575) by [@fiberjw](https://github.com/fiberjw))
+- [eas-cli] New command `observe:logs` for custom events. ([#3638](https://github.com/expo/eas-cli/pull/3638) by [@douglowder](https://github.com/douglowder))
+
+### 🐛 Bug fixes
+
+- [eas-cli] Create portable project archives on all platforms to normalize cross-platform tar metadata and permissions. ([#3234](https://github.com/expo/eas-cli/pull/3234) by [@sjchmiela](https://github.com/sjchmiela))
+- [eas-cli] Remove hardcoded `builderEnvironment.image` override in `eas build:resign`. ([#3661](https://github.com/expo/eas-cli/pull/3661) by [@hSATAC](https://github.com/hSATAC))
+- [eas-cli] Fix `eas update --json` intermittently failing with JSON parse errors during "Computing project fingerprints" by passing `silent: true` to `@expo/fingerprint` to suppress subprocess stdout pollution. ([#3659](https://github.com/expo/eas-cli/pull/3659) by [@Mookiies](https://github.com/Mookiies))
+
+## [18.9.1](https://github.com/expo/eas-cli/releases/tag/v18.9.1) - 2026-04-30
+
+## [18.9.0](https://github.com/expo/eas-cli/releases/tag/v18.9.0) - 2026-04-30
+
+### 🎉 New features
+
+- [eas-cli] Add `eas integrations:asc` commands to manage App Store Connect integrations for EAS projects. ([#3558](https://github.com/expo/eas-cli/pull/3558) by [@sswrk](https://github.com/sswrk))
+- [eas-cli] Allow `eas build:download` to accept a build ID. ([#3655](https://github.com/expo/eas-cli/pull/3655) by [@douglowder](https://github.com/douglowder))
+- [eas-cli] Add `--id` alias for `--build-id` flag in `eas build:download`. ([#3656](https://github.com/expo/eas-cli/pull/3656) by [@brentvatne](https://github.com/brentvatne))
+
+### 🐛 Bug fixes
+
+- [steps] Fix workflow job context interpolation when a string contains multiple `${{ }}` expressions on the same line (for example a changelog built from two context values). ([#3644](https://github.com/expo/eas-cli/pull/3644) by [@gwdp](https://github.com/gwdp))
+
+## [18.8.1](https://github.com/expo/eas-cli/releases/tag/v18.8.1) - 2026-04-23
+
 ## [18.8.0](https://github.com/expo/eas-cli/releases/tag/v18.8.0) - 2026-04-22
 
 ### 🎉 New features

lerna.json

@@ -1,5 +1,5 @@
 {
   "npmClient": "yarn",
-  "version": "18.8.0",
+  "version": "20.0.0",
   "$schema": "node_modules/lerna/schemas/lerna-schema.json"
 }

packages/build-tools/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/build-tools",
-  "version": "18.8.0",
+  "version": "20.0.0",
   "bugs": "https://github.com/expo/eas-cli/issues",
   "license": "BUSL-1.1",
   "author": "Expo <[email protected]>",
@@ -37,20 +37,21 @@
   "dependencies": {
     "@expo/config": "55.0.10",
     "@expo/config-plugins": "55.0.7",
-    "@expo/downloader": "18.5.0",
-    "@expo/eas-build-job": "18.8.0",
-    "@expo/eas-json": "18.8.0",
+    "@expo/downloader": "20.0.0",
+    "@expo/eas-build-job": "20.0.0",
     "@expo/env": "^0.4.0",
-    "@expo/logger": "18.5.0",
+    "@expo/logger": "20.0.0",
     "@expo/package-manager": "1.9.10",
     "@expo/plist": "^0.2.0",
     "@expo/results": "^1.0.0",
     "@expo/spawn-async": "1.7.2",
-    "@expo/steps": "18.8.0",
-    "@expo/template-file": "18.5.0",
-    "@expo/turtle-spawn": "18.5.0",
+    "@expo/steps": "20.0.0",
+    "@expo/template-file": "20.0.0",
+    "@expo/turtle-spawn": "20.0.0",
     "@expo/xcpretty": "^4.3.1",
     "@google-cloud/storage": "^7.11.2",
+    "@ngrok/ngrok": "1.7.0",
+    "@sentry/node": "7.77.0",
     "@urql/core": "^6.0.1",
     "bplist-parser": "0.3.2",
     "fast-glob": "^3.3.2",

packages/build-tools/src/__mocks__/fs/promises.ts

@@ -1,10 +1,7 @@
 import { fs } from 'memfs';
 
-const fsRealpath = fs.realpath;
-(fsRealpath as any).native = fsRealpath;
-
 const fsRm = (path: string, options: object): Promise<void> => {
   return fs.promises.rm(path, options);
 };
 
-module.exports = { ...fs.promises, realpath: fsRealpath, rm: fsRm };
+module.exports = { ...fs.promises, rm: fsRm };

packages/build-tools/src/__tests__/context.test.ts

@@ -1,14 +1,36 @@
-import { BuildTrigger, Job, Metadata } from '@expo/eas-build-job';
+import {
+  BuildPhase,
+  BuildPhaseResult,
+  BuildTrigger,
+  Job,
+  Metadata,
+  Platform,
+} from '@expo/eas-build-job';
 import { randomUUID } from 'crypto';
+import fs from 'fs-extra';
 import { vol } from 'memfs';
 
 import { createMockLogger } from './utils/logger';
 import { BuildContext } from '../context';
+import { Datadog } from '../datadog';
 
 jest.mock('fs');
 jest.mock('fs-extra');
+jest.mock('../datadog', () => ({
+  Datadog: {
+    distribution: jest.fn(),
+  },
+}));
+
+const datadogDistributionMock = jest.mocked(Datadog.distribution);
 
 describe('BuildContext', () => {
+  beforeEach(() => {
+    vol.reset();
+    jest.clearAllMocks();
+    (fs.readdir as unknown as jest.Mock).mockResolvedValue([]);
+  });
+
   it('should merge secrets', async () => {
     const robotAccessToken = randomUUID();
     await vol.promises.mkdir('/workingdir/eas-environment-secrets/', { recursive: true });
@@ -116,4 +138,68 @@ describe('BuildContext', () => {
       foo: 'bar',
     });
   });
+
+  it('emits build phase duration metrics for successful build phases', async () => {
+    const ctx = createTestBuildContext({ platform: Platform.IOS });
+
+    await ctx.runBuildPhase(BuildPhase.RUN_FASTLANE, async () => {});
+
+    expect(datadogDistributionMock).toHaveBeenCalledWith(
+      'eas.build.phase_duration',
+      expect.any(Number),
+      {
+        build_phase: 'run_fastlane',
+        platform: Platform.IOS,
+        result: BuildPhaseResult.SUCCESS,
+      }
+    );
+  });
+
+  it('emits build phase duration metrics for failed build phases', async () => {
+    const ctx = createTestBuildContext({ platform: Platform.ANDROID });
+
+    await expect(
+      ctx.runBuildPhase(BuildPhase.INSTALL_DEPENDENCIES, async () => {
+        throw new Error('boom');
+      })
+    ).rejects.toThrow();
+
+    expect(datadogDistributionMock).toHaveBeenCalledWith(
+      'eas.build.phase_duration',
+      expect.any(Number),
+      {
+        build_phase: 'install_dependencies',
+        platform: Platform.ANDROID,
+        result: BuildPhaseResult.FAIL,
+      }
+    );
+  });
+
+  it('does not emit build phase duration metrics for non-platform jobs', async () => {
+    const ctx = createTestBuildContext({});
+
+    await ctx.runBuildPhase(BuildPhase.PREPARE_PROJECT, async () => {});
+
+    expect(datadogDistributionMock).not.toHaveBeenCalled();
+  });
 });
+
+function createTestBuildContext({ platform }: { platform?: Platform }): BuildContext {
+  vol.mkdirSync('/workingdir/env', { recursive: true });
+
+  return new BuildContext(
+    {
+      ...(platform ? { platform } : {}),
+      builderEnvironment: { env: {} },
+    } as Job,
+    {
+      env: {
+        __API_SERVER_URL: 'http://api.expo.test',
+      },
+      workingdir: '/workingdir',
+      logger: createMockLogger(),
+      logBuffer: { getLogs: () => [], getPhaseLogs: () => [] },
+      uploadArtifact: jest.fn(),
+    }
+  );
+}

packages/build-tools/src/__tests__/datadog.test.ts

@@ -0,0 +1,243 @@
+import { Response } from 'node-fetch';
+
+import { Datadog } from '../datadog';
+import { Sentry } from '../sentry';
+import { turtleFetch } from '../utils/turtleFetch';
+
+jest.mock('../sentry', () => ({
+  Sentry: {
+    capture: jest.fn(),
+  },
+}));
+jest.mock('../utils/turtleFetch', () => ({
+  turtleFetch: jest.fn(),
+}));
+
+const turtleFetchMock = jest.mocked(turtleFetch);
+const sentryCaptureMock = jest.mocked(Sentry.capture);
+
+describe('Datadog singleton', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    Datadog.setup(null);
+  });
+
+  it('POSTs distribution metrics to the turtle build metrics endpoint', () => {
+    turtleFetchMock.mockResolvedValueOnce({} as Response);
+
+    Datadog.setup({
+      expoApiV2BaseUrl: 'https://api.expo.test/v2/',
+      turtleBuildId: 'build-id',
+      robotAccessToken: 'token-abc',
+    });
+
+    Datadog.distribution('eas.build.phase_duration', 1234, {
+      build_phase: 'install_dependencies',
+      platform: 'ios',
+      result: 'success',
+    });
+
+    expect(turtleFetchMock).toHaveBeenCalledWith(
+      'https://api.expo.test/v2/turtle-builds/build-id/metrics',
+      'POST',
+      {
+        json: {
+          metrics: [
+            {
+              name: 'eas.build.phase_duration',
+              type: 'distribution',
+              value: 1234,
+              tags: {
+                build_phase: 'install_dependencies',
+                platform: 'ios',
+                result: 'success',
+              },
+            },
+          ],
+        },
+        headers: { Authorization: 'Bearer token-abc' },
+        retries: 2,
+      }
+    );
+  });
+
+  it('POSTs logs to the turtle build logs endpoint', () => {
+    turtleFetchMock.mockResolvedValueOnce({} as Response);
+
+    Datadog.setup({
+      expoApiV2BaseUrl: 'https://api.expo.test/v2/',
+      turtleBuildId: 'build-id',
+      robotAccessToken: 'token-abc',
+    });
+
+    Datadog.log('artifact dry-run matched', {
+      event: 'find_artifacts_absolute_path_dry_run',
+      status: 'match',
+    });
+
+    expect(turtleFetchMock).toHaveBeenCalledWith(
+      'https://api.expo.test/v2/turtle-builds/logs',
+      'POST',
+      {
+        json: {
+          buildId: 'build-id',
+          message: 'artifact dry-run matched',
+          tags: {
+            event: 'find_artifacts_absolute_path_dry_run',
+            status: 'match',
+          },
+        },
+        headers: { Authorization: 'Bearer token-abc' },
+        shouldThrowOnNotOk: false,
+      }
+    );
+  });
+
+  it('is a no-op when setup is null', () => {
+    Datadog.setup(null);
+
+    Datadog.distribution('eas.build.phase_duration', 1);
+    Datadog.log('artifact dry-run matched');
+
+    expect(turtleFetchMock).not.toHaveBeenCalled();
+  });
+
+  it('swallows upload failures', async () => {
+    turtleFetchMock.mockRejectedValueOnce(new Error('network down'));
+    Datadog.setup({
+      expoApiV2BaseUrl: 'https://api.expo.test/v2/',
+      turtleBuildId: 'build-id',
+      robotAccessToken: 'token-abc',
+    });
+
+    Datadog.distribution('eas.build.phase_duration', 1);
+    await flushPromises();
+
+    expect(turtleFetchMock).toHaveBeenCalled();
+    expect(sentryCaptureMock).toHaveBeenCalledWith(
+      'Failed to report turtle build metric',
+      expect.any(Error),
+      expect.objectContaining({
+        extras: {
+          metrics: [{ name: 'eas.build.phase_duration', type: 'distribution', value: 1, tags: {} }],
+        },
+      })
+    );
+  });
+
+  it('swallows log upload failures', async () => {
+    turtleFetchMock.mockRejectedValueOnce(new Error('network down'));
+    Datadog.setup({
+      expoApiV2BaseUrl: 'https://api.expo.test/v2/',
+      turtleBuildId: 'build-id',
+      robotAccessToken: 'token-abc',
+    });
+
+    Datadog.log('artifact dry-run matched');
+    await flushPromises();
+
+    expect(turtleFetchMock).toHaveBeenCalled();
+    expect(sentryCaptureMock).toHaveBeenCalledWith(
+      'Failed to report turtle build log',
+      expect.any(Error),
+      expect.objectContaining({
+        extras: {
+          log: { buildId: 'build-id', message: 'artifact dry-run matched', tags: {} },
+        },
+      })
+    );
+  });
+
+  it('uses the latest setup options', () => {
+    turtleFetchMock.mockResolvedValue({} as Response);
+
+    Datadog.setup({
+      expoApiV2BaseUrl: 'https://api.expo.test/v2/',
+      turtleBuildId: 'first-build-id',
+      robotAccessToken: 'first-token',
+    });
+    Datadog.setup({
+      expoApiV2BaseUrl: 'https://api.expo.test/v2/',
+      turtleBuildId: 'second-build-id',
+      robotAccessToken: 'second-token',
+    });
+
+    Datadog.distribution('eas.build.phase_duration', 1);
+    Datadog.log('artifact dry-run matched');
+
+    expect(turtleFetchMock).toHaveBeenNthCalledWith(
+      1,
+      'https://api.expo.test/v2/turtle-builds/second-build-id/metrics',
+      'POST',
+      expect.objectContaining({
+        headers: { Authorization: 'Bearer second-token' },
+      })
+    );
+    expect(turtleFetchMock).toHaveBeenNthCalledWith(
+      2,
+      'https://api.expo.test/v2/turtle-builds/logs',
+      'POST',
+      expect.objectContaining({
+        headers: { Authorization: 'Bearer second-token' },
+      })
+    );
+  });
+
+  it('flushes pending metric uploads', async () => {
+    let resolveUpload!: (response: Response) => void;
+    turtleFetchMock.mockReturnValueOnce(
+      new Promise<Response>(resolve => {
+        resolveUpload = resolve;
+      })
+    );
+    Datadog.setup({
+      expoApiV2BaseUrl: 'https://api.expo.test/v2/',
+      turtleBuildId: 'build-id',
+      robotAccessToken: 'token-abc',
+    });
+
+    let flushed = false;
+    Datadog.distribution('eas.build.phase_duration', 1);
+    const flushPromise = Datadog.flushAsync().then(() => {
+      flushed = true;
+    });
+    await Promise.resolve();
+    expect(flushed).toBe(false);
+
+    resolveUpload({} as Response);
+    await flushPromise;
+
+    expect(flushed).toBe(true);
+  });
+
+  it('flushes pending log uploads', async () => {
+    let resolveUpload!: (response: Response) => void;
+    turtleFetchMock.mockReturnValueOnce(
+      new Promise<Response>(resolve => {
+        resolveUpload = resolve;
+      })
+    );
+    Datadog.setup({
+      expoApiV2BaseUrl: 'https://api.expo.test/v2/',
+      turtleBuildId: 'build-id',
+      robotAccessToken: 'token-abc',
+    });
+
+    let flushed = false;
+    Datadog.log('artifact dry-run matched');
+    const flushPromise = Datadog.flushAsync().then(() => {
+      flushed = true;
+    });
+    await Promise.resolve();
+    expect(flushed).toBe(false);
+
+    resolveUpload({} as Response);
+    await flushPromise;
+
+    expect(flushed).toBe(true);
+  });
+});
+
+async function flushPromises(): Promise<void> {
+  await new Promise(resolve => setImmediate(resolve));
+}

packages/build-tools/src/__tests__/sentry.test.ts

@@ -0,0 +1,256 @@
+import * as sentryNode from '@sentry/node';
+
+import { Sentry } from '../sentry';
+
+jest.mock('@sentry/node');
+
+describe('Sentry singleton', () => {
+  beforeEach(() => {
+    jest.mocked(sentryNode.init).mockReset();
+    jest.mocked(sentryNode.flush).mockReset();
+    jest.mocked(sentryNode.captureException).mockReset();
+    jest.mocked(sentryNode.captureMessage).mockReset();
+    jest.mocked(sentryNode.withScope).mockReset();
+  });
+
+  describe('setup', () => {
+    it('initializes the SDK with dsn + environment when dsn is non-null', () => {
+      Sentry.setup({ dsn: 'https://[email protected]/1', environment: 'production' });
+      expect(sentryNode.init).toHaveBeenCalledWith({
+        dsn: 'https://[email protected]/1',
+        environment: 'production',
+      });
+    });
+
+    it('passes default tags into the SDK init as initialScope', () => {
+      Sentry.setup({
+        dsn: 'https://[email protected]/1',
+        environment: 'production',
+        tags: { service: 'worker:darwin' },
+      });
+      expect(sentryNode.init).toHaveBeenCalledWith({
+        dsn: 'https://[email protected]/1',
+        environment: 'production',
+        initialScope: { tags: { service: 'worker:darwin' } },
+      });
+    });
+
+    it('skips SDK init when dsn is null', () => {
+      Sentry.setup({ dsn: null, environment: 'development' });
+      expect(sentryNode.init).not.toHaveBeenCalled();
+    });
+
+    it('passes the latest initialScope tags when setup is called more than once', () => {
+      Sentry.setup({
+        dsn: 'https://[email protected]/1',
+        environment: 'test',
+        tags: { service: 'first' },
+      });
+      Sentry.setup({
+        dsn: 'https://[email protected]/1',
+        environment: 'test',
+        tags: { service: 'second' },
+      });
+
+      expect(sentryNode.init).toHaveBeenNthCalledWith(
+        2,
+        expect.objectContaining({ initialScope: { tags: { service: 'second' } } })
+      );
+    });
+  });
+
+  describe('capture', () => {
+    it('routes (msg) to captureMessage with msg only', () => {
+      const scope = mockWithScope();
+
+      Sentry.capture('plain message');
+
+      expect(sentryNode.captureMessage).toHaveBeenCalledWith('plain message');
+      expect(sentryNode.captureException).not.toHaveBeenCalled();
+      expect(scope.setExtra).not.toHaveBeenCalled();
+    });
+
+    it('routes (msg, options) and sets per-call tags/extras/level on the scope', () => {
+      const scope = mockWithScope();
+
+      Sentry.capture('something happened', {
+        tags: { phase: 'running-xclogparser' },
+        extras: { buildId: 'abc' },
+        level: 'warning',
+      });
+
+      expect(scope.setTags).toHaveBeenCalledWith({ phase: 'running-xclogparser' });
+      expect(scope.setExtras).toHaveBeenCalledWith({ buildId: 'abc' });
+      expect(scope.setLevel).toHaveBeenCalledWith('warning');
+      expect(sentryNode.captureMessage).toHaveBeenCalledWith('something happened');
+      expect(sentryNode.captureException).not.toHaveBeenCalled();
+    });
+
+    it('routes (msg, err) to captureException and sets msg as `message` extra when distinct from err.message', () => {
+      const scope = mockWithScope();
+      const err = new Error('boom');
+
+      Sentry.capture('something went wrong', err);
+
+      expect(scope.setExtra).toHaveBeenCalledWith('message', 'something went wrong');
+      expect(sentryNode.captureException).toHaveBeenCalledWith(err);
+      expect(sentryNode.captureMessage).not.toHaveBeenCalled();
+    });
+
+    it('routes (msg, err, options) to captureException with per-call tags/extras', () => {
+      const scope = mockWithScope();
+      const err = new Error('spawn ENOENT');
+
+      Sentry.capture('xclogparser failed', err, {
+        tags: { phase: 'running-xclogparser' },
+        extras: { buildId: 'abc' },
+      });
+
+      expect(scope.setTags).toHaveBeenCalledWith({ phase: 'running-xclogparser' });
+      expect(scope.setExtras).toHaveBeenCalledWith({ buildId: 'abc' });
+      expect(scope.setExtra).toHaveBeenCalledWith('message', 'xclogparser failed');
+      expect(sentryNode.captureException).toHaveBeenCalledWith(err);
+    });
+
+    it('does not set the `message` extra when msg equals err.message', () => {
+      const scope = mockWithScope();
+      const err = new Error('build failed');
+
+      Sentry.capture('build failed', err);
+
+      expect(scope.setExtra).not.toHaveBeenCalledWith('message', expect.anything());
+      expect(sentryNode.captureException).toHaveBeenCalledWith(err);
+    });
+
+    it('routes (err) alone to captureException with no scope mutations', () => {
+      const scope = mockWithScope();
+      const err = new Error('boom');
+
+      Sentry.capture(err);
+
+      expect(scope.setTags).not.toHaveBeenCalled();
+      expect(scope.setExtras).not.toHaveBeenCalled();
+      expect(scope.setLevel).not.toHaveBeenCalled();
+      expect(scope.setExtra).not.toHaveBeenCalled();
+      expect(sentryNode.captureException).toHaveBeenCalledWith(err);
+      expect(sentryNode.captureMessage).not.toHaveBeenCalled();
+    });
+
+    it('treats (msg, null) as a no-err call (parity with 3-arg null behavior)', () => {
+      const scope = mockWithScope();
+
+      Sentry.capture('forwarded null', null as unknown as Error);
+
+      expect(scope.setExtra).not.toHaveBeenCalled();
+      expect(sentryNode.captureMessage).toHaveBeenCalledWith('forwarded null');
+      expect(sentryNode.captureException).not.toHaveBeenCalled();
+    });
+
+    it('treats (msg, null, options) as a no-err call', () => {
+      const scope = mockWithScope();
+
+      Sentry.capture('forwarded null with opts', null as unknown as Error, {
+        tags: { phase: 'cleanup' },
+      });
+
+      expect(scope.setTags).toHaveBeenCalledWith({ phase: 'cleanup' });
+      expect(scope.setExtra).not.toHaveBeenCalled();
+      expect(sentryNode.captureMessage).toHaveBeenCalledWith('forwarded null with opts');
+      expect(sentryNode.captureException).not.toHaveBeenCalled();
+    });
+
+    it('treats (msg, undefined, options) as a no-err call (forwarding `Error | undefined` typed vars)', () => {
+      const scope = mockWithScope();
+
+      Sentry.capture('forwarded with no err', undefined, {
+        tags: { phase: 'install-dependencies' },
+        extras: { buildId: 'abc' },
+      });
+
+      expect(scope.setTags).toHaveBeenCalledWith({ phase: 'install-dependencies' });
+      expect(scope.setExtras).toHaveBeenCalledWith({ buildId: 'abc' });
+      expect(scope.setExtra).not.toHaveBeenCalled();
+      expect(sentryNode.captureMessage).toHaveBeenCalledWith('forwarded with no err');
+      expect(sentryNode.captureException).not.toHaveBeenCalled();
+    });
+
+    it('coerces 2-arg primitive thrown value to Error (e.g. `throw "boom"`)', () => {
+      mockWithScope();
+
+      Sentry.capture('caught a string', 'boom' as unknown as Error);
+
+      expect(sentryNode.captureException).toHaveBeenCalledWith(expect.any(Error));
+      const coerced = jest.mocked(sentryNode.captureException).mock.calls[0][0] as Error;
+      expect(coerced.message).toBe('boom');
+      expect(sentryNode.captureMessage).not.toHaveBeenCalled();
+    });
+
+    it('coerces non-Error middle arg to Error when caller passes 3 args (e.g. `catch (err: any)`)', () => {
+      const scope = mockWithScope();
+
+      Sentry.capture('something failed', 'raw string thrown' as unknown as Error, {
+        tags: { phase: 'install-dependencies' },
+        extras: { buildId: 'abc' },
+      });
+
+      expect(scope.setTags).toHaveBeenCalledWith({ phase: 'install-dependencies' });
+      expect(scope.setExtras).toHaveBeenCalledWith({ buildId: 'abc' });
+      expect(scope.setExtra).toHaveBeenCalledWith('message', 'something failed');
+      expect(sentryNode.captureException).toHaveBeenCalledWith(expect.any(Error));
+      const coerced = jest.mocked(sentryNode.captureException).mock.calls[0][0] as Error;
+      expect(coerced.message).toBe('raw string thrown');
+      expect(sentryNode.captureMessage).not.toHaveBeenCalled();
+    });
+
+    it('routes (err, options) to captureException with no message extra', () => {
+      const scope = mockWithScope();
+      const err = new Error('boom');
+
+      Sentry.capture(err, { tags: { phase: 'install-dependencies' }, level: 'warning' });
+
+      expect(scope.setTags).toHaveBeenCalledWith({ phase: 'install-dependencies' });
+      expect(scope.setLevel).toHaveBeenCalledWith('warning');
+      expect(scope.setExtra).not.toHaveBeenCalled();
+      expect(sentryNode.captureException).toHaveBeenCalledWith(err);
+      expect(sentryNode.captureMessage).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('flush', () => {
+    it('forwards the timeout to the SDK and resolves with its result', async () => {
+      jest.mocked(sentryNode.flush).mockResolvedValue(true);
+
+      const result = await Sentry.flush(3000);
+
+      expect(sentryNode.flush).toHaveBeenCalledWith(3000);
+      expect(result).toBe(true);
+    });
+
+    it('defaults the timeout to 2000ms when not specified', async () => {
+      jest.mocked(sentryNode.flush).mockResolvedValue(true);
+
+      await Sentry.flush();
+
+      expect(sentryNode.flush).toHaveBeenCalledWith(2000);
+    });
+  });
+});
+
+function mockWithScope(): {
+  setTags: jest.Mock;
+  setExtras: jest.Mock;
+  setExtra: jest.Mock;
+  setLevel: jest.Mock;
+} {
+  const scope = {
+    setTags: jest.fn(),
+    setExtras: jest.fn(),
+    setExtra: jest.fn(),
+    setLevel: jest.fn(),
+  };
+  jest.mocked(sentryNode.withScope).mockImplementation((cb: any) => {
+    cb(scope as unknown as sentryNode.Scope);
+    return undefined as any;
+  });
+  return scope;
+}

packages/build-tools/src/android/gradle.ts

@@ -32,18 +32,27 @@ export async function runGradleCommand(
   await fs.chmod(path.join(androidDir, 'gradlew'), 0o755);
   const verboseFlag = ctx.env['EAS_VERBOSE'] === '1' ? '--info' : '';
 
-  const spawnPromise = spawn('bash', ['-c', `./gradlew ${gradleCommand} ${verboseFlag}`], {
-    cwd: androidDir,
-    logger,
-    lineTransformer: (line?: string) => {
-      if (!line || /^\.+$/.exec(line)) {
-        return null;
-      } else {
-        return line;
-      }
-    },
-    env: { ...ctx.env, ...extraEnv, ...resolveVersionOverridesEnvs(ctx), LC_ALL: 'C.UTF-8' },
-  });
+  const spawnPromise = spawn(
+    'bash',
+    ['-c', `./gradlew ${gradleCommand} --profile ${verboseFlag}`],
+    {
+      cwd: androidDir,
+      logger,
+      lineTransformer: (line?: string) => {
+        if (!line || /^\.+$/.exec(line)) {
+          return null;
+        } else {
+          return line;
+        }
+      },
+      env: {
+        ...ctx.env,
+        ...extraEnv,
+        ...resolveVersionOverridesEnvs(ctx),
+        LC_ALL: 'C.UTF-8',
+      },
+    }
+  );
   if (ctx.env.EAS_BUILD_RUNNER === 'eas-build' && process.platform === 'linux') {
     adjustOOMScore(spawnPromise, logger);
   }

packages/build-tools/src/android/gradleProfile.ts

@@ -0,0 +1,231 @@
+import { XMLParser } from 'fast-xml-parser';
+import fs from 'fs-extra';
+import path from 'path';
+
+export interface GradleProfileTask {
+  path: string;
+  durationMs: number;
+  result: string;
+}
+
+export async function parseGradleProfile(androidDir: string): Promise<GradleProfileTask[]> {
+  const profileDir = path.join(androidDir, 'build', 'reports', 'profile');
+  // Gradle profile may not exist for all builds (e.g. custom, repack
+  // jobs). We should short circuit and not unnecessarily log.
+  if (!(await fs.pathExists(profileDir))) {
+    return [];
+  }
+
+  const files = await fs.readdir(profileDir);
+  const htmlFile = files
+    .filter(f => f.startsWith('profile-') && f.endsWith('.html'))
+    .sort()
+    .pop();
+
+  if (!htmlFile) {
+    throw new Error(`No Gradle profile HTML found in ${profileDir}`);
+  }
+
+  const html = await fs.readFile(path.join(profileDir, htmlFile), 'utf8');
+
+  // Locate the <h2>Task Execution</h2> heading and extract its <table>
+  const headingMatch = html.match(/<h2[^>]*>\s*Task Execution\s*<\/h2>/i);
+  if (!headingMatch || headingMatch.index === undefined) {
+    throw new Error('Could not find Task Execution section in Gradle profile');
+  }
+
+  const sectionStart = headingMatch.index;
+  const tableStart = html.indexOf('<table', sectionStart);
+  const tableEnd = html.indexOf('</table>', tableStart);
+  if (tableStart === -1 || tableEnd === -1) {
+    throw new Error('Could not find task execution table in Gradle profile');
+  }
+
+  const tableHtml = html.slice(tableStart, tableEnd + '</table>'.length);
+  const parser = new XMLParser({
+    ignoreAttributes: true,
+    isArray: name => name === 'tr' || name === 'td',
+    trimValues: true,
+  });
+
+  const parsed = parser.parse(tableHtml);
+  const rows: any[] = parsed?.table?.tbody?.tr ?? parsed?.table?.tr ?? [];
+
+  const tasks: GradleProfileTask[] = [];
+  for (const row of rows) {
+    const cells: unknown[] = row?.td;
+    if (!cells || cells.length < 2) {
+      continue;
+    }
+
+    const taskPath = String(cells[0] ?? '').trim();
+    const durationStr = String(cells[1] ?? '').trim();
+    const result = String(cells[2] ?? '').trim() || 'executed';
+
+    if (!taskPath || !durationStr) {
+      continue;
+    }
+
+    const durationMs = parseDurationToMs(durationStr);
+    tasks.push({ path: taskPath, durationMs, result: result.toLowerCase() });
+  }
+
+  return tasks;
+}
+
+function parseDurationToMs(duration: string): number {
+  // Gradle profile durations can be like "1.234s", "0.045s", "12.5s"
+  const secondsMatch = duration.match(/^([\d.]+)s$/);
+  if (secondsMatch) {
+    return Math.round(parseFloat(secondsMatch[1]) * 1000);
+  }
+  return 0;
+}
+
+function formatSeconds(ms: number): string {
+  const s = ms / 1000;
+  if (s < 0.1) {
+    return `${ms}ms`;
+  }
+  return `${s.toFixed(1)}s`;
+}
+
+export function formatGradleProfileReport(tasks: GradleProfileTask[]): string {
+  // Filter out tasks under 1 second
+  const significantTasks = tasks.filter(t => t.durationMs >= 1000);
+
+  // Separate module totals from individual tasks
+  const moduleTotals = significantTasks.filter(t => t.result === '(total)');
+  const individualTasks = significantTasks.filter(t => t.result !== '(total)');
+
+  // Group individual tasks by their module prefix
+  const moduleChildren = new Map<string, GradleProfileTask[]>();
+  const orphanTasks: GradleProfileTask[] = [];
+
+  for (const task of individualTasks) {
+    const parent = moduleTotals.find(m => task.path.startsWith(m.path + ':'));
+    if (parent) {
+      const children = moduleChildren.get(parent.path) ?? [];
+      children.push(task);
+      moduleChildren.set(parent.path, children);
+    } else {
+      orphanTasks.push(task);
+    }
+  }
+
+  // Sort module totals by duration, sort children within each module
+  const sortedModules = [...moduleTotals].sort((a, b) => b.durationMs - a.durationMs);
+  for (const children of moduleChildren.values()) {
+    children.sort((a, b) => b.durationMs - a.durationMs);
+  }
+  orphanTasks.sort((a, b) => b.durationMs - a.durationMs);
+
+  // Build display rows: [displayName, task]
+  const rows: { displayName: string; task: GradleProfileTask }[] = [];
+
+  for (const mod of sortedModules) {
+    rows.push({ displayName: mod.path, task: mod });
+    const children = moduleChildren.get(mod.path) ?? [];
+    for (let i = 0; i < children.length; i++) {
+      const isLast = i === children.length - 1;
+      const prefix = isLast ? '  └─ ' : '  ├─ ';
+      const shortName = children[i].path.slice(mod.path.length + 1);
+      rows.push({ displayName: prefix + shortName, task: children[i] });
+    }
+  }
+
+  for (const task of orphanTasks) {
+    rows.push({ displayName: task.path, task });
+  }
+
+  // Compute totals from individual tasks only (avoid double-counting)
+  const totalMs = individualTasks.reduce((sum, t) => sum + t.durationMs, 0);
+  const maxMs = totalMs || 1;
+
+  const nameWidth = Math.max(4, ...rows.map(r => r.displayName.length)) + 2;
+  const barMaxWidth = 20;
+
+  const header =
+    '┌─' +
+    '─'.repeat(nameWidth) +
+    '─┬────────────┬──────────┬────────────┬─' +
+    '─'.repeat(barMaxWidth) +
+    '─┐';
+  const divider =
+    '├─' +
+    '─'.repeat(nameWidth) +
+    '─┼────────────┼──────────┼────────────┼─' +
+    '─'.repeat(barMaxWidth) +
+    '─┤';
+  const footer =
+    '└─' +
+    '─'.repeat(nameWidth) +
+    '─┴────────────┴──────────┴────────────┴─' +
+    '─'.repeat(barMaxWidth) +
+    '─┘';
+
+  const taskCount = individualTasks.length;
+  const cachedCount = individualTasks.filter(t => t.result !== 'executed').length;
+  const lines: string[] = [];
+
+  lines.push('Gradle Build — Task Execution Profile');
+  const cachedSuffix = cachedCount > 0 ? ` (${cachedCount} cached/up-to-date)` : '';
+  lines.push(`${taskCount} tasks${cachedSuffix}, total task time: ${formatSeconds(totalMs)}`);
+  lines.push('% Time = share of total task execution time');
+  lines.push('');
+  lines.push(header);
+  lines.push(
+    '│ ' +
+      'Task'.padEnd(nameWidth) +
+      ' │ ' +
+      'Duration'.padStart(10) +
+      ' │ ' +
+      '% Time'.padStart(8) +
+      ' │ ' +
+      'Result'.padEnd(10) +
+      ' │ ' +
+      ' '.repeat(barMaxWidth) +
+      ' │'
+  );
+  lines.push(divider);
+
+  for (const row of rows) {
+    const pct = totalMs === 0 ? 0 : (row.task.durationMs / totalMs) * 100;
+    const barLength = Math.round((row.task.durationMs / maxMs) * barMaxWidth);
+    const bar = '█'.repeat(barLength) + '░'.repeat(barMaxWidth - barLength);
+    const result = row.task.result === '(total)' ? 'total' : row.task.result;
+
+    lines.push(
+      '│ ' +
+        row.displayName.padEnd(nameWidth) +
+        ' │ ' +
+        formatSeconds(row.task.durationMs).padStart(10) +
+        ' │ ' +
+        `${pct.toFixed(1)}%`.padStart(8) +
+        ' │ ' +
+        result.padEnd(10) +
+        ' │ ' +
+        bar +
+        ' │'
+    );
+  }
+
+  lines.push(divider);
+  lines.push(
+    '│ ' +
+      'TOTAL'.padEnd(nameWidth) +
+      ' │ ' +
+      formatSeconds(totalMs).padStart(10) +
+      ' │ ' +
+      '100.0%'.padStart(8) +
+      ' │ ' +
+      ' '.repeat(10) +
+      ' │ ' +
+      ' '.repeat(barMaxWidth) +
+      ' │'
+  );
+  lines.push(footer);
+  lines.push('');
+
+  return lines.join('\n');
+}

packages/build-tools/src/builders/__tests__/android.test.ts

@@ -4,7 +4,9 @@ import { vol } from 'memfs';
 import { createTestAndroidJob } from '../../__tests__/utils/job';
 import { createMockLogger } from '../../__tests__/utils/logger';
 import { BuildContext } from '../../context';
+import { Datadog } from '../../datadog';
 import { restoreCredentials } from '../../android/credentials';
+import { uploadEmbeddedBundleAsync } from '../../utils/expoUpdatesEmbedded';
 import androidBuilder from '../android';
 import { runBuilderWithHooksAsync } from '../common';
 import {
@@ -56,6 +58,9 @@ jest.mock('../../utils/expoUpdates', () => ({
   configureExpoUpdatesIfInstalledAsync: jest.fn(),
   resolveRuntimeVersionForExpoUpdatesIfConfiguredAsync: jest.fn(async () => null),
 }));
+jest.mock('../../utils/expoUpdatesEmbedded', () => ({
+  uploadEmbeddedBundleAsync: jest.fn(),
+}));
 jest.mock('../../utils/hooks', () => ({
   Hook: {
     POST_INSTALL: 'POST_INSTALL',
@@ -67,8 +72,11 @@ jest.mock('../../utils/prepareBuildExecutable', () => ({
   prepareExecutableAsync: jest.fn(),
 }));
 
+const datadogDistributionMock = jest.spyOn(Datadog, 'distribution');
+
 describe(androidBuilder, () => {
   beforeEach(() => {
+    jest.clearAllMocks();
     vol.fromJSON(
       {
         '/workingdir/env/.gitkeep': '',
@@ -138,7 +146,6 @@ describe(androidBuilder, () => {
   });
 
   it('marks the configure Android version phase as warning for legacy eas-build.gradle', async () => {
-    const reportBuildPhaseStats = jest.fn();
     const job: Android.Job = {
       ...createTestAndroidJob(),
       secrets: {
@@ -157,23 +164,23 @@ describe(androidBuilder, () => {
         __API_SERVER_URL: 'http://api.expo.test',
       },
       uploadArtifact: jest.fn(),
-      reportBuildPhaseStats,
     });
     vol.mkdirSync('/workingdir/build/android/app', { recursive: true });
     vol.writeFileSync('/workingdir/build/android/app/eas-build.gradle', '// Legacy content');
 
     await androidBuilder(ctx);
 
-    expect(reportBuildPhaseStats).toHaveBeenCalledWith(
+    expect(datadogDistributionMock).toHaveBeenCalledWith(
+      'eas.build.phase_duration',
+      expect.any(Number),
       expect.objectContaining({
-        buildPhase: BuildPhase.CONFIGURE_ANDROID_VERSION,
+        build_phase: BuildPhase.CONFIGURE_ANDROID_VERSION.toLowerCase(),
         result: BuildPhaseResult.WARNING,
       })
     );
   });
 
   it('marks the prepare credentials phase as warning for legacy eas-build.gradle', async () => {
-    const reportBuildPhaseStats = jest.fn();
     const ctx = new BuildContext(createTestAndroidJob(), {
       workingdir: '/workingdir',
       logBuffer: { getLogs: () => [], getPhaseLogs: () => [] },
@@ -182,23 +189,23 @@ describe(androidBuilder, () => {
         __API_SERVER_URL: 'http://api.expo.test',
       },
       uploadArtifact: jest.fn(),
-      reportBuildPhaseStats,
     });
     vol.mkdirSync('/workingdir/build/android/app', { recursive: true });
     vol.writeFileSync('/workingdir/build/android/app/eas-build.gradle', '// Legacy content');
 
     await androidBuilder(ctx);
 
-    expect(reportBuildPhaseStats).toHaveBeenCalledWith(
+    expect(datadogDistributionMock).toHaveBeenCalledWith(
+      'eas.build.phase_duration',
+      expect.any(Number),
       expect.objectContaining({
-        buildPhase: BuildPhase.PREPARE_CREDENTIALS,
+        build_phase: BuildPhase.PREPARE_CREDENTIALS.toLowerCase(),
         result: BuildPhaseResult.WARNING,
       })
     );
   });
 
   it('injects credentials and version config when both are configured', async () => {
-    const reportBuildPhaseStats = jest.fn();
     const job: Android.Job = {
       ...createTestAndroidJob(),
       version: {
@@ -214,7 +221,6 @@ describe(androidBuilder, () => {
         __API_SERVER_URL: 'http://api.expo.test',
       },
       uploadArtifact: jest.fn(),
-      reportBuildPhaseStats,
     });
     vol.mkdirSync('/workingdir/build/android/app', { recursive: true });
     vol.writeFileSync('/workingdir/build/android/app/eas-build.gradle', '// Legacy content');
@@ -234,15 +240,19 @@ describe(androidBuilder, () => {
         versionName: '1.2.3',
       }
     );
-    expect(reportBuildPhaseStats).toHaveBeenCalledWith(
+    expect(datadogDistributionMock).toHaveBeenCalledWith(
+      'eas.build.phase_duration',
+      expect.any(Number),
       expect.objectContaining({
-        buildPhase: BuildPhase.PREPARE_CREDENTIALS,
+        build_phase: BuildPhase.PREPARE_CREDENTIALS.toLowerCase(),
         result: BuildPhaseResult.WARNING,
       })
     );
-    expect(reportBuildPhaseStats).toHaveBeenCalledWith(
+    expect(datadogDistributionMock).toHaveBeenCalledWith(
+      'eas.build.phase_duration',
+      expect.any(Number),
       expect.objectContaining({
-        buildPhase: BuildPhase.CONFIGURE_ANDROID_VERSION,
+        build_phase: BuildPhase.CONFIGURE_ANDROID_VERSION.toLowerCase(),
         result: BuildPhaseResult.WARNING,
       })
     );
@@ -263,4 +273,37 @@ describe(androidBuilder, () => {
 
     expect(runBuilderWithHooksAsync).toHaveBeenCalledWith(ctx, expect.any(Function));
   });
+
+  it('runs the embedded bundle upload phase when EAS_UPDATE_EXPERIMENTAL_UPLOAD_EMBEDDED_BUNDLE is set', async () => {
+    const ctx = new BuildContext(createTestAndroidJob(), {
+      workingdir: '/workingdir',
+      logBuffer: { getLogs: () => [], getPhaseLogs: () => [] },
+      logger: createMockLogger(),
+      env: {
+        __API_SERVER_URL: 'http://api.expo.test',
+        EAS_UPDATE_EXPERIMENTAL_UPLOAD_EMBEDDED_BUNDLE: '1',
+      },
+      uploadArtifact: jest.fn(),
+    });
+
+    await androidBuilder(ctx);
+
+    expect(uploadEmbeddedBundleAsync).toHaveBeenCalledWith(ctx);
+  });
+
+  it('skips the embedded bundle upload phase when EAS_UPDATE_EXPERIMENTAL_UPLOAD_EMBEDDED_BUNDLE is not set', async () => {
+    const ctx = new BuildContext(createTestAndroidJob(), {
+      workingdir: '/workingdir',
+      logBuffer: { getLogs: () => [], getPhaseLogs: () => [] },
+      logger: createMockLogger(),
+      env: {
+        __API_SERVER_URL: 'http://api.expo.test',
+      },
+      uploadArtifact: jest.fn(),
+    });
+
+    await androidBuilder(ctx);
+
+    expect(uploadEmbeddedBundleAsync).not.toHaveBeenCalled();
+  });
 });

packages/build-tools/src/builders/android.ts

@@ -10,6 +10,8 @@ import {
   resolveGradleCommand,
   runGradleCommand,
 } from '../android/gradle';
+import { parseGradleProfile, formatGradleProfileReport } from '../android/gradleProfile';
+import { Sentry } from '../sentry';
 import { eagerBundleAsync, shouldUseEagerBundle } from '../common/eagerBundle';
 import { prebuildAsync } from '../common/prebuild';
 import { setupAsync } from '../common/setup';
@@ -30,6 +32,7 @@ import {
   configureExpoUpdatesIfInstalledAsync,
   resolveRuntimeVersionForExpoUpdatesIfConfiguredAsync,
 } from '../utils/expoUpdates';
+import { uploadEmbeddedBundleAsync } from '../utils/expoUpdatesEmbedded';
 import { Hook, runHookIfPresent } from '../utils/hooks';
 import { prepareExecutableAsync } from '../utils/prepareBuildExecutable';
 
@@ -180,6 +183,20 @@ async function buildAsync(ctx: BuildContext<Android.Job>): Promise<void> {
     });
   });
 
+  await ctx.runBuildPhase(BuildPhase.GRADLE_BUILD_PROFILE, async () => {
+    try {
+      const androidDir = path.join(ctx.getReactNativeProjectDirectory(), 'android');
+      const profileTasks = await parseGradleProfile(androidDir);
+      if (profileTasks.length > 0) {
+        const report = formatGradleProfileReport(profileTasks);
+        ctx.logger.info(report);
+      }
+    } catch (err: any) {
+      Sentry.capture('Failed to parse Gradle build profile', err);
+      ctx.markBuildPhaseSkipped();
+    }
+  });
+
   await ctx.runBuildPhase(BuildPhase.PRE_UPLOAD_ARTIFACTS_HOOK, async () => {
     await runHookIfPresent(ctx, Hook.PRE_UPLOAD_ARTIFACTS);
   });
@@ -192,6 +209,12 @@ async function buildAsync(ctx: BuildContext<Android.Job>): Promise<void> {
     });
   });
 
+  if (ctx.env.EAS_UPDATE_EXPERIMENTAL_UPLOAD_EMBEDDED_BUNDLE) {
+    await ctx.runBuildPhase(BuildPhase.UPLOAD_EMBEDDED_BUNDLE, async () => {
+      await uploadEmbeddedBundleAsync(ctx);
+    });
+  }
+
   await ctx.runBuildPhase(BuildPhase.SAVE_CACHE, async () => {
     if (ctx.isLocal) {
       ctx.logger.info('Local builds do not support saving cache.');

packages/build-tools/src/builders/ios.ts

@@ -16,6 +16,7 @@ import { runFastlaneGym, runFastlaneResign } from '../ios/fastlane';
 import { installPods } from '../ios/pod';
 import { downloadApplicationArchiveAsync } from '../ios/resign';
 import { resolveArtifactPath, resolveBuildConfiguration, resolveScheme } from '../ios/resolve';
+import { Sentry } from '../sentry';
 import { parseAndReportXcactivitylog } from '../steps/utils/ios/xcactivitylog';
 import { cacheStatsAsync, restoreCcacheAsync } from '../steps/functions/restoreBuildCache';
 import { saveCcacheAsync } from '../steps/functions/saveBuildCache';
@@ -24,6 +25,7 @@ import {
   configureExpoUpdatesIfInstalledAsync,
   resolveRuntimeVersionForExpoUpdatesIfConfiguredAsync,
 } from '../utils/expoUpdates';
+import { uploadEmbeddedBundleAsync } from '../utils/expoUpdatesEmbedded';
 import { Hook, runHookIfPresent } from '../utils/hooks';
 import { prepareExecutableAsync } from '../utils/prepareBuildExecutable';
 import { getParentAndDescendantProcessPidsAsync } from '../utils/processes';
@@ -173,17 +175,28 @@ async function buildAsync(ctx: BuildContext<Ios.Job>): Promise<void> {
     });
   }
 
