v27.3.0

* [worker] Manage warm Simulator services

Edited-by: Codex

* [worker] Use the shared warm Simulator terms in the changeset

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* [worker] Stop the recorded Simulator launcher version

* [worker] Skip Simulator stop on images without a startup script

* [worker] Stop current-boot warmup when the script is absent

* [worker] Skip launcher resolution after confirmed cleanup

* [worker] Recognize Bun cache misses alongside warning output

* [worker] Honor the package manager for versioned launcher stop

* [worker] Ignore invalid launcher state when no startup script exists

* [worker] Use existing package-manager helpers directly

Co-authored-by: Codex <[email protected]>

* [worker] Keep the warmup stop changeset scoped to worker

Edited-by: Codex

* [worker] Let the launcher handle Simulator stop state

Edited-by: Codex

* [worker] Stop warm Simulator services in the background

Edited-by: Codex

* [worker] Fix warm stop job fixtures

Edited-by: Codex

* [worker] Let build-tools wait on the launcher state for warm Simulator cleanup

The worker stops warmup in the background and shares nothing with build-tools. Before it boots,
starts or clones a Simulator, build-tools waits until the launcher's state file says disabled.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* [build-tools] Require cleanup confirmation from the current boot

---------

Co-authored-by: Claude Opus 5.5 <[email protected]>
Co-authored-by: Codex <[email protected]>
Co-authored-by: Codex <[email protected]>

.changeset/config.json

@@ -19,7 +19,9 @@
       "@expo/downloader",
       "@expo/turtle-spawn",
       "@expo/template-file",
-      "create-eas-build-function"
+      "create-eas-build-function",
+      "@expo/vm-tools",
+      "@expo/simulator-launcher"
     ]
   ],
   "linked": [],

CHANGELOG.md

@@ -2,6 +2,69 @@
 
 This is the log of notable changes to EAS CLI and related packages.
 