-  if (ctx.env.EXPERIMENTAL_EAS_XCACTIVITYLOG === '1') {
-    const { derivedDataPath, workspacePath } = nullthrows(fastlaneResult);
-    await ctx.runBuildPhase(BuildPhase.PARSE_XCACTIVITYLOG, async () => {
-      await parseAndReportXcactivitylog({
+  await ctx.runBuildPhase(BuildPhase.PARSE_XCACTIVITYLOG, async () => {
+    if (ctx.isLocal) {
+      ctx.logger.info('Local builds skip build performance analysis.');
+      return;
+    }
+    try {
+      const { derivedDataPath, workspacePath } = nullthrows(fastlaneResult);
+      const { skipped } = await parseAndReportXcactivitylog({
         derivedDataPath,
         workspacePath,
         logger: ctx.logger,
         proxyBaseUrl: ctx.env.EAS_BUILD_COCOAPODS_CACHE_URL,
+        env: ctx.env,
       });
-    });
-  }
+      if (skipped) {
+        ctx.markBuildPhaseSkipped();
+      }
+    } catch (err: any) {
+      Sentry.capture('Failed to parse xcactivitylog', err);
+      ctx.markBuildPhaseSkipped();
+    }
+  });
 
   await ctx.runBuildPhase(BuildPhase.PRE_UPLOAD_ARTIFACTS_HOOK, async () => {
     await runHookIfPresent(ctx, Hook.PRE_UPLOAD_ARTIFACTS);
@@ -197,6 +210,12 @@ async function buildAsync(ctx: BuildContext<Ios.Job>): Promise<void> {
     });
   });
 
+  if (ctx.env.EAS_UPDATE_EXPERIMENTAL_UPLOAD_EMBEDDED_BUNDLE) {
+    await ctx.runBuildPhase(BuildPhase.UPLOAD_EMBEDDED_BUNDLE, async () => {
+      await uploadEmbeddedBundleAsync(ctx);
+    });
+  }
+
   await ctx.runBuildPhase(BuildPhase.SAVE_CACHE, async () => {
     if (ctx.isLocal) {
       ctx.logger.info('Local builds do not support saving cache.');

packages/build-tools/src/common/__tests__/easBuildInternal.test.ts

@@ -1,4 +1,4 @@
-import { BuildJob } from '@expo/eas-build-job';
+import { ArchiveSourceType, BuildJob, Platform, Workflow } from '@expo/eas-build-job';
 import spawn from '@expo/turtle-spawn';
 
 import { resolveEnvFromBuildProfileAsync, runEasBuildInternalAsync } from '../easBuildInternal';
@@ -15,7 +15,7 @@ jest.mock('../../utils/easCli', () => ({
 
 describe('easBuildInternal', () => {
   beforeEach(() => {
-    jest.resetAllMocks();
+    jest.clearAllMocks();
     jest.mocked(resolveEasCommandPrefixAndEnvAsync).mockResolvedValue({
       cmd: 'npx',
       args: ['-y', 'eas-cli@latest'],
@@ -69,4 +69,131 @@ describe('easBuildInternal', () => {
     expect(resolveEasCommandPrefixAndEnvAsync).toHaveBeenCalledWith();
     expect(spawn).not.toHaveBeenCalled();
   });
+
+  it('passes --refresh-ad-hoc-provisioning-profile to build:internal for iOS jobs with refreshAdHocProvisioningProfile', async () => {
+    const logger = {
+      info: jest.fn(),
+      warn: jest.fn(),
+      error: jest.fn(),
+      child: jest.fn(),
+    } as any;
+
+    const internalJob = {
+      platform: Platform.IOS,
+      type: Workflow.GENERIC,
+      triggeredBy: 'EAS_CLI',
+      projectArchive: { type: ArchiveSourceType.URL, url: 'https://example.com' },
+      projectRootDirectory: '.',
+      secrets: {
+        buildCredentials: {
+          testapp: {
+            distributionCertificate: {
+              dataBase64: 'YmluYXJ5Y29udGVudDE=',
+              password: 'distCertPassword',
+            },
+            provisioningProfileBase64: 'MnRuZXRub2N5cmFuaWI=',
+          },
+        },
+      },
+      initiatingUserId: 'user-id',
+      appId: 'app-id',
+    };
+
+    jest.mocked(spawn).mockResolvedValue({
+      stdout: Buffer.from(
+        JSON.stringify({
+          job: internalJob,
+          metadata: {},
+        })
+      ),
+      stderr: Buffer.from(''),
+    } as any);
+
+    const job = {
+      platform: Platform.IOS,
+      buildProfile: 'preview',
+      refreshAdHocProvisioningProfile: true,
+      appId: 'app-id',
+      initiatingUserId: 'user-id',
+      secrets: { robotAccessToken: 'token' },
+    } as unknown as BuildJob;
+
+    await runEasBuildInternalAsync({
+      job,
+      logger,
+      env: {},
+      cwd: '/tmp/project',
+    });
+
+    expect(spawn).toHaveBeenCalledWith(
+      'npx',
+      expect.arrayContaining([
+        'build:internal',
+        '--platform',
+        Platform.IOS,
+        '--profile',
+        'preview',
+        '--refresh-ad-hoc-provisioning-profile',
+      ]),
+      expect.any(Object)
+    );
+  });
+
+  it('preserves refreshAdHocProvisioningProfile from the incoming job', async () => {
+    const logger = {
+      info: jest.fn(),
+      warn: jest.fn(),
+      error: jest.fn(),
+      child: jest.fn(),
+    } as any;
+
+    const internalJob = {
+      platform: Platform.IOS,
+      type: Workflow.GENERIC,
+      triggeredBy: 'EAS_CLI',
+      projectArchive: { type: ArchiveSourceType.URL, url: 'https://example.com' },
+      projectRootDirectory: '.',
+      secrets: {
+        buildCredentials: {
+          testapp: {
+            distributionCertificate: {
+              dataBase64: 'YmluYXJ5Y29udGVudDE=',
+              password: 'distCertPassword',
+            },
+            provisioningProfileBase64: 'MnRuZXRub2N5cmFuaWI=',
+          },
+        },
+      },
+      initiatingUserId: 'user-id',
+      appId: 'app-id',
+    };
+
+    jest.mocked(spawn).mockResolvedValue({
+      stdout: Buffer.from(
+        JSON.stringify({
+          job: internalJob,
+          metadata: {},
+        })
+      ),
+      stderr: Buffer.from(''),
+    } as any);
+
+    const job = {
+      platform: Platform.IOS,
+      buildProfile: 'preview',
+      refreshAdHocProvisioningProfile: true,
+      appId: 'app-id',
+      initiatingUserId: 'user-id',
+      secrets: { robotAccessToken: 'token' },
+    } as unknown as BuildJob;
+
+    const { newJob } = await runEasBuildInternalAsync({
+      job,
+      logger,
+      env: {},
+      cwd: '/tmp/project',
+    });
+
+    expect((newJob as any).refreshAdHocProvisioningProfile).toBe(true);
+  });
 });

packages/build-tools/src/common/__tests__/xcpretty.test.ts

@@ -0,0 +1,94 @@
+import { EventEmitter } from 'events';
+
+import spawnAsync from '@expo/spawn-async';
+import { ExpoRunFormatter } from '@expo/xcpretty';
+import fg from 'fast-glob';
+
+import { createMockLogger } from '../../__tests__/utils/logger';
+import { Sentry } from '../../sentry';
+import { XcodeBuildLogger } from '../xcpretty';
+
+jest.mock('@expo/spawn-async');
+jest.mock('@expo/xcpretty');
+jest.mock('fast-glob');
+jest.mock('../../sentry', () => ({
+  Sentry: {
+    setup: jest.fn(),
+    capture: jest.fn(),
+    flush: jest.fn(),
+  },
+}));
+
+describe(XcodeBuildLogger, () => {
+  let stdout: EventEmitter;
+  let formatter: { pipe: jest.Mock; getBuildSummary: jest.Mock };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    stdout = new EventEmitter();
+    const spawnPromise = Object.assign(new Promise(() => {}), {
+      child: { stdout, kill: jest.fn() },
+    });
+    jest.mocked(spawnAsync).mockReturnValue(spawnPromise as any);
+
+    formatter = {
+      pipe: jest.fn(),
+      getBuildSummary: jest.fn().mockReturnValue('summary'),
+    };
+    jest.mocked(ExpoRunFormatter.create).mockReturnValue(formatter as any);
+
+    jest.mocked(fg).mockResolvedValue(['build.log'] as any);
+  });
+
+  async function startWatchingAsync(logger: ReturnType<typeof createMockLogger>): Promise<void> {
+    const buildLogger = new XcodeBuildLogger(logger, '/project');
+    await buildLogger.watchLogFiles('/logs');
+  }
+
+  it('logs formatted lines', async () => {
+    const logger = createMockLogger();
+    await startWatchingAsync(logger);
+
+    formatter.pipe.mockReturnValue(['line1', 'line2']);
+    stdout.emit('data', 'raw xcodebuild output');
+
+    expect(formatter.pipe).toHaveBeenCalledWith('raw xcodebuild output');
+    expect(logger.info).toHaveBeenCalledWith('line1');
+    expect(logger.info).toHaveBeenCalledWith('line2');
+    expect(Sentry.capture).not.toHaveBeenCalled();
+  });
+
+  it('falls back to raw logs when the formatter throws', async () => {
+    const logger = createMockLogger();
+    await startWatchingAsync(logger);
+
+    formatter.pipe.mockImplementation(() => {
+      throw new RangeError('Invalid array length');
+    });
+    stdout.emit('data', 'offending output');
+
+    expect(logger.info).toHaveBeenCalledWith('offending output');
+  });
+
+  it('reports the formatter error to Sentry only once', async () => {
+    const logger = createMockLogger();
+    await startWatchingAsync(logger);
+
+    const error = new RangeError('Invalid array length');
+    formatter.pipe.mockImplementation(() => {
+      throw error;
+    });
+    stdout.emit('data', 'offending output');
+    stdout.emit('data', 'more offending output');
+
+    expect(logger.info).toHaveBeenCalledWith('offending output');
+    expect(logger.info).toHaveBeenCalledWith('more offending output');
+    expect(Sentry.capture).toHaveBeenCalledTimes(1);
+    expect(Sentry.capture).toHaveBeenCalledWith(
+      'xcpretty formatter failed to parse xcodebuild logs',
+      error,
+      { extras: { data: 'offending output' } }
+    );
+  });
+});

packages/build-tools/src/common/easBuildInternal.ts

@@ -1,4 +1,12 @@
-import { BuildJob, Env, Metadata, sanitizeBuildJob, sanitizeMetadata } from '@expo/eas-build-job';
+import {
+  BuildJob,
+  Env,
+  Ios,
+  Metadata,
+  Platform,
+  sanitizeBuildJob,
+  sanitizeMetadata,
+} from '@expo/eas-build-job';
 import { PipeMode, bunyan } from '@expo/logger';
 import { BuildStepEnv } from '@expo/steps';
 import spawn from '@expo/turtle-spawn';
@@ -42,38 +50,48 @@ export async function runEasBuildInternalAsync<TJob extends BuildJob>({
     autoSubmitArgs.push('--auto-submit');
   }
 
-  const result = await spawn(
-    cmd,
-    [
-      ...args,
-      'build:internal',
-      '--platform',
-      job.platform,
-      '--profile',
-      buildProfile,
-      ...autoSubmitArgs,
-    ],
-    {
-      cwd,
-      env: {
-        ...env,
-        EXPO_TOKEN: nullthrows(job.secrets, 'Secrets must be defined for non-custom builds')
-          .robotAccessToken,
-        ...extraEnv,
-        EAS_PROJECT_ROOT: projectRootOverride,
-      },
-      logger,
-      // This prevents printing stdout with job secrets and credentials to logs.
-      mode: PipeMode.STDERR_ONLY_AS_STDOUT,
-    }
-  );
+  const refreshAdHocProvisioningProfileArgs = [];
+  if (job.platform === Platform.IOS && job.refreshAdHocProvisioningProfile === true) {
+    refreshAdHocProvisioningProfileArgs.push('--refresh-ad-hoc-provisioning-profile');
+  }
 
-  const stdout = result.stdout.toString();
-  const parsed = JSON.parse(stdout);
-  return validateEasBuildInternalResult({
-    result: parsed,
-    oldJob: job,
-  });
+  try {
+    const result = await spawn(
+      cmd,
+      [
+        ...args,
+        'build:internal',
+        '--platform',
+        job.platform,
+        '--profile',
+        buildProfile,
+        ...autoSubmitArgs,
+        ...refreshAdHocProvisioningProfileArgs,
+      ],
+      {
+        cwd,
+        env: {
+          ...env,
+          EXPO_TOKEN: nullthrows(job.secrets, 'Secrets must be defined for non-custom builds')
+            .robotAccessToken,
+          ...extraEnv,
+          EAS_PROJECT_ROOT: projectRootOverride,
+        },
+        logger,
+        // This prevents printing stdout with job secrets and credentials to logs.
+        mode: PipeMode.STDERR_ONLY_AS_STDOUT,
+      }
+    );
+
+    const stdout = result.stdout.toString();
+    const parsed = JSON.parse(stdout);
+    return validateEasBuildInternalResult({
+      result: parsed,
+      oldJob: job,
+    });
+  } catch (err: any) {
+    throw new Error('Failed to run eas build:internal');
+  }
 }
 
 export async function resolveEnvFromBuildProfileAsync<TJob extends BuildJob>(
@@ -134,6 +152,9 @@ function validateEasBuildInternalResult<TJob extends BuildJob>({
     // We want to retain values that we have set on the job.
     appId: oldJob.appId,
     initiatingUserId: oldJob.initiatingUserId,
+    ...(oldJob.platform === Platform.IOS && oldJob.refreshAdHocProvisioningProfile === true
+      ? { refreshAdHocProvisioningProfile: true }
+      : null),
   }) as TJob;
   assert(newJob.platform === oldJob.platform, 'eas-cli returned a job for a wrong platform');
   const newMetadata = sanitizeMetadata(value.metadata);

packages/build-tools/src/common/xcpretty.ts

@@ -6,11 +6,14 @@ import fg from 'fast-glob';
 import fs from 'fs-extra';
 import path from 'path';
 
+import { Sentry } from '../sentry';
+
 const CHECK_FILE_INTERVAL_MS = 1000;
 
 export class XcodeBuildLogger {
   private loggerError?: Error;
   private flushing: boolean = false;
+  private reportedFormatterError: boolean = false;
   private logReaderPromise?: SpawnPromise<SpawnResult>;
   private logsPath?: string;
 
@@ -60,9 +63,21 @@ export class XcodeBuildLogger {
       this.logReaderPromise = spawnAsync('tail', ['-n', '+0', '-f', logsPath], { stdio: 'pipe' });
       assert(this.logReaderPromise.child.stdout, 'stdout is not available');
       this.logReaderPromise.child.stdout.on('data', (data: string) => {
-        const lines = formatter.pipe(data.toString());
-        for (const line of lines) {
-          this.logger.info(line);
+        try {
+          const lines = formatter.pipe(data.toString());
+          for (const line of lines) {
+            this.logger.info(line);
+          }
+        } catch (err: any) {
+          // The formatter can throw on unexpected xcodebuild output. Fall back to
+          // raw logs instead of crashing the process with an uncaught exception.
+          if (!this.reportedFormatterError) {
+            this.reportedFormatterError = true;
+            Sentry.capture('xcpretty formatter failed to parse xcodebuild logs', err, {
+              extras: { data: data.toString().slice(-2000) },
+            });
+          }
+          this.logger.info(data.toString());
         }
       });
       await this.logReaderPromise;

packages/build-tools/src/context.ts

@@ -2,7 +2,6 @@ import { ExpoConfig } from '@expo/config';
 import {
   BuildPhase,
   BuildPhaseResult,
-  BuildPhaseStats,
   Env,
   EnvironmentSecretType,
   GenericArtifactType,
@@ -20,6 +19,7 @@ import fs from 'fs-extra';
 import path from 'path';
 
 import { resolveBuildPhaseErrorAsync } from './buildErrors/detectError';
+import { Datadog } from './datadog';
 import { readAppConfig } from './utils/appConfig';
 import { createTemporaryEnvironmentSecretFile } from './utils/environmentSecrets';
 import { PackageManager, resolvePackageManager } from './utils/packageManager';
@@ -64,7 +64,6 @@ export interface BuildContextOptions {
     err?: Error,
     options?: { tags?: Record<string, string>; extras?: Record<string, string> }
   ) => void;
-  reportBuildPhaseStats?: (stats: BuildPhaseStats) => void;
   skipNativeBuild?: boolean;
   metadata?: Metadata;
   expoApiV2BaseUrl?: string;
@@ -97,7 +96,6 @@ export class BuildContext<TJob extends Job = Job> {
   private buildPhaseSkipped = false;
   private buildPhaseHasWarnings = false;
   private _appConfig?: Promise<ExpoConfig>;
-  private readonly reportBuildPhaseStats?: (stats: BuildPhaseStats) => void;
   public readonly graphqlClient: Client;
 
   constructor(job: TJob, options: BuildContextOptions) {
@@ -113,7 +111,6 @@ export class BuildContext<TJob extends Job = Job> {
     this._metadata = options.metadata;
     this.skipNativeBuild = options.skipNativeBuild;
     this.expoApiV2BaseUrl = options.expoApiV2BaseUrl;
-    this.reportBuildPhaseStats = options.reportBuildPhaseStats;
 
     const environmentSecrets = this.getEnvironmentSecrets(job);
     this._env = {
@@ -354,7 +351,13 @@ export class BuildContext<TJob extends Job = Job> {
     }
     await this.collectAndUpdateEnvVariablesAsync();
 
-    this.reportBuildPhaseStats?.({ buildPhase: this.buildPhase, result, durationMs });
+    if (this.job.platform) {
+      Datadog.distribution('eas.build.phase_duration', durationMs, {
+        build_phase: this.buildPhase.toLowerCase(),
+        platform: this.job.platform,
+        result,
+      });
+    }
 
     if (!doNotMarkEnd) {
       this.logger.info(

packages/build-tools/src/datadog.ts

@@ -0,0 +1,84 @@
+import { Sentry } from './sentry';
+import { turtleFetch } from './utils/turtleFetch';
+
+type DatadogSetupOptions = {
+  expoApiV2BaseUrl: string;
+  turtleBuildId: string;
+  robotAccessToken: string;
+};
+
+let setupOptions: DatadogSetupOptions | null = null;
+let pendingUploads: Promise<unknown>[] = [];
+
+export const Datadog = {
+  setup(opts: DatadogSetupOptions | null): void {
+    setupOptions = opts;
+  },
+
+  distribution(name: string, value: number, tags: Record<string, string> = {}): void {
+    if (!setupOptions) {
+      return;
+    }
+    const { expoApiV2BaseUrl, turtleBuildId, robotAccessToken } = setupOptions;
+    const metrics = [
+      {
+        name,
+        type: 'distribution' as const,
+        value,
+        tags,
+      },
+    ];
+
+    const uploadPromise = turtleFetch(
+      new URL(`turtle-builds/${turtleBuildId}/metrics`, expoApiV2BaseUrl).toString(),
+      'POST',
+      {
+        json: { metrics },
+        headers: {
+          Authorization: `Bearer ${robotAccessToken}`,
+        },
+        retries: 2,
+      }
+    ).catch(err => {
+      Sentry.capture('Failed to report turtle build metric', err, {
+        extras: { metrics },
+      });
+    });
+
+    pendingUploads.push(uploadPromise);
+  },
+
+  log(message: string, tags: Record<string, string> = {}): void {
+    if (!setupOptions) {
+      return;
+    }
+    const { expoApiV2BaseUrl, turtleBuildId, robotAccessToken } = setupOptions;
+    const log = {
+      buildId: turtleBuildId,
+      message,
+      tags,
+    };
+
+    const uploadPromise = turtleFetch(
+      new URL('turtle-builds/logs', expoApiV2BaseUrl).toString(),
+      'POST',
+      {
+        json: log,
+        headers: {
+          Authorization: `Bearer ${robotAccessToken}`,
+        },
+        shouldThrowOnNotOk: false,
+      }
+    ).catch(err => {
+      Sentry.capture('Failed to report turtle build log', err, {
+        extras: { log },
+      });
+    });
+
+    pendingUploads.push(uploadPromise);
+  },
+
+  async flushAsync(): Promise<void> {
+    await Promise.allSettled(pendingUploads);
+  },
+};

packages/build-tools/src/index.ts

@@ -20,4 +20,10 @@ export { findAndUploadXcodeBuildLogsAsync } from './ios/xcodeBuildLogs';
 
 export { Hook, runHookIfPresent } from './utils/hooks';
 
+export { parseGradleProfile, formatGradleProfileReport } from './android/gradleProfile';
+export type { GradleProfileTask } from './android/gradleProfile';
+
 export * from './generic';
+
+export { Datadog } from './datadog';
+export { Sentry } from './sentry';

packages/build-tools/src/ios/__tests__/__snapshots__/fastfile.test.ts.snap

@@ -9,6 +9,7 @@ exports[`fastfile createFastfileForResigningBuild should create Fastfile with al
       "com.example.app" => "/path/to/profiles/main.mobileprovision",
       "com.example.app.widget" => "/path/to/profiles/widget.mobileprovision",
     },
+    use_app_entitlements: true,
     keychain_path: "/Users/expo/Library/Keychains/login.keychain"
   )
 end
@@ -22,6 +23,7 @@ exports[`fastfile createFastfileForResigningBuild should handle empty provisioni
     signing_identity: "iPhone Distribution",
     provisioning_profile: {
     },
+    use_app_entitlements: true,
     keychain_path: "/tmp/keychain"
   )
 end
@@ -39,6 +41,7 @@ exports[`fastfile createFastfileForResigningBuild should handle multiple provisi
       "com.example.app.extension" => "/profiles/extension.mobileprovision",
       "com.example.app.intents" => "/profiles/intents.mobileprovision",
     },
+    use_app_entitlements: true,
     keychain_path: "/tmp/keychain"
   )
 end
@@ -53,6 +56,7 @@ exports[`fastfile createFastfileForResigningBuild should handle paths with speci
     provisioning_profile: {
       "com.example.app" => "/path/with spaces/profile (1).mobileprovision",
     },
+    use_app_entitlements: true,
     keychain_path: "/Users/expo/Library/Keychains/login keychain.keychain"
   )
 end
@@ -67,6 +71,7 @@ exports[`fastfile createFastfileForResigningBuild should handle single provision
     provisioning_profile: {
       "com.example.app" => "/tmp/profile.mobileprovision",
     },
+    use_app_entitlements: true,
     keychain_path: "/tmp/keychain"
   )
 end
@@ -81,6 +86,7 @@ exports[`fastfile createFastfileForResigningBuild should produce valid Ruby synt
     provisioning_profile: {
       "com.example.app" => "/path/to/profile.mobileprovision",
     },
+    use_app_entitlements: true,
     keychain_path: "/tmp/keychain"
   )
 end

packages/build-tools/src/ios/__tests__/pod.test.ts

@@ -0,0 +1,203 @@
+import { Ios, getInstalledExpoPackageVersionAsync } from '@expo/eas-build-job';
+import spawn from '@expo/turtle-spawn';
+import fs from 'fs-extra';
+import { vol } from 'memfs';
+import path from 'path';
+
+import { createTestIosJob } from '../../__tests__/utils/job';
+import { createMockLogger } from '../../__tests__/utils/logger';
+import { BuildContext } from '../../context';
+import { installPods } from '../pod';
+
+jest.mock('@expo/eas-build-job', () => ({
+  ...jest.requireActual('@expo/eas-build-job'),
+  getInstalledExpoPackageVersionAsync: jest.fn(),
+}));
+jest.mock('@expo/turtle-spawn', () => ({
+  __esModule: true,
+  default: jest.fn(),
+}));
+
+const WORKING_DIR = '/workingdir';
+const PROJECT_DIR = path.join(WORKING_DIR, 'build');
+const IOS_DIR = path.join(PROJECT_DIR, 'ios');
+
+function makeIosBuildContext({
+  expoVersion,
+  cocoapodsCacheUrl,
+  usePrecompiledModules = true,
+  expoUsePrecompiledModules,
+}: {
+  expoVersion?: string;
+  cocoapodsCacheUrl?: string;
+  usePrecompiledModules?: boolean;
+  expoUsePrecompiledModules?: string;
+}): BuildContext<Ios.Job> {
+  vol.fromJSON({
+    [path.join(IOS_DIR, '.keep')]: '',
+    ...(expoVersion
+      ? {
+          [path.join(PROJECT_DIR, 'node_modules/expo/package.json')]: JSON.stringify({
+            version: expoVersion,
+          }),
+        }
+      : {}),
+  });
+
+  const job: Ios.Job = {
+    ...createTestIosJob(),
+    builderEnvironment: {
+      env: {
+        ...(usePrecompiledModules ? { EAS_USE_PRECOMPILED_MODULES: '1' } : {}),
+      },
+    },
+  };
+
+  return new BuildContext(job, {
+    workingdir: WORKING_DIR,
+    logger: createMockLogger(),
+    logBuffer: { getLogs: () => [], getPhaseLogs: () => [] },
+    env: {
+      __API_SERVER_URL: 'http://api.expo.test',
+      ...(expoUsePrecompiledModules
+        ? { EXPO_USE_PRECOMPILED_MODULES: expoUsePrecompiledModules }
+        : {}),
+      ...(cocoapodsCacheUrl ? { EAS_BUILD_COCOAPODS_CACHE_URL: cocoapodsCacheUrl } : {}),
+    },
+    uploadArtifact: jest.fn(),
+  });
+}
+
+describe(installPods, () => {
+  beforeEach(() => {
+    vol.reset();
+    jest.mocked(getInstalledExpoPackageVersionAsync).mockImplementation(async ({ projectDir }) => {
+      return (await fs.readJson(path.join(projectDir, 'node_modules/expo/package.json'))).version;
+    });
+    (spawn as jest.Mock).mockResolvedValue(undefined);
+  });
+
+  it('adds precompiled modules env var for Expo versions well above the minimum', async () => {
+    const ctx = makeIosBuildContext({ expoVersion: '999.0.0' });
+
+    await installPods(ctx, {});
+
+    expect(getInstalledExpoPackageVersionAsync).toHaveBeenCalledWith({
+      env: expect.objectContaining({
+        __API_SERVER_URL: 'http://api.expo.test',
+      }),
+      projectDir: PROJECT_DIR,
+    });
+    expect(spawn).toHaveBeenCalledWith(
+      'pod',
+      ['install'],
+      expect.objectContaining({
+        cwd: IOS_DIR,
+        env: expect.objectContaining({
+          EXPO_USE_PRECOMPILED_MODULES: '1',
+          EXPO_PRECOMPILED_MODULES_BASE_URL:
+            'https://storage.googleapis.com/eas-build-precompiled-modules/',
+        }),
+      })
+    );
+    expect(ctx.logger.info).toHaveBeenCalledWith(
+      'Detected expo=999.0.0; enabling precompiled modules use. Installing pods with additional environment variables.\nEXPO_USE_PRECOMPILED_MODULES=1\nEXPO_PRECOMPILED_MODULES_BASE_URL=https://storage.googleapis.com/eas-build-precompiled-modules/\nPrecompiled modules pod install environment is configured.'
+    );
+  });
+
+  it('proxies precompiled modules through CocoaPods cache when enabled', async () => {
+    const ctx = makeIosBuildContext({
+      expoVersion: '999.0.0',
+      cocoapodsCacheUrl: 'https://cocoapods-cache.expo.test/',
+    });
+
+    await installPods(ctx, {});
+
+    expect(spawn).toHaveBeenCalledWith(
+      'pod',
+      ['install'],
+      expect.objectContaining({
+        cwd: IOS_DIR,
+        env: expect.objectContaining({
+          EXPO_USE_PRECOMPILED_MODULES: '1',
+          EXPO_PRECOMPILED_MODULES_BASE_URL:
+            'https://cocoapods-cache.expo.test/storage.googleapis.com/eas-build-precompiled-modules/',
+        }),
+      })
+    );
+    expect(ctx.logger.info).toHaveBeenCalledWith(
+      'Detected expo=999.0.0; enabling precompiled modules use. Installing pods with additional environment variables.\nEXPO_USE_PRECOMPILED_MODULES=1\nEXPO_PRECOMPILED_MODULES_BASE_URL=https://cocoapods-cache.expo.test/storage.googleapis.com/eas-build-precompiled-modules/\nPrecompiled modules pod install environment is configured.'
+    );
+  });
+
+  it('does not add precompiled modules env vars below the minimum Expo version', async () => {
+    const ctx = makeIosBuildContext({ expoVersion: '55.0.25' });
+
+    await installPods(ctx, {});
+
+    expect((spawn as jest.Mock).mock.calls[0][2].env.EXPO_USE_PRECOMPILED_MODULES).toBeUndefined();
+    expect(ctx.logger.info).toHaveBeenCalledWith(
+      expect.stringMatching(
+        /^Detected expo=55\.0\.25; not enabling precompiled modules use because precompiled modules require expo>=55\.0\.26\./
+      )
+    );
+  });
+
+  it('does not add precompiled modules env vars when Expo version is invalid', async () => {
+    const ctx = makeIosBuildContext({ expoVersion: 'invalid-version' });
+
+    await installPods(ctx, {});
+
+    expect((spawn as jest.Mock).mock.calls[0][2].env.EXPO_USE_PRECOMPILED_MODULES).toBeUndefined();
+    expect(ctx.logger.info).toHaveBeenCalledWith(
+      'Detected expo=invalid-version; not enabling precompiled modules use because the installed Expo package version is not a valid semver version.'
+    );
+  });
+
+  it('does not add precompiled modules env vars when Expo version detection fails', async () => {
+    const ctx = makeIosBuildContext({});
+
+    await installPods(ctx, {});
+
+    expect((spawn as jest.Mock).mock.calls[0][2].env.EXPO_USE_PRECOMPILED_MODULES).toBeUndefined();
+    expect(ctx.logger.info).toHaveBeenCalledWith(
+      expect.objectContaining({ err: expect.objectContaining({ code: 'ENOENT' }) }),
+      'Failed to detect installed Expo package version; not enabling precompiled modules use.'
+    );
+  });
+
+  it('does not add precompiled modules env vars without the builder flag', async () => {
+    const ctx = makeIosBuildContext({
+      expoVersion: '999.0.0',
+      usePrecompiledModules: false,
+    });
+
+    await installPods(ctx, {});
+
+    expect((spawn as jest.Mock).mock.calls[0][2].env.EAS_USE_PRECOMPILED_MODULES).toBeUndefined();
+    expect((spawn as jest.Mock).mock.calls[0][2].env.EXPO_USE_PRECOMPILED_MODULES).toBeUndefined();
+    expect(
+      (spawn as jest.Mock).mock.calls[0][2].env.EXPO_PRECOMPILED_MODULES_BASE_URL
+    ).toBeUndefined();
+    expect(ctx.logger.info).not.toHaveBeenCalled();
+  });
+
+  it('does not override EXPO_USE_PRECOMPILED_MODULES=0 even when builder flag is enabled', async () => {
+    const ctx = makeIosBuildContext({
+      expoVersion: '999.0.0',
+      usePrecompiledModules: true,
+      expoUsePrecompiledModules: '0',
+    });
+
+    await installPods(ctx, {});
+
+    expect((spawn as jest.Mock).mock.calls[0][2].env.EXPO_USE_PRECOMPILED_MODULES).toBe('0');
+    expect(
+      (spawn as jest.Mock).mock.calls[0][2].env.EXPO_PRECOMPILED_MODULES_BASE_URL
+    ).toBeUndefined();
+    expect(ctx.logger.info).toHaveBeenCalledWith(
+      'EXPO_USE_PRECOMPILED_MODULES=0 is set; not enabling precompiled modules use.'
+    );
+    expect(getInstalledExpoPackageVersionAsync).not.toHaveBeenCalled();
+  });
+});

packages/build-tools/src/ios/fastlane.ts

@@ -10,8 +10,8 @@ import type { Credentials } from './credentials/manager';
 import { createFastfileForResigningBuild } from './fastfile';
 import { createGymfileForArchiveBuild, createGymfileForSimulatorBuild } from './gymfile';
 import { isTVOS } from './tvos';
-import { XcodeBuildLogger } from './xcpretty';
 import { COMMON_FASTLANE_ENV } from '../common/fastlane';
+import { XcodeBuildLogger } from '../common/xcpretty';
 import { BuildContext, SkipNativeBuildError } from '../context';
 
 export async function runFastlaneGym<TJob extends Ios.Job>(

packages/build-tools/src/ios/pod.ts

@@ -1,9 +1,14 @@
-import { Ios } from '@expo/eas-build-job';
+import { Env, Ios, getInstalledExpoPackageVersionAsync } from '@expo/eas-build-job';
 import spawn, { SpawnOptions, SpawnPromise, SpawnResult } from '@expo/turtle-spawn';
 import path from 'path';
+import semver from 'semver';
 
 import { BuildContext } from '../context';
 
+const MIN_PRECOMPILED_MODULES_EXPO_VERSION = '55.0.26';
+const PRECOMPILED_MODULES_BASE_URL =
+  'https://storage.googleapis.com/eas-build-precompiled-modules/';
+
 export async function installPods<TJob extends Ios.Job>(
   ctx: BuildContext<TJob>,
   { infoCallbackFn }: SpawnOptions
@@ -12,6 +17,7 @@ export async function installPods<TJob extends Ios.Job>(
 
   const verboseFlag = ctx.env['EAS_VERBOSE'] === '1' ? ['--verbose'] : [];
   const cocoapodsDeploymentFlag = ctx.env['POD_INSTALL_DEPLOYMENT'] === '1' ? ['--deployment'] : [];
+  const precompiledModulesEnv = await resolvePrecompiledModulesPodInstallEnvAsync(ctx);
 
   return {
     spawnPromise: spawn('pod', ['install', ...verboseFlag, ...cocoapodsDeploymentFlag], {
@@ -20,6 +26,7 @@ export async function installPods<TJob extends Ios.Job>(
       env: {
         ...ctx.env,
         LANG: 'en_US.UTF-8',
+        ...precompiledModulesEnv,
       },
       lineTransformer: (line?: string) => {
         if (
@@ -35,3 +42,72 @@ export async function installPods<TJob extends Ios.Job>(
     }),
   };
 }
+
+async function resolvePrecompiledModulesPodInstallEnvAsync<TJob extends Ios.Job>(
+  ctx: BuildContext<TJob>
+): Promise<Env> {
+  if (ctx.env.EXPO_USE_PRECOMPILED_MODULES === '0') {
+    ctx.logger.info('EXPO_USE_PRECOMPILED_MODULES=0 is set; not enabling precompiled modules use.');
+    return {};
+  }
+
+  if (ctx.job.builderEnvironment?.env?.EAS_USE_PRECOMPILED_MODULES !== '1') {
+    return {};
+  }
+
+  let expoPackageVersion: string;
+  try {
+    expoPackageVersion = await getInstalledExpoPackageVersionAsync({
+      env: ctx.env,
+      projectDir: ctx.getReactNativeProjectDirectory(),
+    });
+  } catch (err) {
+    ctx.logger.info(
+      { err },
+      'Failed to detect installed Expo package version; not enabling precompiled modules use.'
+    );
+    return {};
+  }
+
+  const validExpoPackageVersion = semver.valid(expoPackageVersion);
+  if (!validExpoPackageVersion) {
+    ctx.logger.info(
+      `Detected expo=${expoPackageVersion}; not enabling precompiled modules use because the installed Expo package version is not a valid semver version.`
+    );
+    return {};
+  }
+
+  if (semver.lt(validExpoPackageVersion, MIN_PRECOMPILED_MODULES_EXPO_VERSION)) {
+    ctx.logger.info(
+      `Detected expo=${validExpoPackageVersion}; not enabling precompiled modules use because precompiled modules require expo>=${MIN_PRECOMPILED_MODULES_EXPO_VERSION}.`
+    );
+    return {};
+  }
+
+  const env: Env = {
+    EXPO_USE_PRECOMPILED_MODULES: '1',
+    EXPO_PRECOMPILED_MODULES_BASE_URL: getPrecompiledModulesBaseUrl(ctx),
+  };
+
+  ctx.logger.info(
+    `Detected expo=${validExpoPackageVersion}; enabling precompiled modules use. Installing pods with additional environment variables.\n${Object.entries(
+      env
+    )
+      .map(([key, value]) => `${key}=${value}`)
+      .join('\n')}\nPrecompiled modules pod install environment is configured.`
+  );
+
+  return env;
+}
+
+function getPrecompiledModulesBaseUrl<TJob extends Ios.Job>(ctx: BuildContext<TJob>): string {
+  if (!ctx.env.EAS_BUILD_COCOAPODS_CACHE_URL) {
+    return PRECOMPILED_MODULES_BASE_URL;
+  }
+
+  const parsedUrl = new URL(PRECOMPILED_MODULES_BASE_URL);
+  return PRECOMPILED_MODULES_BASE_URL.replace(
+    `${parsedUrl.protocol}//${parsedUrl.host}`,
+    `${ctx.env.EAS_BUILD_COCOAPODS_CACHE_URL.replace(/\/$/, '')}/${parsedUrl.host}`
+  );
+}

packages/build-tools/src/sentry.ts

@@ -0,0 +1,81 @@
+import * as sentryNode from '@sentry/node';
+
+type CaptureOptions = {
+  tags?: Record<string, string>;
+  extras?: Record<string, unknown>;
+  level?: sentryNode.SeverityLevel;
+};
+
+type SentryAPI = {
+  setup(opts: { dsn: string | null; environment: string; tags?: Record<string, string> }): void;
+  capture(msg: string, options?: CaptureOptions): void;
+  capture(msg: string, err: Error | undefined, options?: CaptureOptions): void;
+  capture(err: Error, options?: CaptureOptions): void;
+  flush(timeoutMs?: number): Promise<boolean>;
+};
+
+export const Sentry: SentryAPI = {
+  setup({ dsn, environment, tags }) {
+    if (dsn) {
+      sentryNode.init({
+        dsn,
+        environment,
+        ...(tags ? { initialScope: { tags } } : {}),
+      });
+    }
+  },
+
+  capture(arg1: string | Error, arg2?: Error | CaptureOptions, arg3?: CaptureOptions): void {
+    let msg: string | undefined;
+    let err: Error | undefined;
+    let options: CaptureOptions = {};
+
+    if (arg1 instanceof Error) {
+      err = arg1;
+      options = (arg2 as CaptureOptions | undefined) ?? {};
+    } else {
+      msg = arg1;
+      if (arg3 !== undefined) {
+        // 3-arg form: arg2 unambiguously means err (null/undefined → no err)
+        options = arg3;
+        if (arg2 !== undefined && arg2 !== null) {
+          err = arg2 instanceof Error ? arg2 : new Error(String(arg2));
+        }
+      } else if (arg2 instanceof Error) {
+        err = arg2;
+      } else if (arg2 !== undefined && arg2 !== null) {
+        // 2-arg form: non-Error object → options; primitive → coerced err
+        if (typeof arg2 === 'object') {
+          options = arg2;
+        } else {
+          err = new Error(String(arg2));
+        }
+      }
+    }
+
+    sentryNode.withScope(scope => {
+      if (options.tags) {
+        scope.setTags(options.tags);
+      }
+      if (options.extras) {
+        scope.setExtras(options.extras);
+      }
+      if (options.level) {
+        scope.setLevel(options.level);
+      }
+
+      if (err) {
+        if (msg && err.message !== msg) {
+          scope.setExtra('message', msg);
+        }
+        sentryNode.captureException(err);
+      } else if (msg) {
+        sentryNode.captureMessage(msg);
+      }
+    });
+  },
+
+  flush(timeoutMs: number = 2000): Promise<boolean> {
+    return sentryNode.flush(timeoutMs);
+  },
+};

packages/build-tools/src/steps/easFunctions.ts

@@ -27,7 +27,6 @@ import { createRepackBuildFunction } from './functions/repack';
 import { createReportMaestroTestResultsFunction } from './functions/reportMaestroTestResults';
 import { resolveAppleTeamIdFromCredentialsFunction } from './functions/resolveAppleTeamIdFromCredentials';
 import { createResolveBuildConfigBuildFunction } from './functions/resolveBuildConfig';
-import { createResolveSubmitConfigBuildFunction } from './functions/resolveSubmitConfig';
 import {
   createCacheStatsBuildFunction,
   createRestoreBuildCacheFunction,
@@ -36,12 +35,16 @@ import { createRestoreCacheFunction } from './functions/restoreCache';
 import { parseXcactivitylogFunction } from './functions/parseXcactivitylog';
 import { runFastlaneFunction } from './functions/runFastlane';
 import { runGradleFunction } from './functions/runGradle';
+import { createMaestroTestsBuildFunction } from './functions/maestroTests';
 import { createSaveBuildCacheFunction } from './functions/saveBuildCache';
 import { createSaveCacheFunction } from './functions/saveCache';
 import { createSendSlackMessageFunction } from './functions/sendSlackMessage';
+import { createStartAgentDeviceRemoteSessionBuildFunction } from './functions/startAgentDeviceRemoteSession';
 import { createStartAndroidEmulatorBuildFunction } from './functions/startAndroidEmulator';
+import { createStartArgentRemoteSessionBuildFunction } from './functions/startArgentRemoteSession';
 import { createStartCuttlefishDeviceBuildFunction } from './functions/startCuttlefishDevice';
 import { createStartIosSimulatorBuildFunction } from './functions/startIosSimulator';
+import { createStartServeSimRemoteSessionBuildFunction } from './functions/startServeSimRemoteSession';
 import { createUploadArtifactBuildFunction } from './functions/uploadArtifact';
 import { createUploadToAscBuildFunction } from './functions/uploadToAsc';
 import { createSetUpNpmrcBuildFunction } from './functions/useNpmToken';
@@ -78,9 +81,12 @@ export function getEasFunctions(ctx: CustomBuildContext): BuildFunction[] {
     generateGymfileFromTemplateFunction(),
     runFastlaneFunction(),
     parseXcactivitylogFunction(),
+    createStartAgentDeviceRemoteSessionBuildFunction(ctx),
+    createStartArgentRemoteSessionBuildFunction(ctx),
     createStartAndroidEmulatorBuildFunction(),
     createStartCuttlefishDeviceBuildFunction(),
     createStartIosSimulatorBuildFunction(),
+    createStartServeSimRemoteSessionBuildFunction(ctx),
     createInstallMaestroBuildFunction(),
 
     createInstallPodsBuildFunction(),
@@ -89,10 +95,10 @@ export function getEasFunctions(ctx: CustomBuildContext): BuildFunction[] {
     calculateEASUpdateRuntimeVersionFunction(),
 
     createSubmissionEntityFunction(),
-    createResolveSubmitConfigBuildFunction(ctx),
     createUploadToAscBuildFunction(),
 
     createReportMaestroTestResultsFunction(ctx),
+    createMaestroTestsBuildFunction(),
   ];
 
   if (ctx.hasBuildJob()) {

packages/build-tools/src/steps/functions/__tests__/maestroFlowDiscovery.test.ts

@@ -0,0 +1,302 @@
+import { vol } from 'memfs';
+
+import { buildFlowNameToPathMap, readFlowName, walkDir } from '../maestroFlowDiscovery';
+import { createMockLogger } from '../../../__tests__/utils/logger';
+
+describe(readFlowName, () => {
+  beforeEach(() => vol.reset());
+
+  it('returns top-level `name` when present', async () => {
+    vol.fromJSON({
+      '/p/login.yml': `appId: com.example\nname: Login Flow\n---\n- launchApp\n`,
+    });
+    expect(await readFlowName('/p/login.yml')).toBe('Login Flow');
+  });
+
+  it('falls back to basename without extension when name absent', async () => {
+    vol.fromJSON({ '/p/login.yml': `appId: com.example\n---\n- launchApp\n` });
+    expect(await readFlowName('/p/login.yml')).toBe('login');
+  });
+
+  it('falls back when name is empty string', async () => {
+    vol.fromJSON({ '/p/login.yml': `name: ""\n` });
+    expect(await readFlowName('/p/login.yml')).toBe('login');
+  });
+
+  it('falls back when name is non-string', async () => {
+    vol.fromJSON({ '/p/login.yml': `name: 42\n` });
+    expect(await readFlowName('/p/login.yml')).toBe('login');
+  });
+
+  it('falls back when YAML is malformed', async () => {
+    vol.fromJSON({ '/p/login.yml': `appId: [unclosed\n` });
+    expect(await readFlowName('/p/login.yml')).toBe('login');
+  });
+
+  it('falls back when file is empty', async () => {
+    vol.fromJSON({ '/p/login.yml': '' });
+    expect(await readFlowName('/p/login.yml')).toBe('login');
+  });
+
+  it('falls back when file does not exist', async () => {
+    expect(await readFlowName('/p/missing.yml')).toBe('missing');
+  });
+
+  it('only parses the first YAML document (commands document errors are ignored)', async () => {
+    vol.fromJSON({
+      '/p/login.yml': `name: Login\n---\n- this is: { malformed yaml\n`,
+    });
+    expect(await readFlowName('/p/login.yml')).toBe('Login');
+  });
+
+  it('handles .yaml extension', async () => {
+    vol.fromJSON({ '/p/checkout.yaml': `name: Checkout\n` });
+    expect(await readFlowName('/p/checkout.yaml')).toBe('Checkout');
+  });
+
+  it('handles a leading `---` document marker', async () => {
+    vol.fromJSON({
+      '/p/login.yml': `---\nappId: com.example\nname: Login\n---\n- launchApp\n`,
+    });
+    expect(await readFlowName('/p/login.yml')).toBe('Login');
+  });
+});
+
+describe(walkDir, () => {
+  beforeEach(() => vol.reset());
+
+  it('collects all .yml/.yaml files recursively, sorted', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({
+      '/p/flows/a.yml': '',
+      '/p/flows/b.yaml': '',
+      '/p/flows/sub/c.yml': '',
+      '/p/flows/sub/d.YAML': '',
+      '/p/flows/readme.md': '',
+    });
+    const out: string[] = [];
+    await walkDir('/p/flows', new Set(), out, logger);
+    expect(out.sort()).toEqual([
+      '/p/flows/a.yml',
+      '/p/flows/b.yaml',
+      '/p/flows/sub/c.yml',
+      '/p/flows/sub/d.YAML',
+    ]);
+  });
+
+  it('skips files named config.yaml (case-insensitive)', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({
+      '/p/flows/config.yaml': '',
+      '/p/flows/CONFIG.yaml': '',
+      '/p/flows/login.yml': '',
+    });
+    const out: string[] = [];
+    await walkDir('/p/flows', new Set(), out, logger);
+    expect(out.sort()).toEqual(['/p/flows/login.yml']);
+  });
+
+  it('returns silently when realpath fails (e.g. missing dir)', async () => {
+    const logger = createMockLogger();
+    const out: string[] = [];
+    await walkDir('/p/missing', new Set(), out, logger);
+    expect(out).toEqual([]);
+  });
+});
+
+describe(buildFlowNameToPathMap, () => {
+  beforeEach(() => vol.reset());
+
+  it('builds a map from a single file input (basename name)', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({ '/proj/flows/login.yml': 'appId: x\n' });
+    const map = await buildFlowNameToPathMap({
+      inputFlowPaths: ['flows/login.yml'],
+      projectRoot: '/proj',
+      logger,
+    });
+    expect(map).toEqual(new Map([['login', 'flows/login.yml']]));
+  });
+
+  it('uses top-level name when present', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({ '/proj/flows/a.yml': 'name: Login Flow\n' });
+    const map = await buildFlowNameToPathMap({
+      inputFlowPaths: ['flows/a.yml'],
+      projectRoot: '/proj',
+      logger,
+    });
+    expect(map).toEqual(new Map([['Login Flow', 'flows/a.yml']]));
+  });
+
+  it('walks a directory input and adds each flow', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({
+      '/proj/.maestro/login.yml': 'name: Login\n',
+      '/proj/.maestro/checkout.yml': '',
+      '/proj/.maestro/sub/profile.yml': '',
+    });
+    const map = await buildFlowNameToPathMap({
+      inputFlowPaths: ['.maestro'],
+      projectRoot: '/proj',
+      logger,
+    });
+    expect(map).toEqual(
+      new Map([
+        ['Login', '.maestro/login.yml'],
+        ['checkout', '.maestro/checkout.yml'],
+        ['profile', '.maestro/sub/profile.yml'],
+      ])
+    );
+  });
+
+  it('merges file + directory inputs', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({
+      '/proj/.maestro/a.yml': '',
+      '/proj/extra/b.yml': '',
+    });
+    const map = await buildFlowNameToPathMap({
+      inputFlowPaths: ['.maestro', 'extra/b.yml'],
+      projectRoot: '/proj',
+      logger,
+    });
+    expect(map).toEqual(
+      new Map([
+        ['a', '.maestro/a.yml'],
+        ['b', 'extra/b.yml'],
+      ])
+    );
+  });
+
+  it('skips non-existent inputs with warn', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({ '/proj/flows/a.yml': '' });
+    const map = await buildFlowNameToPathMap({
+      inputFlowPaths: ['flows/missing.yml', 'flows/a.yml'],
+      projectRoot: '/proj',
+      logger,
+    });
+    expect(map).toEqual(new Map([['a', 'flows/a.yml']]));
+    expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining('flows/missing.yml'));
+  });
+
+  it('skips workspace config.yaml inside directory inputs', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({
+      '/proj/.maestro/config.yaml': 'flows:\n  - "*.yml"\n',
+      '/proj/.maestro/login.yml': '',
+    });
+    const map = await buildFlowNameToPathMap({
+      inputFlowPaths: ['.maestro'],
+      projectRoot: '/proj',
+      logger,
+    });
+    expect(map).toEqual(new Map([['login', '.maestro/login.yml']]));
+  });
+
+  it('does NOT skip config.yaml when passed as an explicit file input', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({
+      '/proj/.maestro/config.yaml': 'name: Workspace Defaults\nflows:\n  - "*.yml"\n',
+    });
+    const map = await buildFlowNameToPathMap({
+      inputFlowPaths: ['.maestro/config.yaml'],
+      projectRoot: '/proj',
+      logger,
+    });
+    expect(map).toEqual(new Map([['Workspace Defaults', '.maestro/config.yaml']]));
+  });
+
+  it('returns null when two files share top-level name', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({
+      '/proj/a.yml': 'name: Login\n',
+      '/proj/b.yml': 'name: Login\n',
+    });
+    const map = await buildFlowNameToPathMap({
+      inputFlowPaths: ['a.yml', 'b.yml'],
+      projectRoot: '/proj',
+      logger,
+    });
+    expect(map).toBeNull();
+    expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining('"Login"'));
+    expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining('a.yml'));
+    expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining('b.yml'));
+  });
+
+  it('returns null when two files share basename across directories', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({
+      '/proj/login/index.yml': '',
+      '/proj/checkout/index.yml': '',
+    });
+    const map = await buildFlowNameToPathMap({
+      inputFlowPaths: ['login', 'checkout'],
+      projectRoot: '/proj',
+      logger,
+    });
+    expect(map).toBeNull();
+  });
+
+  it('returns null when name collides with another file basename', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({
+      '/proj/login.yml': 'name: Other\n',
+      '/proj/Other.yml': '',
+    });
+    const map = await buildFlowNameToPathMap({
+      inputFlowPaths: ['login.yml', 'Other.yml'],
+      projectRoot: '/proj',
+      logger,
+    });
+    expect(map).toBeNull();
+  });
+
+  it('dedupes the same physical file passed via overlapping inputs', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({ '/proj/.maestro/login.yml': '' });
+    const map = await buildFlowNameToPathMap({
+      inputFlowPaths: ['.maestro', '.maestro/login.yml'],
+      projectRoot: '/proj',
+      logger,
+    });
+    expect(map).toEqual(new Map([['login', '.maestro/login.yml']]));
+    expect(logger.warn).not.toHaveBeenCalled();
+  });
+
+  it('uses absolute fallback when input file lives outside projectRoot', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({ '/elsewhere/a.yml': '' });
+    const map = await buildFlowNameToPathMap({
+      inputFlowPaths: ['/elsewhere/a.yml'],
+      projectRoot: '/proj',
+      logger,
+    });
+    expect(map).toEqual(new Map([['a', '/elsewhere/a.yml']]));
+  });
+
+  it('absolute directory input under projectRoot yields project-relative children', async () => {
+    const logger = createMockLogger();
+    vol.fromJSON({ '/proj/.maestro/a.yml': '' });
+    const map = await buildFlowNameToPathMap({
+      inputFlowPaths: ['/proj/.maestro'],
+      projectRoot: '/proj',
+      logger,
+    });
+    expect(map).toEqual(new Map([['a', '.maestro/a.yml']]));
+  });
+
+  it('returns null and warns on unexpected helper failure', async () => {
+    const logger = createMockLogger();
+    const map = await buildFlowNameToPathMap({
+      inputFlowPaths: [Symbol('bad') as unknown as string],
+      projectRoot: '/proj',
+      logger,
+    });
+    expect(map).toBeNull();
+    expect(logger.warn).toHaveBeenCalledWith(
+      expect.stringContaining('buildFlowNameToPathMap failed unexpectedly')
+    );
+  });
+});

packages/build-tools/src/steps/functions/__tests__/maestroResultParser.test.ts

@@ -1,63 +1,18 @@
+import { XMLParser } from 'fast-xml-parser';
+import fs from 'fs/promises';
 import { vol } from 'memfs';
 
 import {
-  parseFlowMetadata,
+  copyLatestAttemptXml,
+  mergeJUnitReports,
+  parseFailedFlowsFromJUnit,
   parseJUnitTestCases,
   parseMaestroResults,
 } from '../maestroResultParser';
 
-describe(parseFlowMetadata, () => {
-  it('parses valid ai-*.json', async () => {
-    vol.fromJSON({
-      '/tests/2026-01-28_055409/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/Users/expo/workingdir/build/.maestro/home.yml',
-      }),
-    });
-
-    const result = await parseFlowMetadata('/tests/2026-01-28_055409/ai-home.json');
-    expect(result).toEqual({
-      flow_name: 'home',
-      flow_file_path: '/Users/expo/workingdir/build/.maestro/home.yml',
-    });
-  });
-
-  it('returns null when flow_name is missing', async () => {
-    vol.fromJSON({
-      '/tests/2026-01-28_055409/ai-home.json': JSON.stringify({
-        flow_file_path: '/Users/expo/workingdir/build/.maestro/home.yml',
-      }),
-    });
-
-    const result = await parseFlowMetadata('/tests/2026-01-28_055409/ai-home.json');
-    expect(result).toBeNull();
-  });
-
-  it('returns null when flow_file_path is missing', async () => {
-    vol.fromJSON({
-      '/tests/2026-01-28_055409/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-      }),
-    });
-
-    const result = await parseFlowMetadata('/tests/2026-01-28_055409/ai-home.json');
-    expect(result).toBeNull();
-  });
-
-  it('returns null for invalid JSON', async () => {
-    vol.fromJSON({
-      '/tests/2026-01-28_055409/ai-home.json': 'not json',
-    });
-
-    const result = await parseFlowMetadata('/tests/2026-01-28_055409/ai-home.json');
-    expect(result).toBeNull();
-  });
-});
-
 describe(parseMaestroResults, () => {
-  it('parses JUnit results and enriches with ai-*.json metadata', async () => {
+  it('parses JUnit results and enriches with name→path map', async () => {
     vol.fromJSON({
-      // JUnit XML (primary data)
       '/junit/report.xml': [
         '<?xml version="1.0"?>',
         '<testsuites>',
@@ -69,18 +24,15 @@ describe(parseMaestroResults, () => {
         '  </testsuite>',
         '</testsuites>',
       ].join('\n'),
-      // Debug output (for flow_file_path)
-      '/tests/2026-01-28_055409/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
-      '/tests/2026-01-28_055409/ai-login.json': JSON.stringify({
-        flow_name: 'login',
-        flow_file_path: '/root/project/.maestro/login.yml',
-      }),
     });
 
-    const results = await parseMaestroResults('/junit', '/tests', '/root/project');
+    const results = await parseMaestroResults(
+      '/junit',
+      new Map([
+        ['home', '.maestro/home.yml'],
+        ['login', '.maestro/login.yml'],
+      ])
+    );
     expect(results).toHaveLength(2);
     expect(results).toEqual(
       expect.arrayContaining([
@@ -108,7 +60,7 @@ describe(parseMaestroResults, () => {
     );
   });
 
-  it('calculates retryCount from timestamp directory occurrences', async () => {
+  it('uses flow name as fallback path when nameToPath is null', async () => {
     vol.fromJSON({
       '/junit/report.xml': [
         '<?xml version="1.0"?>',
@@ -118,49 +70,33 @@ describe(parseMaestroResults, () => {
         '  </testsuite>',
         '</testsuites>',
       ].join('\n'),
-      // Two timestamp dirs = 1 retry
-      '/tests/2026-01-28_055409/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
-      '/tests/2026-01-28_055420/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
     });
 
-    const results = await parseMaestroResults('/junit', '/tests', '/root/project');
-    expect(results[0].retryCount).toBe(1);
-  });
-
-  it('uses flow name as fallback path when ai-*.json not found', async () => {
-    vol.fromJSON({
-      '/junit/report.xml': [
-        '<?xml version="1.0"?>',
-        '<testsuites>',
-        '  <testsuite name="Test Suite" tests="1" failures="0">',
-        '    <testcase id="home" name="home" classname="home" time="10.0" status="SUCCESS"/>',
-        '  </testsuite>',
-        '</testsuites>',
-      ].join('\n'),
-      // No ai-*.json files
-    });
-
-    const results = await parseMaestroResults('/junit', '/tests', '/root/project');
+    const results = await parseMaestroResults('/junit', null);
     expect(results[0].path).toBe('home');
     expect(results[0].retryCount).toBe(0);
   });
 
-  it('returns empty array when no JUnit files found', async () => {
+  it('uses flow name as fallback path when name not in map', async () => {
     vol.fromJSON({
-      '/junit/.gitkeep': '',
-      '/tests/2026-01-28_055409/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
+      '/junit/report.xml': [
+        '<?xml version="1.0"?>',
+        '<testsuites>',
+        '  <testsuite name="Test Suite" tests="1" failures="0">',
+        '    <testcase id="home" name="home" classname="home" time="10.0" status="SUCCESS"/>',
+        '  </testsuite>',
+        '</testsuites>',
+      ].join('\n'),
     });
 
-    const results = await parseMaestroResults('/junit', '/tests', '/root/project');
+    const results = await parseMaestroResults('/junit', new Map());
+    expect(results[0].path).toBe('home');
+  });
+
+  it('returns empty array when no JUnit files found', async () => {
+    vol.fromJSON({ '/junit/.gitkeep': '' });
+
+    const results = await parseMaestroResults('/junit', new Map([['home', '.maestro/home.yml']]));
     expect(results).toEqual([]);
   });
 
@@ -179,44 +115,13 @@ describe(parseMaestroResults, () => {
         '  </testsuite>',
         '</testsuites>',
       ].join('\n'),
-      '/tests/2026-01-28_055409/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
     });
 
-    const results = await parseMaestroResults('/junit', '/tests', '/root/project');
+    const results = await parseMaestroResults('/junit', new Map([['home', '.maestro/home.yml']]));
     expect(results[0].tags).toEqual(['e2e', 'smoke']);
     expect(results[0].properties).toEqual({ env: 'staging' });
   });
 
-  it('handles reuse_devices=true (junit_report_directory == tests_directory)', async () => {
-    vol.fromJSON({
-      // Same directory for both JUnit and debug output
-      '/maestro-tests/android-maestro-junit.xml': [
-        '<?xml version="1.0"?>',
-        '<testsuites>',
-        '  <testsuite name="Test Suite" tests="1" failures="0">',
-        '    <testcase id="home" name="home" classname="home" time="10.0" status="SUCCESS"/>',
-        '  </testsuite>',
-        '</testsuites>',
-      ].join('\n'),
-      '/maestro-tests/2026-01-28_055409/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
-    });
-
-    const results = await parseMaestroResults('/maestro-tests', '/maestro-tests', '/root/project');
-    expect(results).toEqual([
-      expect.objectContaining({
-        name: 'home',
-        path: '.maestro/home.yml',
-        status: 'passed',
-      }),
-    ]);
-  });
-
   it('returns per-attempt results when multiple JUnit files exist for the same flow', async () => {
     vol.fromJSON({
       // Attempt 0: login FAILED
@@ -239,20 +144,11 @@ describe(parseMaestroResults, () => {
         '  </testsuite>',
         '</testsuites>',
       ].join('\n'),
-      // ai-*.json metadata (2 timestamp dirs = 2 attempts)
-      '/tests/2026-01-28_055409/ai-login.json': JSON.stringify({
-        flow_name: 'login',
-        flow_file_path: '/root/project/.maestro/login.yml',
-      }),
-      '/tests/2026-01-28_055420/ai-login.json': JSON.stringify({
-        flow_name: 'login',
-        flow_file_path: '/root/project/.maestro/login.yml',
-      }),
     });
 
-    const results = await parseMaestroResults('/junit', '/tests', '/root/project');
+    const results = await parseMaestroResults('/junit', new Map([['login', '.maestro/login.yml']]));
 
-    // Should return 2 results — one per attempt
+    // Should return 2 results — one per attempt; retryCount from filename
     expect(results).toHaveLength(2);
     expect(results).toEqual([
       expect.objectContaining({
@@ -298,25 +194,15 @@ describe(parseMaestroResults, () => {
         '  </testsuite>',
         '</testsuites>',
       ].join('\n'),
-      '/tests/2026-01-28_055409/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
-      '/tests/2026-01-28_055409/ai-login.json': JSON.stringify({
-        flow_name: 'login',
-        flow_file_path: '/root/project/.maestro/login.yml',
-      }),
-      '/tests/2026-01-28_055420/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
-      '/tests/2026-01-28_055420/ai-login.json': JSON.stringify({
-        flow_name: 'login',
-        flow_file_path: '/root/project/.maestro/login.yml',
-      }),
     });
 
-    const results = await parseMaestroResults('/junit-reports', '/tests', '/root/project');
+    const results = await parseMaestroResults(
+      '/junit-reports',
+      new Map([
+        ['home', '.maestro/home.yml'],
+        ['login', '.maestro/login.yml'],
+      ])
+    );
 
     // 4 results: 2 flows × 2 attempts
     expect(results).toHaveLength(4);
@@ -330,7 +216,6 @@ describe(parseMaestroResults, () => {
 
   it('returns per-attempt results with sharding (multiple testsuites per attempt file)', async () => {
     vol.fromJSON({
-      // Attempt 0: shard 1 has home (FAILED), shard 2 has login (PASSED)
       '/junit-reports/android-maestro-junit-attempt-0.xml': [
         '<?xml version="1.0"?>',
         '<testsuites>',
@@ -344,7 +229,6 @@ describe(parseMaestroResults, () => {
         '  </testsuite>',
         '</testsuites>',
       ].join('\n'),
-      // Attempt 1: all passed across shards
       '/junit-reports/android-maestro-junit-attempt-1.xml': [
         '<?xml version="1.0"?>',
         '<testsuites>',
@@ -356,25 +240,15 @@ describe(parseMaestroResults, () => {
         '  </testsuite>',
         '</testsuites>',
       ].join('\n'),
-      '/tests/2026-01-28_055409/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
-      '/tests/2026-01-28_055409/ai-login.json': JSON.stringify({
-        flow_name: 'login',
-        flow_file_path: '/root/project/.maestro/login.yml',
-      }),
-      '/tests/2026-01-28_055420/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
-      '/tests/2026-01-28_055420/ai-login.json': JSON.stringify({
-        flow_name: 'login',
-        flow_file_path: '/root/project/.maestro/login.yml',
-      }),
     });
 
-    const results = await parseMaestroResults('/junit-reports', '/tests', '/root/project');
+    const results = await parseMaestroResults(
+      '/junit-reports',
+      new Map([
+        ['home', '.maestro/home.yml'],
+        ['login', '.maestro/login.yml'],
+      ])
+    );
 
     expect(results).toHaveLength(4);
     expect(results).toEqual([
@@ -385,52 +259,8 @@ describe(parseMaestroResults, () => {
     ]);
   });
 
-  it('backward compat: reuse_devices=true with retries but old single JUnit file', async () => {
+  it('handles reuse_devices=false (separate junit_report_directory, per-flow files)', async () => {
     vol.fromJSON({
-      // Single overwritten JUnit (only has final attempt's results)
-      '/maestro-tests/android-maestro-junit.xml': [
-        '<?xml version="1.0"?>',
-        '<testsuites>',
-        '  <testsuite name="Test Suite" tests="2" failures="0">',
-        '    <testcase id="home" name="home" classname="home" time="4.0" status="SUCCESS"/>',
-        '    <testcase id="login" name="login" classname="login" time="2.0" status="SUCCESS"/>',
-        '  </testsuite>',
-        '</testsuites>',
-      ].join('\n'),
-      // 2 timestamp dirs — both flows appear in both (entire suite retried)
-      '/maestro-tests/2026-01-28_055409/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
-      '/maestro-tests/2026-01-28_055409/ai-login.json': JSON.stringify({
-        flow_name: 'login',
-        flow_file_path: '/root/project/.maestro/login.yml',
-      }),
-      '/maestro-tests/2026-01-28_055420/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
-      '/maestro-tests/2026-01-28_055420/ai-login.json': JSON.stringify({
-        flow_name: 'login',
-        flow_file_path: '/root/project/.maestro/login.yml',
-      }),
-    });
-
-    const results = await parseMaestroResults('/maestro-tests', '/maestro-tests', '/root/project');
-
-    // Both flows have 2 occurrences → retryCount = 1 for both
-    expect(results).toHaveLength(2);
-    expect(results).toEqual(
-      expect.arrayContaining([
-        expect.objectContaining({ name: 'home', status: 'passed', retryCount: 1 }),
-        expect.objectContaining({ name: 'login', status: 'passed', retryCount: 1 }),
-      ])
-    );
-  });
-
-  it('handles reuse_devices=false (separate junit_report_directory)', async () => {
-    vol.fromJSON({
-      // JUnit in temp dir (per-flow files)
       '/tmp/maestro-reports-abc123/junit-report-flow-1.xml': [
         '<?xml version="1.0"?>',
         '<testsuites>',
@@ -449,21 +279,14 @@ describe(parseMaestroResults, () => {
         '  </testsuite>',
         '</testsuites>',
       ].join('\n'),
-      // Debug output in default location
-      '/tests/2026-01-28_055409/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
-      '/tests/2026-01-28_055409/ai-login.json': JSON.stringify({
-        flow_name: 'login',
-        flow_file_path: '/root/project/.maestro/login.yml',
-      }),
     });
 
     const results = await parseMaestroResults(
       '/tmp/maestro-reports-abc123',
-      '/tests',
-      '/root/project'
+      new Map([
+        ['home', '.maestro/home.yml'],
+        ['login', '.maestro/login.yml'],
+      ])
     );
     expect(results).toHaveLength(2);
     expect(results).toEqual(
@@ -473,51 +296,6 @@ describe(parseMaestroResults, () => {
       ])
     );
   });
-
-  it('uses raw path when flow_file_path is outside project_root', async () => {
-    vol.fromJSON({
-      '/junit/report.xml': [
-        '<?xml version="1.0"?>',
-        '<testsuites>',
-        '  <testsuite name="Test Suite" tests="1" failures="0">',
-        '    <testcase id="home" name="home" classname="home" time="10.0" status="SUCCESS"/>',
-        '  </testsuite>',
-        '</testsuites>',
-      ].join('\n'),
-      '/tests/2026-01-28_055409/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/somewhere/else/.maestro/home.yml',
-      }),
-    });
-
-    const results = await parseMaestroResults('/junit', '/tests', '/root/project');
-    expect(results[0].path).toBe('/somewhere/else/.maestro/home.yml');
-  });
-
-  it('filters out non-timestamp directories when scanning debug output', async () => {
-    vol.fromJSON({
-      '/junit/report.xml': [
-        '<?xml version="1.0"?>',
-        '<testsuites>',
-        '  <testsuite name="Test Suite" tests="1" failures="0">',
-        '    <testcase id="home" name="home" classname="home" time="10.0" status="SUCCESS"/>',
-        '  </testsuite>',
-        '</testsuites>',
-      ].join('\n'),
-      '/tests/2026-01-28_055409/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
-      '/tests/not-a-timestamp/ai-home.json': JSON.stringify({
-        flow_name: 'home',
-        flow_file_path: '/root/project/.maestro/home.yml',
-      }),
-    });
-
-    const results = await parseMaestroResults('/junit', '/tests', '/root/project');
-    // Only 1 occurrence (not-a-timestamp dir should be ignored)
-    expect(results[0].retryCount).toBe(0);
-  });
 });
 
 describe(parseJUnitTestCases, () => {
@@ -803,3 +581,310 @@ describe(parseJUnitTestCases, () => {
     expect(results[0].properties).toEqual({});
   });
 });
+
+describe('parseFailedFlowsFromJUnit', () => {
+  it('returns the subset of input flow paths whose testcases failed', async () => {
+    vol.fromJSON({
+      '/tmp/junit-reports/android-maestro-junit-attempt-0.xml': `<?xml version="1.0"?>
+<testsuites>
+  <testsuite>
+    <testcase name="Login" status="SUCCESS" time="1.0" />
+    <testcase name="Search" status="SUCCESS" time="1.0" />
+    <testcase name="Checkout" time="1.0"><failure>something</failure></testcase>
+  </testsuite>
+</testsuites>`,
+    });
+
+    const result = await parseFailedFlowsFromJUnit({
+      junitFile: '/tmp/junit-reports/android-maestro-junit-attempt-0.xml',
+      nameToPath: new Map([
+        ['Login', 'flows/login.yaml'],
+        ['Search', 'flows/search.yaml'],
+        ['Checkout', 'flows/checkout.yaml'],
+      ]),
+    });
+
+    expect(result).toEqual(['flows/checkout.yaml']);
+  });
+
+  it('returns null when a failing testcase has no entry in nameToPath', async () => {
+    vol.fromJSON({
+      '/tmp/junit-reports/attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="Login" status="SUCCESS" time="1.0" />
+  <testcase name="Unknown" time="1.0"><failure>x</failure></testcase>
+</testsuite></testsuites>`,
+    });
+
+    const result = await parseFailedFlowsFromJUnit({
+      junitFile: '/tmp/junit-reports/attempt-0.xml',
+      nameToPath: new Map([['Login', 'flows/login.yaml']]),
+    });
+
+    expect(result).toBeNull();
+  });
+
+  it('returns null when two failing testcases share the same name (collision)', async () => {
+    vol.fromJSON({
+      '/tmp/junit-reports/android-maestro-junit-attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="Duplicate" time="1.0"><failure>x</failure></testcase>
+  <testcase name="Duplicate" time="1.0"><failure>y</failure></testcase>
+</testsuite></testsuites>`,
+    });
+
+    const result = await parseFailedFlowsFromJUnit({
+      junitFile: '/tmp/junit-reports/android-maestro-junit-attempt-0.xml',
+      nameToPath: new Map([['Duplicate', 'flows/a.yaml']]),
+    });
+
+    expect(result).toBeNull();
+  });
+
+  it('returns null when a failing testcase shares a name with any other testcase (pass or fail)', async () => {
+    vol.fromJSON({
+      '/tmp/junit-reports/android-maestro-junit-attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="Shared" status="SUCCESS" time="1.0" />
+  <testcase name="Shared" time="2.0"><failure>x</failure></testcase>
+</testsuite></testsuites>`,
+    });
+
+    const result = await parseFailedFlowsFromJUnit({
+      junitFile: '/tmp/junit-reports/android-maestro-junit-attempt-0.xml',
+      nameToPath: new Map([['Shared', 'flows/a.yaml']]),
+    });
+
+    expect(result).toBeNull();
+  });
+
+  it('returns null when junit file does not exist', async () => {
+    const result = await parseFailedFlowsFromJUnit({
+      junitFile: '/tmp/missing.xml',
+      nameToPath: new Map([['A', 'flows/a.yaml']]),
+    });
+    expect(result).toBeNull();
+  });
+
+  it('returns null when junit file is malformed', async () => {
+    vol.fromJSON({
+      '/tmp/junit-reports/bad.xml': 'this is not xml',
+    });
+    const result = await parseFailedFlowsFromJUnit({
+      junitFile: '/tmp/junit-reports/bad.xml',
+      nameToPath: new Map([['A', 'flows/a.yaml']]),
+    });
+    expect(result).toBeNull();
+  });
+
+  it('returns null when junit XML is truncated mid-tag (partial parse risk)', async () => {
+    // fast-xml-parser can produce a partial parse from truncated XML — without
+    // strict validation, retry-failed-only would only retry the visible failures and
+    // silently skip flows that were cut off.
+    vol.fromJSON({
+      '/tmp/junit-reports/attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="A" time="1.0"><failure>x</failure></testcase>
+  <testcase name="B"`, // intentionally truncated mid-tag
+    });
+    const result = await parseFailedFlowsFromJUnit({
+      junitFile: '/tmp/junit-reports/attempt-0.xml',
+      nameToPath: new Map([
+        ['A', 'flows/a.yaml'],
+        ['B', 'flows/b.yaml'],
+      ]),
+    });
+    expect(result).toBeNull();
+  });
+
+  it('returns null when junit XML has unclosed tags (partial parse risk)', async () => {
+    vol.fromJSON({
+      '/tmp/junit-reports/attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="A" time="1.0"><failure>x</failure></testcase>
+</testsuite>`, // missing </testsuites>
+    });
+    const result = await parseFailedFlowsFromJUnit({
+      junitFile: '/tmp/junit-reports/attempt-0.xml',
+      nameToPath: new Map([['A', 'flows/a.yaml']]),
+    });
+    expect(result).toBeNull();
+  });
+});
+
+describe('mergeJUnitReports', () => {
+  it('identity-copies a single attempt (preserves suite-level metadata)', async () => {
+    // Single-attempt runs should land in final_report_path with the same
+    // suite-level attributes (tests/failures/time) and non-testcase children
+    // (e.g. <system-out>) that the legacy bash `cp` upload preserved. The
+    // rebuild path used for multi-attempt merges drops these, so the single
+    // case must short-circuit to a byte-equivalent copy.
+    const input = `<?xml version="1.0"?>
+<testsuites>
+  <testsuite name="Maestro Flows" tests="2" failures="0" time="3.0" device="Pixel 7">
+    <testcase name="A" status="SUCCESS" time="1.0" />
+    <testcase name="B" status="SUCCESS" time="2.0" />
+    <system-out>boot complete</system-out>
+  </testsuite>
+</testsuites>`;
+    vol.fromJSON({
+      '/tmp/junit-reports/android-maestro-junit-attempt-0.xml': input,
+    });
+
+    await mergeJUnitReports({
+      sourceDir: '/tmp/junit-reports',
+      outputPath: '/tmp/final.xml',
+    });
+
+    const out = await fs.readFile('/tmp/final.xml', 'utf-8');
+    expect(out).toBe(input);
+  });
+
+  it('keeps the latest attempt per flow name across multiple files', async () => {
+    vol.fromJSON({
+      '/tmp/r/android-maestro-junit-attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="A" status="SUCCESS" time="1.0" />
+  <testcase name="B" time="2.0"><failure>bad</failure></testcase>
+</testsuite></testsuites>`,
+      '/tmp/r/android-maestro-junit-attempt-1.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="B" status="SUCCESS" time="3.0" />
+</testsuite></testsuites>`,
+    });
+
+    await mergeJUnitReports({ sourceDir: '/tmp/r', outputPath: '/tmp/final.xml' });
+
+    const out = await fs.readFile('/tmp/final.xml', 'utf-8');
+    const parsed = new XMLParser({ ignoreAttributes: false }).parse(out);
+    const testcases = parsed.testsuites.testsuite.testcase;
+    const a = testcases.find((t: any) => t['@_name'] === 'A');
+    const b = testcases.find((t: any) => t['@_name'] === 'B');
+    expect(a['@_status']).toBe('SUCCESS'); // from attempt 0
+    expect(b['@_status']).toBe('SUCCESS'); // from attempt 1 (latest)
+    expect(b.failure).toBeUndefined();
+  });
+
+  it('throws when source directory contains no *.xml files', async () => {
+    // No per-attempt JUnit files were ever written (maestro crashed before
+    // producing output). Phase 3 in runMaestroTests treats this as a SystemError
+    // — without a throw here, mergeJUnitReports would silently write an empty
+    // <testsuite> and the caller would upload a misleading empty report.
+    vol.fromJSON({
+      '/tmp/r/.gitkeep': '',
+    });
+
+    await expect(
+      mergeJUnitReports({ sourceDir: '/tmp/r', outputPath: '/tmp/final.xml' })
+    ).rejects.toThrow(/no \*\.xml files/);
+  });
+
+  it('throws on invalid XML so caller can fall back to copyLatestAttemptXml', async () => {
+    // Without a throw, mergeJUnitReports would silently emit an empty merged
+    // document and the copy-latest fallback (which only triggers on throw)
+    // would never run.
+    vol.fromJSON({
+      '/tmp/r/android-maestro-junit-attempt-0.xml': 'not xml at all',
+    });
+
+    await expect(
+      mergeJUnitReports({ sourceDir: '/tmp/r', outputPath: '/tmp/final.xml' })
+    ).rejects.toThrow(/invalid XML/);
+  });
+
+  it('throws when every input has <testsuites> but no <testcase> elements', async () => {
+    vol.fromJSON({
+      '/tmp/r/android-maestro-junit-attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite></testsuite></testsuites>`,
+    });
+
+    await expect(
+      mergeJUnitReports({ sourceDir: '/tmp/r', outputPath: '/tmp/final.xml' })
+    ).rejects.toThrow(/no parseable testcases/);
+  });
+
+  it('throws when any input XML is malformed (even if others parse)', async () => {
+    vol.fromJSON({
+      '/tmp/r/attempt-0.xml': `<?xml version="1.0"?><testsuites><testsuite><testcase name="A" status="SUCCESS" time="1.0"/></testsuite></testsuites>`,
+      '/tmp/r/attempt-1.xml': 'garbage not xml',
+    });
+    await expect(
+      mergeJUnitReports({ sourceDir: '/tmp/r', outputPath: '/tmp/final.xml' })
+    ).rejects.toThrow();
+  });
+
+  it('throws when an input XML is truncated mid-tag (would otherwise partial-parse)', async () => {
+    // fast-xml-parser is lenient and can return partial results from truncated
+    // XML. Without strict validation, mergeJUnitReports would emit a merged
+    // report missing the cut-off flows and Phase 3's copy-latest fallback
+    // would never run. Validation must reject the file.
+    vol.fromJSON({
+      '/tmp/r/attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="A" status="SUCCESS" time="1.0"/>
+  <testcase name="B"`, // truncated mid-tag
+    });
+    await expect(
+      mergeJUnitReports({ sourceDir: '/tmp/r', outputPath: '/tmp/final.xml' })
+    ).rejects.toThrow();
+  });
+
+  it('throws when an input XML has unclosed tags (would otherwise partial-parse)', async () => {
+    vol.fromJSON({
+      '/tmp/r/attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="A" status="SUCCESS" time="1.0"/>
+</testsuite>`, // missing </testsuites>
+    });
+    await expect(
+      mergeJUnitReports({ sourceDir: '/tmp/r', outputPath: '/tmp/final.xml' })
+    ).rejects.toThrow();
+  });
+
+  it('throws when any input XML parses but has no testcases (even if others have testcases)', async () => {
+    vol.fromJSON({
+      '/tmp/r/attempt-0.xml': `<?xml version="1.0"?><testsuites><testsuite><testcase name="A" status="SUCCESS" time="1.0"/></testsuite></testsuites>`,
+      '/tmp/r/attempt-1.xml': `<?xml version="1.0"?><testsuites></testsuites>`,
+    });
+    await expect(
+      mergeJUnitReports({ sourceDir: '/tmp/r', outputPath: '/tmp/final.xml' })
+    ).rejects.toThrow();
+  });
+
+  it('preserves duplicate names within the same attempt', async () => {
+    vol.fromJSON({
+      '/tmp/r/attempt-0.xml': `<?xml version="1.0"?>
+<testsuites><testsuite>
+  <testcase name="Dup" status="SUCCESS" time="1.0" />
+  <testcase name="Dup" status="SUCCESS" time="2.0" />
+</testsuite></testsuites>`,
+    });
+
+    await mergeJUnitReports({ sourceDir: '/tmp/r', outputPath: '/tmp/final.xml' });
+
+    const out = await fs.readFile('/tmp/final.xml', 'utf-8');
+    const parsed = new XMLParser({ ignoreAttributes: false, isArray: n => n === 'testcase' }).parse(
+      out
+    );
+    expect(parsed.testsuites.testsuite.testcase).toHaveLength(2);
+  });
+});
+
+describe('copyLatestAttemptXml', () => {
+  it('picks the highest attempt number', async () => {
+    vol.fromJSON({
+      '/tmp/r/android-maestro-junit-attempt-0.xml': '<a/>',
+      '/tmp/r/android-maestro-junit-attempt-1.xml': '<b/>',
+      '/tmp/r/android-maestro-junit-attempt-2.xml': '<c/>',
+    });
+    await copyLatestAttemptXml({ sourceDir: '/tmp/r', outputPath: '/tmp/out.xml' });
+    expect(await fs.readFile('/tmp/out.xml', 'utf-8')).toBe('<c/>');
+  });
+
+  it('throws when source has no xml files', async () => {
+    vol.fromJSON({ '/tmp/r/.keep': '' });
+    await expect(
+      copyLatestAttemptXml({ sourceDir: '/tmp/r', outputPath: '/tmp/out.xml' })
+    ).rejects.toThrow();
+  });
+});

packages/build-tools/src/steps/functions/__tests__/maestroTests.test.ts

@@ -0,0 +1,642 @@
+import { SystemError, UserError } from '@expo/eas-build-job';
+import spawn from '@expo/turtle-spawn';
+
+import { createGlobalContextMock } from '../../../__tests__/utils/context';
+import { createMockLogger } from '../../../__tests__/utils/logger';
+import * as discovery from '../maestroFlowDiscovery';
+import * as parser from '../maestroResultParser';
+import { createMaestroTestsBuildFunction } from '../maestroTests';
+
+jest.mock('@expo/turtle-spawn', () => ({
+  __esModule: true,
+  default: jest.fn(),
+}));
+
+jest.mock('../../../utils/retry', () => ({
+  ...jest.requireActual('../../../utils/retry'),
+  sleepAsync: jest.fn().mockResolvedValue(undefined),
+}));
+
+const mockedSpawn = jest.mocked(spawn);
+
+const SPAWN_SUCCESS = {
+  status: 0,
+  pid: 1,
+  output: [''],
+  stdout: '',
+  stderr: '',
+  signal: null,
+} as any;
+
+const rejectExit1 = (): Error => {
+  const e: any = new Error('exit 1');
+  e.status = 1;
+  return e;
+};
+
+function createStep(
+  callInputs?: Record<string, unknown>,
+  options: { env?: Record<string, string | undefined> } = {}
+): ReturnType<
+  ReturnType<typeof createMaestroTestsBuildFunction>['createBuildStepFromFunctionCall']
+> {
+  const logger = createMockLogger();
+  const fn = createMaestroTestsBuildFunction();
+  const globalCtx = createGlobalContextMock({ logger });
+  globalCtx.updateEnv(options.env ?? { HOME: '/home/expo' });
+  return fn.createBuildStepFromFunctionCall(globalCtx, { callInputs });
+}
+
+describe('createMaestroTestsBuildFunction', () => {
+  beforeEach(() => {
+    mockedSpawn.mockReset();
+    // Default-stub the merge helper so tests that don't care about it don't
+    // hit the real disk. Individual tests override this.
+    jest.restoreAllMocks();
+    jest.spyOn(parser, 'mergeJUnitReports').mockResolvedValue();
+  });
+
+  it('exports a factory that returns a BuildFunction instance', () => {
+    expect(createMaestroTestsBuildFunction()).toBeDefined();
+  });
+
+  it('sets all outputs before running any flows', async () => {
+    // Make spawn reject so the step still throws; we're locking in that outputs
+    // are set BEFORE the spawn call (downstream `upload_artifact` fails if
+    // `final_report_path` is empty).
+    mockedSpawn.mockRejectedValue(new Error('stop'));
+
+    const step = createStep({ flow_path: ['flows/a.yaml'], platform: 'android' });
+    await expect(step.executeAsync()).rejects.toThrow();
+
+    expect(step.getOutputValueByName('junit_report_directory')).toMatch(
+      /\.maestro\/tests\/junit-reports$/
+    );
+    expect(step.getOutputValueByName('tests_directory')).toMatch(/\.maestro\/tests$/);
+    expect(step.getOutputValueByName('final_report_path')).toMatch(
+      /\.maestro\/tests\/android-maestro-junit\.xml$/
+    );
+  });
+
+  it('succeeds when maestro exits 0 on first attempt', async () => {
+    mockedSpawn.mockResolvedValue(SPAWN_SUCCESS);
+    const step = createStep({
+      flow_path: ['flows/a.yaml', 'flows/b.yaml'],
+      output_format: 'junit',
+      platform: 'android',
+    });
+
+    await step.executeAsync();
+
+    expect(mockedSpawn).toHaveBeenCalledTimes(1);
+    const [cmd, args] = mockedSpawn.mock.calls[0];
+    expect(cmd).toBe('maestro');
+    expect(args).toEqual(expect.arrayContaining(['test', 'flows/a.yaml', 'flows/b.yaml']));
+    expect(args).toEqual(expect.arrayContaining(['--format=JUNIT']));
+    expect(args!.join(' ')).toMatch(/--output=.*android-maestro-junit-attempt-0\.xml/);
+  });
+
+  it('throws SystemError when spawn fails with ENOENT (binary missing)', async () => {
+    mockedSpawn.mockRejectedValue(Object.assign(new Error('not found'), { code: 'ENOENT' }));
+    const step = createStep({ flow_path: ['a.yaml'], platform: 'android' });
+    await expect(step.executeAsync()).rejects.toThrow(SystemError);
+  });
+
+  it('throws SystemError for unknown-shape spawn rejections', async () => {
+    mockedSpawn.mockRejectedValue(new Error('mystery'));
+    const step = createStep({ flow_path: ['a.yaml'], platform: 'android' });
+    await expect(step.executeAsync()).rejects.toThrow(SystemError);
+  });
+
+  it('throws SystemError on signal-only spawn rejections (OOM / SIGTERM)', async () => {
+    mockedSpawn.mockRejectedValue(
+      Object.assign(new Error('killed'), {
+        status: null,
+        signal: 'SIGKILL',
+        stdout: '',
+        stderr: '',
+        output: ['', ''],
+        pid: 1,
+      })
+    );
+    const step = createStep({ flow_path: ['a.yaml'], platform: 'android' });
+    await expect(step.executeAsync()).rejects.toThrow(SystemError);
+  });
+
+  it('treats reject-with-status as a retryable test failure', async () => {
+    const rejectWithExit = (status: number): Error =>
+      Object.assign(new Error(`maestro exited with non-zero code: ${status}`), {
+        status,
+        signal: null,
+        stdout: '',
+        stderr: '',
+        output: ['', ''],
+        pid: 1,
+      });
+    mockedSpawn.mockRejectedValueOnce(rejectWithExit(1)).mockResolvedValueOnce(SPAWN_SUCCESS);
+    // Default `retries` is 0, so even though the first attempt rejects with
+    // `status: 1`, no retry occurs and the post-loop check throws UserError.
+    // Spawn ran once.
+    const step = createStep({ flow_path: ['a.yaml'], platform: 'android' });
+    await expect(step.executeAsync()).rejects.toThrow(UserError);
+    expect(mockedSpawn).toHaveBeenCalledTimes(1);
+  });
+
+  it('retries only the failed flows on the next attempt (junit mode)', async () => {
+    mockedSpawn.mockRejectedValueOnce(rejectExit1()).mockResolvedValueOnce(SPAWN_SUCCESS);
+    jest.spyOn(parser, 'parseFailedFlowsFromJUnit').mockResolvedValue(['flows/b.yaml']);
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml', 'flows/b.yaml', 'flows/c.yaml'],
+      retries: 1,
+      output_format: 'junit',
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    // Attempt 0 saw all 3
+    expect(mockedSpawn.mock.calls[0][1]).toEqual(
+      expect.arrayContaining(['flows/a.yaml', 'flows/b.yaml', 'flows/c.yaml'])
+    );
+    // Attempt 1 saw only the failed one
+    const a1Args = mockedSpawn.mock.calls[1][1]!;
+    expect(a1Args).toContain('flows/b.yaml');
+    expect(a1Args).not.toContain('flows/a.yaml');
+    expect(a1Args).not.toContain('flows/c.yaml');
+  });
+
+  it('retries all flows when parseFailedFlowsFromJUnit returns null', async () => {
+    const spawnMock = mockedSpawn
+      .mockRejectedValueOnce(rejectExit1())
+      .mockResolvedValueOnce(SPAWN_SUCCESS);
+    jest.spyOn(parser, 'parseFailedFlowsFromJUnit').mockResolvedValue(null);
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml', 'flows/b.yaml', 'flows/c.yaml'],
+      retries: 1,
+      output_format: 'junit',
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    // Both attempts saw all 3 flows
+    expect(spawnMock.mock.calls[0][1]).toEqual(
+      expect.arrayContaining(['flows/a.yaml', 'flows/b.yaml', 'flows/c.yaml'])
+    );
+    expect(spawnMock.mock.calls[1][1]).toEqual(
+      expect.arrayContaining(['flows/a.yaml', 'flows/b.yaml', 'flows/c.yaml'])
+    );
+  });
+
+  it('always retries all flows when output_format is not junit', async () => {
+    const spawnMock = mockedSpawn
+      .mockRejectedValueOnce(rejectExit1())
+      .mockResolvedValueOnce(SPAWN_SUCCESS);
+    const parseSpy = jest.spyOn(parser, 'parseFailedFlowsFromJUnit');
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml', 'flows/b.yaml'],
+      retries: 1,
+      output_format: 'html',
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    expect(parseSpy).not.toHaveBeenCalled();
+    expect(spawnMock.mock.calls[1][1]).toEqual(
+      expect.arrayContaining(['flows/a.yaml', 'flows/b.yaml'])
+    );
+  });
+
+  it('runs all original flows on every retry when retry_failed_only=false', async () => {
+    mockedSpawn.mockRejectedValueOnce(rejectExit1()).mockResolvedValueOnce(SPAWN_SUCCESS);
+    const parseSpy = jest
+      .spyOn(parser, 'parseFailedFlowsFromJUnit')
+      .mockResolvedValue(['flows/b.yaml']);
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml', 'flows/b.yaml'],
+      retries: 1,
+      output_format: 'junit',
+      retry_failed_only: false,
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    // Both attempts must see both flows in the original input order. Tail-slice
+    // equality locks order, not just membership — guards against any future
+    // failed-first reshuffling of the dumb-retry list.
+    const a0 = mockedSpawn.mock.calls[0][1]!;
+    const a1 = mockedSpawn.mock.calls[1][1]!;
+    expect(a0.slice(-2)).toEqual(['flows/a.yaml', 'flows/b.yaml']);
+    expect(a1.slice(-2)).toEqual(['flows/a.yaml', 'flows/b.yaml']);
+    expect(parseSpy).not.toHaveBeenCalled();
+  });
+
+  it('subsets to failing flows on retry when retry_failed_only=true (default behaviour)', async () => {
+    mockedSpawn.mockRejectedValueOnce(rejectExit1()).mockResolvedValueOnce(SPAWN_SUCCESS);
+    jest.spyOn(parser, 'parseFailedFlowsFromJUnit').mockResolvedValue(['flows/b.yaml']);
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml', 'flows/b.yaml'],
+      retries: 1,
+      output_format: 'junit',
+      retry_failed_only: true,
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    expect(mockedSpawn.mock.calls[0][1]).toEqual(
+      expect.arrayContaining(['flows/a.yaml', 'flows/b.yaml'])
+    );
+    const a1 = mockedSpawn.mock.calls[1][1]!;
+    expect(a1).toContain('flows/b.yaml');
+    expect(a1).not.toContain('flows/a.yaml');
+  });
+
+  it('falls back to all-flows retry when retry_failed_only=true but output_format!=junit', async () => {
+    mockedSpawn.mockRejectedValueOnce(rejectExit1()).mockResolvedValueOnce(SPAWN_SUCCESS);
+    const parseSpy = jest.spyOn(parser, 'parseFailedFlowsFromJUnit');
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml', 'flows/b.yaml'],
+      retries: 1,
+      output_format: 'html',
+      retry_failed_only: true,
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    expect(parseSpy).not.toHaveBeenCalled();
+    expect(mockedSpawn.mock.calls[1][1]).toEqual(
+      expect.arrayContaining(['flows/a.yaml', 'flows/b.yaml'])
+    );
+  });
+
+  it('falls back to all-flows retry when nameToPath is null (duplicate flow names)', async () => {
+    mockedSpawn.mockRejectedValueOnce(rejectExit1()).mockResolvedValueOnce(SPAWN_SUCCESS);
+    jest.spyOn(discovery, 'buildFlowNameToPathMap').mockResolvedValue(null);
+    const parseSpy = jest.spyOn(parser, 'parseFailedFlowsFromJUnit');
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml', 'flows/b.yaml'],
+      retries: 1,
+      output_format: 'junit',
+      retry_failed_only: true,
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    expect(parseSpy).not.toHaveBeenCalled();
+    expect(mockedSpawn.mock.calls[1][1]).toEqual(
+      expect.arrayContaining(['flows/a.yaml', 'flows/b.yaml'])
+    );
+  });
+
+  it('defaults retry_failed_only to true when omitted from inputs', async () => {
+    mockedSpawn.mockRejectedValueOnce(rejectExit1()).mockResolvedValueOnce(SPAWN_SUCCESS);
+    jest.spyOn(parser, 'parseFailedFlowsFromJUnit').mockResolvedValue(['flows/b.yaml']);
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml', 'flows/b.yaml'],
+      retries: 1,
+      output_format: 'junit',
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    const a1 = mockedSpawn.mock.calls[1][1]!;
+    expect(a1).toContain('flows/b.yaml');
+    expect(a1).not.toContain('flows/a.yaml');
+  });
+
+  it('writes merged junit on success', async () => {
+    mockedSpawn.mockResolvedValue(SPAWN_SUCCESS);
+    const mergeSpy = jest.spyOn(parser, 'mergeJUnitReports').mockResolvedValue();
+
+    const step = createStep({
+      flow_path: ['a.yaml'],
+      output_format: 'junit',
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    expect(mergeSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sourceDir: expect.stringContaining('junit-reports'),
+        outputPath: expect.stringContaining('android-maestro-junit.xml'),
+      })
+    );
+  });
+
+  it('falls back to copyLatestAttemptXml when mergeJUnitReports throws a data error', async () => {
+    mockedSpawn.mockResolvedValue(SPAWN_SUCCESS);
+    jest.spyOn(parser, 'mergeJUnitReports').mockRejectedValue(new Error('bad xml'));
+    const copySpy = jest.spyOn(parser, 'copyLatestAttemptXml').mockResolvedValue();
+
+    const step = createStep({
+      flow_path: ['a.yaml'],
+      output_format: 'junit',
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    expect(copySpy).toHaveBeenCalled();
+  });
+
+  it('swallows merge and copy-latest failures when maestro succeeded', async () => {
+    // Throwing on copy failure would mask the real reason for early-failing
+    // maestro runs (bad YAML writes no *.xml) and would also wrap a user-side
+    // failure as SystemError, which cancels the build's billing.
+    mockedSpawn.mockResolvedValue(SPAWN_SUCCESS);
+    jest.spyOn(parser, 'mergeJUnitReports').mockRejectedValue(new Error('bad xml'));
+    jest
+      .spyOn(parser, 'copyLatestAttemptXml')
+      .mockRejectedValue(Object.assign(new Error('no space'), { code: 'ENOSPC' }));
+
+    const step = createStep({
+      flow_path: ['a.yaml'],
+      output_format: 'junit',
+      platform: 'android',
+    });
+    await expect(step.executeAsync()).resolves.toBeUndefined();
+  });
+
+  it('surfaces ERR_MAESTRO_TESTS_FAILED (not copy error) when maestro fails and copy fails', async () => {
+    mockedSpawn.mockRejectedValue(
+      Object.assign(new Error('exit 1'), {
+        status: 1,
+        signal: null,
+        stdout: '',
+        stderr: '',
+        output: ['', ''],
+        pid: 1,
+      })
+    );
+    jest.spyOn(parser, 'copyLatestAttemptXml').mockRejectedValue(new Error('No *.xml files found'));
+
+    const step = createStep({
+      flow_path: ['a.yaml'],
+      output_format: 'junit',
+      platform: 'android',
+    });
+    await expect(step.executeAsync()).rejects.toThrow(UserError);
+  });
+
+  it('throws UserError when retries are exhausted with a non-zero exit', async () => {
+    mockedSpawn.mockRejectedValue(
+      Object.assign(new Error('exit 1'), {
+        status: 1,
+        signal: null,
+        stdout: '',
+        stderr: '',
+        output: ['', ''],
+        pid: 1,
+      })
+    );
+    jest.spyOn(parser, 'parseFailedFlowsFromJUnit').mockResolvedValue(['flows/a.yaml']);
+    jest.spyOn(parser, 'mergeJUnitReports').mockResolvedValue();
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml'],
+      retries: 2,
+      output_format: 'junit',
+      platform: 'android',
+    });
+    await expect(step.executeAsync()).rejects.toThrow(UserError);
+  });
+
+  it('throws UserError early on empty flow_path', async () => {
+    const step = createStep({ flow_path: [], platform: 'android' });
+    await expect(step.executeAsync()).rejects.toThrow(UserError);
+  });
+
+  it('uses $HOME/.maestro/tests output path for non-junit formats (e.g. html)', async () => {
+    mockedSpawn.mockResolvedValue(SPAWN_SUCCESS);
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml'],
+      output_format: 'html',
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    const args = mockedSpawn.mock.calls[0][1] as string[];
+    // Non-JUnit uses a fixed path inside $HOME/.maestro/tests so the
+    // whole-directory upload picks it up.
+    const outputArg = args.find(a => a.startsWith('--output='));
+    expect(outputArg).toMatch(/\.maestro\/tests\/android-maestro-html\.html$/);
+    expect(outputArg).not.toMatch(/junit-reports/);
+  });
+
+  it('uses lowercase extension for non-junit formats regardless of input casing', async () => {
+    mockedSpawn.mockResolvedValue(SPAWN_SUCCESS);
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml'],
+      output_format: 'HTML',
+      platform: 'ios',
+    });
+    await step.executeAsync();
+
+    const args = mockedSpawn.mock.calls[0][1] as string[];
+    const outputArg = args.find(a => a.startsWith('--output='));
+    expect(outputArg).toMatch(/\.maestro\/tests\/ios-maestro-html\.html$/);
+  });
+
+  it('does not include --output when output_format is undefined', async () => {
+    mockedSpawn.mockResolvedValue(SPAWN_SUCCESS);
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml'],
+      output_format: '',
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    const args = mockedSpawn.mock.calls[0][1] as string[];
+    expect(args.some(a => a.startsWith('--output'))).toBe(false);
+    expect(args).not.toContain('--output');
+    expect(args).not.toContain('--output=undefined');
+    expect(args).not.toContain('--output=null');
+    expect(args).not.toContain('--output=');
+  });
+
+  it('accepts output_format casing variations (e.g. JUNIT) case-insensitively', async () => {
+    // output_format.toLowerCase() must propagate end-to-end: final_report_path
+    // populated, per-attempt XMLs written into junit-reports/, merge invoked.
+    mockedSpawn.mockResolvedValue(SPAWN_SUCCESS);
+    const mergeSpy = jest.spyOn(parser, 'mergeJUnitReports').mockResolvedValue();
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml'],
+      output_format: 'JUNIT',
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    // Phase 1: final_report_path populated
+    expect(step.getOutputValueByName('final_report_path')).toMatch(
+      /\.maestro\/tests\/android-maestro-junit\.xml$/
+    );
+    // Retry loop: --output written into junit-reports/ (not legacy path)
+    const args = mockedSpawn.mock.calls[0][1] as string[];
+    const outputArg = args.find(a => a.startsWith('--output='));
+    expect(outputArg).toMatch(/junit-reports\/android-maestro-junit-attempt-0\.xml$/);
+    // Phase 3: merge invoked
+    expect(mergeSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        sourceDir: expect.stringContaining('junit-reports'),
+        outputPath: expect.stringContaining('android-maestro-junit.xml'),
+      })
+    );
+  });
+
+  it('passes include_tags, exclude_tags, and shards through to maestro argv', async () => {
+    mockedSpawn.mockResolvedValue(SPAWN_SUCCESS);
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml'],
+      output_format: 'junit',
+      platform: 'android',
+      shards: 3,
+      include_tags: 'smoke,critical',
+      exclude_tags: 'slow',
+    });
+    await step.executeAsync();
+
+    const args = mockedSpawn.mock.calls[0][1] as string[];
+    expect(args).toContain('--shard-split=3');
+    expect(args).toContain('--include-tags=smoke,critical');
+    expect(args).toContain('--exclude-tags=slow');
+  });
+
+  it('passes cwd and env to spawn so relative flow paths resolve correctly', async () => {
+    mockedSpawn.mockResolvedValue(SPAWN_SUCCESS);
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml'],
+      output_format: 'junit',
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    const spawnOptions = mockedSpawn.mock.calls[0][2] as {
+      cwd?: string;
+      env?: Record<string, string | undefined>;
+    };
+    expect(spawnOptions).toBeDefined();
+    expect(typeof spawnOptions.cwd).toBe('string');
+    expect(spawnOptions.cwd!.length).toBeGreaterThan(0);
+    expect(spawnOptions.env).toBeDefined();
+    expect(spawnOptions.env!.HOME).toBe('/home/expo');
+  });
+
+  it('exports MAESTRO_TESTS_DIR to maestro so flows can reference ${MAESTRO_TESTS_DIR}', async () => {
+    // Public docs (EAS workflows pre-packaged-jobs) instruct users to write
+    // screenshots/recordings into ${MAESTRO_TESTS_DIR}. The step must export
+    // it in the spawn env.
+    mockedSpawn.mockResolvedValue(SPAWN_SUCCESS);
+
+    const step = createStep({
+      flow_path: ['flows/a.yaml'],
+      output_format: 'junit',
+      platform: 'android',
+    });
+    await step.executeAsync();
+
+    const spawnOptions = mockedSpawn.mock.calls[0][2] as {
+      env?: Record<string, string | undefined>;
+    };
+    expect(spawnOptions.env!.MAESTRO_TESTS_DIR).toBe('/home/expo/.maestro/tests');
+  });
+
+  it('uses env.HOME (not os.homedir()) for maestro tests output paths', async () => {
+    // Even when os.homedir() differs, the step should derive paths from env.HOME
+    // so maestro (which receives env) and the step (which inspects those paths)
+    // agree on where reports land.
+    mockedSpawn.mockResolvedValue(SPAWN_SUCCESS);
+
+    const step = createStep(
+      {
+        flow_path: ['flows/a.yaml'],
+        output_format: 'junit',
+        platform: 'android',
+      },
+      { env: { HOME: '/custom/home' } }
+    );
+    await step.executeAsync();
+
+    expect(step.getOutputValueByName('tests_directory')).toBe('/custom/home/.maestro/tests');
+    expect(step.getOutputValueByName('junit_report_directory')).toBe(
+      '/custom/home/.maestro/tests/junit-reports'
+    );
+    expect(step.getOutputValueByName('final_report_path')).toBe(
+      '/custom/home/.maestro/tests/android-maestro-junit.xml'
+    );
+    const args = mockedSpawn.mock.calls[0][1] as string[];
+    const outputArg = args.find(a => a.startsWith('--output='));
+    expect(outputArg).toMatch(
+      /^--output=\/custom\/home\/\.maestro\/tests\/junit-reports\/android-maestro-junit-attempt-0\.xml$/
+    );
+  });
+
+  it('throws SystemError when env.HOME is unset', async () => {
+    const step = createStep(
+      {
+        flow_path: ['flows/a.yaml'],
+        output_format: 'junit',
+        platform: 'android',
+      },
+      { env: {} }
+    );
+    await expect(step.executeAsync()).rejects.toThrow(SystemError);
+  });
+
+  it('throws UserError on non-string entries in flow_path', async () => {
+    const step = createStep({
+      flow_path: ['flows/a.yaml', 2 as unknown as string],
+      platform: 'android',
+    });
+    await expect(step.executeAsync()).rejects.toThrow(UserError);
+  });
+
+  it('throws UserError when retries is negative', async () => {
+    const step = createStep({
+      flow_path: ['flows/a.yaml'],
+      retries: -1,
+      platform: 'android',
+    });
+    await expect(step.executeAsync()).rejects.toThrow(UserError);
+  });
+
+  it('throws UserError when retries is a non-integer number', async () => {
+    const step = createStep({
+      flow_path: ['flows/a.yaml'],
+      retries: 1.5,
+      platform: 'android',
+    });
+    await expect(step.executeAsync()).rejects.toThrow(UserError);
+  });
+
+  it('throws UserError when shards is zero', async () => {
+    const step = createStep({ flow_path: ['a.yaml'], platform: 'android', shards: 0 });
+    await expect(step.executeAsync()).rejects.toThrow(UserError);
+  });
+
+  it('throws UserError when shards is negative', async () => {
+    const step = createStep({ flow_path: ['a.yaml'], platform: 'android', shards: -1 });
+    await expect(step.executeAsync()).rejects.toThrow(UserError);
+  });
+
+  it('throws UserError when shards is a non-integer', async () => {
+    const step = createStep({ flow_path: ['a.yaml'], platform: 'android', shards: 1.5 });
+    await expect(step.executeAsync()).rejects.toThrow(UserError);
+  });
+
+  it('accepts shards: undefined (optional input)', async () => {
+    mockedSpawn.mockResolvedValue(SPAWN_SUCCESS);
+    const step = createStep({ flow_path: ['a.yaml'], platform: 'android' }); // no shards
+    await step.executeAsync(); // should succeed, not throw
+  });
+});

packages/build-tools/src/steps/functions/__tests__/reportMaestroTestResults.test.ts

@@ -72,7 +72,7 @@ describe(createReportMaestroTestResultsFunction, () => {
   it('parses JUnit results and calls GraphQL mutation', async () => {
     vol.fromJSON({
       '/junit/report.xml': JUNIT_PASS,
-      '/tests/2026-01-28_055409/ai-home.json': FLOW_AI,
+      '/root/project/.maestro/home.yml': '',
     });
 
     mockMutationFn.mockResolvedValue({
@@ -83,7 +83,11 @@ describe(createReportMaestroTestResultsFunction, () => {
       },
     });
 
-    await createStep().executeAsync();
+    await createStep({
+      callInputs: {
+        flow_path: ['.maestro/home.yml'],
+      },
+    }).executeAsync();
 
     expect(mockGraphqlClient.mutation).toHaveBeenCalledTimes(1);
     const [, variables] = (mockGraphqlClient.mutation as jest.Mock).mock.calls[0];

packages/build-tools/src/steps/functions/__tests__/startIosSimulator.test.ts

@@ -0,0 +1,76 @@
+import spawn from '@expo/turtle-spawn';
+
+import { createGlobalContextMock } from '../../../__tests__/utils/context';
+import { createMockLogger } from '../../../__tests__/utils/logger';
+import { IosSimulatorUtils } from '../../../utils/IosSimulatorUtils';
+import { createStartIosSimulatorBuildFunction } from '../startIosSimulator';
+
+jest.mock('@expo/turtle-spawn', () => ({
+  __esModule: true,
+  default: jest.fn(),
+}));
+
+jest.mock('../../../utils/IosSimulatorUtils', () => ({
+  IosSimulatorUtils: {
+    getAvailableDevicesAsync: jest.fn(),
+    getDeviceAsync: jest.fn(),
+    cloneAsync: jest.fn(),
+    startAsync: jest.fn(),
+    waitForReadyAsync: jest.fn(),
+    disableApsdAsync: jest.fn(),
+  },
+}));
+
+const mockedSpawn = jest.mocked(spawn);
+const mockedUtils = jest.mocked(IosSimulatorUtils);
+
+function createStep(callInputs?: Record<string, unknown>) {
+  const logger = createMockLogger();
+  const fn = createStartIosSimulatorBuildFunction();
+  const globalCtx = createGlobalContextMock({ logger });
+  const step = fn.createBuildStepFromFunctionCall(globalCtx, { callInputs });
+  return Object.assign(step, { logger });
+}
+
+describe(createStartIosSimulatorBuildFunction, () => {
+  beforeEach(() => {
+    mockedSpawn.mockResolvedValue({ stdout: '', stderr: '' } as any);
+    mockedUtils.getAvailableDevicesAsync.mockResolvedValue([]);
+    mockedUtils.getDeviceAsync.mockResolvedValue(null);
+    mockedUtils.cloneAsync.mockResolvedValue(undefined);
+    mockedUtils.startAsync.mockResolvedValue({ udid: 'test-udid' as any });
+    mockedUtils.waitForReadyAsync.mockResolvedValue(undefined);
+    mockedUtils.disableApsdAsync.mockResolvedValue(undefined);
+  });
+
+  it('disables apsd on the main device and every clone', async () => {
+    mockedUtils.startAsync
+      .mockResolvedValueOnce({ udid: 'base' as any })
+      .mockResolvedValueOnce({ udid: 'clone-1' as any })
+      .mockResolvedValueOnce({ udid: 'clone-2' as any });
+
+    await createStep({ device_identifier: 'iPhone 15', count: 2 }).executeAsync();
+
+    expect(mockedUtils.disableApsdAsync).toHaveBeenCalledWith({
+      udid: 'base',
+      env: expect.any(Object),
+    });
+    expect(mockedUtils.disableApsdAsync).toHaveBeenCalledWith({
+      udid: 'clone-1',
+      env: expect.any(Object),
+    });
+    expect(mockedUtils.disableApsdAsync).toHaveBeenCalledWith({
+      udid: 'clone-2',
+      env: expect.any(Object),
+    });
+  });
+
+  it('continues when disabling apsd fails', async () => {
+    mockedUtils.disableApsdAsync.mockRejectedValue(new Error('apsd disable failed'));
+
+    await createStep({ device_identifier: 'iPhone 15', count: 2 }).executeAsync();
+
+    // Startup is not aborted: readiness is still awaited for each device.
+    expect(mockedUtils.waitForReadyAsync).toHaveBeenCalled();
+  });
+});

packages/build-tools/src/steps/functions/maestroFlowDiscovery.ts

@@ -0,0 +1,190 @@
+import type { bunyan } from '@expo/logger';
+import { asyncResult } from '@expo/results';
+import fs from 'fs/promises';
+import path from 'path';
+import yaml from 'yaml';
+
+const YAML_EXT = /\.ya?ml$/i;
+const WORKSPACE_CONFIG_BASENAME = 'config.yaml';
+
+export interface BuildFlowNameToPathMapArgs {
+  inputFlowPaths: string[];
+  projectRoot: string;
+  logger: bunyan;
+}
+
+interface FlowEntry {
+  name: string;
+  path: string;
+  realpath: string;
+}
+
+export async function buildFlowNameToPathMap(
+  args: BuildFlowNameToPathMapArgs
+): Promise<Map<string, string> | null> {
+  try {
+    const flows = await discoverFlows(args);
+    return dedupAndDetectDuplicates(flows, args.logger);
+  } catch (err: any) {
+    args.logger.warn(`buildFlowNameToPathMap failed unexpectedly: ${err?.message ?? String(err)}`);
+    return null;
+  }
+}
+
+async function discoverFlows({
+  inputFlowPaths,
+  projectRoot,
+  logger,
+}: BuildFlowNameToPathMapArgs): Promise<FlowEntry[]> {
+  const realRootResult = await asyncResult(fs.realpath(projectRoot));
+  const realRoot = realRootResult.ok ? realRootResult.value : projectRoot;
+  const fileLists = await Promise.all(
+    inputFlowPaths.map(async input => {
+      const abs = path.resolve(projectRoot, input);
+      const statResult = await asyncResult(fs.stat(abs));
+      if (!statResult.ok) {
+        logger.warn(`flow_path entry "${input}" not found, skipping`);
+        return [];
+      }
+      const stat = statResult.value;
+      if (stat.isFile() && YAML_EXT.test(abs)) {
+        return [abs];
+      }
+      if (stat.isDirectory()) {
+        const out: string[] = [];
+        await walkDir(abs, new Set(), out, logger);
+        return out;
+      }
+      return [];
+    })
+  );
+  return Promise.all(fileLists.flat().map(absFile => makeEntry(absFile, realRoot)));
+}
+
+async function makeEntry(absFile: string, realRoot: string): Promise<FlowEntry> {
+  const [name, realFileResult] = await Promise.all([
+    readFlowName(absFile),
+    asyncResult(fs.realpath(absFile)),
+  ]);
+  const realFile = realFileResult.ok ? realFileResult.value : absFile;
+  const rel = path.relative(realRoot, realFile);
+  const value = rel.startsWith('..') || path.isAbsolute(rel) ? absFile : rel;
+  return { name, path: value, realpath: realFile };
+}
+
+function dedupAndDetectDuplicates(flows: FlowEntry[], logger: bunyan): Map<string, string> | null {
+  const byKey = new Map<string, FlowEntry>();
+  for (const f of flows) {
+    if (!byKey.has(f.realpath)) {
+      byKey.set(f.realpath, f);
+    }
+  }
+  const unique = [...byKey.values()];
+
+  const nameToPath = new Map<string, string>();
+  const duplicates = new Map<string, string[]>();
+  for (const f of unique) {
+    if (nameToPath.has(f.name)) {
+      const existing = nameToPath.get(f.name)!;
+      const list = duplicates.get(f.name) ?? [existing];
+      list.push(f.path);
+      duplicates.set(f.name, list);
+    }
+    nameToPath.set(f.name, f.path);
+  }
+  if (duplicates.size > 0) {
+    for (const [name, paths] of duplicates) {
+      logger.warn(`Duplicate Maestro flow name "${name}" across paths: ${paths.join(', ')}.`);
+    }
+    logger.warn(
+      'Retry-failed-only is disabled for this run; will retry all flows on failure. ' +
+        'Give each Maestro flow a unique name (file basename or top-level name) to enable retry-failed-only.'
+    );
+    return null;
+  }
+  return nameToPath;
+}
+
+export async function walkDir(
+  dir: string,
+  visited: Set<string>,
+  out: string[],
+  logger: bunyan
+): Promise<void> {
+  // Cycle protection: dedup on realpath (fall back to the original path when
+  // realpath fails so we still make progress on missing or restricted dirs).
+  const realResult = await asyncResult(fs.realpath(dir));
+  const real = realResult.ok ? realResult.value : dir;
+  if (visited.has(real)) {
+    return;
+  }
+  visited.add(real);
+
+  let entries;
+  try {
+    entries = await fs.readdir(dir, { withFileTypes: true });
+  } catch (err: any) {
+    logger.warn(`readdir failed for ${dir}: ${err?.message ?? String(err)}`);
+    return;
+  }
+  entries.sort((a, b) => a.name.localeCompare(b.name));
+
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isSymbolicLink()) {
+      const tgtResult = await asyncResult(fs.stat(full));
+      if (!tgtResult.ok) {
+        continue;
+      }
+      const tgt = tgtResult.value;
+      if (tgt.isDirectory()) {
+        await walkDir(full, visited, out, logger);
+      } else if (tgt.isFile() && isYamlFile(entry.name) && !isWorkspaceConfig(entry.name)) {
+        out.push(full);
+      }
+    } else if (entry.isDirectory()) {
+      await walkDir(full, visited, out, logger);
+    } else if (entry.isFile()) {
+      if (isYamlFile(entry.name) && !isWorkspaceConfig(entry.name)) {
+        out.push(full);
+      }
+    }
+  }
+}
+
+export async function readFlowName(absFile: string): Promise<string> {
+  const ext = path.extname(absFile);
+  const fallback = path.basename(absFile, ext);
+  let content: string;
+  try {
+    content = await fs.readFile(absFile, 'utf-8');
+  } catch {
+    return fallback;
+  }
+
+  let firstDoc;
+  try {
+    const docs = yaml.parseAllDocuments(content);
+    firstDoc = docs[0];
+  } catch {
+    return fallback;
+  }
+  if (!firstDoc || firstDoc.errors.length > 0) {
+    return fallback;
+  }
+
+  const parsed = firstDoc.toJS();
+  const name = parsed?.name;
+  if (typeof name === 'string' && name.length > 0) {
+    return name;
+  }
+  return fallback;
+}
+
+function isYamlFile(name: string): boolean {
+  return YAML_EXT.test(name);
+}
+
+function isWorkspaceConfig(name: string): boolean {
+  return name.toLowerCase() === WORKSPACE_CONFIG_BASENAME;
+}

packages/build-tools/src/steps/functions/maestroResultParser.ts

@@ -1,7 +1,6 @@
-import { XMLParser } from 'fast-xml-parser';
+import { XMLBuilder, XMLParser, XMLValidator } from 'fast-xml-parser';
 import fs from 'fs/promises';
 import path from 'path';
-import { z } from 'zod';
 
 export interface MaestroFlowResult {
   name: string;
@@ -14,13 +13,8 @@ export interface MaestroFlowResult {
   properties: Record<string, string>;
 }
 
-// Maestro's TestDebugReporter creates timestamped directories, e.g. "2024-06-15_143022"
-const TIMESTAMP_DIR_PATTERN = /^\d{4}-\d{2}-\d{2}_\d{6}$/;
-
-export function extractFlowKey(filename: string, prefix: string): string | null {
-  const match = filename.match(new RegExp(`^${prefix}-(.+)\\.json$`));
-  return match?.[1] ?? null;
-}
+// Per-attempt JUnit XML files use `*-attempt-N.xml` names; this extracts N.
+const ATTEMPT_PATTERN = /attempt-(\d+)/;
 
 export interface JUnitTestCaseResult {
   name: string;
@@ -38,11 +32,9 @@ const xmlParser = new XMLParser({
   isArray: name => ['testsuite', 'testcase', 'property'].includes(name),
 });
 
-// Internal helper — not exported. Parses a single JUnit XML file.
-async function parseJUnitFile(filePath: string): Promise<JUnitTestCaseResult[]> {
+function parseJUnitContent(content: string): JUnitTestCaseResult[] {
   const results: JUnitTestCaseResult[] = [];
   try {
-    const content = await fs.readFile(filePath, 'utf-8');
     const parsed = xmlParser.parse(content);
 
     const testsuites = parsed?.testsuites?.testsuite;
@@ -106,11 +98,20 @@ async function parseJUnitFile(filePath: string): Promise<JUnitTestCaseResult[]>
       }
     }
   } catch {
-    // Skip malformed XML files
+    // Malformed XML — return whatever we collected before the parser bailed.
   }
   return results;
 }
 
+async function parseJUnitFile(filePath: string): Promise<JUnitTestCaseResult[]> {
+  try {
+    const content = await fs.readFile(filePath, 'utf-8');
+    return parseJUnitContent(content);
+  } catch {
+    return [];
+  }
+}
+
 export async function parseJUnitTestCases(junitDirectory: string): Promise<JUnitTestCaseResult[]> {
   let entries: string[];
   try {
@@ -124,49 +125,16 @@ export async function parseJUnitTestCases(junitDirectory: string): Promise<JUnit
     return [];
   }
 
-  const results: JUnitTestCaseResult[] = [];
-  for (const xmlFile of xmlFiles) {
-    results.push(...(await parseJUnitFile(path.join(junitDirectory, xmlFile))));
-  }
-  return results;
-}
-
-const FlowMetadataFileSchema = z.object({
-  flow_name: z.string(),
-  flow_file_path: z.string(),
-});
-
-type FlowMetadata = z.output<typeof FlowMetadataFileSchema>;
-
-/**
- * Parses an `ai-*.json` file produced by Maestro's TestDebugReporter.
- *
- * The file contains:
- * - `flow_name`: derived from the YAML `config.name` field if present, otherwise
- *   the flow filename without extension.
- *   See: https://github.com/mobile-dev-inc/Maestro/blob/c0e95fd/maestro-cli/src/main/java/maestro/cli/runner/TestRunner.kt#L70
- * - `flow_file_path`: absolute path to the original flow YAML file.
- * - `outputs`: screenshot defect data (unused here).
- *
- * Filename format: `ai-(flowName).json` where `/` in flowName is replaced with `_`.
- * See: https://github.com/mobile-dev-inc/Maestro/blob/c0e95fd/maestro-cli/src/main/java/maestro/cli/report/TestDebugReporter.kt#L67
- */
-export async function parseFlowMetadata(filePath: string): Promise<FlowMetadata | null> {
-  try {
-    const content = await fs.readFile(filePath, 'utf-8');
-    const data = JSON.parse(content);
-    return FlowMetadataFileSchema.parse(data);
-  } catch {
-    return null;
-  }
+  const perFile = await Promise.all(
+    xmlFiles.map(f => parseJUnitFile(path.join(junitDirectory, f)))
+  );
+  return perFile.flat();
 }
 
 export async function parseMaestroResults(
   junitDirectory: string,
-  testsDirectory: string,
-  projectRoot: string
+  nameToPath: Map<string, string> | null
 ): Promise<MaestroFlowResult[]> {
-  // 1. Parse JUnit XML files, tracking which file each result came from
   let junitEntries: string[];
   try {
     junitEntries = await fs.readdir(junitDirectory);
@@ -195,54 +163,8 @@ export async function parseMaestroResults(
     return [];
   }
 
-  // 2. Parse ai-*.json from debug output for flow_file_path + retryCount
-  const flowPathMap = new Map<string, string>(); // flowName → flowFilePath
-  const flowOccurrences = new Map<string, number>(); // flowName → count
-
-  let entries: string[];
-  try {
-    entries = await fs.readdir(testsDirectory);
-  } catch {
-    entries = [];
-  }
-
-  const timestampDirs = entries.filter(name => TIMESTAMP_DIR_PATTERN.test(name)).sort();
-
-  for (const dir of timestampDirs) {
-    const dirPath = path.join(testsDirectory, dir);
-    let files: string[];
-    try {
-      files = await fs.readdir(dirPath);
-    } catch {
-      continue;
-    }
-
-    for (const file of files) {
-      const flowKey = extractFlowKey(file, 'ai');
-      if (!flowKey) {
-        continue;
-      }
-
-      const metadata = await parseFlowMetadata(path.join(dirPath, file));
-      if (!metadata) {
-        continue;
-      }
-
-      // Track latest path (last timestamp dir wins)
-      flowPathMap.set(metadata.flow_name, metadata.flow_file_path);
-
-      // Count occurrences for retryCount
-      flowOccurrences.set(metadata.flow_name, (flowOccurrences.get(metadata.flow_name) ?? 0) + 1);
-    }
-  }
-
-  // 3. Merge: JUnit results + ai-*.json metadata
   const results: MaestroFlowResult[] = [];
 
-  // Parse attempt index from filename pattern: *-attempt-N.*
-  const ATTEMPT_PATTERN = /attempt-(\d+)/;
-
-  // Group results by flow name
   const resultsByName = new Map<string, JUnitResultWithSource[]>();
   for (const entry of junitResultsWithSource) {
     const group = resultsByName.get(entry.result.name) ?? [];
@@ -251,74 +173,259 @@ export async function parseMaestroResults(
   }
 
   for (const [flowName, flowEntries] of resultsByName) {
-    const flowFilePath = flowPathMap.get(flowName);
-    const relativePath = flowFilePath
-      ? await relativizePathAsync(flowFilePath, projectRoot)
-      : flowName;
-
-    if (flowEntries.length === 1) {
-      // Single result for this flow — use ai-*.json occurrence count for retryCount
-      // (backward compat with old-style single JUnit file that gets overwritten)
-      const { result } = flowEntries[0];
-      const occurrences = flowOccurrences.get(flowName) ?? 0;
-      const retryCount = Math.max(0, occurrences - 1);
+    const flowPath = nameToPath?.get(flowName) ?? flowName;
+    // retryCount is derived from each entry's source filename (`attempt-N`);
+    // a single entry from `report.xml` (no marker) collapses to attempt 0.
+    const sorted = flowEntries
+      .map(entry => {
+        const match = entry.sourceFile.match(ATTEMPT_PATTERN);
+        const attemptIndex = match ? parseInt(match[1], 10) : 0;
+        return { ...entry, attemptIndex };
+      })
+      .sort((a, b) => a.attemptIndex - b.attemptIndex);
 
+    for (const { result, attemptIndex } of sorted) {
       results.push({
         name: flowName,
-        path: relativePath,
+        path: flowPath,
         status: result.status,
         errorMessage: result.errorMessage,
         duration: result.duration,
-        retryCount,
+        retryCount: attemptIndex,
         tags: result.tags,
         properties: result.properties,
       });
-    } else {
-      // Multiple results — per-attempt JUnit files. Sort by attempt index from filename.
-      const sorted = flowEntries
-        .map(entry => {
-          const match = entry.sourceFile.match(ATTEMPT_PATTERN);
-          const attemptIndex = match ? parseInt(match[1], 10) : 0;
-          return { ...entry, attemptIndex };
-        })
-        .sort((a, b) => a.attemptIndex - b.attemptIndex);
-
-      for (const { result, attemptIndex } of sorted) {
-        results.push({
-          name: flowName,
-          path: relativePath,
-          status: result.status,
-          errorMessage: result.errorMessage,
-          duration: result.duration,
-          retryCount: attemptIndex,
-          tags: result.tags,
-          properties: result.properties,
-        });
-      }
     }
   }
 
   return results;
 }
 
-async function relativizePathAsync(flowFilePath: string, projectRoot: string): Promise<string> {
-  if (!path.isAbsolute(flowFilePath)) {
-    return flowFilePath;
+/**
+ * Returns the subset of `inputFlowPaths` whose testcases failed in the given
+ * attempt's JUnit file, or `null` when the result cannot be trusted (caller
+ * then falls back to dumb retry — re-run everything).
+ *
+ * Caller passes a precomputed `nameToPath` map built from the user's
+ * `inputFlowPaths`. We translate failed testcase names to flow paths via
+ * that map; unknown names → null.
+ */
+export async function parseFailedFlowsFromJUnit(args: {
+  junitFile: string;
+  nameToPath: Map<string, string>;
+}): Promise<string[] | null> {
+  // fast-xml-parser is lenient — truncated XML can produce a partial parse
+  // with some testcases dropped. Trusting that subset for retry-failed-only would
+  // skip retries for cut-off flows; reject any malformed XML and fall back
+  // to dumb retry.
+  let content: string;
+  try {
+    content = await fs.readFile(args.junitFile, 'utf-8');
+  } catch {
+    return null;
+  }
+  if (XMLValidator.validate(content) !== true) {
+    return null;
   }
 
-  // Resolve symlinks (e.g., /tmp -> /private/tmp on macOS) for consistent comparison
-  let resolvedRoot = projectRoot;
-  let resolvedFlow = flowFilePath;
-  try {
-    resolvedRoot = await fs.realpath(projectRoot);
-  } catch {}
-  try {
-    resolvedFlow = await fs.realpath(flowFilePath);
-  } catch {}
-
-  const relative = path.relative(resolvedRoot, resolvedFlow);
-  if (relative.startsWith('..')) {
-    return flowFilePath;
+  const testcases = parseJUnitContent(content);
+  if (testcases.length === 0) {
+    return null;
   }
-  return relative;
+
+  const failing = testcases.filter(tc => tc.status === 'failed');
+  if (failing.length === 0) {
+    return [];
+  }
+
+  // Two testcases with the same name (pass+fail or fail+fail) make it
+  // impossible to map back to a single input flow_path. Signal "unknown".
+  // Complementary to the map-build duplicate check (which catches the case
+  // where tag filter hides duplication from JUnit).
+  const allNameCounts = new Map<string, number>();
+  for (const tc of testcases) {
+    allNameCounts.set(tc.name, (allNameCounts.get(tc.name) ?? 0) + 1);
+  }
+  for (const count of allNameCounts.values()) {
+    if (count > 1) {
+      return null;
+    }
+  }
+
+  const matched: string[] = [];
+  for (const tc of failing) {
+    const p = args.nameToPath.get(tc.name);
+    if (p === undefined) {
+      return null;
+    }
+    matched.push(p);
+  }
+  return matched;
+}
+
+/**
+ * Reads every *.xml in sourceDir (per-attempt JUnit files), picks the latest
+ * attempt's <testcase> per unique flow name (latest determined from the
+ * filename's `attempt-(\d+)` marker; files without the marker = attempt 0),
+ * and writes a merged document to outputPath.
+ *
+ * Throws on empty/malformed/no-testcase input so the caller can fall back to
+ * copyLatestAttemptXml — silently dropping bad attempts could keep stale
+ * failure rows around and produce a misleading merged report.
+ */
+export async function mergeJUnitReports(args: {
+  sourceDir: string;
+  outputPath: string;
+}): Promise<void> {
+  const entries = await fs.readdir(args.sourceDir);
+  const xmlFiles = entries.filter(f => f.endsWith('.xml')).sort();
+
+  if (xmlFiles.length === 0) {
+    throw new Error(`mergeJUnitReports: no *.xml files found in ${args.sourceDir}`);
+  }
+
+  interface FileGroup {
+    attemptIndex: number;
+    filename: string;
+    content: string;
+    testcasesByName: Map<string, unknown[]>;
+  }
+  const contents = await Promise.all(
+    xmlFiles.map(async f => ({
+      filename: f,
+      content: await fs.readFile(path.join(args.sourceDir, f), 'utf-8'),
+    }))
+  );
+  const fileGroups: FileGroup[] = [];
+  for (const { filename, content } of contents) {
+    if (XMLValidator.validate(content) !== true) {
+      throw new Error(`mergeJUnitReports: invalid XML in ${filename}`);
+    }
+    let parsed: any;
+    try {
+      parsed = xmlParser.parse(content);
+    } catch (err) {
+      throw new Error(`mergeJUnitReports: failed to parse ${filename}`, { cause: err });
+    }
+    const testsuites = parsed?.testsuites?.testsuite;
+    if (!Array.isArray(testsuites)) {
+      throw new Error(`mergeJUnitReports: no <testsuite> array in ${filename}`);
+    }
+    const match = filename.match(ATTEMPT_PATTERN);
+    const attemptIndex = match ? parseInt(match[1], 10) : 0;
+    const testcasesByName = new Map<string, unknown[]>();
+    for (const suite of testsuites) {
+      const cases = suite?.testcase;
+      if (!Array.isArray(cases)) {
+        continue;
+      }
+      for (const tc of cases) {
+        const name = tc?.['@_name'];
+        if (typeof name !== 'string') {
+          continue;
+        }
+        const group = testcasesByName.get(name) ?? [];
+        group.push(tc);
+        testcasesByName.set(name, group);
+      }
+    }
+    if (testcasesByName.size === 0) {
+      throw new Error(`mergeJUnitReports: no parseable testcases in ${filename}`);
+    }
+    fileGroups.push({ attemptIndex, filename, content, testcasesByName });
+  }
+
+  // Single attempt: copy the original XML so suite-level metadata (testsuite
+  // attributes, <system-out>, etc.) survives. The rebuild path below would
+  // collapse those to a single attribute-less <testsuite>.
+  if (fileGroups.length === 1) {
+    await fs.writeFile(args.outputPath, fileGroups[0].content);
+    return;
+  }
+
+  // For each unique name, pick the file with the highest attempt index that
+  // contains it (ties broken by sorted filename — later wins). Preserve every
+  // <testcase> element from the winning file for that name, so same-attempt
+  // duplicates survive.
+  const nameToWinningFile = new Map<string, FileGroup>();
+  for (const group of fileGroups) {
+    for (const name of group.testcasesByName.keys()) {
+      const current = nameToWinningFile.get(name);
+      if (!current || group.attemptIndex >= current.attemptIndex) {
+        nameToWinningFile.set(name, group);
+      }
+    }
+  }
+
+  // Emit in first-seen order (iteration over `fileGroups` yields stable order
+  // matching the sorted filename list).
+  const testcases: unknown[] = [];
+  const emitted = new Set<string>();
+  for (const group of fileGroups) {
+    for (const [name, cases] of group.testcasesByName) {
+      if (emitted.has(name)) {
+        continue;
+      }
+      const winner = nameToWinningFile.get(name);
+      if (winner === group) {
+        for (const tc of cases) {
+          testcases.push(tc);
+        }
+        emitted.add(name);
+      }
+    }
+  }
+
+  const builder = new XMLBuilder({
+    ignoreAttributes: false,
+    attributeNamePrefix: '@_',
+    format: true,
+    suppressEmptyNode: true,
+  });
+  const xml = builder.build({
+    testsuites: {
+      testsuite: {
+        testcase: testcases,
+      },
+    },
+  });
+  await fs.writeFile(args.outputPath, xml);
+}
+
+/**
+ * Copies the highest-attempt-index *.xml file from sourceDir to outputPath.
+ * Used as a fallback when mergeJUnitReports fails due to data issues but the
+ * step still needs to produce final_report_path.
+ *
+ * Throws if sourceDir contains no *.xml files or if the copy fails.
+ */
+export async function copyLatestAttemptXml(args: {
+  sourceDir: string;
+  outputPath: string;
+}): Promise<void> {
+  const entries = await fs.readdir(args.sourceDir);
+  const xmlFiles = entries.filter(f => f.endsWith('.xml')).sort();
+  if (xmlFiles.length === 0) {
+    throw new Error(`No *.xml files found in ${args.sourceDir}`);
+  }
+
+  // Pick the file with the highest attempt index. Files without the marker are
+  // treated as attempt 0. Ties are broken by sorted filename — later wins
+  // (same rule as mergeJUnitReports).
+  let winner = xmlFiles[0];
+  let winnerAttempt = (() => {
+    const m = winner.match(ATTEMPT_PATTERN);
+    return m ? parseInt(m[1], 10) : 0;
+  })();
+  for (let i = 1; i < xmlFiles.length; i++) {
+    const candidate = xmlFiles[i];
+    const match = candidate.match(ATTEMPT_PATTERN);
+    const attempt = match ? parseInt(match[1], 10) : 0;
+    if (attempt >= winnerAttempt) {
+      winner = candidate;
+      winnerAttempt = attempt;
+    }
+  }
+
+  await fs.copyFile(path.join(args.sourceDir, winner), args.outputPath);
 }

packages/build-tools/src/steps/functions/maestroTests.ts

@@ -0,0 +1,330 @@
+import { SystemError, UserError } from '@expo/eas-build-job';
+import {
+  BuildFunction,
+  BuildRuntimePlatform,
+  BuildStepInput,
+  BuildStepInputValueTypeName,
+  BuildStepOutput,
+} from '@expo/steps';
+import spawn from '@expo/turtle-spawn';
+import fs from 'fs/promises';
+import path from 'path';
+import { z } from 'zod';
+
+import { buildFlowNameToPathMap } from './maestroFlowDiscovery';
+import {
+  copyLatestAttemptXml,
+  mergeJUnitReports,
+  parseFailedFlowsFromJUnit,
+} from './maestroResultParser';
+import { sleepAsync } from '../../utils/retry';
+
+const FlowPathSchema = z.array(z.string().min(1)).min(1);
+const RetriesSchema = z.number().int().min(0).default(0);
+const ShardsSchema = z.number().int().min(1).optional();
+
+function parseInput<S extends z.ZodTypeAny>(
+  schema: S,
+  value: unknown,
+  message: string
+): z.output<S> {
+  const result = schema.safeParse(value);
+  if (!result.success) {
+    throw new UserError('ERR_MAESTRO_INVALID_INPUT', message, { cause: result.error });
+  }
+  return result.data;
+}
+
+// ENOENT is excluded — "input XML missing" is a data issue, not a storage
+// fault, so the post-loop merge should fall through to copy-latest instead
+// of throwing.
+function isFilesystemError(err: any): boolean {
+  if (!err || typeof err !== 'object') {
+    return false;
+  }
+  const code = err.code;
+  return (
+    code === 'ENOSPC' || code === 'EACCES' || code === 'EROFS' || code === 'EIO' || code === 'EPERM'
+  );
+}
+
+// `outputPath: null` means "let maestro pick" (no --output flag). Junit and
+// other declared formats pass an explicit path so downstream upload steps
+// know where to find the result.
+function buildMaestroArgs(args: {
+  flow_path: string[];
+  outputPath: string | null;
+  output_format: string | undefined;
+  shards: number | undefined;
+  include_tags: string | undefined;
+  exclude_tags: string | undefined;
+}): string[] {
+  const out: string[] = ['test'];
+  if (args.output_format) {
+    out.push(`--format=${args.output_format.toUpperCase()}`);
+  }
+  if (args.outputPath) {
+    out.push(`--output=${args.outputPath}`);
+  }
+  if (args.shards !== undefined) {
+    out.push(`--shard-split=${args.shards}`);
+  }
+  if (args.include_tags) {
+    out.push(`--include-tags=${args.include_tags}`);
+  }
+  if (args.exclude_tags) {
+    out.push(`--exclude-tags=${args.exclude_tags}`);
+  }
+  out.push(...args.flow_path);
+  return out;
+}
+
+export function createMaestroTestsBuildFunction(): BuildFunction {
+  return new BuildFunction({
+    namespace: 'eas',
+    id: 'maestro_tests',
+    name: 'Run Maestro Tests',
+    __metricsId: 'eas/maestro_tests',
+    inputProviders: [
+      BuildStepInput.createProvider({
+        id: 'flow_path',
+        required: true,
+        allowedValueTypeName: BuildStepInputValueTypeName.JSON,
+      }),
+      BuildStepInput.createProvider({
+        id: 'retries',
+        required: false,
+        defaultValue: 0,
+        allowedValueTypeName: BuildStepInputValueTypeName.NUMBER,
+      }),
+      BuildStepInput.createProvider({
+        id: 'retry_failed_only',
+        required: false,
+        defaultValue: true,
+        allowedValueTypeName: BuildStepInputValueTypeName.BOOLEAN,
+      }),
+      BuildStepInput.createProvider({
+        id: 'shards',
+        required: false,
+        allowedValueTypeName: BuildStepInputValueTypeName.NUMBER,
+      }),
+      BuildStepInput.createProvider({
+        id: 'include_tags',
+        required: false,
+        allowedValueTypeName: BuildStepInputValueTypeName.STRING,
+      }),
+      BuildStepInput.createProvider({
+        id: 'exclude_tags',
+        required: false,
+        allowedValueTypeName: BuildStepInputValueTypeName.STRING,
+      }),
+      BuildStepInput.createProvider({
+        id: 'output_format',
+        required: false,
+        defaultValue: 'junit',
+        allowedValueTypeName: BuildStepInputValueTypeName.STRING,
+      }),
+      BuildStepInput.createProvider({
+        id: 'platform',
+        required: false,
+        allowedValueTypeName: BuildStepInputValueTypeName.STRING,
+      }),
+    ],
+    outputProviders: [
+      BuildStepOutput.createProvider({ id: 'junit_report_directory', required: true }),
+      BuildStepOutput.createProvider({ id: 'final_report_path', required: false }),
+      BuildStepOutput.createProvider({ id: 'tests_directory', required: true }),
+    ],
+    fn: async (stepCtx, { inputs, outputs, env, signal }) => {
+      const { logger, global } = stepCtx;
+      const platformInput = inputs.platform.value as string | undefined;
+      const outputFormat = (inputs.output_format.value as string | undefined)?.toLowerCase();
+      const includeTags = inputs.include_tags.value as string | undefined;
+      const excludeTags = inputs.exclude_tags.value as string | undefined;
+
+      const platform: 'ios' | 'android' =
+        platformInput === 'ios' || platformInput === 'android'
+          ? platformInput
+          : global.runtimePlatform === BuildRuntimePlatform.DARWIN
+            ? 'ios'
+            : 'android';
+
+      // Paths derive from env.HOME (not os.homedir()). Maestro is spawned with
+      // this env and writes debug output under $HOME/.maestro/tests; the step
+      // must read from the same place or stale files leak across runs.
+      const home = env.HOME;
+      if (!home) {
+        throw new SystemError('HOME env var is not set');
+      }
+      const testsDirectory = path.join(home, '.maestro', 'tests');
+      const junitReportDirectory = path.join(testsDirectory, 'junit-reports');
+      const finalReportPath =
+        outputFormat === 'junit'
+          ? path.join(testsDirectory, `${platform}-maestro-junit.xml`)
+          : undefined;
+
+      // Public docs (EAS workflows pre-packaged-jobs) document
+      // `${MAESTRO_TESTS_DIR}` for users to save screenshots/recordings into
+      // the uploaded dir.
+      const spawnEnv = { ...env, MAESTRO_TESTS_DIR: testsDirectory };
+
+      // Outputs are published BEFORE any throw below so downstream
+      // `if: always()` upload steps still see populated values when this
+      // step fails early.
+      outputs.tests_directory.set(testsDirectory);
+      outputs.junit_report_directory.set(junitReportDirectory);
+      if (finalReportPath !== undefined) {
+        outputs.final_report_path.set(finalReportPath);
+      }
+
+      const flowPaths = parseInput(
+        FlowPathSchema,
+        inputs.flow_path.value,
+        'flow_path must be a non-empty array of non-empty strings.'
+      );
+      const retries = parseInput(
+        RetriesSchema,
+        inputs.retries.value,
+        'retries must be a non-negative integer.'
+      );
+      const shards = parseInput(
+        ShardsSchema,
+        inputs.shards.value,
+        'shards must be a positive integer.'
+      );
+      const retryFailedOnly = inputs.retry_failed_only.value as boolean;
+
+      try {
+        await fs.mkdir(junitReportDirectory, { recursive: true });
+      } catch (err) {
+        throw new SystemError('Failed to create JUnit report directory', { cause: err });
+      }
+
+      // null → duplicate flow names; retry-failed-only disabled, fall through to
+      // dumb retry (re-run everything) on failure.
+      const nameToPath = await buildFlowNameToPathMap({
+        inputFlowPaths: flowPaths,
+        projectRoot: stepCtx.workingDirectory,
+        logger,
+      });
+
+      // Retry loop. spawn-async error shapes:
+      //   ENOENT/EACCES → infra (binary missing/not executable) → SystemError.
+      //   numeric err.status → maestro exited non-zero → retry.
+      //   else (signal-only, OOM kill, unknown) → infra → SystemError, never
+      //     downgraded to "tests failed".
+      // Retry-failed-only (junit mode): after a failed attempt, subset to the failing
+      // flows. parseFailedFlowsFromJUnit returns null when the JUnit cannot be
+      // trusted; we then fall through to dumb retry (re-run everything).
+      let flowsToRun: string[] = flowPaths;
+      let lastAttemptExitCode: number | null = null;
+
+      const totalAttempts = retries + 1;
+      for (let attempt = 0; attempt <= retries; attempt++) {
+        const outputPath =
+          outputFormat === 'junit'
+            ? path.join(junitReportDirectory, `${platform}-maestro-junit-attempt-${attempt}.xml`)
+            : outputFormat
+              ? path.join(testsDirectory, `${platform}-maestro-${outputFormat}.${outputFormat}`)
+              : null;
+
+        const maestroArgs = buildMaestroArgs({
+          flow_path: flowsToRun,
+          outputPath,
+          output_format: outputFormat,
+          shards,
+          include_tags: includeTags,
+          exclude_tags: excludeTags,
+        });
+        logger.info(
+          `Running maestro (attempt ${attempt + 1}/${totalAttempts}): maestro ${maestroArgs.join(' ')}`
+        );
+
+        try {
+          await spawn('maestro', maestroArgs, {
+            cwd: stepCtx.workingDirectory,
+            env: spawnEnv,
+            logger,
+            signal,
+          });
+          lastAttemptExitCode = 0;
+        } catch (err: any) {
+          if (err && (err.code === 'ENOENT' || err.code === 'EACCES')) {
+            throw new SystemError('Failed to invoke maestro', { cause: err });
+          }
+          if (err && typeof err.status === 'number') {
+            lastAttemptExitCode = err.status;
+          } else {
+            throw new SystemError('Unexpected spawn failure invoking maestro', { cause: err });
+          }
+        }
+
+        if (lastAttemptExitCode === 0 || attempt === retries) {
+          break;
+        }
+
+        if (retryFailedOnly && outputFormat === 'junit' && outputPath && nameToPath) {
+          const failed = await parseFailedFlowsFromJUnit({
+            junitFile: outputPath,
+            nameToPath,
+          });
+          if (failed !== null && failed.length > 0) {
+            flowsToRun = failed;
+            logger.info(
+              `Test failed; retrying ${failed.length} failed flow(s): ${failed.join(', ')}`
+            );
+          } else {
+            flowsToRun = flowPaths;
+            logger.info('Test failed; could not determine failed subset, retrying all flows');
+          }
+        } else {
+          flowsToRun = flowPaths;
+          logger.info('Test failed, retrying all flows');
+        }
+
+        await sleepAsync(2000);
+      }
+
+      // Smart merge first; on data errors (bad XML, missing input) fall back
+      // to copy-latest so the caller still gets a single JUnit file.
+      // Filesystem errors short-circuit straight to SystemError.
+      if (finalReportPath !== undefined) {
+        try {
+          await mergeJUnitReports({
+            sourceDir: junitReportDirectory,
+            outputPath: finalReportPath,
+          });
+        } catch (mergeErr: any) {
+          if (isFilesystemError(mergeErr)) {
+            throw new SystemError('Failed to write final_report_path', { cause: mergeErr });
+          }
+          logger.warn({ err: mergeErr }, 'Smart merge failed; falling back to copy-latest.');
+          try {
+            await copyLatestAttemptXml({
+              sourceDir: junitReportDirectory,
+              outputPath: finalReportPath,
+            });
+          } catch (copyErr: any) {
+            // Swallow: a copy failure here usually means maestro itself failed
+            // early (bad YAML wrote no *.xml). Throwing SystemError would mask
+            // the real reason and cancel billing for a user-side failure — let
+            // the lastAttemptExitCode check below surface ERR_MAESTRO_TESTS_FAILED.
+            logger.warn(
+              `Failed to produce final_report_path at ${finalReportPath}: ${copyErr?.message ?? copyErr}`
+            );
+          }
+        }
+      }
+
+      // The retry loop exits via success (0), numeric status (retryable),
+      // or throw (infra). A non-null non-zero status means the user's tests
+      // failed every attempt.
+      if (lastAttemptExitCode !== 0) {
+        throw new UserError(
+          'ERR_MAESTRO_TESTS_FAILED',
+          `Maestro tests failed after ${totalAttempts} attempt${totalAttempts === 1 ? '' : 's'}.`
+        );
+      }
+    },
+  });
+}

packages/build-tools/src/steps/functions/parseXcactivitylog.ts

@@ -45,6 +45,7 @@ export function parseXcactivitylogFunction(): BuildFunction {
         xclogparserVersion: version,
         logger: stepCtx.logger,
         proxyBaseUrl: env.EAS_BUILD_COCOAPODS_CACHE_URL,
+        env,
       });
     },
   });

packages/build-tools/src/steps/functions/reportMaestroTestResults.ts

@@ -1,9 +1,13 @@
 import { BuildFunction, BuildStepInput, BuildStepInputValueTypeName } from '@expo/steps';
 import { graphql } from 'gql.tada';
+import { z } from 'zod';
 
+import { buildFlowNameToPathMap } from './maestroFlowDiscovery';
 import { MaestroFlowResult, parseMaestroResults } from './maestroResultParser';
 import { CustomBuildContext } from '../../customBuildContext';
 
+const FlowPathSchema = z.array(z.string().min(1)).min(1);
+
 const CREATE_MUTATION = graphql(`
   mutation CreateWorkflowDeviceTestCaseResults($input: CreateWorkflowDeviceTestCaseResultsInput!) {
     workflowDeviceTestCaseResult {
@@ -38,6 +42,11 @@ export function createReportMaestroTestResultsFunction(ctx: CustomBuildContext):
         allowedValueTypeName: BuildStepInputValueTypeName.STRING,
         defaultValue: '${{ env.HOME }}/.maestro/tests',
       }),
+      BuildStepInput.createProvider({
+        id: 'flow_path',
+        required: false,
+        allowedValueTypeName: BuildStepInputValueTypeName.JSON,
+      }),
     ],
     fn: async (stepsCtx, { inputs }) => {
       const { logger } = stepsCtx;
@@ -51,14 +60,26 @@ export function createReportMaestroTestResultsFunction(ctx: CustomBuildContext):
         logger.info('No JUnit directory provided, skipping test results report');
         return;
       }
-      const testsDirectory = inputs.tests_directory.value as string;
+
+      const flowPathRaw = inputs.flow_path.value;
+      let nameToPath: Map<string, string> | null = null;
+      if (flowPathRaw !== undefined) {
+        const parsed = FlowPathSchema.safeParse(flowPathRaw);
+        if (parsed.success) {
+          nameToPath = await buildFlowNameToPathMap({
+            inputFlowPaths: parsed.data,
+            projectRoot: stepsCtx.workingDirectory,
+            logger,
+          });
+        } else {
+          logger.warn(
+            'Ignoring malformed flow_path input (expected a non-empty array of non-empty strings).'
+          );
+        }
+      }
 
       try {
-        const flowResults = await parseMaestroResults(
-          junitDirectory,
-          testsDirectory,
-          stepsCtx.workingDirectory
-        );
+        const flowResults = await parseMaestroResults(junitDirectory, nameToPath);
         if (flowResults.length === 0) {
           logger.info('No maestro test results found, skipping report');
           return;

packages/build-tools/src/steps/functions/resolveSubmitConfig/android.ts

@@ -1,182 +0,0 @@
-import { Platform, SubmissionConfig, SystemError, UserError } from '@expo/eas-build-job';
-import { AndroidReleaseStatus, SubmitProfile } from '@expo/eas-json';
-import { bunyan } from '@expo/logger';
-import { asyncResult } from '@expo/results';
-import spawn from '@expo/turtle-spawn';
-import { BuildStepEnv } from '@expo/steps';
-import fs from 'fs-extra';
-import { graphql } from 'gql.tada';
-import path from 'node:path';
-import { z } from 'zod';
-
-import { BuildInfo, ResolvedSubmitConfig } from './common';
-import { CustomBuildContext } from '../../../customBuildContext';
-
-const ANDROID_APP_CREDENTIALS_QUERY = graphql(`
-  query ResolveSubmitConfigAndroidAppCredentials(
-    $appId: String!
-    $applicationIdentifier: String
-  ) {
-    app {
-      byId(appId: $appId) {
-        id
-        androidAppCredentials(filter: { applicationIdentifier: $applicationIdentifier }) {
-          id
-          googleServiceAccountKeyForSubmissions {
-            id
-            keyJson
-          }
-        }
-      }
-    }
-  }
-`);
-
-const AndroidReleaseStatusToSubmissionReleaseStatus: Record<
-  AndroidReleaseStatus,
-  SubmissionConfig.Android.ReleaseStatus
-> = {
-  [AndroidReleaseStatus.completed]: SubmissionConfig.Android.ReleaseStatus.COMPLETED,
-  [AndroidReleaseStatus.draft]: SubmissionConfig.Android.ReleaseStatus.DRAFT,
-  [AndroidReleaseStatus.halted]: SubmissionConfig.Android.ReleaseStatus.HALTED,
-  [AndroidReleaseStatus.inProgress]: SubmissionConfig.Android.ReleaseStatus.IN_PROGRESS,
-};
-
-export async function resolveAndroidSubmitConfigAsync({
-  artifactPath,
-  build,
-  ctx,
-  env,
-  logger,
-  profile,
-  workingDirectory,
-}: {
-  artifactPath: string;
-  build: BuildInfo;
-  ctx: CustomBuildContext;
-  env: BuildStepEnv;
-  logger: bunyan;
-  profile: SubmitProfile<Platform.ANDROID>;
-  workingDirectory: string;
-}): Promise<ResolvedSubmitConfig> {
-  const applicationId =
-    build.appIdentifier ??
-    profile.applicationId ??
-    (await readAndroidApplicationIdAsync(artifactPath, env, logger));
-  if (!applicationId) {
-    throw new UserError(
-      'EAS_RESOLVE_SUBMIT_CONFIG_ANDROID_APPLICATION_ID_NOT_FOUND',
-      'Could not resolve Android applicationId from build metadata or artifact. Set applicationId in the Android submit profile, or pass an APK/AAB artifact with a readable package name.'
-    );
-  }
-
-  const googleServiceAccountKeyJson = profile.serviceAccountKeyPath
-    ? await fs.readFile(path.resolve(workingDirectory, profile.serviceAccountKeyPath), 'utf8')
-    : await getGoogleServiceAccountKeyJsonAsync({
-        applicationId,
-        appId: build.appId,
-        ctx,
-      });
-
-  const releaseStatus = AndroidReleaseStatusToSubmissionReleaseStatus[profile.releaseStatus];
-  const baseConfigInput = {
-    changesNotSentForReview: profile.changesNotSentForReview,
-    googleServiceAccountKeyJson,
-    track: profile.track,
-  };
-  const configInput: z.input<typeof SubmissionConfig.Android.SchemaZ> =
-    releaseStatus === SubmissionConfig.Android.ReleaseStatus.IN_PROGRESS
-      ? {
-          ...baseConfigInput,
-          releaseStatus,
-          rollout: profile.rollout,
-        }
-      : {
-          ...baseConfigInput,
-          releaseStatus,
-        };
-
-  return {
-    appIdentifier: applicationId,
-    config: SubmissionConfig.Android.SchemaZ.parse(configInput),
-    platform: Platform.ANDROID,
-  };
-}
-
-async function getGoogleServiceAccountKeyJsonAsync({
-  applicationId,
-  appId,
-  ctx,
-}: {
-  applicationId: string;
-  appId: string;
-  ctx: CustomBuildContext;
-}): Promise<string> {
-  const credentialsResult = await ctx.graphqlClient
-    .query(ANDROID_APP_CREDENTIALS_QUERY, {
-      appId,
-      applicationIdentifier: applicationId,
-    })
-    .toPromise();
-  if (credentialsResult.error) {
-    throw credentialsResult.error;
-  }
-
-  const key =
-    credentialsResult.data?.app.byId.androidAppCredentials[0]
-      ?.googleServiceAccountKeyForSubmissions;
-  if (!key) {
-    throw new UserError(
-      'EAS_RESOLVE_SUBMIT_CONFIG_ANDROID_SERVICE_ACCOUNT_KEY_NOT_CONFIGURED',
-      `Google Service Account Key for submissions is not configured for ${applicationId}. Configure a Google Service Account Key for submissions in EAS credentials, or set serviceAccountKeyPath in the Android submit profile.`
-    );
-  }
-
-  if (!key.keyJson) {
-    throw new SystemError(`Google Service Account Key ${key.id} could not be resolved.`);
-  }
-  return key.keyJson;
-}
-
-async function readAndroidApplicationIdAsync(
-  artifactPath: string,
-  env: BuildStepEnv,
-  logger: bunyan
-): Promise<string | undefined> {
-  if (artifactPath.endsWith('.apk')) {
-    return await readAndroidApplicationIdFromApkAsync(artifactPath, env, logger);
-  } else if (artifactPath.endsWith('.aab')) {
-    return await readAndroidApplicationIdFromAabAsync(artifactPath, env, logger);
-  }
-  return undefined;
-}
-
-async function readAndroidApplicationIdFromApkAsync(
-  apkPath: string,
-  env: BuildStepEnv,
-  logger: bunyan
-): Promise<string | undefined> {
-  const aapt2Result = await asyncResult(spawn('aapt2', ['dump', 'packagename', apkPath], { env }));
-  if (aapt2Result.ok) {
-    return aapt2Result.value.stdout.trim();
-  }
-  logger.warn('Failed to read APK package name with aapt2.');
-  return undefined;
-}
-
-async function readAndroidApplicationIdFromAabAsync(
-  aabPath: string,
-  env: BuildStepEnv,
-  logger: bunyan
-): Promise<string | undefined> {
-  const result = await asyncResult(
-    spawn('bundletool', ['dump', 'manifest', `--bundle=${aabPath}`, '--xpath=/manifest/@package'], {
-      env,
-    })
-  );
-  if (!result.ok) {
-    logger.warn('Failed to read AAB package name with bundletool.');
-    return undefined;
-  }
-  return result.value.stdout.trim();
-}

packages/build-tools/src/steps/functions/resolveSubmitConfig/common.ts

@@ -1,84 +0,0 @@
-import { Platform, SubmissionConfig, UserError } from '@expo/eas-build-job';
-import { EasJsonAccessor, EasJsonUtils, SubmitProfile } from '@expo/eas-json';
-import { graphql } from 'gql.tada';
-
-import { CustomBuildContext } from '../../../customBuildContext';
-
-export type AppPlatform = 'ANDROID' | 'IOS';
-
-export const AppPlatformToPlatform: Record<AppPlatform, Platform> = {
-  ANDROID: Platform.ANDROID,
-  IOS: Platform.IOS,
-};
-
-export type BuildInfo = {
-  appIdentifier?: string | null;
-  appId: string;
-  buildId: string;
-  projectOwnerAccountId: string;
-  platform: Platform;
-};
-
-export type ResolvedSubmitConfig = {
-  appIdentifier?: string;
-  config: SubmissionConfig.Android | SubmissionConfig.Ios;
-  platform: Platform;
-};
-
-const BUILD_BY_ID_QUERY = graphql(`
-  query ResolveSubmitConfigBuildById($buildId: ID!) {
-    builds {
-      byId(buildId: $buildId) {
-        id
-        platform
-        appIdentifier
-        app {
-          id
-          ownerAccount {
-            id
-          }
-        }
-      }
-    }
-  }
-`);
-
-export async function getBuildInfoAsync(
-  ctx: CustomBuildContext,
-  buildId: string
-): Promise<BuildInfo> {
-  const result = await ctx.graphqlClient.query(BUILD_BY_ID_QUERY, { buildId }).toPromise();
-  if (result.error) {
-    throw result.error;
-  }
-  const build = result.data?.builds.byId;
-  if (!build) {
-    throw new UserError(
-      'EAS_RESOLVE_SUBMIT_CONFIG_BUILD_NOT_FOUND',
-      `Could not find build ${buildId}.`
-    );
-  }
-  return {
-    appIdentifier: build.appIdentifier,
-    appId: build.app.id,
-    buildId: build.id,
-    projectOwnerAccountId: build.app.ownerAccount.id,
-    platform: AppPlatformToPlatform[build.platform],
-  };
-}
-
-export async function getSubmitProfileAsync<T extends Platform>({
-  platform,
-  profileName,
-  workingDirectory,
-}: {
-  platform: T;
-  profileName: string;
-  workingDirectory: string;
-}): Promise<SubmitProfile<T>> {
-  return await EasJsonUtils.getSubmitProfileAsync(
-    EasJsonAccessor.fromProjectPath(workingDirectory),
-    platform,
-    profileName
-  );
-}

packages/build-tools/src/steps/functions/resolveSubmitConfig/index.ts

@@ -1,139 +0,0 @@
-import { Platform, SystemError } from '@expo/eas-build-job';
-import { bunyan } from '@expo/logger';
-import {
-  BuildFunction,
-  BuildStepEnv,
-  BuildStepInput,
-  BuildStepInputValueTypeName,
-  BuildStepOutput,
-} from '@expo/steps';
-import path from 'node:path';
-import { z } from 'zod';
-
-import { resolveAndroidSubmitConfigAsync } from './android';
-import { ResolvedSubmitConfig, getBuildInfoAsync, getSubmitProfileAsync } from './common';
-import { resolveIosSubmitConfigAsync } from './ios';
-import { CustomBuildContext } from '../../../customBuildContext';
-
-export function createResolveSubmitConfigBuildFunction(ctx: CustomBuildContext): BuildFunction {
-  return new BuildFunction({
-    namespace: 'eas',
-    id: 'resolve_submit_config',
-    name: 'Resolve submit config',
-    __metricsId: 'eas/resolve_submit_config',
-    inputProviders: [
-      BuildStepInput.createProvider({
-        id: 'build_id',
-        required: true,
-        allowedValueTypeName: BuildStepInputValueTypeName.STRING,
-      }),
-      BuildStepInput.createProvider({
-        id: 'profile',
-        required: true,
-        allowedValueTypeName: BuildStepInputValueTypeName.STRING,
-      }),
-      BuildStepInput.createProvider({
-        id: 'artifact_path',
-        required: true,
-        allowedValueTypeName: BuildStepInputValueTypeName.STRING,
-      }),
-    ],
-    outputProviders: [
-      BuildStepOutput.createProvider({
-        id: 'config_json',
-        required: true,
-      }),
-      BuildStepOutput.createProvider({
-        id: 'platform',
-        required: true,
-      }),
-      BuildStepOutput.createProvider({
-        id: 'app_identifier',
-        required: false,
-      }),
-    ],
-    fn: async (stepsCtx, { env, inputs, outputs }) => {
-      const buildId = z.string().uuid().parse(inputs.build_id.value);
-      const profileName = z.string().parse(inputs.profile.value);
-      const artifactPath = path.resolve(
-        stepsCtx.workingDirectory,
-        z.string().parse(inputs.artifact_path.value)
-      );
-
-      const { config, platform, appIdentifier } = await resolveSubmitConfigAsync({
-        artifactPath,
-        buildId,
-        ctx,
-        env,
-        logger: stepsCtx.logger,
-        profileName,
-        workingDirectory: stepsCtx.workingDirectory,
-      });
-
-      outputs.config_json.set(JSON.stringify(config));
-      outputs.platform.set(platform);
-      if (appIdentifier) {
-        outputs.app_identifier.set(appIdentifier);
-      }
-    },
-  });
-}
-
-export async function resolveSubmitConfigAsync({
-  artifactPath,
-  buildId,
-  ctx,
-  env,
-  logger,
-  profileName,
-  workingDirectory,
-}: {
-  artifactPath: string;
-  buildId: string;
-  ctx: CustomBuildContext;
-  env: BuildStepEnv;
-  logger: bunyan;
-  profileName: string;
-  workingDirectory: string;
-}): Promise<ResolvedSubmitConfig> {
-  logger.info('Resolving submit config...');
-  const build = await getBuildInfoAsync(ctx, buildId);
-
-  switch (build.platform) {
-    case Platform.ANDROID: {
-      const profile = await getSubmitProfileAsync({
-        platform: build.platform,
-        profileName,
-        workingDirectory,
-      });
-      return await resolveAndroidSubmitConfigAsync({
-        artifactPath,
-        build,
-        ctx,
-        env,
-        logger,
-        profile,
-        workingDirectory,
-      });
-    }
-    case Platform.IOS: {
-      const profile = await getSubmitProfileAsync({
-        platform: build.platform,
-        profileName,
-        workingDirectory,
-      });
-      return await resolveIosSubmitConfigAsync({
-        artifactPath,
-        appId: build.appId,
-        buildAppIdentifier: build.appIdentifier,
-        ctx,
-        env,
-        profile,
-        projectOwnerAccountId: build.projectOwnerAccountId,
-        workingDirectory,
-      });
-    }
-    default:
-      throw new SystemError(`Unsupported platform: ${build.platform}`);
-  }
-}

packages/build-tools/src/steps/functions/resolveSubmitConfig/ios.ts

@@ -1,214 +0,0 @@
-import { Platform, SubmissionConfig, UserError } from '@expo/eas-build-job';
-import { SubmitProfile } from '@expo/eas-json';
-import { BuildStepEnv } from '@expo/steps';
-import fs from 'fs-extra';
-import { graphql } from 'gql.tada';
-import path from 'node:path';
-import { z } from 'zod';
-
-import { readIpaInfoAsync } from '../readIpaInfo';
-import { ResolvedSubmitConfig } from './common';
-import { CustomBuildContext } from '../../../customBuildContext';
-
-const APPLE_APP_IDENTIFIER_QUERY = graphql(`
-  query ResolveSubmitConfigAppleAppIdentifier(
-    $accountId: String!
-    $bundleIdentifier: String!
-  ) {
-    account {
-      byId(accountId: $accountId) {
-        id
-        appleAppIdentifiers(bundleIdentifier: $bundleIdentifier) {
-          id
-          bundleIdentifier
-        }
-      }
-    }
-  }
-`);
-
-const IOS_APP_CREDENTIALS_QUERY = graphql(`
-  query ResolveSubmitConfigIosAppCredentials(
-    $appId: String!
-    $appleAppIdentifierId: String!
-  ) {
-    app {
-      byId(appId: $appId) {
-        id
-        iosAppCredentials(filter: { appleAppIdentifierId: $appleAppIdentifierId }) {
-          id
-          appStoreConnectApiKeyForSubmissions {
-            id
-            issuerIdentifier
-            keyIdentifier
-            keyP8
-          }
-        }
-      }
-    }
-  }
-`);
-
-export async function resolveIosSubmitConfigAsync({
-  appId,
-  artifactPath,
-  buildAppIdentifier,
-  ctx,
-  env,
-  profile,
-  projectOwnerAccountId,
-  workingDirectory,
-}: {
-  appId: string;
-  artifactPath: string;
-  buildAppIdentifier?: string | null;
-  ctx: CustomBuildContext;
-  env: BuildStepEnv;
-  profile: SubmitProfile<Platform.IOS>;
-  projectOwnerAccountId: string;
-  workingDirectory: string;
-}): Promise<ResolvedSubmitConfig> {
-  const bundleIdentifier =
-    buildAppIdentifier ??
-    profile.bundleIdentifier ??
-    (await readIpaInfoAsync(artifactPath)).bundleIdentifier;
-
-  if (!profile.ascAppId) {
-    throw new UserError(
-      'EAS_RESOLVE_SUBMIT_CONFIG_IOS_ASC_APP_ID_NOT_CONFIGURED',
-      'Set ascAppId in the submit profile in eas.json.'
-    );
-  }
-
-  const appSpecificPassword = env.EXPO_APPLE_APP_SPECIFIC_PASSWORD;
-  const configInput: z.input<typeof SubmissionConfig.Ios.SchemaZ> = {
-    ascAppIdentifier: profile.ascAppId,
-    groups: profile.groups,
-    ...(appSpecificPassword
-      ? {
-          appleAppSpecificPassword: validateAppSpecificPassword(appSpecificPassword),
-          appleIdUsername: requireAppleIdUsername(profile.appleId ?? env.EXPO_APPLE_ID),
-        }
-      : {
-          ascApiJsonKey: await getAscApiJsonKeyAsync({
-            accountId: projectOwnerAccountId,
-            appId,
-            bundleIdentifier,
-            ctx,
-            profile,
-            workingDirectory,
-          }),
-        }),
-  };
-
-  return {
-    appIdentifier: bundleIdentifier,
-    config: SubmissionConfig.Ios.SchemaZ.parse(configInput),
-    platform: Platform.IOS,
-  };
-}
-
-async function getAscApiJsonKeyAsync({
-  accountId,
-  appId,
-  bundleIdentifier,
-  ctx,
-  profile,
-  workingDirectory,
-}: {
-  accountId: string;
-  appId: string;
-  bundleIdentifier?: string;
-  ctx: CustomBuildContext;
-  profile: SubmitProfile<Platform.IOS>;
-  workingDirectory: string;
-}): Promise<string> {
-  // Prefer explicit local ASC API key fields from eas.json when all are present.
-  if (profile.ascApiKeyPath && profile.ascApiKeyIssuerId && profile.ascApiKeyId) {
-    return JSON.stringify({
-      issuer_id: profile.ascApiKeyIssuerId,
-      key: await fs.readFile(path.resolve(workingDirectory, profile.ascApiKeyPath), 'utf8'),
-      key_id: profile.ascApiKeyId,
-    });
-  }
-
-  if (profile.ascApiKeyPath || profile.ascApiKeyIssuerId || profile.ascApiKeyId) {
-    throw new UserError(
-      'EAS_RESOLVE_SUBMIT_CONFIG_IOS_ASC_API_KEY_INCOMPLETE',
-      'ascApiKeyPath, ascApiKeyIssuerId and ascApiKeyId must all be defined in eas.json.'
-    );
-  }
-
-  if (!bundleIdentifier) {
-    throw new UserError(
-      'EAS_RESOLVE_SUBMIT_CONFIG_IOS_BUNDLE_IDENTIFIER_NOT_FOUND',
-      'Could not resolve iOS bundleIdentifier from build metadata or artifact. Set bundleIdentifier in the iOS submit profile, or pass an IPA artifact with a readable bundle identifier.'
-    );
-  }
-
-  // Server credentials are keyed by the Apple App Identifier, so first map the bundle id to it.
-  const appleAppIdentifierResult = await ctx.graphqlClient
-    .query(APPLE_APP_IDENTIFIER_QUERY, {
-      accountId,
-      bundleIdentifier,
-    })
-    .toPromise();
-  if (appleAppIdentifierResult.error) {
-    throw appleAppIdentifierResult.error;
-  }
-
-  const appleAppIdentifierId =
-    appleAppIdentifierResult.data?.account.byId.appleAppIdentifiers[0]?.id;
-  if (!appleAppIdentifierId) {
-    throw new UserError(
-      'EAS_RESOLVE_SUBMIT_CONFIG_IOS_APP_IDENTIFIER_NOT_CONFIGURED',
-      `Apple App Identifier is not configured for ${bundleIdentifier}. Configure the bundle identifier in EAS credentials for this account.`
-    );
-  }
-
-  // The app credentials record points at the ASC API key selected for submissions.
-  const credentialsResult = await ctx.graphqlClient
-    .query(IOS_APP_CREDENTIALS_QUERY, {
-      appId,
-      appleAppIdentifierId,
-    })
-    .toPromise();
-  if (credentialsResult.error) {
-    throw credentialsResult.error;
-  }
-
-  const ascApiKey =
-    credentialsResult.data?.app.byId.iosAppCredentials[0]?.appStoreConnectApiKeyForSubmissions;
-  if (!ascApiKey) {
-    throw new UserError(
-      'EAS_RESOLVE_SUBMIT_CONFIG_IOS_ASC_API_KEY_NOT_CONFIGURED',
-      `App Store Connect API Key for submissions is not configured for ${bundleIdentifier}. Configure an App Store Connect API Key for submissions in EAS credentials, or set ascApiKeyPath, ascApiKeyIssuerId, and ascApiKeyId in the iOS submit profile.`
-    );
-  }
-
-  return JSON.stringify({
-    issuer_id: ascApiKey.issuerIdentifier,
-    key: ascApiKey.keyP8,
-    key_id: ascApiKey.keyIdentifier,
-  });
-}
-
-function validateAppSpecificPassword(password: string): string {
-  if (!/^[a-z]{4}-[a-z]{4}-[a-z]{4}-[a-z]{4}$/.test(password)) {
-    throw new UserError(
-      'EAS_RESOLVE_SUBMIT_CONFIG_IOS_APP_SPECIFIC_PASSWORD_INVALID',
-      'EXPO_APPLE_APP_SPECIFIC_PASSWORD must be in the format xxxx-xxxx-xxxx-xxxx, where x is a lowercase letter.'
-    );
-  }
-  return password;
-}
-
-function requireAppleIdUsername(appleIdUsername?: string): string {
-  if (!appleIdUsername) {
-    throw new UserError(
-      'EAS_RESOLVE_SUBMIT_CONFIG_IOS_APPLE_ID_NOT_CONFIGURED',
-      'Set appleId in the submit profile or EXPO_APPLE_ID when using EXPO_APPLE_APP_SPECIFIC_PASSWORD.'
-    );
-  }
-  return appleIdUsername;
-}

packages/build-tools/src/steps/functions/restoreBuildCache.ts

@@ -19,8 +19,9 @@ import {
   generateDefaultBuildCacheKeyAsync,
   getCcachePath,
 } from '../../utils/cacheKey';
+import { Datadog } from '../../datadog';
 import { GRADLE_CACHE_KEY_PREFIX, generateGradleCacheKeyAsync } from '../../utils/gradleCacheKey';
-import { TurtleFetchError } from '../../utils/turtleFetch';
+import { TurtleFetchError, turtleFetch } from '../../utils/turtleFetch';
 
 export function createRestoreBuildCacheFunction(): BuildFunction {
   return new BuildFunction({
@@ -277,9 +278,15 @@ export async function restoreGradleCacheAsync({
       logger,
     });
 
+    const hitType = matchedKey === cacheKey ? 'direct_hit' : 'prefix_match';
     logger.info(
-      `Gradle cache restored to ${gradleCachesPath} ${matchedKey === cacheKey ? '(direct hit)' : '(prefix match)'}`
+      `Gradle cache restored to ${gradleCachesPath} (${hitType === 'direct_hit' ? 'direct hit' : 'prefix match'})`
     );
+
+    Datadog.log(`Gradle cache restored (${hitType})`, {
+      event: 'gradle_cache_restored',
+      cache_hit_type: hitType,
+    });
   } catch (err: unknown) {
     if (err instanceof TurtleFetchError && err.response?.status === 404) {
       logger.info('No Gradle cache found for this key');

packages/build-tools/src/steps/functions/startAgentDeviceRemoteSession.ts

@@ -0,0 +1,170 @@
+import { SystemError } from '@expo/eas-build-job';
+import { bunyan } from '@expo/logger';
+import {
+  BuildFunction,
+  BuildRuntimePlatform,
+  BuildStepEnv,
+  BuildStepInput,
+  BuildStepInputValueTypeName,
+} from '@expo/steps';
+import spawn from '@expo/turtle-spawn';
+import os from 'node:os';
+import path from 'node:path';
+
+import { CustomBuildContext } from '../../customBuildContext';
+import {
+  getDeviceRunSessionIdOrThrow,
+  getNgrokAuthtokenOrThrow,
+  getNgrokTunnelDomainOrThrow,
+  spawnDetached,
+  startNgrokTunnelAsync,
+  startServeSimWithTunnelAsync,
+  uploadRemoteSessionConfigAsync,
+  waitForFileAsync,
+} from '../utils/remoteDeviceRunSession';
+
+const AGENT_DEVICE_REPO_URL = 'https://github.com/callstackincubator/agent-device.git';
+const SRC_DIR = '/tmp/agent-device-src';
+const DAEMON_JSON_PATH = path.join(os.homedir(), '.agent-device', 'daemon.json');
+const XCODE_DEVELOPER_DIR = '/Applications/Xcode.app/Contents/Developer';
+const STARTUP_TIMEOUT_MS = 60_000;
+
+export function createStartAgentDeviceRemoteSessionBuildFunction(
+  ctx: CustomBuildContext
+): BuildFunction {
+  return new BuildFunction({
+    namespace: 'eas',
+    id: 'start_agent_device_remote_session',
+    name: 'Start agent device remote session',
+    __metricsId: 'eas/start_agent_device_remote_session',
+    inputProviders: [
+      BuildStepInput.createProvider({
+        id: 'package_version',
+        required: false,
+        allowedValueTypeName: BuildStepInputValueTypeName.STRING,
+      }),
+    ],
+    fn: async ({ logger, global }, { inputs, env }) => {
+      // Fail fast before any expensive setup if the injected env
+      // vars are missing: DEVICE_RUN_SESSION_ID (to report the remote config
+      // back to the API server), EAS_SIMULATOR_NGROK_TUNNEL_DOMAIN (base domain
+      // for our ngrok tunnels), and NGROK_AUTHTOKEN (to authenticate them).
+      const deviceRunSessionId = getDeviceRunSessionIdOrThrow(env);
+      const ngrokTunnelDomain = getNgrokTunnelDomainOrThrow(env);
+      const ngrokAuthtoken = getNgrokAuthtokenOrThrow(env);
+
+      const packageVersion = inputs.package_version.value as string | undefined;
+      const { runtimePlatform } = global;
+      logger.info(
+        `Starting agent-device remote session (version: ${packageVersion ?? 'latest'}, runtime: ${runtimePlatform}).`
+      );
+
+      if (runtimePlatform === BuildRuntimePlatform.DARWIN) {
+        logger.info(`Selecting Xcode developer directory: ${XCODE_DEVELOPER_DIR}.`);
+        await spawn('sudo', ['xcode-select', '-s', XCODE_DEVELOPER_DIR], { env, logger });
+      }
+
+      logger.info(
+        packageVersion
+          ? `Cloning agent-device @ v${packageVersion} into ${SRC_DIR}.`
+          : `Cloning agent-device (latest) into ${SRC_DIR}.`
+      );
+      await cloneAgentDeviceAsync({ packageVersion, env, logger });
+
+      logger.info('Installing agent-device dependencies.');
+      await spawn('bun', ['install', '--production'], {
+        cwd: SRC_DIR,
+        env,
+        logger,
+      });
+
+      logger.info('Launching agent-device daemon.');
+      spawnDetached({
+        command: 'bun',
+        args: ['run', 'src/daemon.ts'],
+        cwd: SRC_DIR,
+        env: { ...env, AGENT_DEVICE_DAEMON_SERVER_MODE: 'http' },
+      });
+
+      logger.info(`Waiting for daemon credentials at ${DAEMON_JSON_PATH}.`);
+      const { port: daemonPort, token: daemonToken } = await waitForFileAsync({
+        filePath: DAEMON_JSON_PATH,
+        timeoutMs: STARTUP_TIMEOUT_MS,
+        description: 'agent-device daemon credentials',
+        parse: parseDaemonInfo,
+      });
+      logger.info(`Daemon is listening on port ${daemonPort}; loaded auth token.`);
+
+      const agentDeviceRemoteSessionUrl = await startNgrokTunnelAsync({
+        port: daemonPort,
+        subdomainPrefix: 'agent-device',
+        baseDomain: ngrokTunnelDomain,
+        authtoken: ngrokAuthtoken,
+        logger,
+      });
+      logger.info(`Tunnel is ready at ${agentDeviceRemoteSessionUrl}.`);
+
+      // serve-sim is iOS-only — only launch it (and report a webPreviewUrl)
+      // on Darwin. Android sessions go without a preview URL.
+      let webPreviewUrl: string | undefined;
+      if (runtimePlatform === BuildRuntimePlatform.DARWIN) {
+        const { previewUrl } = await startServeSimWithTunnelAsync({
+          baseDomain: ngrokTunnelDomain,
+          env,
+          logger,
+          timeoutMs: STARTUP_TIMEOUT_MS,
+        });
+        webPreviewUrl = previewUrl;
+        logger.info(`Web preview URL: ${webPreviewUrl}`);
+      }
+
+      await uploadRemoteSessionConfigAsync({
+        ctx,
+        deviceRunSessionId,
+        remoteConfig: {
+          agentDeviceRemoteSessionUrl,
+          agentDeviceRemoteSessionToken: daemonToken,
+          ...(webPreviewUrl ? { webPreviewUrl } : {}),
+        },
+        logger,
+      });
+
+      logger.info('Remote session is live. Keeping the job alive until the session is stopped.');
+      // Keep the turtle job alive so the daemon and tunnel stay reachable
+      // until stopDeviceRunSession cancels the run.
+      await new Promise<never>(() => {});
+    },
+  });
+}
+
+async function cloneAgentDeviceAsync({
+  packageVersion,
+  env,
+  logger,
+}: {
+  packageVersion: string | undefined;
+  env: BuildStepEnv;
+  logger: bunyan;
+}): Promise<void> {
+  const branchArgs = packageVersion ? ['--branch', `v${packageVersion}`] : [];
+  await spawn('git', ['clone', '--depth', '1', ...branchArgs, AGENT_DEVICE_REPO_URL, SRC_DIR], {
+    env,
+    logger,
+  });
+}
+
+function parseDaemonInfo(raw: string): { port: number; token: string } {
+  const parsed = JSON.parse(raw) as unknown;
+  if (
+    !parsed ||
+    typeof parsed !== 'object' ||
+    typeof (parsed as { httpPort: unknown }).httpPort !== 'number' ||
+    typeof (parsed as { token: unknown }).token !== 'string'
+  ) {
+    throw new SystemError(
+      'Expected daemon credentials to contain { "httpPort": <number>, "token": "..." }.'
+    );
+  }
+  const { httpPort, token } = parsed as { httpPort: number; token: string };
+  return { port: httpPort, token };
+}

packages/build-tools/src/steps/functions/startArgentRemoteSession.ts

@@ -0,0 +1,140 @@
+import { SystemError } from '@expo/eas-build-job';
+import {
+  BuildFunction,
+  BuildRuntimePlatform,
+  BuildStepInput,
+  BuildStepInputValueTypeName,
+} from '@expo/steps';
+import spawn from '@expo/turtle-spawn';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { z } from 'zod';
+
+import { CustomBuildContext } from '../../customBuildContext';
+import {
+  getDeviceRunSessionIdOrThrow,
+  getNgrokAuthtokenOrThrow,
+  getNgrokTunnelDomainOrThrow,
+  spawnDetached,
+  startNgrokTunnelAsync,
+  startServeSimWithTunnelAsync,
+  uploadRemoteSessionConfigAsync,
+  waitForFileAsync,
+} from '../utils/remoteDeviceRunSession';
+
+const ARGENT_PACKAGE_NAME = '@swmansion/argent';
+const ARGENT_STATE_FILE = path.join(os.homedir(), '.argent', 'tool-server.json');
+const XCODE_DEVELOPER_DIR = '/Applications/Xcode.app/Contents/Developer';
+const STARTUP_TIMEOUT_MS = 60_000;
+
+const ArgentToolServerStateSchema = z.object({ port: z.number() });
+
+export function createStartArgentRemoteSessionBuildFunction(
+  ctx: CustomBuildContext
+): BuildFunction {
+  return new BuildFunction({
+    namespace: 'eas',
+    id: 'start_argent_remote_session',
+    name: 'Start argent remote session',
+    __metricsId: 'eas/start_argent_remote_session',
+    inputProviders: [
+      BuildStepInput.createProvider({
+        id: 'package_version',
+        required: false,
+        allowedValueTypeName: BuildStepInputValueTypeName.STRING,
+      }),
+    ],
+    fn: async ({ logger, global }, { inputs, env }) => {
+      // Fail fast before any expensive setup if the injected env
+      // vars are missing: DEVICE_RUN_SESSION_ID (to report the remote config
+      // back to the API server), EAS_SIMULATOR_NGROK_TUNNEL_DOMAIN (base domain
+      // for our ngrok tunnels), and NGROK_AUTHTOKEN (to authenticate them).
+      const deviceRunSessionId = getDeviceRunSessionIdOrThrow(env);
+      const ngrokTunnelDomain = getNgrokTunnelDomainOrThrow(env);
+      const ngrokAuthtoken = getNgrokAuthtokenOrThrow(env);
+
+      const packageVersion = inputs.package_version.value as string | undefined;
+      const versionSpec = packageVersion ?? 'latest';
+      const { runtimePlatform } = global;
+      logger.info(
+        `Starting argent remote session (version: ${versionSpec}, runtime: ${runtimePlatform}).`
+      );
+
+      if (runtimePlatform === BuildRuntimePlatform.DARWIN) {
+        logger.info(`Selecting Xcode developer directory: ${XCODE_DEVELOPER_DIR}.`);
+        await spawn('sudo', ['xcode-select', '-s', XCODE_DEVELOPER_DIR], { env, logger });
+      }
+
+      // Stale state from a previous run would mask the new server's port.
+      await fs.promises.rm(ARGENT_STATE_FILE, { force: true });
+
+      logger.info(`Launching ${ARGENT_PACKAGE_NAME}@${versionSpec} via bunx.`);
+      // `argent mcp` is the public entry that triggers @argent/tools-client
+      // to spawn the tool-server detached + unref'd, so the tool-server
+      // outlives this MCP process. ARGENT_IDLE_TIMEOUT_MINUTES=0 disables the
+      // 30-min idle shutdown that would otherwise tear the tunnel down.
+      spawnDetached({
+        command: 'bunx',
+        args: [`${ARGENT_PACKAGE_NAME}@${versionSpec}`, 'mcp'],
+        env: { ...env, ARGENT_IDLE_TIMEOUT_MINUTES: '0' },
+      });
+
+      logger.info(`Waiting for argent tool-server state at ${ARGENT_STATE_FILE}.`);
+      const { port: toolServerPort } = await waitForFileAsync({
+        filePath: ARGENT_STATE_FILE,
+        timeoutMs: STARTUP_TIMEOUT_MS,
+        description: 'argent tool-server state',
+        parse: parseArgentToolServerState,
+      });
+      logger.info(`Argent tool-server is listening on port ${toolServerPort}.`);
+
+      const toolsUrl = await startNgrokTunnelAsync({
+        port: toolServerPort,
+        subdomainPrefix: 'argent',
+        baseDomain: ngrokTunnelDomain,
+        authtoken: ngrokAuthtoken,
+        logger,
+      });
+      logger.info(`Tunnel is ready at ${toolsUrl}.`);
+
+      // serve-sim is iOS-only — Android sessions go without a preview URL.
+      let webPreviewUrl: string | undefined;
+      if (runtimePlatform === BuildRuntimePlatform.DARWIN) {
+        const serveSim = await startServeSimWithTunnelAsync({
+          baseDomain: ngrokTunnelDomain,
+          env,
+          logger,
+          timeoutMs: STARTUP_TIMEOUT_MS,
+        });
+        webPreviewUrl = serveSim.previewUrl;
+        logger.info(`Web preview URL: ${webPreviewUrl}`);
+      }
+
+      await uploadRemoteSessionConfigAsync({
+        ctx,
+        deviceRunSessionId,
+        remoteConfig: {
+          toolsUrl,
+          ...(webPreviewUrl ? { webPreviewUrl } : {}),
+        },
+        logger,
+      });
+
+      logger.info('Remote session is live. Keeping the job alive until the session is stopped.');
+      // Keep the turtle job alive so the tool-server and tunnel stay reachable
+      // until stopDeviceRunSession cancels the run.
+      await new Promise<never>(() => {});
+    },
+  });
+}
+
+function parseArgentToolServerState(raw: string): { port: number } {
+  const result = ArgentToolServerStateSchema.safeParse(JSON.parse(raw));
+  if (!result.success) {
+    throw new SystemError(
+      `Expected tool-server state to contain { "port": <number>, ... }: ${result.error.message}`
+    );
+  }
+  return result.data;
+}

packages/build-tools/src/steps/functions/startIosSimulator.ts

@@ -65,6 +65,12 @@ export function createStartIosSimulatorBuildFunction(): BuildFunction {
         env,
       });
 
+      try {
+        await IosSimulatorUtils.disableApsdAsync({ udid, env });
+      } catch (err) {
+        logger.warn({ err }, 'Failed to disable apsd in the Simulator.');
+      }
+
       await IosSimulatorUtils.waitForReadyAsync({ udid, env });
 
       logger.info('');
@@ -96,6 +102,12 @@ export function createStartIosSimulatorBuildFunction(): BuildFunction {
             env,
           });
 
+          try {
+            await IosSimulatorUtils.disableApsdAsync({ udid: cloneUdid, env });
+          } catch (err) {
+            logger.warn({ err }, 'Failed to disable apsd in the Simulator.');
+          }
+
           await IosSimulatorUtils.waitForReadyAsync({
             udid: cloneUdid,
             env,

packages/build-tools/src/steps/functions/startServeSimRemoteSession.ts

@@ -0,0 +1,55 @@
+import { BuildFunction, BuildRuntimePlatform } from '@expo/steps';
+import spawn from '@expo/turtle-spawn';
+
+import { CustomBuildContext } from '../../customBuildContext';
+import {
+  getDeviceRunSessionIdOrThrow,
+  getNgrokTunnelDomainOrThrow,
+  startServeSimWithTunnelAsync,
+  uploadRemoteSessionConfigAsync,
+} from '../utils/remoteDeviceRunSession';
+
+const XCODE_DEVELOPER_DIR = '/Applications/Xcode.app/Contents/Developer';
+const STARTUP_TIMEOUT_MS = 60_000;
+
+export function createStartServeSimRemoteSessionBuildFunction(
+  ctx: CustomBuildContext
+): BuildFunction {
+  return new BuildFunction({
+    namespace: 'eas',
+    id: 'start_serve_sim_remote_session',
+    name: 'Start serve-sim remote session',
+    __metricsId: 'eas/start_serve_sim_remote_session',
+    supportedRuntimePlatforms: [BuildRuntimePlatform.DARWIN],
+    fn: async ({ logger }, { env }) => {
+      const deviceRunSessionId = getDeviceRunSessionIdOrThrow(env);
+      const ngrokTunnelDomain = getNgrokTunnelDomainOrThrow(env);
+
+      logger.info('Starting serve-sim remote session.');
+
+      logger.info(`Selecting Xcode developer directory: ${XCODE_DEVELOPER_DIR}.`);
+      await spawn('sudo', ['xcode-select', '-s', XCODE_DEVELOPER_DIR], { env, logger });
+
+      const { previewUrl, streamUrl } = await startServeSimWithTunnelAsync({
+        baseDomain: ngrokTunnelDomain,
+        env,
+        logger,
+        timeoutMs: STARTUP_TIMEOUT_MS,
+      });
+      logger.info(`Preview URL: ${previewUrl}`);
+      logger.info(`Stream URL: ${streamUrl}`);
+
+      await uploadRemoteSessionConfigAsync({
+        ctx,
+        deviceRunSessionId,
+        remoteConfig: { previewUrl, streamUrl },
+        logger,
+      });
+
+      logger.info('Remote session is live. Keeping the job alive until the session is stopped.');
+      // Keep the turtle job alive so the serve-sim tunnel stays reachable
+      // until stopDeviceRunSession cancels the run.
+      await new Promise<never>(() => {});
+    },
+  });
+}

packages/build-tools/src/steps/utils/android/gradle.ts

@@ -23,18 +23,27 @@ export async function runGradleCommand({
 
   logger.info(`Running 'gradlew ${gradleCommand} ${verboseFlag}' in ${androidDir}`);
   await fs.chmod(path.join(androidDir, 'gradlew'), 0o755);
-  const spawnPromise = spawn('bash', ['-c', `./gradlew ${gradleCommand} ${verboseFlag}`], {
-    cwd: androidDir,
-    logger,
-    lineTransformer: (line?: string) => {
-      if (!line || /^\.+$/.exec(line)) {
-        return null;
-      } else {
-        return line;
-      }
-    },
-    env: { ...env, ...extraEnv, LC_ALL: 'C.UTF-8' },
-  });
+
+  const spawnPromise = spawn(
+    'bash',
+    ['-c', `./gradlew ${gradleCommand} --profile ${verboseFlag}`],
+    {
+      cwd: androidDir,
+      logger,
+      lineTransformer: (line?: string) => {
+        if (!line || /^\.+$/.exec(line)) {
+          return null;
+        } else {
+          return line;
+        }
+      },
+      env: {
+        ...env,
+        ...extraEnv,
+        LC_ALL: 'C.UTF-8',
+      },
+    }
+  );
   if (env.EAS_BUILD_RUNNER === 'eas-build' && process.platform === 'linux') {
     adjustOOMScore(spawnPromise, logger);
   }

packages/build-tools/src/steps/utils/ios/__tests__/xcactivitylog.test.ts

@@ -4,11 +4,12 @@ import fs from 'fs-extra';
 import path from 'path';
 
 import { createMockLogger } from '../../../../__tests__/utils/logger';
+import { Sentry } from '../../../../sentry';
 import {
   buildTargetMetrics,
-  isCompileStep,
   collectTopLevelCompileSteps,
   formatReport,
+  isCompileStep,
   parseAndReportXcactivitylog,
 } from '../xcactivitylog';
 
@@ -17,6 +18,13 @@ jest.mock('@expo/turtle-spawn', () => ({
   __esModule: true,
   default: jest.fn(),
 }));
+jest.mock('../../../../sentry', () => ({
+  Sentry: {
+    setup: jest.fn(),
+    capture: jest.fn(),
+    flush: jest.fn(),
+  },
+}));
 
 // Minimal fixture: two modules with compile steps
 const FIXTURE_TWO_MODULES = {
@@ -146,19 +154,67 @@ const FIXTURE_NESTED = {
   ],
 };
 
+// Overlapping + gapped intervals with pairwise-distinct totals
+// (taskSeconds=11, wallSpan=12, activeWallTime=8). Distinct values catch a
+// regression that leaks wallSpan or taskSeconds into the rendered Active cell.
+const FIXTURE_OVERLAP_WITH_GAP = {
+  schema: { name: 'OverlapWithGap' },
+  subSteps: [
+    {
+      title: 'Build target GappedModule',
+      subSteps: [
+        {
+          detailStepType: 'cCompilation',
+          duration: 5.0,
+          startTimestamp: 100.0,
+          endTimestamp: 105.0,
+          signature: 'CompileC a.c',
+          subSteps: [],
+        },
+        {
+          detailStepType: 'cCompilation',
+          duration: 4.0,
+          startTimestamp: 102.0,
+          endTimestamp: 106.0,
+          signature: 'CompileC b.c',
+          subSteps: [],
+        },
+        {
+          detailStepType: 'cCompilation',
+          duration: 2.0,
+          startTimestamp: 110.0,
+          endTimestamp: 112.0,
+          signature: 'CompileC c.c',
+          subSteps: [],
+        },
+      ],
+    },
+  ],
+};
+
 const mockedDownloadFile = jest.mocked(downloadFile);
 const mockedSpawn = jest.mocked(spawn);
 
+const TEST_ENV = { PATH: '/custom/bin:/usr/bin' };
+
 function mockFilesystem({
   tempDir = '/tmp/xclogparser-123',
   jsonOutput = JSON.stringify(FIXTURE_TWO_MODULES),
+  buildLogEntries = ['12345-abc.xcactivitylog'] as string[] | Error,
 }: {
   tempDir?: string;
   jsonOutput?: string;
+  buildLogEntries?: string[] | Error;
 } = {}) {
   jest.spyOn(fs, 'mkdtemp').mockImplementation(async () => tempDir);
   jest.spyOn(fs, 'chmod').mockImplementation(async () => undefined);
   jest.spyOn(fs, 'readFile').mockImplementation(async () => jsonOutput);
+  jest.spyOn(fs, 'readdir').mockImplementation((async () => {
+    if (buildLogEntries instanceof Error) {
+      throw buildLogEntries;
+    }
+    return buildLogEntries;
+  }) as any);
   jest.spyOn(fs, 'rm').mockImplementation(async () => undefined);
 
   return {
@@ -171,38 +227,46 @@ describe('parseAndReportXcactivitylog', () => {
   beforeEach(() => {
     mockedDownloadFile.mockReset();
     mockedSpawn.mockReset();
+    jest.mocked(Sentry.capture).mockClear();
   });
 
   afterEach(() => {
     jest.restoreAllMocks();
   });
 
-  it('downloads xclogparser from GCS and logs only the final report on success', async () => {
+  it('downloads xclogparser from GCS and logs resolution + final report when no binary is preinstalled', async () => {
     const logger = createMockLogger();
     const { tempDir, reportPath } = mockFilesystem();
 
     mockedDownloadFile.mockResolvedValue(undefined);
+    mockedSpawn.mockRejectedValueOnce(new Error('xclogparser not found'));
     mockedSpawn.mockResolvedValue({ stdout: '', stderr: '' } as any);
 
-    await parseAndReportXcactivitylog({
+    const result = await parseAndReportXcactivitylog({
       derivedDataPath: '/tmp/derived-data',
       workspacePath: '/tmp/workspace',
       logger,
+      env: TEST_ENV,
     });
 
+    expect(result).toEqual({ skipped: false });
+    expect(mockedSpawn).toHaveBeenNthCalledWith(1, 'xclogparser', ['version'], {
+      stdio: 'pipe',
+      env: TEST_ENV,
+    });
     expect(mockedDownloadFile).toHaveBeenCalledWith(
-      'https://storage.googleapis.com/turtle-v2/xclogparser/XCLogParser-macOS-x86-64-arm64-v0.2.46.zip',
-      path.join(tempDir, 'XCLogParser-macOS-x86-64-arm64-v0.2.46.zip'),
+      'https://storage.googleapis.com/turtle-v2/xclogparser/XCLogParser-macOS-x86-64-arm64-v0.2.47.zip',
+      path.join(tempDir, 'XCLogParser-macOS-x86-64-arm64-v0.2.47.zip'),
       { retry: 3, timeout: 20_000 }
     );
     expect(mockedSpawn).toHaveBeenNthCalledWith(
-      1,
+      2,
       'unzip',
-      ['-q', path.join(tempDir, 'XCLogParser-macOS-x86-64-arm64-v0.2.46.zip'), '-d', tempDir],
-      { stdio: 'pipe' }
+      ['-q', path.join(tempDir, 'XCLogParser-macOS-x86-64-arm64-v0.2.47.zip'), '-d', tempDir],
+      { stdio: 'pipe', env: TEST_ENV }
     );
     expect(mockedSpawn).toHaveBeenNthCalledWith(
-      2,
+      3,
       path.join(tempDir, 'xclogparser'),
       [
         'parse',
@@ -212,18 +276,22 @@ describe('parseAndReportXcactivitylog', () => {
         '/tmp/workspace',
         '--reporter',
         'json',
+        '--omit_warnings',
+        '--omit_notes',
+        '--trunc_large_issues',
         '--output',
         reportPath,
       ],
-      { stdio: 'pipe' }
+      { stdio: 'pipe', env: TEST_ENV }
     );
     expect(fs.readFile).toHaveBeenCalledWith(reportPath, 'utf8');
-    expect(logger.info).toHaveBeenCalledTimes(1);
+    expect(logger.info).toHaveBeenCalledWith('Using downloaded xclogparser v0.2.47.');
     expect(logger.info).toHaveBeenCalledWith(
       expect.stringContaining('Xcode Build — Compile Metrics by Module')
     );
     expect(logger.debug).not.toHaveBeenCalled();
     expect(logger.warn).not.toHaveBeenCalled();
+    expect(Sentry.capture).not.toHaveBeenCalled();
   });
 
   it('tries the proxy URL first and falls back to the direct GCS URL', async () => {
@@ -233,6 +301,7 @@ describe('parseAndReportXcactivitylog', () => {
     mockedDownloadFile
       .mockRejectedValueOnce(new Error('proxy failed'))
       .mockResolvedValueOnce(undefined);
+    mockedSpawn.mockRejectedValueOnce(new Error('xclogparser not found'));
     mockedSpawn.mockResolvedValue({ stdout: '', stderr: '' } as any);
 
     await parseAndReportXcactivitylog({
@@ -240,18 +309,19 @@ describe('parseAndReportXcactivitylog', () => {
       workspacePath: '/tmp/workspace',
       logger,
       proxyBaseUrl: 'https://cache.example.com',
+      env: TEST_ENV,
     });
 
     expect(mockedDownloadFile).toHaveBeenNthCalledWith(
       1,
-      'https://cache.example.com/storage.googleapis.com/turtle-v2/xclogparser/XCLogParser-macOS-x86-64-arm64-v0.2.46.zip',
-      '/tmp/xclogparser-123/XCLogParser-macOS-x86-64-arm64-v0.2.46.zip',
+      'https://cache.example.com/storage.googleapis.com/turtle-v2/xclogparser/XCLogParser-macOS-x86-64-arm64-v0.2.47.zip',
+      '/tmp/xclogparser-123/XCLogParser-macOS-x86-64-arm64-v0.2.47.zip',
       { retry: 3, timeout: 20_000 }
     );
     expect(mockedDownloadFile).toHaveBeenNthCalledWith(
       2,
-      'https://storage.googleapis.com/turtle-v2/xclogparser/XCLogParser-macOS-x86-64-arm64-v0.2.46.zip',
-      '/tmp/xclogparser-123/XCLogParser-macOS-x86-64-arm64-v0.2.46.zip',
+      'https://storage.googleapis.com/turtle-v2/xclogparser/XCLogParser-macOS-x86-64-arm64-v0.2.47.zip',
+      '/tmp/xclogparser-123/XCLogParser-macOS-x86-64-arm64-v0.2.47.zip',
       { retry: 3, timeout: 20_000 }
     );
     expect(logger.debug).toHaveBeenCalledWith(
@@ -267,6 +337,7 @@ describe('parseAndReportXcactivitylog', () => {
 
     mockedDownloadFile.mockResolvedValue(undefined);
     mockedSpawn
+      .mockRejectedValueOnce(new Error('xclogparser not found'))
       .mockRejectedValueOnce(new Error('invalid zip'))
       .mockResolvedValueOnce({ stdout: '', stderr: '' } as any)
       .mockResolvedValueOnce({ stdout: '', stderr: '' } as any);
@@ -276,18 +347,19 @@ describe('parseAndReportXcactivitylog', () => {
       workspacePath: '/tmp/workspace',
       logger,
       proxyBaseUrl: 'https://cache.example.com',
+      env: TEST_ENV,
     });
 
     expect(mockedDownloadFile).toHaveBeenNthCalledWith(
       1,
-      'https://cache.example.com/storage.googleapis.com/turtle-v2/xclogparser/XCLogParser-macOS-x86-64-arm64-v0.2.46.zip',
-      '/tmp/xclogparser-123/XCLogParser-macOS-x86-64-arm64-v0.2.46.zip',
+      'https://cache.example.com/storage.googleapis.com/turtle-v2/xclogparser/XCLogParser-macOS-x86-64-arm64-v0.2.47.zip',
+      '/tmp/xclogparser-123/XCLogParser-macOS-x86-64-arm64-v0.2.47.zip',
       { retry: 3, timeout: 20_000 }
     );
     expect(mockedDownloadFile).toHaveBeenNthCalledWith(
       2,
-      'https://storage.googleapis.com/turtle-v2/xclogparser/XCLogParser-macOS-x86-64-arm64-v0.2.46.zip',
-      '/tmp/xclogparser-123/XCLogParser-macOS-x86-64-arm64-v0.2.46.zip',
+      'https://storage.googleapis.com/turtle-v2/xclogparser/XCLogParser-macOS-x86-64-arm64-v0.2.47.zip',
+      '/tmp/xclogparser-123/XCLogParser-macOS-x86-64-arm64-v0.2.47.zip',
       { retry: 3, timeout: 20_000 }
     );
     expect(logger.debug).toHaveBeenCalledWith(
@@ -300,11 +372,12 @@ describe('parseAndReportXcactivitylog', () => {
     expect(logger.warn).not.toHaveBeenCalled();
   });
 
-  it('skips reporting and logs debug when the JSON output is invalid', async () => {
+  it('reports phase "parsing_xclogparser_output" when the JSON output is invalid', async () => {
     const logger = createMockLogger();
     mockFilesystem({ jsonOutput: '{not valid json' });
 
     mockedDownloadFile.mockResolvedValue(undefined);
+    mockedSpawn.mockRejectedValueOnce(new Error('xclogparser not found'));
     mockedSpawn.mockResolvedValue({ stdout: '', stderr: '' } as any);
 
     await expect(
@@ -312,18 +385,20 @@ describe('parseAndReportXcactivitylog', () => {
         derivedDataPath: '/tmp/derived-data',
         workspacePath: '/tmp/workspace',
         logger,
+        env: TEST_ENV,
       })
-    ).resolves.toBeUndefined();
+    ).resolves.toEqual({ skipped: true });
 
-    expect(logger.info).not.toHaveBeenCalled();
-    expect(logger.debug).toHaveBeenCalledWith(
-      expect.objectContaining({ err: expect.any(Error) }),
-      'Failed to analyze build performance; continuing without a report'
-    );
+    expect(logger.info).toHaveBeenCalledWith('Build performance analysis skipped.');
     expect(logger.warn).not.toHaveBeenCalled();
+    expect(Sentry.capture).toHaveBeenCalledWith(
+      'Build performance analysis failed during "parsing_xclogparser_output"',
+      expect.any(Error),
+      expect.objectContaining({ tags: { phase: 'parsing_xclogparser_output' } })
+    );
   });
 
-  it('skips reporting and logs debug when the JSON output does not match the expected schema', async () => {
+  it('reports phase "parsing_xclogparser_output" when the JSON output does not match the expected schema', async () => {
     const logger = createMockLogger();
     mockFilesystem({
       jsonOutput: JSON.stringify({
@@ -333,6 +408,7 @@ describe('parseAndReportXcactivitylog', () => {
     });
 
     mockedDownloadFile.mockResolvedValue(undefined);
+    mockedSpawn.mockRejectedValueOnce(new Error('xclogparser not found'));
     mockedSpawn.mockResolvedValue({ stdout: '', stderr: '' } as any);
 
     await expect(
@@ -340,15 +416,211 @@ describe('parseAndReportXcactivitylog', () => {
         derivedDataPath: '/tmp/derived-data',
         workspacePath: '/tmp/workspace',
         logger,
+        env: TEST_ENV,
       })
-    ).resolves.toBeUndefined();
+    ).resolves.toEqual({ skipped: true });
 
-    expect(logger.info).not.toHaveBeenCalled();
-    expect(logger.debug).toHaveBeenCalledWith(
-      expect.objectContaining({ err: expect.any(Error) }),
-      'Failed to analyze build performance; continuing without a report'
-    );
+    expect(logger.info).toHaveBeenCalledWith('Build performance analysis skipped.');
     expect(logger.warn).not.toHaveBeenCalled();
+    expect(Sentry.capture).toHaveBeenCalledWith(
+      'Build performance analysis failed during "parsing_xclogparser_output"',
+      expect.any(Error),
+      expect.objectContaining({ tags: { phase: 'parsing_xclogparser_output' } })
+    );
+  });
+
+  it('reports phase "running_xclogparser" when the xclogparser invocation fails', async () => {
+    const logger = createMockLogger();
+    mockFilesystem();
+
+    mockedDownloadFile.mockResolvedValue(undefined);
+    mockedSpawn
+      .mockRejectedValueOnce(new Error('xclogparser not found')) // version detect
+      .mockResolvedValueOnce({ stdout: '', stderr: '' } as any) // unzip
+      .mockRejectedValueOnce(new Error('spawn xclogparser ENOENT')); // xclogparser run
+
+    await expect(
+      parseAndReportXcactivitylog({
+        derivedDataPath: '/tmp/derived-data',
+        workspacePath: '/tmp/workspace',
+        logger,
+        env: TEST_ENV,
+      })
+    ).resolves.toEqual({ skipped: true });
+
+    expect(logger.info).toHaveBeenCalledWith('Build performance analysis skipped.');
+    expect(logger.warn).not.toHaveBeenCalled();
+    expect(Sentry.capture).toHaveBeenCalledWith(
+      'Build performance analysis failed during "running_xclogparser"',
+      expect.objectContaining({ message: 'spawn xclogparser ENOENT' }),
+      expect.objectContaining({ tags: { phase: 'running_xclogparser' } })
+    );
+  });
+
+  it('surfaces spawn error stderr/stdout/status/signal as Sentry extras', async () => {
+    const logger = createMockLogger();
+    mockFilesystem();
+
+    const spawnError: any = new Error('xclogparser exited with non-zero code: 1');
+    spawnError.stderr = 'XCLogParser fatal: missing xcactivitylog\n';
+    spawnError.stdout = 'some stdout';
+    spawnError.status = 1;
+    spawnError.signal = null;
+
+    mockedDownloadFile.mockResolvedValue(undefined);
+    mockedSpawn
+      .mockRejectedValueOnce(new Error('xclogparser not found')) // version detect
+      .mockResolvedValueOnce({ stdout: '', stderr: '' } as any) // unzip
+      .mockRejectedValueOnce(spawnError); // xclogparser run
+
+    await parseAndReportXcactivitylog({
+      derivedDataPath: '/tmp/derived-data',
+      workspacePath: '/tmp/workspace',
+      logger,
+      env: TEST_ENV,
+    });
+
+    expect(Sentry.capture).toHaveBeenCalledWith(
+      'Build performance analysis failed during "running_xclogparser"',
+      expect.any(Error),
+      {
+        tags: { phase: 'running_xclogparser' },
+        extras: {
+          exitStatus: 1,
+          signal: null,
+          stderr: 'XCLogParser fatal: missing xcactivitylog\n',
+          stdout: 'some stdout',
+        },
+      }
+    );
+  });
+
+  it('skips with actionable guidance when Logs/Build has no .xcactivitylog files', async () => {
+    const logger = createMockLogger();
+    mockFilesystem({ buildLogEntries: [] });
+
+    const result = await parseAndReportXcactivitylog({
+      derivedDataPath: '/tmp/derived-data',
+      workspacePath: '/tmp/workspace',
+      logger,
+      env: TEST_ENV,
+    });
+
+    expect(result).toEqual({ skipped: true });
+    expect(mockedSpawn).not.toHaveBeenCalled();
+    expect(mockedDownloadFile).not.toHaveBeenCalled();
+    expect(Sentry.capture).not.toHaveBeenCalled();
+    expect(logger.info).toHaveBeenCalledWith(
+      expect.stringContaining(
+        `Build performance analysis skipped: no .xcactivitylog files found at ${path.join(
+          '/tmp/derived-data',
+          'Logs',
+          'Build'
+        )}.`
+      )
+    );
+    expect(logger.info).toHaveBeenCalledWith(expect.stringContaining('custom ios/Gymfile'));
+    expect(logger.info).toHaveBeenCalledWith(
+      expect.stringContaining('derived_data_path("./build")')
+    );
+    expect(logger.info).toHaveBeenCalledWith(expect.stringContaining('result_bundle(true)'));
+    expect(logger.info).toHaveBeenCalledWith(
+      expect.stringContaining('result_bundle_path("./build/result-bundle.xcresult")')
+    );
+  });
+
+  it('skips when Logs/Build directory does not exist', async () => {
+    const logger = createMockLogger();
+    const enoent: any = new Error('ENOENT');
+    enoent.code = 'ENOENT';
+    mockFilesystem({ buildLogEntries: enoent });
+
+    const result = await parseAndReportXcactivitylog({
+      derivedDataPath: '/tmp/derived-data',
+      workspacePath: '/tmp/workspace',
+      logger,
+      env: TEST_ENV,
+    });
+
+    expect(result).toEqual({ skipped: true });
+    expect(mockedSpawn).not.toHaveBeenCalled();
+    expect(mockedDownloadFile).not.toHaveBeenCalled();
+    expect(Sentry.capture).not.toHaveBeenCalled();
+    expect(logger.info).toHaveBeenCalledWith(
+      expect.stringContaining('Build performance analysis skipped: no .xcactivitylog files found')
+    );
+  });
+
+  it('captures to Sentry and skips when readdir fails with a non-ENOENT error', async () => {
+    const logger = createMockLogger();
+    const eacces: any = new Error('EACCES: permission denied');
+    eacces.code = 'EACCES';
+    mockFilesystem({ buildLogEntries: eacces });
+
+    const result = await parseAndReportXcactivitylog({
+      derivedDataPath: '/tmp/derived-data',
+      workspacePath: '/tmp/workspace',
+      logger,
+      env: TEST_ENV,
+    });
+
+    expect(result).toEqual({ skipped: true });
+    expect(mockedSpawn).not.toHaveBeenCalled();
+    expect(mockedDownloadFile).not.toHaveBeenCalled();
+    expect(Sentry.capture).toHaveBeenCalledWith(
+      'Build performance analysis failed during "checking_xcactivitylog_existence"',
+      expect.objectContaining({ code: 'EACCES' }),
+      expect.objectContaining({
+        tags: { phase: 'checking_xcactivitylog_existence' },
+      })
+    );
+    expect(logger.info).toHaveBeenCalledWith('Build performance analysis skipped.');
+    expect(logger.info).not.toHaveBeenCalledWith(expect.stringContaining('custom ios/Gymfile'));
+  });
+
+  it('ignores non-xcactivitylog entries in Logs/Build when deciding to skip', async () => {
+    const logger = createMockLogger();
+    mockFilesystem({ buildLogEntries: ['LogStoreManifest.plist', 'some-other-file.txt'] });
+
+    const result = await parseAndReportXcactivitylog({
+      derivedDataPath: '/tmp/derived-data',
+      workspacePath: '/tmp/workspace',
+      logger,
+      env: TEST_ENV,
+    });
+
+    expect(result).toEqual({ skipped: true });
+    expect(mockedSpawn).not.toHaveBeenCalled();
+    expect(Sentry.capture).not.toHaveBeenCalled();
+    expect(logger.info).toHaveBeenCalledWith(
+      expect.stringContaining('Build performance analysis skipped: no .xcactivitylog files found')
+    );
+  });
+
+  it('reports phase "downloading_xclogparser" when the direct download fails', async () => {
+    const logger = createMockLogger();
+    mockFilesystem();
+
+    mockedDownloadFile.mockRejectedValue(new Error('network unreachable'));
+    mockedSpawn.mockRejectedValueOnce(new Error('xclogparser not found'));
+    mockedSpawn.mockResolvedValue({ stdout: '', stderr: '' } as any);
+
+    await expect(
+      parseAndReportXcactivitylog({
+        derivedDataPath: '/tmp/derived-data',
+        workspacePath: '/tmp/workspace',
+        logger,
+        env: TEST_ENV,
+      })
+    ).resolves.toEqual({ skipped: true });
+
+    expect(logger.info).toHaveBeenCalledWith('Build performance analysis skipped.');
+    expect(logger.warn).not.toHaveBeenCalled();
+    expect(Sentry.capture).toHaveBeenCalledWith(
+      'Build performance analysis failed during "downloading_xclogparser"',
+      expect.objectContaining({ message: 'network unreachable' }),
+      expect.objectContaining({ tags: { phase: 'downloading_xclogparser' } })
+    );
   });
 
   it('swallows cleanup failures without emitting additional logs', async () => {
@@ -359,6 +631,7 @@ describe('parseAndReportXcactivitylog', () => {
     });
 
     mockedDownloadFile.mockResolvedValue(undefined);
+    mockedSpawn.mockRejectedValueOnce(new Error('xclogparser not found'));
     mockedSpawn.mockResolvedValue({ stdout: '', stderr: '' } as any);
 
     await expect(
@@ -366,13 +639,174 @@ describe('parseAndReportXcactivitylog', () => {
         derivedDataPath: '/tmp/derived-data',
         workspacePath: '/tmp/workspace',
         logger,
+        env: TEST_ENV,
       })
-    ).resolves.toBeUndefined();
+    ).resolves.toEqual({ skipped: false });
 
-    expect(logger.info).toHaveBeenCalledTimes(1);
     expect(logger.debug).not.toHaveBeenCalled();
     expect(logger.warn).not.toHaveBeenCalled();
   });
+
+  describe('xclogparser version resolution', () => {
+    it('uses preinstalled binary when no version is requested', async () => {
+      const logger = createMockLogger();
+      const { reportPath } = mockFilesystem();
+
+      mockedSpawn
+        .mockResolvedValueOnce({ stdout: 'XCLogParser 0.2.50\n', stderr: '' } as any) // version detect
+        .mockResolvedValueOnce({ stdout: '', stderr: '' } as any); // xclogparser parse
+
+      await parseAndReportXcactivitylog({
+        derivedDataPath: '/tmp/derived-data',
+        workspacePath: '/tmp/workspace',
+        logger,
+        env: TEST_ENV,
+      });
+
+      expect(mockedDownloadFile).not.toHaveBeenCalled();
+      expect(mockedSpawn).not.toHaveBeenCalledWith('unzip', expect.any(Array), expect.any(Object));
+      expect(mockedSpawn).toHaveBeenNthCalledWith(
+        2,
+        'xclogparser',
+        [
+          'parse',
+          '--derived_data',
+          '/tmp/derived-data',
+          '--workspace',
+          '/tmp/workspace',
+          '--reporter',
+          'json',
+          '--omit_warnings',
+          '--omit_notes',
+          '--trunc_large_issues',
+          '--output',
+          reportPath,
+        ],
+        { stdio: 'pipe', env: TEST_ENV }
+      );
+      expect(logger.info).toHaveBeenCalledWith('Using preinstalled xclogparser v0.2.50.');
+      expect(logger.info).not.toHaveBeenCalledWith(expect.stringContaining('downloaded'));
+      expect(Sentry.capture).not.toHaveBeenCalled();
+    });
+
+    it('downloads default version when no version requested and no preinstall found', async () => {
+      const logger = createMockLogger();
+      mockFilesystem();
+
+      mockedDownloadFile.mockResolvedValue(undefined);
+      mockedSpawn.mockRejectedValueOnce(new Error('xclogparser not found'));
+      mockedSpawn.mockResolvedValue({ stdout: '', stderr: '' } as any);
+
+      await parseAndReportXcactivitylog({
+        derivedDataPath: '/tmp/derived-data',
+        workspacePath: '/tmp/workspace',
+        logger,
+        env: TEST_ENV,
+      });
+
+      expect(mockedDownloadFile).toHaveBeenCalledWith(
+        expect.stringContaining('XCLogParser-macOS-x86-64-arm64-v0.2.47.zip'),
+        expect.any(String),
+        expect.any(Object)
+      );
+      expect(logger.info).toHaveBeenCalledWith('Using downloaded xclogparser v0.2.47.');
+    });
+
+    it('uses preinstalled binary when requested version matches', async () => {
+      const logger = createMockLogger();
+      mockFilesystem();
+
+      mockedSpawn
+        .mockResolvedValueOnce({ stdout: 'XCLogParser 0.2.50\n', stderr: '' } as any) // version detect
+        .mockResolvedValueOnce({ stdout: '', stderr: '' } as any); // xclogparser parse
+
+      await parseAndReportXcactivitylog({
+        derivedDataPath: '/tmp/derived-data',
+        workspacePath: '/tmp/workspace',
+        xclogparserVersion: 'v0.2.50',
+        logger,
+        env: TEST_ENV,
+      });
+
+      expect(mockedDownloadFile).not.toHaveBeenCalled();
+      expect(logger.info).toHaveBeenCalledWith('Using preinstalled xclogparser v0.2.50.');
+      expect(logger.info).not.toHaveBeenCalledWith(expect.stringContaining('downloaded'));
+    });
+
+    it('downloads requested version when it does not match the preinstalled binary', async () => {
+      const logger = createMockLogger();
+      mockFilesystem();
+
+      mockedDownloadFile.mockResolvedValue(undefined);
+      mockedSpawn
+        .mockResolvedValueOnce({ stdout: 'XCLogParser 0.2.48\n', stderr: '' } as any) // version detect
+        .mockResolvedValueOnce({ stdout: '', stderr: '' } as any) // unzip
+        .mockResolvedValueOnce({ stdout: '', stderr: '' } as any); // xclogparser parse
+
+      await parseAndReportXcactivitylog({
+        derivedDataPath: '/tmp/derived-data',
+        workspacePath: '/tmp/workspace',
+        xclogparserVersion: 'v0.2.50',
+        logger,
+        env: TEST_ENV,
+      });
+
+      expect(mockedDownloadFile).toHaveBeenCalledWith(
+        expect.stringContaining('XCLogParser-macOS-x86-64-arm64-v0.2.50.zip'),
+        expect.any(String),
+        expect.any(Object)
+      );
+      expect(logger.info).toHaveBeenCalledWith('Using downloaded xclogparser v0.2.50.');
+    });
+
+    it('downloads requested version when no preinstall is found', async () => {
+      const logger = createMockLogger();
+      mockFilesystem();
+
+      mockedDownloadFile.mockResolvedValue(undefined);
+      mockedSpawn.mockRejectedValueOnce(new Error('xclogparser not found'));
+      mockedSpawn.mockResolvedValue({ stdout: '', stderr: '' } as any);
+
+      await parseAndReportXcactivitylog({
+        derivedDataPath: '/tmp/derived-data',
+        workspacePath: '/tmp/workspace',
+        xclogparserVersion: 'v0.2.50',
+        logger,
+        env: TEST_ENV,
+      });
+
+      expect(mockedDownloadFile).toHaveBeenCalledWith(
+        expect.stringContaining('XCLogParser-macOS-x86-64-arm64-v0.2.50.zip'),
+        expect.any(String),
+        expect.any(Object)
+      );
+      expect(logger.info).toHaveBeenCalledWith('Using downloaded xclogparser v0.2.50.');
+    });
+
+    it('falls back to download when the version output cannot be parsed', async () => {
+      const logger = createMockLogger();
+      mockFilesystem();
+
+      mockedDownloadFile.mockResolvedValue(undefined);
+      mockedSpawn
+        .mockResolvedValueOnce({ stdout: 'something unexpected', stderr: '' } as any) // version detect
+        .mockResolvedValue({ stdout: '', stderr: '' } as any);
+
+      await parseAndReportXcactivitylog({
+        derivedDataPath: '/tmp/derived-data',
+        workspacePath: '/tmp/workspace',
+        logger,
+        env: TEST_ENV,
+      });
+
+      expect(mockedDownloadFile).toHaveBeenCalledWith(
+        expect.stringContaining('XCLogParser-macOS-x86-64-arm64-v0.2.47.zip'),
+        expect.any(String),
+        expect.any(Object)
+      );
+      expect(logger.info).toHaveBeenCalledWith('Using downloaded xclogparser v0.2.47.');
+    });
+  });
 });
 
 describe('isCompileStep', () => {
@@ -478,17 +912,38 @@ describe('buildTargetMetrics', () => {
     expect(mod).toBeDefined();
     expect(mod!.taskSeconds).toBeCloseTo(3.0);
     expect(mod!.wallSpan).toBe(0); // no valid intervals
+    expect(mod!.activeWallTime).toBe(0); // no valid intervals
+  });
+
+  it('computes activeWallTime by merging overlapping intervals and excluding gaps', () => {
+    const { results } = buildTargetMetrics(FIXTURE_OVERLAP_WITH_GAP);
+    const mod = results.find(r => r.moduleName === 'GappedModule');
+    expect(mod).toBeDefined();
+    expect(mod!.taskSeconds).toBeCloseTo(11.0); // 5 + 4 + 2
+    expect(mod!.wallSpan).toBeCloseTo(12.0); // 112 - 100
+    expect(mod!.activeWallTime).toBeCloseTo(8.0); // (106-100) + (112-110)
   });
 });
 
 describe('formatReport', () => {
-  it('produces table with header and module rows', () => {
+  it('produces table with header, legend, and module rows', () => {
     const report = formatReport(FIXTURE_TWO_MODULES);
     expect(report).toContain('Xcode Build — Compile Metrics by Module');
     expect(report).toContain('ModuleA');
     expect(report).toContain('ModuleB');
     expect(report).toContain('TOTAL');
-    expect(report).toContain('% Task');
+    expect(report).toContain('% Sum');
+    expect(report).toContain('Sum = sum of compile-step wall durations');
+    expect(report).toContain('Active = merged compile-step wall time');
+    expect(report).not.toContain('% Task');
+    expect(report).not.toContain('Wall = ');
+  });
+
+  it('renders Active using activeWallTime, not wallSpan', () => {
+    const report = formatReport(FIXTURE_OVERLAP_WITH_GAP);
+    expect(report).toContain('11.0s');
+    expect(report).toContain('8.0s');
+    expect(report).not.toContain('12.0s');
   });
 
   it('does not include modules below threshold', () => {

packages/build-tools/src/steps/utils/ios/fastlane.ts

@@ -3,8 +3,8 @@ import { BuildStepEnv } from '@expo/steps';
 import spawn, { SpawnResult } from '@expo/turtle-spawn';
 import path from 'path';
 
-import { XcodeBuildLogger } from './xcpretty';
 import { COMMON_FASTLANE_ENV } from '../../../common/fastlane';
+import { XcodeBuildLogger } from '../../../common/xcpretty';
 
 export async function runFastlaneGym({
   workingDir,

packages/build-tools/src/steps/utils/ios/xcactivitylog.ts

@@ -1,58 +1,126 @@
 import downloadFile from '@expo/downloader';
 import { bunyan } from '@expo/logger';
 import { asyncResult } from '@expo/results';
+import { BuildStepEnv } from '@expo/steps';
 import spawn from '@expo/turtle-spawn';
 import fs from 'fs-extra';
 import os from 'os';
 import path from 'path';
 import { z } from 'zod';
 
-const DEFAULT_XCLOGPARSER_VERSION = 'v0.2.46';
+import { Sentry } from '../../../sentry';
+
+const DEFAULT_XCLOGPARSER_VERSION = 'v0.2.47';
 const XCLOGPARSER_DOWNLOAD_URL = 'https://storage.googleapis.com/turtle-v2/xclogparser';
 const XCLOGPARSER_DOWNLOAD_TIMEOUT_MS = 20_000;
 const XCLOGPARSER_OUTPUT_FILENAME = 'xcactivitylog.json';
 
 /**
- * Download xclogparser, parse xcactivitylog from derived data, and log a
- * compile metrics report. Never throws — all errors are logged at debug level.
- *
- * Can be called from both the step-based flow (BuildFunction) and the
- * traditional builder flow (runBuildPhase).
+ * Catches all internal failures (logged + routed to Sentry); returns
+ * `{ skipped: true }` when analysis did not produce a report so callers can
+ * mark the build phase skipped.
  */
 export async function parseAndReportXcactivitylog({
   derivedDataPath,
   workspacePath,
-  xclogparserVersion = DEFAULT_XCLOGPARSER_VERSION,
+  xclogparserVersion,
   logger,
   proxyBaseUrl,
+  env,
 }: {
   derivedDataPath: string;
   workspacePath: string;
   xclogparserVersion?: string;
   logger: bunyan;
   proxyBaseUrl?: string;
-}): Promise<void> {
+  env: BuildStepEnv;
+}): Promise<{ skipped: boolean }> {
   let tempDir: string | undefined;
+  let phase = 'checking_xcactivitylog_existence';
   try {
+    const logsBuildDir = path.join(derivedDataPath, 'Logs', 'Build');
+    let buildLogEntries: string[];
+    try {
+      buildLogEntries = await fs.readdir(logsBuildDir);
+    } catch (err: any) {
+      if (err?.code !== 'ENOENT') {
+        throw err;
+      }
+      buildLogEntries = [];
+    }
+    const hasActivityLog = buildLogEntries.some(entry => entry.endsWith('.xcactivitylog'));
+    if (!hasActivityLog) {
+      logger.info(
+        [
+          `Build performance analysis skipped: no .xcactivitylog files found at ${logsBuildDir}.`,
+          '',
+          'This typically happens when your project has a custom ios/Gymfile. To enable',
+          'build performance analysis, add the following lines to your Gymfile:',
+          '',
+          '    derived_data_path("./build")',
+          '    result_bundle(true)',
+          '    result_bundle_path("./build/result-bundle.xcresult")',
+        ].join('\n')
+      );
+      return { skipped: true };
+    }
+
+    phase = 'creating_temp_directory';
     tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'xclogparser-'));
-    const xclogparserPath = await downloadXclogparser(
-      tempDir,
-      xclogparserVersion,
-      logger,
-      proxyBaseUrl
-    );
+
+    phase = 'resolving_xclogparser';
+    const preinstalledVersion = await detectPreinstalledXclogparserVersion(env);
+    let binaryPath: string;
+    let resolvedVersion: string;
+    if (
+      preinstalledVersion &&
+      (!xclogparserVersion || preinstalledVersion === xclogparserVersion)
+    ) {
+      binaryPath = 'xclogparser';
+      resolvedVersion = preinstalledVersion;
+      logger.info(`Using preinstalled xclogparser ${resolvedVersion}.`);
+    } else {
+      phase = 'downloading_xclogparser';
+      resolvedVersion = xclogparserVersion ?? DEFAULT_XCLOGPARSER_VERSION;
+      binaryPath = await downloadXclogparser({
+        tempDir,
+        version: resolvedVersion,
+        logger,
+        proxyBaseUrl,
+        env,
+      });
+      logger.info(`Using downloaded xclogparser ${resolvedVersion}.`);
+    }
+
+    phase = 'running_xclogparser';
     const jsonOutputPath = await runXclogparser({
-      binaryPath: xclogparserPath,
+      binaryPath,
       derivedDataPath,
       workspacePath,
       outputDir: tempDir,
+      env,
     });
+
+    phase = 'parsing_xclogparser_output';
     const data = XcactivitylogDataSchemaZ.parse(
       JSON.parse(await fs.readFile(jsonOutputPath, 'utf8'))
     );
+
     logger.info(formatReport(data));
-  } catch (err: unknown) {
-    logger.debug({ err }, 'Failed to analyze build performance; continuing without a report');
+    return { skipped: false };
+  } catch (err: any) {
+    logger.info('Build performance analysis skipped.');
+    const msg = `Build performance analysis failed during "${phase}"`;
+    Sentry.capture(msg, err, {
+      tags: { phase },
+      extras: {
+        exitStatus: err?.status,
+        signal: err?.signal,
+        stderr: err?.stderr?.slice(-4000),
+        stdout: err?.stdout?.slice(-4000),
+      },
+    });
+    return { skipped: true };
   } finally {
     if (tempDir) {
       await asyncResult(fs.rm(tempDir, { force: true, recursive: true }));
@@ -60,12 +128,28 @@ export async function parseAndReportXcactivitylog({
   }
 }
 
-async function downloadXclogparser(
-  tempDir: string,
-  version: string,
-  logger: bunyan,
-  proxyBaseUrl?: string
-): Promise<string> {
+async function detectPreinstalledXclogparserVersion(env: BuildStepEnv): Promise<string | null> {
+  const result = await asyncResult(spawn('xclogparser', ['version'], { stdio: 'pipe', env }));
+  if (!result.ok) {
+    return null;
+  }
+  const match = result.value.stdout.match(/(\d+\.\d+\.\d+)/);
+  return match ? `v${match[1]}` : null;
+}
+
+async function downloadXclogparser({
+  tempDir,
+  version,
+  logger,
+  proxyBaseUrl,
+  env,
+}: {
+  tempDir: string;
+  version: string;
+  logger: bunyan;
+  proxyBaseUrl?: string;
+  env: BuildStepEnv;
+}): Promise<string> {
   const zipName = getXclogparserZipName(version);
   const zipPath = path.join(tempDir, zipName);
   const directUrl = `${XCLOGPARSER_DOWNLOAD_URL}/${zipName}`;
@@ -73,7 +157,7 @@ async function downloadXclogparser(
 
   if (proxiedUrl) {
     const proxiedDownloadResult = await asyncResult(
-      downloadAndUnpackXclogparser({ tempDir, zipPath, sourceUrl: proxiedUrl })
+      downloadAndUnpackXclogparser({ tempDir, zipPath, sourceUrl: proxiedUrl, env })
     );
     if (!proxiedDownloadResult.ok) {
       logger.debug(
@@ -86,31 +170,35 @@ async function downloadXclogparser(
     }
   }
 
-  return await downloadAndUnpackXclogparser({ tempDir, zipPath, sourceUrl: directUrl });
+  return await downloadAndUnpackXclogparser({ tempDir, zipPath, sourceUrl: directUrl, env });
 }
 
 async function downloadAndUnpackXclogparser({
   tempDir,
   zipPath,
   sourceUrl,
+  env,
 }: {
   tempDir: string;
   zipPath: string;
   sourceUrl: string;
+  env: BuildStepEnv;
 }): Promise<string> {
   await downloadFile(sourceUrl, zipPath, { retry: 3, timeout: XCLOGPARSER_DOWNLOAD_TIMEOUT_MS });
 
-  return await unpackXclogparser({ tempDir, zipPath });
+  return await unpackXclogparser({ tempDir, zipPath, env });
 }
 
 async function unpackXclogparser({
   tempDir,
   zipPath,
+  env,
 }: {
   tempDir: string;
   zipPath: string;
+  env: BuildStepEnv;
 }): Promise<string> {
-  await spawn('unzip', ['-q', zipPath, '-d', tempDir], { stdio: 'pipe' });
+  await spawn('unzip', ['-q', zipPath, '-d', tempDir], { stdio: 'pipe', env });
 
   const binaryPath = path.join(tempDir, 'xclogparser');
   await fs.chmod(binaryPath, 0o755);
@@ -133,11 +221,13 @@ async function runXclogparser({
   derivedDataPath,
   workspacePath,
   outputDir,
+  env,
 }: {
   binaryPath: string;
   derivedDataPath: string;
   workspacePath: string;
   outputDir: string;
+  env: BuildStepEnv;
 }): Promise<string> {
   const outputPath = path.join(outputDir, XCLOGPARSER_OUTPUT_FILENAME);
 
@@ -151,10 +241,13 @@ async function runXclogparser({
       workspacePath,
       '--reporter',
       'json',
+      '--omit_warnings',
+      '--omit_notes',
+      '--trunc_large_issues',
       '--output',
       outputPath,
     ],
-    { stdio: 'pipe' }
+    { stdio: 'pipe', env }
   );
 
   return outputPath;
@@ -183,6 +276,7 @@ type XcactivitylogData = z.infer<typeof XcactivitylogDataSchemaZ>;
 interface TargetMetric {
   moduleName: string;
   taskSeconds: number;
+  // Not rendered; retained as secondary sort tie-breaker in buildTargetMetrics.
   wallSpan: number;
   activeWallTime: number;
 }
@@ -358,19 +452,22 @@ export function formatReport(data: XcactivitylogData): string {
   lines.push(
     `Schema: ${typeof data.schema === 'string' ? data.schema : (data.schema?.name ?? 'unknown')}`
   );
-  lines.push('% Task = share of total Compile Task Seconds');
-  lines.push('Wall = first compile start to last compile end');
+  lines.push(
+    'Sum = sum of compile-step wall durations within the target; overlapping steps are counted separately'
+  );
+  lines.push('% Sum = share of total Sum');
+  lines.push('Active = merged compile-step wall time, excluding idle gaps between compile steps');
   lines.push('');
   lines.push(header);
   lines.push(
     '│ ' +
       'Module'.padEnd(nameWidth) +
       ' │ ' +
-      'Task'.padStart(taskWidth) +
+      'Sum'.padStart(taskWidth) +
       ' │ ' +
-      '% Task'.padStart(pctWidth) +
+      '% Sum'.padStart(pctWidth) +
       ' │ ' +
-      'Wall'.padStart(wallWidth) +
+      'Active'.padStart(wallWidth) +
       ' │ ' +
       ' '.repeat(barMaxWidth) +
       ' │'
@@ -390,7 +487,7 @@ export function formatReport(data: XcactivitylogData): string {
         ' │ ' +
         `${pct.toFixed(1)}%`.padStart(pctWidth) +
         ' │ ' +
-        formatSeconds(result.wallSpan).padStart(wallWidth) +
+        formatSeconds(result.activeWallTime).padStart(wallWidth) +
         ' │ ' +
         bar +
         ' │'
@@ -406,7 +503,7 @@ export function formatReport(data: XcactivitylogData): string {
       ' │ ' +
       '100.0%'.padStart(pctWidth) +
       ' │ ' +
-      'n/a'.padStart(wallWidth) +
+      ' '.repeat(wallWidth) +
       ' │ ' +
       ' '.repeat(barMaxWidth) +
       ' │'

packages/build-tools/src/steps/utils/ios/xcpretty.ts

@@ -1,91 +0,0 @@
-import { bunyan } from '@expo/logger';
-import spawnAsync, { SpawnPromise, SpawnResult } from '@expo/spawn-async';
-import { ExpoRunFormatter } from '@expo/xcpretty';
-import assert from 'assert';
-import fg from 'fast-glob';
-import fs from 'fs-extra';
-import path from 'path';
-
-const CHECK_FILE_INTERVAL_MS = 1000;
-
-export class XcodeBuildLogger {
-  private loggerError?: Error;
-  private flushing: boolean = false;
-  private logReaderPromise?: SpawnPromise<SpawnResult>;
-  private logsPath?: string;
-
-  constructor(
-    private readonly logger: bunyan,
-    private readonly projectRoot: string
-  ) {}
-
-  public async watchLogFiles(logsDirectory: string): Promise<void> {
-    while (!this.flushing) {
-      const logsFilename = await this.getBuildLogFilename(logsDirectory);
-      if (logsFilename) {
-        this.logsPath = path.join(logsDirectory, logsFilename);
-        void this.startBuildLogger(this.logsPath);
-        return;
-      }
-      await new Promise(res => setTimeout(res, CHECK_FILE_INTERVAL_MS));
-    }
-  }
-
-  public async flush(): Promise<void> {
-    this.flushing = true;
-    if (this.loggerError) {
-      throw this.loggerError;
-    }
-    if (this.logReaderPromise) {
-      this.logReaderPromise.child.kill('SIGINT');
-      try {
-        await this.logReaderPromise;
-      } catch {}
-    }
-    if (this.logsPath) {
-      await this.findBundlerErrors(this.logsPath);
-    }
-  }
-  private async getBuildLogFilename(logsDirectory: string): Promise<string | undefined> {
-    const paths = await fg('*.log', { cwd: logsDirectory });
-    return paths.length >= 1 ? paths[0] : undefined;
-  }
-
-  private async startBuildLogger(logsPath: string): Promise<void> {
-    try {
-      const formatter = ExpoRunFormatter.create(this.projectRoot, {
-        // TODO: Can provide xcode project name for better parsing
-        isDebug: false,
-      });
-      this.logReaderPromise = spawnAsync('tail', ['-n', '+0', '-f', logsPath], { stdio: 'pipe' });
-      assert(this.logReaderPromise.child.stdout, 'stdout is not available');
-      this.logReaderPromise.child.stdout.on('data', (data: string) => {
-        const lines = formatter.pipe(data.toString());
-        for (const line of lines) {
-          this.logger.info(line);
-        }
-      });
-      await this.logReaderPromise;
-
-      this.logger.info(formatter.getBuildSummary());
-    } catch (err: any) {
-      if (!this.flushing) {
-        this.loggerError = err;
-      }
-    }
-  }
-
-  private async findBundlerErrors(logsPath: string): Promise<void> {
-    try {
-      const logFile = await fs.readFile(logsPath, 'utf-8');
-      const match = logFile.match(
-        /Welcome to Metro!\s* Fast - Scalable - Integrated\s*([\s\S]*)Run CLI with --verbose flag for more details.\nCommand PhaseScriptExecution failed with a nonzero exit code/
-      );
-      if (match) {
-        this.logger.info(match[1]);
-      }
-    } catch (err) {
-      this.logger.error({ err }, 'Failed to read Xcode logs');
-    }
-  }
-}

packages/build-tools/src/steps/utils/remoteDeviceRunSession.ts

@@ -0,0 +1,242 @@
+import { SystemError } from '@expo/eas-build-job';
+import { bunyan } from '@expo/logger';
+import { BuildStepEnv } from '@expo/steps';
+import spawn from '@expo/turtle-spawn';
+import * as ngrok from '@ngrok/ngrok';
+import { graphql } from 'gql.tada';
+import { randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+
+import { CustomBuildContext } from '../../customBuildContext';
+import { sleepAsync } from '../../utils/retry';
+
+const START_DEVICE_RUN_SESSION_MUTATION = graphql(`
+  mutation StartDeviceRunSession($deviceRunSessionId: ID!, $remoteConfig: JSONObject!) {
+    deviceRunSession {
+      startDeviceRunSession(
+        deviceRunSessionId: $deviceRunSessionId
+        remoteConfig: $remoteConfig
+      ) {
+        id
+        status
+      }
+    }
+  }
+`);
+
+export function getDeviceRunSessionIdOrThrow(env: BuildStepEnv): string {
+  const deviceRunSessionId = env.DEVICE_RUN_SESSION_ID;
+  if (!deviceRunSessionId) {
+    throw new SystemError(
+      'DEVICE_RUN_SESSION_ID is not set. ' +
+        'This step must run as part of a device run session ' +
+        'which injects DEVICE_RUN_SESSION_ID into the job environment.'
+    );
+  }
+  return deviceRunSessionId;
+}
+
+export function getNgrokTunnelDomainOrThrow(env: BuildStepEnv): string {
+  const baseDomain = env.EAS_SIMULATOR_NGROK_TUNNEL_DOMAIN;
+  if (!baseDomain) {
+    throw new SystemError(
+      'EAS_SIMULATOR_NGROK_TUNNEL_DOMAIN is not set. ' +
+        'This step must run as part of a device run session ' +
+        'which injects EAS_SIMULATOR_NGROK_TUNNEL_DOMAIN into the job environment.'
+    );
+  }
+  return baseDomain;
+}
+
+export function getNgrokAuthtokenOrThrow(env: BuildStepEnv): string {
+  const authtoken = env.NGROK_AUTHTOKEN;
+  if (!authtoken) {
+    throw new SystemError(
+      'NGROK_AUTHTOKEN is not set. ' +
+        'This step must run as part of a device run session ' +
+        'which injects NGROK_AUTHTOKEN into the job environment.'
+    );
+  }
+  return authtoken;
+}
+
+export async function uploadRemoteSessionConfigAsync({
+  ctx,
+  deviceRunSessionId,
+  remoteConfig,
+  logger,
+}: {
+  ctx: CustomBuildContext;
+  deviceRunSessionId: string;
+  remoteConfig: Record<string, unknown>;
+  logger: bunyan;
+}): Promise<void> {
+  logger.info(
+    `Reporting remote config to the API server (device run session: ${deviceRunSessionId}).`
+  );
+  const result = await ctx.graphqlClient
+    .mutation(START_DEVICE_RUN_SESSION_MUTATION, { deviceRunSessionId, remoteConfig })
+    .toPromise();
+  if (result.error) {
+    throw new SystemError(
+      `Failed to start device run session ${deviceRunSessionId}: ${result.error.message}`
+    );
+  }
+}
+
+export type DetachedProcessHandle = {
+  getOutput: () => string;
+};
+
+export function spawnDetached({
+  command,
+  args,
+  cwd,
+  env,
+}: {
+  command: string;
+  args: string[];
+  cwd?: string;
+  env: BuildStepEnv;
+}): DetachedProcessHandle {
+  const promise = spawn(command, args, {
+    cwd,
+    env,
+    stdio: ['ignore', 'pipe', 'pipe'],
+    detached: true,
+  });
+  // We don't await the process — it should outlive this step. Failures show
+  // up in the captured output; suppress unhandled rejections here.
+  promise.catch(() => {});
+  promise.child.unref();
+
+  let output = '';
+  const appendChunk = (chunk: Buffer | string): void => {
+    output += chunk.toString();
+  };
+  promise.child.stdout?.on('data', appendChunk);
+  promise.child.stderr?.on('data', appendChunk);
+
+  return { getOutput: () => output };
+}
+
+export async function startServeSimWithTunnelAsync({
+  baseDomain,
+  env,
+  logger,
+  timeoutMs,
+}: {
+  baseDomain: string;
+  env: BuildStepEnv;
+  logger: bunyan;
+  timeoutMs: number;
+}): Promise<{ previewUrl: string; streamUrl: string }> {
+  logger.info('Launching serve-sim with tunnel.');
+  const serveSim = spawnDetached({
+    command: 'npx',
+    args: [
+      'serve-sim-szdziedzic@latest',
+      '--tunnel',
+      '--tunnel-provider',
+      'ngrok',
+      '--tunnel-domain',
+      baseDomain,
+      '--stream-max-dimension',
+      '1280',
+      '--stream-quality',
+      '0.55',
+      '--codec',
+      'webrtc',
+    ],
+    env,
+  });
+
+  logger.info('Waiting for serve-sim to report tunnel and stream URLs.');
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const output = serveSim.getOutput();
+    const previewUrl = matchLabeledUrl({ output, label: 'Tunnel', baseDomain });
+    const streamUrl = matchLabeledUrl({ output, label: 'Stream', baseDomain });
+    if (previewUrl && streamUrl) {
+      return { previewUrl, streamUrl };
+    }
+    await sleepAsync(1_000);
+  }
+  throw new SystemError(
+    `Timed out waiting for serve-sim to report Tunnel and Stream URLs. Last output:\n${serveSim.getOutput() || '<empty>'}`
+  );
+}
+
+function matchLabeledUrl({
+  output,
+  label,
+  baseDomain,
+}: {
+  output: string;
+  label: string;
+  baseDomain: string;
+}): string | null {
+  const labelPattern = new RegExp(
+    `${label}:\\s*(https:\\/\\/[a-z0-9-]+\\.${escapeRegExp(baseDomain)})`
+  );
+  const match = labelPattern.exec(output);
+  return match ? match[1] : null;
+}
+
+export async function startNgrokTunnelAsync({
+  port,
+  subdomainPrefix,
+  baseDomain,
+  authtoken,
+  logger,
+}: {
+  port: number;
+  subdomainPrefix: string;
+  baseDomain: string;
+  authtoken: string;
+  logger: bunyan;
+}): Promise<string> {
+  const domain = `${subdomainPrefix}-${randomBytes(8).toString('hex')}.${baseDomain}`;
+  logger.info(`Starting ngrok tunnel ${domain} -> http://localhost:${port}.`);
+  // Run the ngrok agent in-process via the SDK; it keeps the session alive until
+  // the process exits, and the step blocks forever to hold it open.
+  const listener = await ngrok.forward({ addr: port, authtoken, domain });
+  const url = listener.url();
+  if (!url) {
+    throw new SystemError(`ngrok tunnel for ${domain} did not return a public URL.`);
+  }
+  return url;
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+export async function waitForFileAsync<T>({
+  filePath,
+  timeoutMs,
+  description,
+  parse,
+}: {
+  filePath: string;
+  timeoutMs: number;
+  description: string;
+  parse: (raw: string) => T;
+}): Promise<T> {
+  const deadline = Date.now() + timeoutMs;
+  let lastError: unknown;
+  while (Date.now() < deadline) {
+    try {
+      const raw = await fs.promises.readFile(filePath, 'utf8');
+      return parse(raw);
+    } catch (err) {
+      lastError = err;
+    }
+    await sleepAsync(1_000);
+  }
+  throw new SystemError(
+    `Timed out waiting for ${description} to be ready at ${filePath}${
+      lastError instanceof Error ? `: ${lastError.message}` : ''
+    }.`
+  );
+}

packages/build-tools/src/templates/FastfileResign.ts

@@ -5,6 +5,7 @@ export const FastfileResignTemplate = `lane :do_resign do
     provisioning_profile: {<% _.forEach(PROFILES, function(profile) { %>
       "<%- profile.BUNDLE_ID %>" => "<%- profile.PATH %>",<% }); %>
     },
+    use_app_entitlements: true,
     keychain_path: "<%- KEYCHAIN_PATH %>"
   )
 end

packages/build-tools/src/utils/IosSimulatorUtils.ts

@@ -122,9 +122,10 @@ export namespace IosSimulatorUtils {
     udid: IosSimulatorUuid;
     env: NodeJS.ProcessEnv;
   }): Promise<void> {
+    const readinessScreenshotPath = path.join(os.tmpdir(), 'eas-simulator-readiness.png');
     await retryAsync(
       async () => {
-        await spawn('xcrun', ['simctl', 'io', udid, 'screenshot', '/dev/null'], {
+        await spawn('xcrun', ['simctl', 'io', udid, 'screenshot', readinessScreenshotPath], {
           env,
         });
       },
@@ -136,6 +137,7 @@ export namespace IosSimulatorUtils {
         },
       }
     );
+    await fs.promises.rm(readinessScreenshotPath, { force: true });
 
     // Wait for data migration to complete before declaring the simulator ready
     // Based on WebKit's approach: https://trac.webkit.org/changeset/231452/webkit
@@ -155,6 +157,25 @@ export namespace IosSimulatorUtils {
     );
   }
 
+  export async function disableApsdAsync({
+    udid,
+    env,
+  }: {
+    udid: IosSimulatorUuid;
+    env: NodeJS.ProcessEnv;
+  }): Promise<void> {
+    await spawn(
+      'xcrun',
+      ['simctl', 'spawn', udid, 'launchctl', 'disable', 'system/com.apple.apsd'],
+      { env }
+    );
+    await spawn(
+      'xcrun',
+      ['simctl', 'spawn', udid, 'launchctl', 'bootout', 'system/com.apple.apsd'],
+      { env }
+    );
+  }
+
   export async function collectLogsAsync({
     deviceIdentifier,
     env,

packages/build-tools/src/utils/__tests__/IosSimulatorUtils.test.ts

@@ -0,0 +1,64 @@
+import spawn from '@expo/turtle-spawn';
+import os from 'node:os';
+import path from 'node:path';
+
+import { IosSimulatorUtils } from '../IosSimulatorUtils';
+import { retryAsync } from '../retry';
+
+jest.mock('@expo/turtle-spawn', () => ({
+  __esModule: true,
+  default: jest.fn(),
+}));
+
+jest.mock('../retry', () => ({
+  retryAsync: jest.fn(async fn => await fn(0)),
+}));
+
+const mockedSpawn = jest.mocked(spawn);
+
+describe('IosSimulatorUtils', () => {
+  beforeEach(() => {
+    mockedSpawn.mockResolvedValue({ stdout: '', stderr: '' } as any);
+  });
+
+  describe(IosSimulatorUtils.waitForReadyAsync, () => {
+    it('takes the readiness screenshot into a writable temp file, not /dev/null', async () => {
+      await IosSimulatorUtils.waitForReadyAsync({
+        udid: 'test-udid' as any,
+        env: process.env,
+      });
+
+      expect(mockedSpawn).toHaveBeenCalledWith(
+        'xcrun',
+        [
+          'simctl',
+          'io',
+          'test-udid',
+          'screenshot',
+          path.join(os.tmpdir(), 'eas-simulator-readiness.png'),
+        ],
+        { env: process.env }
+      );
+    });
+  });
+
+  describe(IosSimulatorUtils.disableApsdAsync, () => {
+    it('disables and boots out apsd in the simulator', async () => {
+      await IosSimulatorUtils.disableApsdAsync({
+        udid: 'test-udid' as any,
+        env: process.env,
+      });
+
+      expect(mockedSpawn).toHaveBeenCalledWith(
+        'xcrun',
+        ['simctl', 'spawn', 'test-udid', 'launchctl', 'disable', 'system/com.apple.apsd'],
+        { env: process.env }
+      );
+      expect(mockedSpawn).toHaveBeenCalledWith(
+        'xcrun',
+        ['simctl', 'spawn', 'test-udid', 'launchctl', 'bootout', 'system/com.apple.apsd'],
+        { env: process.env }
+      );
+    });
+  });
+});

packages/build-tools/src/utils/__tests__/artifacts.test.ts

@@ -71,6 +71,26 @@ describe(findArtifacts, () => {
     expect(paths.length).toBe(2);
   });
 
+  test('with absolute glob pattern', async () => {
+    await fs.mkdirp('/tmp');
+    await fs.mkdirp('/tmp/maestro_xctestrunner_xcodebuild_output123');
+    await fs.mkdirp('/tmp/maestro_xctestrunner_xcodebuild_output456');
+    const loggerMock = {
+      info: jest.fn(),
+      error: jest.fn(),
+    };
+    const paths = await findArtifacts({
+      rootDir: '/Users/expo/build',
+      patternOrPath: '/tmp/maestro_xctestrunner_xcodebuild_output*',
+      logger: loggerMock as any,
+    });
+    expect(loggerMock.error).toHaveBeenCalledTimes(0);
+    expect(paths).toEqual([
+      '/tmp/maestro_xctestrunner_xcodebuild_output123',
+      '/tmp/maestro_xctestrunner_xcodebuild_output456',
+    ]);
+  });
+
   test('with missing file in empty directory', async () => {
     await fs.mkdirp('/dir1/dir2/dir3');
     let errMsg = '';

packages/build-tools/src/utils/__tests__/expoUpdatesEmbedded.test.ts

@@ -0,0 +1,273 @@
+import { Platform } from '@expo/eas-build-job';
+
+import { BuildContext } from '../../context';
+import * as expoUpdates from '../expoUpdates';
+import { uploadEmbeddedBundleAsync } from '../expoUpdatesEmbedded';
+import * as easCli from '../easCli';
+import * as artifacts from '../artifacts';
+
+jest.mock('../expoUpdates');
+jest.mock('../easCli');
+jest.mock('../artifacts');
+
+const mockZipEntries = jest.fn();
+const mockZipExtract = jest.fn();
+const mockZipClose = jest.fn();
+
+jest.mock('node-stream-zip', () => ({
+  __esModule: true,
+  default: {
+    async: jest.fn(() => ({
+      entries: mockZipEntries,
+      extract: mockZipExtract,
+      close: mockZipClose,
+    })),
+  },
+}));
+
+function zipEntryMap(entries: Record<string, true>): Record<string, { name: string }> {
+  return Object.fromEntries(Object.keys(entries).map(name => [name, { name }]));
+}
+
+function makeCtx(overrides: {
+  platform: Platform;
+  simulator?: boolean;
+  channel?: string;
+  env?: Record<string, string>;
+}): BuildContext<any> {
+  const job =
+    overrides.platform === Platform.IOS
+      ? {
+          platform: Platform.IOS,
+          simulator: overrides.simulator ?? false,
+          updates: overrides.channel ? { channel: overrides.channel } : undefined,
+        }
+      : {
+          platform: Platform.ANDROID,
+          updates: overrides.channel ? { channel: overrides.channel } : undefined,
+        };
+
+  return {
+    job,
+    env: overrides.env ?? {},
+    appConfig: Promise.resolve({
+      updates: { url: 'https://u.expo.dev/project-id' },
+    }),
+    logger: {
+      info: jest.fn(),
+      warn: jest.fn(),
+    },
+    markBuildPhaseSkipped: jest.fn(),
+    markBuildPhaseHasWarnings: jest.fn(),
+    getReactNativeProjectDirectory: () => '/project',
+  } as any;
+}
+
+describe('uploadEmbeddedBundleAsync', () => {
+  beforeEach(() => {
+    jest.mocked(expoUpdates.isEASUpdateConfigured).mockResolvedValue(true);
+    jest.mocked(easCli.runEasCliCommand).mockResolvedValue({} as any);
+    jest.mocked(artifacts.findArtifacts).mockResolvedValue([]);
+    mockZipEntries.mockResolvedValue({});
+    mockZipExtract.mockResolvedValue(undefined);
+    mockZipClose.mockResolvedValue(undefined);
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+    jest.restoreAllMocks();
+  });
+
+  it('skips when EAS Update is not configured', async () => {
+    jest.mocked(expoUpdates.isEASUpdateConfigured).mockResolvedValue(false);
+    const ctx = makeCtx({ platform: Platform.ANDROID, channel: 'production' });
+
+    await uploadEmbeddedBundleAsync(ctx);
+
+    expect(ctx.markBuildPhaseSkipped).toHaveBeenCalled();
+    expect(artifacts.findArtifacts).not.toHaveBeenCalled();
+  });
+
+  it('warns when no channel is configured and does not look for the archive', async () => {
+    const ctx = makeCtx({ platform: Platform.ANDROID });
+
+    await uploadEmbeddedBundleAsync(ctx);
+
+    expect(ctx.logger.warn).toHaveBeenCalledWith(
+      'Skipping embedded bundle upload: no channel configured for this build profile.'
+    );
+    expect(ctx.markBuildPhaseHasWarnings).toHaveBeenCalled();
+    expect(artifacts.findArtifacts).not.toHaveBeenCalled();
+  });
+
+  it('throws for an unsupported platform', async () => {
+    const ctx = makeCtx({ platform: Platform.ANDROID, channel: 'production' });
+    (ctx.job as { platform: string }).platform = 'web';
+
+    await expect(uploadEmbeddedBundleAsync(ctx)).rejects.toThrow(
+      'Uploading embedded updates is not supported for the web platform.'
+    );
+    expect(artifacts.findArtifacts).not.toHaveBeenCalled();
+  });
+
+  it('uploads from Android APK archives', async () => {
+    jest.mocked(artifacts.findArtifacts).mockResolvedValue(['/tmp/app-release.apk']);
+    mockZipEntries.mockResolvedValue(
+      zipEntryMap({
+        'assets/index.android.bundle': true,
+        'assets/app.manifest': true,
+      })
+    );
+    const ctx = makeCtx({
+      platform: Platform.ANDROID,
+      channel: 'production',
+      env: { EAS_BUILD_ID: 'build-123' },
+    });
+
+    await uploadEmbeddedBundleAsync(ctx);
+
+    expect(mockZipExtract).toHaveBeenCalledWith(
+      'assets/index.android.bundle',
+      expect.stringContaining('index.android.bundle')
+    );
+    expect(easCli.runEasCliCommand).toHaveBeenCalledWith(
+      expect.objectContaining({
+        args: expect.arrayContaining([
+          'update:embedded:upload',
+          '--platform',
+          Platform.ANDROID,
+          '--channel',
+          'production',
+          '--build-id',
+          'build-123',
+        ]),
+      })
+    );
+  });
+
+  it('uploads from Android AAB archives', async () => {
+    jest.mocked(artifacts.findArtifacts).mockResolvedValue(['/tmp/app-release.aab']);
+    mockZipEntries.mockResolvedValue(
+      zipEntryMap({
+        'base/assets/index.android.bundle': true,
+        'base/assets/app.manifest': true,
+      })
+    );
+    const ctx = makeCtx({ platform: Platform.ANDROID, channel: 'production' });
+
+    await uploadEmbeddedBundleAsync(ctx);
+
+    expect(mockZipExtract).toHaveBeenCalledWith(
+      'base/assets/index.android.bundle',
+      expect.stringContaining('index.android.bundle')
+    );
+    expect(easCli.runEasCliCommand).toHaveBeenCalled();
+  });
+
+  it('uploads from iOS IPA archives', async () => {
+    jest.mocked(artifacts.findArtifacts).mockResolvedValue(['/tmp/App.ipa']);
+    mockZipEntries.mockResolvedValue(
+      zipEntryMap({
+        'Payload/App.app/main.jsbundle': true,
+        'Payload/App.app/EXUpdates.bundle/app.manifest': true,
+      })
+    );
+    const ctx = makeCtx({ platform: Platform.IOS, channel: 'production' });
+
+    await uploadEmbeddedBundleAsync(ctx);
+
+    expect(easCli.runEasCliCommand).toHaveBeenCalledWith(
+      expect.objectContaining({
+        args: expect.arrayContaining(['--platform', Platform.IOS]),
+      })
+    );
+  });
+
+  it('skips simulator builds', async () => {
+    const ctx = makeCtx({ platform: Platform.IOS, simulator: true, channel: 'preview' });
+
+    await uploadEmbeddedBundleAsync(ctx);
+
+    expect(ctx.markBuildPhaseSkipped).toHaveBeenCalled();
+    expect(artifacts.findArtifacts).not.toHaveBeenCalled();
+  });
+
+  it('warns when bundle or manifest is missing from the archive', async () => {
+    jest.mocked(artifacts.findArtifacts).mockResolvedValue(['/tmp/app-release.apk']);
+    mockZipEntries.mockResolvedValue(
+      zipEntryMap({
+        'assets/app.manifest': true,
+      })
+    );
+    const ctx = makeCtx({ platform: Platform.ANDROID, channel: 'production' });
+
+    await uploadEmbeddedBundleAsync(ctx);
+
+    expect(ctx.logger.warn).toHaveBeenCalledWith(
+      'Skipping embedded bundle upload: bundle or manifest not found in archive.'
+    );
+    expect(easCli.runEasCliCommand).not.toHaveBeenCalled();
+  });
+
+  it('warns when build archive is not found', async () => {
+    jest.mocked(artifacts.findArtifacts).mockResolvedValue([]);
+    const ctx = makeCtx({ platform: Platform.ANDROID, channel: 'production' });
+
+    await uploadEmbeddedBundleAsync(ctx);
+
+    expect(ctx.logger.warn).toHaveBeenCalledWith(
+      'Skipping embedded bundle upload: build archive not found.'
+    );
+    expect(ctx.markBuildPhaseHasWarnings).toHaveBeenCalled();
+    expect(easCli.runEasCliCommand).not.toHaveBeenCalled();
+  });
+
+  it('treats findArtifacts errors as no archive found', async () => {
+    jest.mocked(artifacts.findArtifacts).mockRejectedValue(new Error('glob failed'));
+    const ctx = makeCtx({ platform: Platform.ANDROID, channel: 'production' });
+
+    await uploadEmbeddedBundleAsync(ctx);
+
+    expect(ctx.logger.warn).toHaveBeenCalledWith(
+      'Skipping embedded bundle upload: build archive not found.'
+    );
+    expect(ctx.markBuildPhaseHasWarnings).toHaveBeenCalled();
+    expect(easCli.runEasCliCommand).not.toHaveBeenCalled();
+  });
+
+  it('warns and continues when CLI upload throws', async () => {
+    jest.mocked(artifacts.findArtifacts).mockResolvedValue(['/tmp/app-release.apk']);
+    mockZipEntries.mockResolvedValue(
+      zipEntryMap({
+        'assets/index.android.bundle': true,
+        'assets/app.manifest': true,
+      })
+    );
+    jest.mocked(easCli.runEasCliCommand).mockRejectedValue(new Error('upload failed'));
+    const ctx = makeCtx({ platform: Platform.ANDROID, channel: 'production' });
+
+    await uploadEmbeddedBundleAsync(ctx);
+
+    expect(ctx.logger.warn).toHaveBeenCalledWith(
+      expect.objectContaining({ err: expect.any(Error) }),
+      'Failed to upload embedded bundle.'
+    );
+    expect(ctx.markBuildPhaseHasWarnings).toHaveBeenCalled();
+  });
+
+  it('swallows zip.close() failures so they do not mask the upload result', async () => {
+    jest.mocked(artifacts.findArtifacts).mockResolvedValue(['/tmp/app-release.apk']);
+    mockZipEntries.mockResolvedValue(
+      zipEntryMap({
+        'assets/index.android.bundle': true,
+        'assets/app.manifest': true,
+      })
+    );
+    mockZipClose.mockRejectedValue(new Error('close failed'));
+    const ctx = makeCtx({ platform: Platform.ANDROID, channel: 'production' });
+
+    await expect(uploadEmbeddedBundleAsync(ctx)).resolves.toBeUndefined();
+    expect(easCli.runEasCliCommand).toHaveBeenCalled();
+    expect(mockZipClose).toHaveBeenCalled();
+  });
+});

packages/build-tools/src/utils/artifacts.ts

@@ -19,11 +19,12 @@ export async function findArtifacts({
   /** If provided, will log error suggesting possible files to upload. */
   logger: bunyan | null;
 }): Promise<string[]> {
-  const files = path.isAbsolute(patternOrPath)
-    ? (await fs.pathExists(patternOrPath))
-      ? [patternOrPath]
-      : []
-    : await fg(patternOrPath, { cwd: rootDir, onlyFiles: false });
+  const files =
+    path.isAbsolute(patternOrPath) && !fg.isDynamicPattern(patternOrPath)
+      ? (await fs.pathExists(patternOrPath))
+        ? [patternOrPath]
+        : []
+      : await fg(patternOrPath, { cwd: rootDir, onlyFiles: false });
   if (files.length === 0) {
     if (fg.isDynamicPattern(patternOrPath)) {
       throw new FindArtifactsError(`There are no files matching pattern "${patternOrPath}"`);

packages/build-tools/src/utils/expoUpdatesEmbedded.ts

@@ -0,0 +1,118 @@
+import { Android, BuildJob, Ios, Platform } from '@expo/eas-build-job';
+import { PipeMode } from '@expo/logger';
+import { asyncResult } from '@expo/results';
+import fs from 'fs-extra';
+import os from 'os';
+import path from 'path';
+import StreamZip from 'node-stream-zip';
+
+import { findArtifacts } from './artifacts';
+import { runEasCliCommand } from './easCli';
+import { resolveArtifactPath } from '../ios/resolve';
+import { BuildContext } from '../context';
+import { isEASUpdateConfigured } from './expoUpdates';
+
+export async function uploadEmbeddedBundleAsync(ctx: BuildContext<BuildJob>): Promise<void> {
+  if (!(await isEASUpdateConfigured(ctx))) {
+    ctx.markBuildPhaseSkipped();
+    return;
+  }
+
+  const { platform } = ctx.job;
+  if (platform === Platform.IOS && (ctx.job as Ios.Job).simulator) {
+    ctx.markBuildPhaseSkipped();
+    return;
+  }
+
+  const channel = ctx.job.updates?.channel;
+  if (!channel) {
+    ctx.logger.warn(
+      'Skipping embedded bundle upload: no channel configured for this build profile.'
+    );
+    ctx.markBuildPhaseHasWarnings();
+    return;
+  }
+
+  const projectDir = ctx.getReactNativeProjectDirectory();
+
+  let archivePattern: string;
+  if (platform === Platform.IOS) {
+    archivePattern = resolveArtifactPath(ctx as BuildContext<Ios.Job>);
+  } else if (platform === Platform.ANDROID) {
+    archivePattern =
+      (ctx as BuildContext<Android.Job>).job.applicationArchivePath ??
+      'android/app/build/outputs/**/*.{apk,aab}';
+  } else {
+    throw new Error(`Uploading embedded updates is not supported for the ${platform} platform.`);
+  }
+
+  const [archivePath] = await findArtifacts({
+    rootDir: projectDir,
+    patternOrPath: archivePattern,
+    logger: null,
+  }).catch(() => [] as string[]);
+
+  if (!archivePath) {
+    ctx.logger.warn('Skipping embedded bundle upload: build archive not found.');
+    ctx.markBuildPhaseHasWarnings();
+    return;
+  }
+
+  const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'eas-embedded-bundle-'));
+  const bundleName = platform === Platform.IOS ? 'main.jsbundle' : 'index.android.bundle';
+  const bundlePath = path.join(tmpDir, bundleName);
+  const manifestPath = path.join(tmpDir, 'app.manifest');
+  const zip = new StreamZip.async({ file: archivePath });
+  try {
+    const entries = Object.values(await zip.entries());
+    const bundleEntry = entries.find(e =>
+      platform === Platform.IOS
+        ? e.name.endsWith('/main.jsbundle')
+        : e.name.endsWith('assets/index.android.bundle')
+    );
+    const manifestEntry = entries.find(e =>
+      platform === Platform.IOS
+        ? e.name.includes('EXUpdates.bundle/app.manifest')
+        : e.name.endsWith('assets/app.manifest')
+    );
+
+    if (!bundleEntry || !manifestEntry) {
+      ctx.logger.warn('Skipping embedded bundle upload: bundle or manifest not found in archive.');
+      ctx.markBuildPhaseHasWarnings();
+      return;
+    }
+
+    await zip.extract(bundleEntry.name, bundlePath);
+    await zip.extract(manifestEntry.name, manifestPath);
+
+    const args = [
+      'update:embedded:upload',
+      '--platform',
+      platform,
+      '--bundle',
+      bundlePath,
+      '--manifest',
+      manifestPath,
+      '--channel',
+      channel,
+      '--non-interactive',
+    ];
+    if (ctx.env.EAS_BUILD_ID) {
+      args.push('--build-id', ctx.env.EAS_BUILD_ID);
+    }
+    await runEasCliCommand({
+      args,
+      options: {
+        cwd: projectDir,
+        env: ctx.env,
+        logger: ctx.logger,
+        mode: PipeMode.STDERR_ONLY_AS_STDOUT,
+      },
+    });
+  } catch (err: any) {
+    ctx.logger.warn({ err }, 'Failed to upload embedded bundle.');
+    ctx.markBuildPhaseHasWarnings();
+  } finally {
+    await asyncResult(zip.close());
+  }
+}

packages/create-eas-build-function/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-eas-build-function",
-  "version": "18.8.0",
+  "version": "20.0.0",
   "description": "Create functions for use in EAS Build custom builds.",
   "keywords": [
     "expo",
@@ -35,7 +35,7 @@
     "clean": "rimraf ./build/ \"*.tsbuildinfo\""
   },
   "dependencies": {
-    "@expo/steps": "18.8.0"
+    "@expo/steps": "20.0.0"
   },
   "devDependencies": {
     "@expo/package-manager": "1.9.10",

packages/downloader/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/downloader",
-  "version": "18.5.0",
+  "version": "20.0.0",
   "bugs": "https://github.com/expo/eas-cli/issues",
   "license": "BUSL-1.1",
   "author": "Expo <[email protected]>",

packages/eas-build-cache-provider/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eas-build-cache-provider",
-  "version": "18.5.0",
+  "version": "20.0.0",
   "description": "A build cache provider plugin for the Expo CLI",
   "homepage": "https://github.com/expo/eas-cli",
   "bugs": "https://github.com/expo/eas-cli/issues",

packages/eas-build-job/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/eas-build-job",
-  "version": "18.8.0",
+  "version": "20.0.0",
   "bugs": "https://github.com/expo/eas-cli/issues",
   "license": "MIT",
   "author": "Expo <[email protected]>",
@@ -25,7 +25,9 @@
     "clean": "rimraf node_modules dist coverage \"*.tsbuildinfo\""
   },
   "dependencies": {
-    "@expo/logger": "18.5.0",
+    "@expo/logger": "20.0.0",
+    "@expo/results": "1.0.0",
+    "@expo/turtle-spawn": "20.0.0",
     "joi": "^17.13.1",
     "semver": "^7.6.2",
     "zod": "^4.3.5"

packages/eas-build-job/src/__tests__/android.test.ts

@@ -266,6 +266,9 @@ describe('Android.JobSchema', () => {
       customBuildConfig: {
         path: 'production.android.yml',
       },
+      outputs: {
+        android_build_type: 'apk',
+      },
       initiatingUserId: randomUUID(),
       appId: randomUUID(),
     };
@@ -340,6 +343,28 @@ describe('Android.JobSchema', () => {
     expect(error).toBeFalsy();
   });
 
+  test('preserves outputs for build jobs', () => {
+    const job = {
+      mode: BuildMode.BUILD,
+      type: Workflow.GENERIC,
+      platform: Platform.ANDROID,
+      projectArchive: {
+        type: ArchiveSourceType.URL,
+        url: 'https://expo.dev/builds/123',
+      },
+      projectRootDirectory: '.',
+      outputs: {
+        android_build_type: 'apk',
+      },
+      secrets,
+      initiatingUserId: randomUUID(),
+      appId: randomUUID(),
+    };
+    const { value, error } = Android.JobSchema.validate(job, joiOptions);
+    expect(value).toMatchObject(job);
+    expect(error).toBeFalsy();
+  });
+
   test('can set hooks with arbitrary names', () => {
     const job = {
       mode: BuildMode.BUILD,

packages/eas-build-job/src/__tests__/ios.test.ts

@@ -77,6 +77,9 @@ describe('Ios.JobSchema', () => {
       },
       initiatingUserId: randomUUID(),
       appId: randomUUID(),
+      outputs: {
+        resign_job: 'true',
+      },
     };
 
     const { value, error } = Ios.JobSchema.validate(genericJob, joiOptions);
@@ -180,6 +183,9 @@ describe('Ios.JobSchema', () => {
       customBuildConfig: {
         path: 'production.ios.yml',
       },
+      outputs: {
+        ios_build_type: 'simulator',
+      },
       initiatingUserId: randomUUID(),
       appId: randomUUID(),
     };
@@ -254,6 +260,30 @@ describe('Ios.JobSchema', () => {
     expect(error).toBeFalsy();
   });
 
+  test('preserves outputs for build jobs', () => {
+    const job = {
+      mode: BuildMode.BUILD,
+      type: Workflow.UNKNOWN,
+      platform: Platform.IOS,
+      projectArchive: {
+        type: ArchiveSourceType.URL,
+        url: 'https://expo.dev/builds/123',
+      },
+      projectRootDirectory: '.',
+      outputs: {
+        ios_build_type: 'simulator',
+      },
+      secrets: {
+        buildCredentials,
+      },
+      initiatingUserId: randomUUID(),
+      appId: randomUUID(),
+    };
+    const { value, error } = Ios.JobSchema.validate(job, joiOptions);
+    expect(value).toMatchObject(job);
+    expect(error).toBeFalsy();
+  });
+
   test('invalid generic job', () => {
     const genericJob = {
       secrets: {
@@ -504,4 +534,47 @@ describe('Ios.JobSchema', () => {
     expect(value).toMatchObject(job);
     expect(error).toBeFalsy();
   });
+
+  test('accepts optional refreshAdHocProvisioningProfile', () => {
+    const job = {
+      secrets: {
+        buildCredentials,
+      },
+      type: Workflow.GENERIC,
+      platform: Platform.IOS,
+      projectArchive: {
+        type: ArchiveSourceType.URL,
+        url: 'http://localhost:3000',
+      },
+      projectRootDirectory: '.',
+      initiatingUserId: randomUUID(),
+      appId: randomUUID(),
+      refreshAdHocProvisioningProfile: true,
+    };
+
+    const { value, error } = Ios.JobSchema.validate(job, joiOptions);
+    expect(value.refreshAdHocProvisioningProfile).toBe(true);
+    expect(error).toBeFalsy();
+  });
+
+  test('does not require refreshAdHocProvisioningProfile', () => {
+    const job = {
+      secrets: {
+        buildCredentials,
+      },
+      type: Workflow.GENERIC,
+      platform: Platform.IOS,
+      projectArchive: {
+        type: ArchiveSourceType.URL,
+        url: 'http://localhost:3000',
+      },
+      projectRootDirectory: '.',
+      initiatingUserId: randomUUID(),
+      appId: randomUUID(),
+    };
+
+    const { value, error } = Ios.JobSchema.validate(job, joiOptions);
+    expect(value.refreshAdHocProvisioningProfile).toBeUndefined();
+    expect(error).toBeFalsy();
+  });
 });

packages/eas-build-job/src/__tests__/projectPackage.test.ts

@@ -0,0 +1,77 @@
+import fs from 'fs/promises';
+import os from 'os';
+import path from 'path';
+
+import { errors } from '..';
+import { getInstalledExpoPackageVersionAsync } from '../projectPackage';
+
+describe(getInstalledExpoPackageVersionAsync, () => {
+  it('returns the installed expo package version resolved by project node', async () => {
+    const projectDir = await fs.mkdtemp(path.join(os.tmpdir(), 'eas-build-job-package-test-'));
+    try {
+      await fs.mkdir(path.join(projectDir, 'node_modules/expo'), { recursive: true });
+      await fs.writeFile(
+        path.join(projectDir, 'node_modules/expo/package.json'),
+        JSON.stringify({ version: '55.0.17' })
+      );
+
+      await expect(getInstalledExpoPackageVersionAsync({ projectDir })).resolves.toBe('55.0.17');
+    } finally {
+      await fs.rm(projectDir, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects when expo cannot be resolved from the project', async () => {
+    const projectDir = await fs.mkdtemp(path.join(os.tmpdir(), 'eas-build-job-package-test-'));
+    try {
+      await expect(getInstalledExpoPackageVersionAsync({ projectDir })).rejects.toMatchObject({
+        errorCode: 'EAS_BUILD_EXPO_PACKAGE_VERSION_NOT_FOUND',
+      });
+      await expect(getInstalledExpoPackageVersionAsync({ projectDir })).rejects.toBeInstanceOf(
+        errors.UserError
+      );
+    } finally {
+      await fs.rm(projectDir, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects when expo package.json cannot be read', async () => {
+    const projectDir = await fs.mkdtemp(path.join(os.tmpdir(), 'eas-build-job-package-test-'));
+    try {
+      await fs.mkdir(path.join(projectDir, 'node_modules/expo'), { recursive: true });
+      await fs.writeFile(
+        path.join(projectDir, 'node_modules/expo/package.json'),
+        JSON.stringify({ version: '55.0.17' })
+      );
+      jest.spyOn(fs, 'readFile').mockRejectedValueOnce(new Error('read failed'));
+
+      const promise = getInstalledExpoPackageVersionAsync({ projectDir });
+      await expect(promise).rejects.toMatchObject({
+        errorCode: 'EAS_BUILD_EXPO_PACKAGE_VERSION_READ_FAILED',
+      });
+      await expect(promise).rejects.toBeInstanceOf(errors.UserError);
+    } finally {
+      await fs.rm(projectDir, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects when the installed expo package version is not valid semver', async () => {
+    const projectDir = await fs.mkdtemp(path.join(os.tmpdir(), 'eas-build-job-package-test-'));
+    try {
+      await fs.mkdir(path.join(projectDir, 'node_modules/expo'), { recursive: true });
+      await fs.writeFile(
+        path.join(projectDir, 'node_modules/expo/package.json'),
+        JSON.stringify({ version: 'invalid-version' })
+      );
+
+      await expect(getInstalledExpoPackageVersionAsync({ projectDir })).rejects.toMatchObject({
+        errorCode: 'EAS_BUILD_EXPO_PACKAGE_VERSION_INVALID',
+      });
+      await expect(getInstalledExpoPackageVersionAsync({ projectDir })).rejects.toBeInstanceOf(
+        errors.UserError
+      );
+    } finally {
+      await fs.rm(projectDir, { recursive: true, force: true });
+    }
+  });
+});

packages/eas-build-job/src/android.ts

@@ -15,6 +15,8 @@ import {
   EnvironmentSecretsSchema,
   Hooks,
   HooksSchema,
+  JobOutputs,
+  JobOutputsSchema,
   Platform,
   StaticWorkflowInterpolationContext,
   StaticWorkflowInterpolationContextZ,
@@ -110,7 +112,7 @@ export interface Job {
   };
   hooks?: Hooks;
   steps?: Step[];
-  outputs?: Record<string, string>;
+  outputs?: JobOutputs;
 
   experimental?: {
     prebuildCommand?: string;
@@ -176,6 +178,7 @@ export const JobSchema = Joi.object({
   buildType: Joi.string().valid(...Object.values(BuildType)),
   username: Joi.string(),
   hooks: HooksSchema,
+  outputs: JobOutputsSchema,
 
   experimental: Joi.object({
     prebuildCommand: Joi.string(),

packages/eas-build-job/src/common.ts

@@ -181,12 +181,6 @@ export const CacheSchema = Joi.object({
   paths: Joi.array().items(Joi.string()).default([]),
 });
 
-export interface BuildPhaseStats {
-  buildPhase: BuildPhase;
-  result: BuildPhaseResult;
-  durationMs: number;
-}
-
 const GitHubContextZ = z.object({
   triggering_actor: z.string().optional(),
   event_name: z.enum(['push', 'pull_request', 'workflow_dispatch', 'schedule']),
@@ -352,6 +346,10 @@ export type DynamicInterpolationContext = {
 export type WorkflowInterpolationContext = StaticWorkflowInterpolationContext &
   DynamicInterpolationContext;
 
+export type JobOutputs = Record<string, string>;
+export const JobOutputsSchema = Joi.object<JobOutputs>().pattern(Joi.string(), Joi.string());
+export const JobOutputsSchemaZ = z.record(z.string(), z.string());
+
 export const CustomBuildConfigSchema = Joi.object().when('.mode', {
   is: [BuildMode.CUSTOM, BuildMode.REPACK],
   then: Joi.object().when('.customBuildConfig.path', {
@@ -361,7 +359,6 @@ export const CustomBuildConfigSchema = Joi.object().when('.mode', {
         path: Joi.string().required(),
       }).required(),
       steps: Joi.any().strip(),
-      outputs: Joi.any().strip(),
     }),
     otherwise: Joi.object({
       customBuildConfig: Joi.any().strip(),
@@ -369,13 +366,11 @@ export const CustomBuildConfigSchema = Joi.object().when('.mode', {
         .items(Joi.any())
         .required()
         .custom(steps => validateSteps(steps), 'steps validation'),
-      outputs: Joi.object().pattern(Joi.string(), Joi.string()).required(),
     }),
   }),
   otherwise: Joi.object({
     customBuildConfig: Joi.any().strip(),
     steps: Joi.any().strip(),
-    outputs: Joi.any().strip(),
   }),
 });
 

packages/eas-build-job/src/generic.ts

@@ -6,6 +6,7 @@ import {
   BuildTrigger,
   EnvironmentSecretZ,
   HooksZ,
+  JobOutputsSchemaZ,
   StaticWorkflowInterpolationContextZ,
 } from './common';
 import { StepZ } from './step';
@@ -48,7 +49,7 @@ export namespace Generic {
 
     hooks: HooksZ.optional(),
     steps: z.array(StepZ).min(1),
-    outputs: z.record(z.string(), z.string()).optional(),
+    outputs: JobOutputsSchemaZ.optional(),
   });
 
   export type PartialJob = z.infer<typeof PartialJobZ>;

packages/eas-build-job/src/index.ts

@@ -5,7 +5,6 @@ export {
   ArchiveSource,
   ArchiveSourceSchemaZ,
   BuildMode,
-  BuildPhaseStats,
   BuildTrigger,
   EasCliNpmTags,
   Env,
@@ -27,6 +26,7 @@ export * from './context';
 export * from './generic';
 export * from './step';
 export * from './submission-config';
+export * from './projectPackage';
 
 const version = require('../package.json').version;
 export { version };

packages/eas-build-job/src/ios.ts

@@ -15,6 +15,8 @@ import {
   EnvironmentSecretsSchema,
   Hooks,
   HooksSchema,
+  JobOutputs,
+  JobOutputsSchema,
   Platform,
   StaticWorkflowInterpolationContext,
   StaticWorkflowInterpolationContextZ,
@@ -124,7 +126,7 @@ export interface Job {
   };
   hooks?: Hooks;
   steps?: Step[];
-  outputs?: Record<string, string>;
+  outputs?: JobOutputs;
 
   experimental?: {
     prebuildCommand?: string;
@@ -142,6 +144,8 @@ export interface Job {
   appId: string;
 
   environment?: string;
+
+  refreshAdHocProvisioningProfile?: boolean;
 }
 
 const SecretsSchema = Joi.object({
@@ -210,6 +214,7 @@ export const JobSchema = Joi.object({
 
   username: Joi.string(),
   hooks: HooksSchema,
+  outputs: JobOutputsSchema,
 
   experimental: Joi.object({
     prebuildCommand: Joi.string(),
@@ -226,6 +231,8 @@ export const JobSchema = Joi.object({
 
   environment: Joi.string(),
 
+  refreshAdHocProvisioningProfile: Joi.boolean(),
+
   workflowInterpolationContext: Joi.object().custom(workflowInterpolationContext =>
     StaticWorkflowInterpolationContextZ.optional().parse(workflowInterpolationContext)
   ),

packages/eas-build-job/src/logs.ts

@@ -27,6 +27,7 @@ export enum BuildPhase {
    */
   UPLOAD_ARTIFACTS = 'UPLOAD_ARTIFACTS',
   UPLOAD_APPLICATION_ARCHIVE = 'UPLOAD_APPLICATION_ARCHIVE',
+  UPLOAD_EMBEDDED_BUNDLE = 'UPLOAD_EMBEDDED_BUNDLE',
   UPLOAD_BUILD_ARTIFACTS = 'UPLOAD_BUILD_ARTIFACTS',
   PREPARE_ARTIFACTS = 'PREPARE_ARTIFACTS',
   CLEAN_UP_CREDENTIALS = 'CLEAN_UP_CREDENTIALS',
@@ -36,6 +37,7 @@ export enum BuildPhase {
   // ANDROID
   FIX_GRADLEW = 'FIX_GRADLEW',
   RUN_GRADLEW = 'RUN_GRADLEW',
+  GRADLE_BUILD_PROFILE = 'GRADLE_BUILD_PROFILE',
 
   // IOS
   INSTALL_PODS = 'INSTALL_PODS',
@@ -90,6 +92,7 @@ export const buildPhaseDisplayName: Record<BuildPhase, string> = {
   [BuildPhase.CACHE_STATS]: 'Cache stats',
   [BuildPhase.UPLOAD_ARTIFACTS]: 'Upload artifacts',
   [BuildPhase.UPLOAD_APPLICATION_ARCHIVE]: 'Upload application archive',
+  [BuildPhase.UPLOAD_EMBEDDED_BUNDLE]: 'Upload embedded bundle',
   [BuildPhase.UPLOAD_BUILD_ARTIFACTS]: 'Upload build artifacts',
   [BuildPhase.PREPARE_ARTIFACTS]: 'Prepare artifacts',
   [BuildPhase.CLEAN_UP_CREDENTIALS]: 'Clean up credentials',
@@ -104,6 +107,7 @@ export const buildPhaseDisplayName: Record<BuildPhase, string> = {
   // ANDROID
   [BuildPhase.FIX_GRADLEW]: 'Fix gradlew',
   [BuildPhase.RUN_GRADLEW]: 'Run gradlew',
+  [BuildPhase.GRADLE_BUILD_PROFILE]: 'Gradle build profile',
 
   // IOS
   [BuildPhase.INSTALL_PODS]: 'Install pods',
@@ -155,6 +159,7 @@ export const buildPhaseWebsiteId: Record<BuildPhase, string> = {
   [BuildPhase.CACHE_STATS]: 'cache-stats',
   [BuildPhase.UPLOAD_ARTIFACTS]: 'upload-artifacts',
   [BuildPhase.UPLOAD_APPLICATION_ARCHIVE]: 'upload-application-archive',
+  [BuildPhase.UPLOAD_EMBEDDED_BUNDLE]: 'upload-embedded-bundle',
   [BuildPhase.UPLOAD_BUILD_ARTIFACTS]: 'upload-build-artifacts',
   [BuildPhase.PREPARE_ARTIFACTS]: 'prepare-artifacts',
   [BuildPhase.CLEAN_UP_CREDENTIALS]: 'clean-up-credentials',
@@ -169,6 +174,7 @@ export const buildPhaseWebsiteId: Record<BuildPhase, string> = {
   // ANDROID
   [BuildPhase.FIX_GRADLEW]: 'fix-gradlew',
   [BuildPhase.RUN_GRADLEW]: 'run-gradlew',
+  [BuildPhase.GRADLE_BUILD_PROFILE]: 'gradle-build-profile',
 
   // IOS
   [BuildPhase.INSTALL_PODS]: 'install-pods',

packages/eas-build-job/src/metadata.ts

@@ -49,6 +49,11 @@ export type Metadata = {
    */
   sdkVersion?: string;
 
+  /**
+   * Version of the expo package used in the project.
+   */
+  expoPackageVersion?: string;
+
   /**
    * Runtime version (for Expo Updates)
    */
@@ -180,6 +185,7 @@ export const MetadataSchema = Joi.object({
   distribution: Joi.string().valid('store', 'internal', 'simulator'),
   credentialsSource: Joi.string().valid('local', 'remote'),
   sdkVersion: Joi.string(),
+  expoPackageVersion: Joi.string(),
   runtimeVersion: Joi.string(),
   fingerprintHash: Joi.string(),
   reactNativeVersion: Joi.string(),

packages/eas-build-job/src/projectPackage.ts

@@ -0,0 +1,54 @@
+import spawn from '@expo/turtle-spawn';
+import { asyncResult } from '@expo/results';
+import fs from 'fs/promises';
+import semver from 'semver';
+
+import { type Env } from './common';
+import * as errors from './errors';
+
+export async function getInstalledExpoPackageVersionAsync({
+  env = process.env,
+  projectDir,
+}: {
+  env?: Env | NodeJS.ProcessEnv;
+  projectDir: string;
+}): Promise<string> {
+  const expoPackageJsonPathResult = await asyncResult(
+    spawn('node', ['--print', "require.resolve('expo/package.json')"], {
+      cwd: projectDir,
+      env,
+      stdio: 'pipe',
+    })
+  );
+  if (!expoPackageJsonPathResult.ok) {
+    throw new errors.UserError(
+      'EAS_BUILD_EXPO_PACKAGE_VERSION_NOT_FOUND',
+      'Cannot resolve the installed expo package version because require.resolve("expo/package.json") failed.',
+      { cause: expoPackageJsonPathResult.reason }
+    );
+  }
+
+  const expoPackageJsonPath = expoPackageJsonPathResult.value.stdout.toString().trim();
+  const expoPackageJsonResult = await asyncResult(readJsonAsync(expoPackageJsonPath));
+  if (!expoPackageJsonResult.ok) {
+    throw new errors.UserError(
+      'EAS_BUILD_EXPO_PACKAGE_VERSION_READ_FAILED',
+      'Cannot resolve the installed expo package version because expo/package.json could not be read.',
+      { cause: expoPackageJsonResult.reason }
+    );
+  }
+
+  const expoPackageVersion = expoPackageJsonResult.value.version;
+  if (typeof expoPackageVersion !== 'string' || !semver.valid(expoPackageVersion)) {
+    throw new errors.UserError(
+      'EAS_BUILD_EXPO_PACKAGE_VERSION_INVALID',
+      'Cannot resolve the installed expo package version because expo/package.json has an invalid version.'
+    );
+  }
+
+  return expoPackageVersion;
+}
+
+async function readJsonAsync(filePath: string): Promise<any> {
+  return JSON.parse(await fs.readFile(filePath, 'utf8'));
+}

packages/eas-cli/CLAUDE.md

@@ -50,7 +50,7 @@ yarn generate-graphql-code    # Generate TypeScript types from GraphQL schema
 yarn verify-graphql-code      # Verify GraphQL code is up to date (CI check)
 ```
 
-The GraphQL schema is fetched from `https://staging-api.expo.dev/graphql` and generates:
+The GraphQL schema is fetched from the API URL resolved by `src/api.ts` and generates:
 
 - `src/graphql/generated.ts` - 499KB+ of TypeScript types
 - Types for all queries, mutations, and fragments

packages/eas-cli/graphql-codegen.ts

@@ -0,0 +1,28 @@
+import type { CodegenConfig } from '@graphql-codegen/cli';
+
+import { getExpoApiBaseUrl } from './src/api';
+
+const schema =
+  process.env.GRAPHQL_SCHEMA_URL ?? new URL('/graphql', getExpoApiBaseUrl()).toString();
+
+const config: CodegenConfig = {
+  overwrite: true,
+  schema,
+  documents: ['src/**/!(*.d).ts'],
+  generates: {
+    'src/graphql/generated.ts': {
+      plugins: ['typescript', 'typescript-operations'],
+      config: {
+        dedupeOperationSuffix: true,
+      },
+      hooks: {
+        afterOneFileWrite: ['node ./scripts/annotate-graphql-codegen.js'],
+      },
+    },
+    './graphql.schema.json': {
+      plugins: ['introspection'],
+    },
+  },
+};
+
+export default config;

packages/eas-cli/graphql-codegen.yml

@@ -1,17 +0,0 @@
-overwrite: true
-schema: 'https://staging-api.expo.dev/graphql'
-documents:
-  - 'src/**/!(*.d).ts'
-generates:
-  src/graphql/generated.ts:
-    plugins:
-      - 'typescript'
-      - 'typescript-operations'
-    config:
-      dedupeOperationSuffix: true
-    hooks:
-      afterOneFileWrite:
-        - 'node ./scripts/annotate-graphql-codegen.js'
-  ./graphql.schema.json:
-    plugins:
-      - 'introspection'

packages/eas-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eas-cli",
-  "version": "18.8.0",
+  "version": "20.0.0",
   "description": "EAS command line tool",
   "keywords": [
     "cli",
@@ -37,7 +37,7 @@
     "typecheck-for-build": "tsc --project tsconfig.build.json",
     "test": "jest",
     "version": "yarn run -T oclif readme && node scripts/patch-readme && git add README.md",
-    "generate-graphql-code": "graphql-codegen --config graphql-codegen.yml",
+    "generate-graphql-code": "graphql-codegen --config graphql-codegen.ts",
     "verify-graphql-code": "./scripts/verify-graphql.sh",
     "clean": "rimraf dist build tmp node_modules yarn-error.log \"*.tsbuildinfo\"",
     "copy-new-templates": "rimraf build/commandUtils/new/templates && mkdir -p build/commandUtils/new && cp -r src/commandUtils/new/templates build/commandUtils/new"
@@ -47,11 +47,11 @@
     "@expo/code-signing-certificates": "0.0.5",
     "@expo/config": "55.0.10",
     "@expo/config-plugins": "55.0.7",
-    "@expo/eas-build-job": "18.8.0",
-    "@expo/eas-json": "18.8.0",
+    "@expo/eas-build-job": "20.0.0",
+    "@expo/eas-json": "20.0.0",
     "@expo/env": "^1.0.0",
     "@expo/json-file": "8.3.3",
-    "@expo/logger": "18.5.0",
+    "@expo/logger": "20.0.0",
     "@expo/multipart-body-parser": "2.0.0",
     "@expo/osascript": "2.1.4",
     "@expo/package-manager": "1.9.10",
@@ -63,7 +63,7 @@
     "@expo/results": "1.0.0",
     "@expo/rudder-sdk-node": "1.1.1",
     "@expo/spawn-async": "1.7.2",
-    "@expo/steps": "18.8.0",
+    "@expo/steps": "20.0.0",
     "@expo/timeago.js": "1.0.0",
     "@oclif/core": "^4.8.3",
     "@oclif/plugin-autocomplete": "^3.2.40",
@@ -78,6 +78,7 @@
     "chalk": "4.1.2",
     "cli-progress": "3.12.0",
     "dateformat": "4.6.3",
+    "debug": "4.4.3",
     "diff": "7.0.0",
     "dotenv": "16.3.1",
     "env-paths": "2.2.0",
@@ -138,6 +139,7 @@
     "@tsconfig/node20": "20.1.8",
     "@types/cli-progress": "3.11.5",
     "@types/dateformat": "3.0.1",
+    "@types/debug": "4.1.13",
     "@types/diff": "6.0.0",
     "@types/envinfo": "7.8.3",
     "@types/express": "4.17.15",
@@ -201,6 +203,9 @@
       "env": {
         "description": "manage project and account environment variables"
       },
+      "integrations": {
+        "description": "manage third-party service integrations"
+      },
       "metadata": {
         "description": "manage store configuration"
       },

packages/eas-cli/scripts/convex-e2e.ts

@@ -0,0 +1,346 @@
+import { spawn } from 'child_process';
+import fs from 'fs/promises';
+import os from 'os';
+import path from 'path';
+
+/*
+ * Manual Convex integration E2E runner.
+ *
+ * Run from packages/eas-cli with:
+ *   yarn ts-node scripts/convex-e2e.ts
+ *
+ * This uses the deployed EAS API and real authenticated EAS/Convex-backed
+ * resources. Cleanup removes EAS-side links when possible, but it does not
+ * destroy Convex-side resources.
+ *
+ * Options:
+ *   CONVEX_E2E_KEEP_PROJECT=1 keeps the temp Expo project and skips cleanup.
+ *   CONVEX_E2E_SKIP_DASHBOARD=1 skips opening the Convex dashboard.
+ *   CONVEX_E2E_ACCOUNT=<account-name> sets the Expo app owner before eas init.
+ */
+
+type RunOptions = {
+  cwd?: string;
+  allowFailure?: boolean;
+  env?: NodeJS.ProcessEnv;
+};
+
+type RunResult = {
+  stdout: string;
+  stderr: string;
+  exitCode: number | null;
+};
+
+const KEEP_PROJECT = process.env.CONVEX_E2E_KEEP_PROJECT === '1';
+const SKIP_DASHBOARD = process.env.CONVEX_E2E_SKIP_DASHBOARD === '1';
+const ACCOUNT = process.env.CONVEX_E2E_ACCOUNT;
+const SCRIPT_DIR = __dirname;
+const EAS_CLI_ROOT = path.resolve(SCRIPT_DIR, '..');
+const LOCAL_EAS_BIN = path.join(EAS_CLI_ROOT, 'bin', 'run');
+const TEMP_ROOT_PREFIX = path.join(os.tmpdir(), 'eas-cli-convex-e2e-');
+
+let tempRoot: string | null = null;
+let projectDir: string | null = null;
+let initializedProject = false;
+let initialConvexTeamSlugs: string[] = [];
+let createdConvexTeamSlug: string | null = null;
+
+async function mainAsync(): Promise<void> {
+  try {
+    await assertFileExistsAsync(
+      LOCAL_EAS_BIN,
+      `Local EAS CLI binary not found at ${LOCAL_EAS_BIN}`
+    );
+    await runEasAsync(['whoami']);
+
+    const testName = `convex-e2e-${Date.now().toString(36)}`;
+    tempRoot = await fs.mkdtemp(TEMP_ROOT_PREFIX);
+    projectDir = path.join(tempRoot, testName);
+
+    logStep(`Creating fresh Expo project ${testName}`);
+    await runAsync('npx', ['--yes', 'create-expo-app@latest', projectDir, '--template', 'blank'], {
+      cwd: tempRoot,
+      env: getNpxEnvironment(),
+    });
+
+    await updateAppJsonAsync(projectDir, testName);
+
+    logStep('Creating/linking EAS project');
+    await runEasAsync(['init', '--non-interactive', '--force'], projectDir);
+    initializedProject = true;
+
+    initialConvexTeamSlugs = parseConvexTeamSlugs(
+      (await runEasAsync(['integrations:convex:team'], projectDir)).stdout
+    );
+
+    logStep('Connecting Convex');
+    await runEasAsync(
+      ['integrations:convex:connect', '--non-interactive', '--project-name', testName],
+      projectDir
+    );
+
+    await assertEnvLocalAsync(projectDir);
+    await assertPackageJsonDependencyAsync(projectDir, 'convex');
+
+    const teamOutput = await runEasAsync(['integrations:convex:team'], projectDir);
+    const projectOutput = await runEasAsync(['integrations:convex:project'], projectDir);
+    assertIncludes(
+      projectOutput.stdout,
+      'Dashboard',
+      'Expected project output to include dashboard'
+    );
+
+    const teamSlugsAfterConnect = parseConvexTeamSlugs(teamOutput.stdout);
+    const newTeamSlugs = teamSlugsAfterConnect.filter(
+      slug => !initialConvexTeamSlugs.includes(slug)
+    );
+    createdConvexTeamSlug = newTeamSlugs[0] ?? null;
+    const convexTeamSlug = createdConvexTeamSlug ?? teamSlugsAfterConnect[0];
+
+    if (!convexTeamSlug) {
+      throw new Error('Could not determine a Convex team slug from team output.');
+    }
+
+    await runEasAsync(
+      ['integrations:convex:team:invite', convexTeamSlug, '--non-interactive'],
+      projectDir
+    );
+
+    if (SKIP_DASHBOARD) {
+      logStep('Skipping dashboard command because CONVEX_E2E_SKIP_DASHBOARD=1');
+    } else {
+      await runEasAsync(['integrations:convex:dashboard'], projectDir);
+    }
+
+    logStep('Convex E2E flow completed successfully');
+  } finally {
+    await cleanupAsync();
+  }
+}
+
+async function cleanupAsync(): Promise<void> {
+  if (!projectDir || !tempRoot) {
+    return;
+  }
+
+  if (KEEP_PROJECT) {
+    logStep('Skipping cleanup because CONVEX_E2E_KEEP_PROJECT=1');
+    log(`Temp project kept at: ${projectDir}`);
+    log('EAS-side links and Convex-side resources were left intact.');
+    return;
+  }
+
+  if (initializedProject) {
+    logStep('Cleaning up EAS-side Convex links');
+    const convexTeamSlugToDelete =
+      createdConvexTeamSlug ?? (await getCreatedConvexTeamSlugForCleanupAsync());
+
+    await runCleanupCommandAsync([
+      'integrations:convex:project:delete',
+      '--non-interactive',
+      '--yes',
+    ]);
+
+    if (convexTeamSlugToDelete) {
+      await runCleanupCommandAsync([
+        'integrations:convex:team:delete',
+        convexTeamSlugToDelete,
+        '--non-interactive',
+        '--yes',
+      ]);
+    } else {
+      warn(
+        'No newly-created Convex team link was detected. Skipping team link deletion to avoid removing a pre-existing EAS-side link.'
+      );
+    }
+
+    warn('Convex-side resources are not destroyed by this cleanup.');
+  }
+
+  await fs.rm(tempRoot, { recursive: true, force: true });
+  log(`Removed temp project directory: ${tempRoot}`);
+}
+
+async function getCreatedConvexTeamSlugForCleanupAsync(): Promise<string | null> {
+  if (!projectDir) {
+    return null;
+  }
+  const result = await runEasAsync(['integrations:convex:team'], projectDir, {
+    allowFailure: true,
+  });
+  if (result.exitCode !== 0) {
+    warn('Could not inspect Convex team links during cleanup.');
+    return null;
+  }
+  return (
+    parseConvexTeamSlugs(result.stdout).find(slug => !initialConvexTeamSlugs.includes(slug)) ?? null
+  );
+}
+
+async function runCleanupCommandAsync(args: string[]): Promise<void> {
+  try {
+    const result = await runEasAsync(args, projectDir ?? undefined, { allowFailure: true });
+    if (result.exitCode !== 0) {
+      warn(`Cleanup command exited with ${result.exitCode}: ${args.join(' ')}`);
+    }
+  } catch (error) {
+    warn(`Cleanup command failed: ${args.join(' ')}`);
+    warn(error instanceof Error ? error.message : String(error));
+  }
+}
+
+async function runEasAsync(
+  args: string[],
+  cwd?: string,
+  options: RunOptions = {}
+): Promise<RunResult> {
+  return await runAsync(LOCAL_EAS_BIN, args, { cwd, ...options });
+}
+
+async function runAsync(
+  command: string,
+  args: string[],
+  { cwd, allowFailure = false, env = {} }: RunOptions = {}
+): Promise<RunResult> {
+  const printableCommand = [command, ...args].join(' ');
+  log(`\n$ ${printableCommand}`);
+  if (cwd) {
+    log(`cwd: ${cwd}`);
+  }
+
+  return await new Promise<RunResult>((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd,
+      env: {
+        ...process.env,
+        ...env,
+        CI: '1',
+      },
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+
+    let stdout = '';
+    let stderr = '';
+
+    child.stdout.on('data', data => {
+      const chunk = data.toString();
+      stdout += chunk;
+      process.stdout.write(redact(chunk));
+    });
+
+    child.stderr.on('data', data => {
+      const chunk = data.toString();
+      stderr += chunk;
+      process.stderr.write(redact(chunk));
+    });
+
+    child.on('error', reject);
+    child.on('close', exitCode => {
+      const result = { stdout, stderr, exitCode };
+      if (!allowFailure && exitCode !== 0) {
+        reject(new Error(`Command failed with exit code ${exitCode}: ${printableCommand}`));
+        return;
+      }
+      resolve(result);
+    });
+  });
+}
+
+async function updateAppJsonAsync(appDir: string, testName: string): Promise<void> {
+  const appJsonPath = path.join(appDir, 'app.json');
+  const rawAppJson = await fs.readFile(appJsonPath, 'utf8');
+  const appJson = JSON.parse(rawAppJson);
+  appJson.expo = {
+    ...appJson.expo,
+    name: testName,
+    slug: testName,
+    ...(ACCOUNT ? { owner: ACCOUNT } : {}),
+  };
+  await fs.writeFile(appJsonPath, `${JSON.stringify(appJson, null, 2)}\n`);
+}
+
+async function assertEnvLocalAsync(appDir: string): Promise<void> {
+  const envLocalPath = path.join(appDir, '.env.local');
+  const envLocal = await fs.readFile(envLocalPath, 'utf8');
+  assertIncludes(
+    envLocal,
+    'CONVEX_DEPLOY_KEY=',
+    'Expected .env.local to contain CONVEX_DEPLOY_KEY'
+  );
+  assertIncludes(
+    envLocal,
+    'EXPO_PUBLIC_CONVEX_URL=',
+    'Expected .env.local to contain EXPO_PUBLIC_CONVEX_URL'
+  );
+  log('\nVerified .env.local contains Convex environment variables:');
+  log(redact(envLocal));
+}
+
+async function assertPackageJsonDependencyAsync(
+  appDir: string,
+  packageName: string
+): Promise<void> {
+  const packageJsonPath = path.join(appDir, 'package.json');
+  const packageJson = JSON.parse(await fs.readFile(packageJsonPath, 'utf8'));
+  const dependencies = {
+    ...packageJson.dependencies,
+    ...packageJson.devDependencies,
+  };
+  if (!dependencies[packageName]) {
+    throw new Error(`Expected package.json to include ${packageName}`);
+  }
+  log(`Verified package.json includes ${packageName}@${dependencies[packageName]}`);
+}
+
+function parseConvexTeamSlugs(output: string): string[] {
+  const strippedOutput = stripAnsi(output);
+  return Array.from(strippedOutput.matchAll(/^Team:\s+.+?\s\/\s(.+)$/gm), match => match[1].trim());
+}
+
+function assertIncludes(value: string, expected: string, message: string): void {
+  if (!value.includes(expected)) {
+    throw new Error(message);
+  }
+}
+
+async function assertFileExistsAsync(filePath: string, message: string): Promise<void> {
+  try {
+    await fs.access(filePath);
+  } catch {
+    throw new Error(message);
+  }
+}
+
+function logStep(message: string): void {
+  log(`\n==> ${message}`);
+}
+
+function log(message: string): void {
+  process.stdout.write(`${message}\n`);
+}
+
+function warn(message: string): void {
+  process.stderr.write(`${message}\n`);
+}
+
+function redact(value: string): string {
+  return value
+    .replace(/^CONVEX_DEPLOY_KEY=.*$/gm, 'CONVEX_DEPLOY_KEY=<redacted>')
+    .replace(/dev:[^\s|]+\|[^\s]+/g, 'dev:<redacted>');
+}
+
+function stripAnsi(value: string): string {
+  return value.replace(/\u001b\[[0-9;]*m/g, '');
+}
+
+function getNpxEnvironment(): NodeJS.ProcessEnv {
+  return {
+    npm_config_user_agent: `npm/10 node/${process.versions.node} ${process.platform} ${process.arch}`,
+    npm_execpath: undefined,
+  };
+}
+
+mainAsync().catch(error => {
+  warn(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});

packages/eas-cli/src/__tests__/commands/go-test.ts

@@ -0,0 +1,197 @@
+import { getConfigFilePaths } from '@expo/config';
+
+import { getWorkflowRunUrl } from '../../build/utils/url';
+import Go from '../../commands/go';
+import { WorkflowRunStatus } from '../../graphql/generated';
+import { WorkflowRunMutation } from '../../graphql/mutations/WorkflowRunMutation';
+import { WorkflowRunQuery } from '../../graphql/queries/WorkflowRunQuery';
+import Log from '../../log';
+import { selectAsync } from '../../prompts';
+import { getPrivateExpoConfigAsync } from '../../project/expoConfig';
+import { uploadAccountScopedFileAsync } from '../../project/uploadAccountScopedFileAsync';
+import { uploadAccountScopedProjectSourceAsync } from '../../project/uploadAccountScopedProjectSourceAsync';
+import { ensureActorHasPrimaryAccount } from '../../user/actions';
+import { detectProjectSdkVersionAsync } from '../../commands/go';
+import { mockTestCommand } from './utils';
+
+jest.mock('@expo/config', () => ({
+  ...jest.requireActual('@expo/config'),
+  getConfigFilePaths: jest.fn(),
+}));
+jest.mock('../../project/expoConfig');
+jest.mock('../../log', () => ({
+  __esModule: true,
+  default: {
+    log: jest.fn(),
+    withTick: jest.fn(),
+    newLine: jest.fn(),
+    succeed: jest.fn(),
+    debug: jest.fn(),
+    markFreshLine: jest.fn(),
+    error: jest.fn(),
+  },
+  learnMore: jest.fn().mockReturnValue(''),
+}));
+jest.mock('../../ora', () => ({
+  ora: jest.fn().mockReturnValue({
+    start: jest.fn().mockReturnThis(),
+    stop: jest.fn().mockReturnThis(),
+    fail: jest.fn().mockReturnThis(),
+    succeed: jest.fn().mockReturnThis(),
+  }),
+}));
+jest.mock('fs-extra', () => ({
+  ensureDir: jest.fn().mockResolvedValue(undefined),
+  writeFile: jest.fn().mockResolvedValue(undefined),
+  remove: jest.fn().mockResolvedValue(undefined),
+}));
+jest.mock('../../user/actions');
+jest.mock('../../graphql/queries/WorkflowRunQuery');
+jest.mock('../../graphql/mutations/WorkflowRunMutation');
+jest.mock('../../project/uploadAccountScopedFileAsync');
+jest.mock('../../project/uploadAccountScopedProjectSourceAsync');
+jest.mock('../../build/utils/url');
+jest.mock('../../prompts');
+
+const mockGetConfigFilePaths = jest.mocked(getConfigFilePaths);
+const mockGetPrivateExpoConfigAsync = jest.mocked(getPrivateExpoConfigAsync);
+
+describe('detectProjectSdkVersionAsync', () => {
+  it('returns undefined when no config file exists', async () => {
+    mockGetConfigFilePaths.mockReturnValue({ staticConfigPath: null, dynamicConfigPath: null });
+    await expect(detectProjectSdkVersionAsync('/project')).resolves.toBeUndefined();
+  });
+
+  it('returns the sdkVersion from the project config', async () => {
+    mockGetConfigFilePaths.mockReturnValue({
+      staticConfigPath: '/project/app.json',
+      dynamicConfigPath: null,
+    });
+    mockGetPrivateExpoConfigAsync.mockResolvedValue({ sdkVersion: '55.0.0' } as any);
+    await expect(detectProjectSdkVersionAsync('/project')).resolves.toBe('55.0.0');
+  });
+
+  it('returns undefined when reading the config throws', async () => {
+    mockGetConfigFilePaths.mockReturnValue({
+      staticConfigPath: '/project/app.json',
+      dynamicConfigPath: null,
+    });
+    mockGetPrivateExpoConfigAsync.mockRejectedValue(new Error('config error'));
+    await expect(detectProjectSdkVersionAsync('/project')).resolves.toBeUndefined();
+  });
+});
+
+const mockAccount = { id: 'account-id', name: 'testuser' };
+const mockActor = {
+  __typename: 'User' as const,
+  id: 'user-id',
+  username: 'testuser',
+  primaryAccount: mockAccount,
+};
+
+describe('Go command', () => {
+  beforeEach(() => {
+    jest.mocked(ensureActorHasPrimaryAccount).mockReturnValue(mockAccount as any);
+    jest.mocked(WorkflowRunQuery.expoGoRepackConfigurationAsync).mockResolvedValue({
+      files: [],
+      sdkVersion: '55.0.0',
+    } as any);
+    jest.mocked(WorkflowRunMutation.createExpoGoRepackWorkflowRunAsync).mockResolvedValue({
+      id: 'run-id',
+    } as any);
+    jest.mocked(uploadAccountScopedProjectSourceAsync).mockResolvedValue({
+      projectArchiveBucketKey: 'archive-key',
+    });
+    jest
+      .mocked(uploadAccountScopedFileAsync)
+      .mockResolvedValue({ fileBucketKey: 'file-key' } as any);
+    jest.mocked(getWorkflowRunUrl).mockReturnValue('https://expo.dev/run/123');
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  function makeCmd(argv: string[] = []) {
+    const ctx = {
+      loggedIn: { actor: mockActor as any, graphqlClient: {} as any },
+      analytics: {} as any,
+    };
+    const cmd = mockTestCommand(Go, ['--bundle-id', 'com.test.go', ...argv], ctx);
+    jest.spyOn(cmd as any, 'ensureEasProjectAsync').mockResolvedValue('project-id');
+    jest.spyOn(cmd as any, 'setupCredentialsAsync').mockResolvedValue({ id: 'asc-app-id' });
+    jest.spyOn(cmd as any, 'monitorWorkflowJobsAsync').mockResolvedValue(WorkflowRunStatus.Success);
+    return cmd;
+  }
+
+  it('logs auto-selected SDK message and reports resolved version after dispatch', async () => {
+    mockGetConfigFilePaths.mockReturnValue({
+      staticConfigPath: '/app.json',
+      dynamicConfigPath: null,
+    });
+    mockGetPrivateExpoConfigAsync.mockResolvedValue({ sdkVersion: '55.0.0' } as any);
+
+    await makeCmd().run();
+
+    expect(Log.log).toHaveBeenCalledWith(expect.stringContaining('SDK 55'));
+    expect(Log.withTick).toHaveBeenCalledWith(expect.stringContaining('Using Expo Go SDK'));
+  });
+
+  it('skips auto-select log when --sdk-version flag is provided', async () => {
+    mockGetConfigFilePaths.mockReturnValue({
+      staticConfigPath: '/app.json',
+      dynamicConfigPath: null,
+    });
+    mockGetPrivateExpoConfigAsync.mockResolvedValue({ sdkVersion: '55.0.0' } as any);
+
+    await makeCmd(['--sdk-version', '55.0.0']).run();
+
+    expect(Log.log).not.toHaveBeenCalledWith(expect.stringContaining('Auto-selected'));
+  });
+
+  it('prompts for SDK version when no project config is found', async () => {
+    mockGetConfigFilePaths.mockReturnValue({ staticConfigPath: null, dynamicConfigPath: null });
+    jest.mocked(WorkflowRunQuery.expoGoSupportedSdkVersionsAsync).mockResolvedValue([
+      { sdkVersion: '54.0.0', isLatest: false, isBeta: false, isDeprecated: false },
+      { sdkVersion: '55.0.0', isLatest: true, isBeta: false, isDeprecated: false },
+      { sdkVersion: '56.0.0', isLatest: false, isBeta: true, isDeprecated: false },
+    ]);
+    jest.mocked(selectAsync).mockResolvedValue('55.0.0');
+
+    await makeCmd().run();
+
+    expect(selectAsync).toHaveBeenCalledWith(
+      'Select an Expo SDK version',
+      expect.arrayContaining([
+        expect.objectContaining({ title: 'SDK 54', value: '54.0.0' }),
+        expect.objectContaining({ title: 'SDK 55 (latest)', value: '55.0.0' }),
+        expect.objectContaining({ title: 'SDK 56 (beta)', value: '56.0.0' }),
+      ]),
+      expect.objectContaining({ initial: '55.0.0' })
+    );
+  });
+
+  it('skips prompt when all versions are deprecated', async () => {
+    mockGetConfigFilePaths.mockReturnValue({ staticConfigPath: null, dynamicConfigPath: null });
+    jest
+      .mocked(WorkflowRunQuery.expoGoSupportedSdkVersionsAsync)
+      .mockResolvedValue([
+        { sdkVersion: '54.0.0', isLatest: false, isBeta: false, isDeprecated: true },
+      ]);
+
+    await makeCmd().run();
+
+    expect(selectAsync).not.toHaveBeenCalled();
+  });
+
+  it('falls back gracefully when supportedSdkVersions fetch fails', async () => {
+    mockGetConfigFilePaths.mockReturnValue({ staticConfigPath: null, dynamicConfigPath: null });
+    jest
+      .mocked(WorkflowRunQuery.expoGoSupportedSdkVersionsAsync)
+      .mockRejectedValue(new Error('network error'));
+
+    await makeCmd().run();
+
+    expect(selectAsync).not.toHaveBeenCalled();
+  });
+});

packages/eas-cli/src/build/__tests__/validateLockfile-test.ts

@@ -0,0 +1,81 @@
+import { vol } from 'memfs';
+
+import { ensureLockfileExistsAsync } from '../validateLockfile';
+
+jest.mock('fs');
+
+const mockResolveWorkspaceRoot = jest.fn();
+jest.mock('@expo/package-manager', () => {
+  const actual = jest.requireActual('@expo/package-manager');
+  return {
+    ...actual,
+    resolveWorkspaceRoot: (...args: unknown[]) => mockResolveWorkspaceRoot(...args),
+  };
+});
+
+beforeEach(() => {
+  vol.reset();
+  mockResolveWorkspaceRoot.mockReturnValue(null);
+});
+
+describe(ensureLockfileExistsAsync, () => {
+  it('passes when package-lock.json exists', async () => {
+    vol.fromJSON({ './package-lock.json': '' }, '/app');
+    await expect(ensureLockfileExistsAsync('/app')).resolves.not.toThrow();
+  });
+
+  it('passes when yarn.lock exists', async () => {
+    vol.fromJSON({ './yarn.lock': '' }, '/app');
+    await expect(ensureLockfileExistsAsync('/app')).resolves.not.toThrow();
+  });
+
+  it('passes when pnpm-lock.yaml exists', async () => {
+    vol.fromJSON({ './pnpm-lock.yaml': '' }, '/app');
+    await expect(ensureLockfileExistsAsync('/app')).resolves.not.toThrow();
+  });
+
+  it('passes when bun.lockb exists', async () => {
+    vol.fromJSON({ './bun.lockb': '' }, '/app');
+    await expect(ensureLockfileExistsAsync('/app')).resolves.not.toThrow();
+  });
+
+  it('passes when bun.lock exists', async () => {
+    vol.fromJSON({ './bun.lock': '' }, '/app');
+    await expect(ensureLockfileExistsAsync('/app')).resolves.not.toThrow();
+  });
+
+  it('throws when no lockfile exists', async () => {
+    vol.fromJSON({ './package.json': '{}' }, '/app');
+    await expect(ensureLockfileExistsAsync('/app')).rejects.toThrow(
+      'No lockfile found in the project directory.'
+    );
+  });
+
+  it('passes when lockfile exists in workspace root', async () => {
+    vol.fromJSON(
+      {
+        './packages/my-app/package.json': '{}',
+        './yarn.lock': '',
+      },
+      '/monorepo'
+    );
+    mockResolveWorkspaceRoot.mockReturnValue('/monorepo');
+    await expect(
+      ensureLockfileExistsAsync('/monorepo/packages/my-app')
+    ).resolves.not.toThrow();
+  });
+
+  it('throws when no lockfile in project dir or workspace root', async () => {
+    vol.fromJSON(
+      {
+        './packages/my-app/package.json': '{}',
+        './package.json': '{}',
+      },
+      '/monorepo'
+    );
+    mockResolveWorkspaceRoot.mockReturnValue('/monorepo');
+    await expect(ensureLockfileExistsAsync('/monorepo/packages/my-app')).rejects.toThrow(
+      'No lockfile found in the project directory.'
+    );
+  });
+});

packages/eas-cli/src/build/createContext.ts

@@ -42,6 +42,7 @@ export async function createBuildContextAsync<T extends Platform>({
   customBuildConfigMetadata,
   buildLoggerLevel,
   freezeCredentials,
+  refreshAdHocProvisioningProfile: refreshAdHocProvisioningProfileFlag,
   isVerboseLoggingEnabled,
   whatToTest,
   env,
@@ -65,6 +66,7 @@ export async function createBuildContextAsync<T extends Platform>({
   customBuildConfigMetadata?: CustomBuildConfigMetadata;
   buildLoggerLevel?: LoggerLevel;
   freezeCredentials: boolean;
+  refreshAdHocProvisioningProfile?: boolean;
   isVerboseLoggingEnabled: boolean;
   whatToTest?: string;
   env: Record<string, string>;
@@ -90,6 +92,8 @@ export async function createBuildContextAsync<T extends Platform>({
 
   const requiredPackageManager = resolvePackageManager(projectDir);
 
+  const refreshAdHocProvisioningProfile = refreshAdHocProvisioningProfileFlag ?? false;
+
   const credentialsCtx = new CredentialsContext({
     projectInfo: { exp, projectId },
     nonInteractive,
@@ -101,6 +105,7 @@ export async function createBuildContextAsync<T extends Platform>({
     easJsonCliConfig,
     vcsClient,
     freezeCredentials,
+    refreshAdHocProvisioningProfile,
   });
 
   const devClientProperties = getDevClientEventProperties({

packages/eas-cli/src/build/ios/__tests__/credentials-test.ts

@@ -0,0 +1,40 @@
+import { Platform } from '@expo/eas-build-job';
+import { CredentialsSource } from '@expo/eas-json';
+
+import { BuildContext } from '../../context';
+import { ensureIosCredentialsAsync } from '../credentials';
+
+describe(ensureIosCredentialsAsync, () => {
+  it('errors when refresh is enabled with local credentials source', async () => {
+    const buildCtx = {
+      buildProfile: {
+        credentialsSource: CredentialsSource.LOCAL,
+        simulator: false,
+        withoutCredentials: false,
+      },
+      credentialsCtx: {
+        refreshAdHocProvisioningProfile: true,
+      },
+    } as BuildContext<Platform.IOS>;
+
+    await expect(ensureIosCredentialsAsync(buildCtx, [])).rejects.toThrow(
+      '--refresh-ad-hoc-provisioning-profile cannot be used with credentialsSource "local". Use remote credentials or omit the flag.'
+    );
+  });
+
+  it('does not reject refresh when credentials source is remote', async () => {
+    const buildCtx = {
+      buildProfile: {
+        credentialsSource: CredentialsSource.REMOTE,
+        simulator: true,
+        withoutCredentials: false,
+        distribution: 'internal',
+      },
+      credentialsCtx: {
+        refreshAdHocProvisioningProfile: true,
+      },
+    } as BuildContext<Platform.IOS>;
+
+    await expect(ensureIosCredentialsAsync(buildCtx, [])).resolves.toBeUndefined();
+  });
+});

packages/eas-cli/src/build/ios/credentials.ts

@@ -17,6 +17,16 @@ export async function ensureIosCredentialsAsync(
     return;
   }
 
+  const { credentialsSource } = buildCtx.buildProfile;
+  if (
+    buildCtx.credentialsCtx.refreshAdHocProvisioningProfile &&
+    credentialsSource === 'local'
+  ) {
+    throw new Error(
+      '--refresh-ad-hoc-provisioning-profile cannot be used with credentialsSource "local". Use remote credentials or omit the flag.'
+    );
+  }
+
   const provider = new IosCredentialsProvider(buildCtx.credentialsCtx, {
     app: await getAppFromContextAsync(buildCtx.credentialsCtx),
     targets,
@@ -24,8 +34,6 @@ export async function ensureIosCredentialsAsync(
     enterpriseProvisioning: buildCtx.buildProfile.enterpriseProvisioning,
   });
 
-  const { credentialsSource } = buildCtx.buildProfile;
-
   logCredentialsSource(credentialsSource, Platform.IOS);
   return {
     credentials: await provider.getCredentialsAsync(credentialsSource),

packages/eas-cli/src/build/ios/prepareJob.ts

@@ -112,6 +112,9 @@ export async function prepareJobAsync(
     // See: https://github.com/expo/eas-build/pull/454
     appId: ctx.projectId,
     initiatingUserId: ctx.user.id,
+    ...(ctx.credentialsCtx.refreshAdHocProvisioningProfile && {
+      refreshAdHocProvisioningProfile: true,
+    }),
   };
   return sanitizeBuildJob(job) as Ios.Job;
 }

packages/eas-cli/src/build/metadata.ts

@@ -1,5 +1,11 @@
-import { Metadata, Platform, sanitizeMetadata } from '@expo/eas-build-job';
+import {
+  Metadata,
+  Platform,
+  getInstalledExpoPackageVersionAsync,
+  sanitizeMetadata,
+} from '@expo/eas-build-job';
 import { IosEnterpriseProvisioning } from '@expo/eas-json';
+import { asyncResult } from '@expo/results';
 import fs from 'fs-extra';
 import resolveFrom from 'resolve-from';
 
@@ -9,9 +15,7 @@ import { maybeResolveVersionsAsync as maybeResolveIosVersionsAsync } from './ios
 import { LocalBuildMode } from './local';
 import { BuildDistributionType } from './types';
 import Log from '../log';
-import {
-  isExpoUpdatesInstalled,
-} from '../project/projectUtils';
+import { isExpoUpdatesInstalled } from '../project/projectUtils';
 import { readChannelSafelyAsync as readAndroidChannelSafelyAsync } from '../update/android/UpdatesModule';
 import { readChannelSafelyAsync as readIosChannelSafelyAsync } from '../update/ios/UpdatesModule';
 import { easCliVersion } from '../utils/easCli';
@@ -26,6 +30,16 @@ export async function collectMetadataAsync<T extends Platform>(
 ): Promise<Metadata> {
   const channelObject = await resolveChannelAsync(ctx);
   const distribution = ctx.buildProfile.distribution ?? BuildDistributionType.STORE;
+  const expoPackageVersionResult = await asyncResult(
+    getInstalledExpoPackageVersionAsync({
+      env: process.env,
+      projectDir: ctx.projectDir,
+    })
+  );
+  if (!expoPackageVersionResult.ok) {
+    Log.debug('Failed to resolve expo package version:');
+    Log.debug(expoPackageVersionResult.reason);
+  }
   const metadata: Metadata = {
     trackingContext: ctx.analyticsEventProperties,
     ...(await maybeResolveVersionsAsync(ctx)),
@@ -36,6 +50,7 @@ export async function collectMetadataAsync<T extends Platform>(
     runtimeVersion: runtimeAndFingerprintMetadata?.runtimeVersion,
     fingerprintHash: runtimeAndFingerprintMetadata?.fingerprintHash,
     reactNativeVersion: await getReactNativeVersionAsync(ctx.projectDir),
+    expoPackageVersion: expoPackageVersionResult.value,
     ...channelObject,
     distribution,
     appName: ctx.exp.name,