+## [27.3.0](https://github.com/expo/eas-cli/releases/tag/v27.3.0) - 2026-11-02
+
+### 🎉 New features
+
+- [eas-build-job] Add optional Observe error context to workflow jobs. ([#4787](https://github.com/expo/eas-cli/pull/4787) by [@AbbanMustafa](https://github.com/AbbanMustafa))
+
+### 🐛 Bug fixes
+
+- [eas-cli] Bump `@expo/apple-utils` to `2.3.0` to fix iOS capability sync when App Store Connect rejects enabling, disabling or changing a capability. ([#4790](https://github.com/expo/eas-cli/pull/4790) by [@douglowder](https://github.com/douglowder))
+- [eas-cli] Keep already linked App Groups, Merchant IDs and iCloud containers when capability sync links another identifier. ([#4584](https://github.com/expo/eas-cli/pull/4584) by [@ceydaakin](https://github.com/ceydaakin))
+- [worker] Mask secrets in every record the worker process writes to its stdout: the build log records and the worker's own records. ([#4782](https://github.com/expo/eas-cli/pull/4782) by [@hSATAC](https://github.com/hSATAC))
+- [worker][build-tools] Stop warmup in the background for jobs that do not use the warm Simulator, so job setup does not wait for it. Before build-tools boots or clones a Simulator, it waits until the launcher's state file records that cleanup finished, and fails if cleanup does not finish in time. ([#4721](https://github.com/expo/eas-cli/pull/4721) by [@gwdp](https://github.com/gwdp))
+- [build-tools] Recover unhealthy device-session tunnels without changing their URLs and block further traffic when shutdown starts, even if ngrok cleanup times out. ([#4526](https://github.com/expo/eas-cli/pull/4526) by [@gwdp](https://github.com/gwdp))
+- [build-tools] Stop sending the SSH host when registering an SSH session. ([#4784](https://github.com/expo/eas-cli/pull/4784) by [@AHGIJMKLKKZNPJKQR](https://github.com/AHGIJMKLKKZNPJKQR))
+
+## [27.2.0](https://github.com/expo/eas-cli/releases/tag/v27.2.0) - 2026-10-29
+
+### 🎉 New features
+
+- [build-tools] Use single-device previews when the session already has a valid device ID. ([#4733](https://github.com/expo/eas-cli/pull/4733) by [@gwdp](https://github.com/gwdp))
+- [eas-cli] Add an experiment that suggests Expo Update to coding agents after a build when the Free plan account is within 5 builds of the platform limit. ([#4758](https://github.com/expo/eas-cli/pull/4758) by [@williamgrosset](https://github.com/williamgrosset))
+- [eas-cli] Add `eas observe:traces` to list request trace spans (or a summary of span names and counts), `eas observe:trace` to display one trace as a span tree, and span rows in the `eas observe:session` timeline. ([#4772](https://github.com/expo/eas-cli/pull/4772) by [@kadikraman](https://github.com/kadikraman))
+- [simulator-launcher] Accept a comma-separated list of warm Simulators in `EXPO_SIMULATOR_DEVICE`; the first is the default. One serve-sim serves every listed device on one port. After the default device is ready, warmup preinstalls the latest stable Expo Go from one download and tries to disable apsd on the other devices, until a job claims one. A claim can select any listed device and reports its preinstalled Expo Go. ([#4764](https://github.com/expo/eas-cli/pull/4764) by [@gwdp](https://github.com/gwdp))
+- [simulator-launcher] Add `@expo/simulator-launcher`, which warms an iOS Simulator at VM boot and hands it to one EAS job (`start`, `claim`, `prepare-tools`, `stop`). ([#4722](https://github.com/expo/eas-cli/pull/4722) by [@gwdp](https://github.com/gwdp))
+- [eas-cli] Show a one-time Expo Simulators hint after a successful build. ([#4768](https://github.com/expo/eas-cli/pull/4768) by [@FiberJW](https://github.com/FiberJW))
+- [vm-tools] Add a macOS startup script loader that runs `/usr/local/share/vm-tools/startup.sh` once per VM boot. ([#4725](https://github.com/expo/eas-cli/pull/4725) by [@gwdp](https://github.com/gwdp))
+
+### 🐛 Bug fixes
+
+- [build-tools] Explain missing background task identifiers reported by App Store Connect. ([#3465](https://github.com/expo/eas-cli/pull/3465) by [@sjchmiela](https://github.com/sjchmiela))
+- [build-tools] Explain App Store Connect NOT_AUTHORIZED responses in the shared API client. ([#3462](https://github.com/expo/eas-cli/pull/3462) by [@sjchmiela](https://github.com/sjchmiela))
+- [build-tools] Explain App Store Connect UNEXPECTED_ERROR responses in the shared API client. ([#3467](https://github.com/expo/eas-cli/pull/3467) by [@sjchmiela](https://github.com/sjchmiela))
+- [build-tools] Explain missing app icons reported by App Store Connect, including codes 90022 and 90023, while preserving Apple’s validation details. ([#3466](https://github.com/expo/eas-cli/pull/3466) by [@sjchmiela](https://github.com/sjchmiela))
+- [build-tools] List failed Google Play commit attempts in order, including network failures, when the outcome is uncertain. ([#4660](https://github.com/expo/eas-cli/pull/4660) by [@sjchmiela](https://github.com/sjchmiela))
+- [worker] Run package-manager version queries in parallel during worker preparation. ([#4710](https://github.com/expo/eas-cli/pull/4710) by [@gwdp](https://github.com/gwdp))
+- [worker] Start the Xcode version check in the background during worker tool preparation. Apply the Xcode 26.0 upload workaround when the query finishes, without delaying job startup. ([#4707](https://github.com/expo/eas-cli/pull/4707) by [@gwdp](https://github.com/gwdp))
+- [build-tools] Fix a five-minute cleanup delay when a device session is canceled during startup and its screen recorder fails before connecting. ([#4761](https://github.com/expo/eas-cli/pull/4761) by [@gwdp](https://github.com/gwdp))
+- [eas-cli] Remove the Free plan build limit guidance experiment for coding agents from `eas build`. ([#4757](https://github.com/expo/eas-cli/pull/4757) by [@williamgrosset](https://github.com/williamgrosset))
+- [worker] Allow jobs to skip installing the CocoaPods cache proxy with EAS_BUILD_DISABLE_COCOAPODS_CACHE_PLUGIN=1. ([#4709](https://github.com/expo/eas-cli/pull/4709) by [@gwdp](https://github.com/gwdp))
+- [build-tools] Handle TURN requests for a stopped device session without reporting a warning. ([#4762](https://github.com/expo/eas-cli/pull/4762) by [@gwdp](https://github.com/gwdp))
+- [build-tools] Preserve indented and incomplete Xcode compiler errors in formatted build logs, including the final diagnostic when logging stops. ([#4365](https://github.com/expo/eas-cli/pull/4365) by [@sjchmiela](https://github.com/sjchmiela))
+
+### 🧹 Chores
+
+- [simulator-launcher] Add the state, request command and service helpers for the warm Simulator launcher. The package stays private until #4722 adds its CLI entry point. ([#4766](https://github.com/expo/eas-cli/pull/4766) by [@gwdp](https://github.com/gwdp))
+
+## [27.1.0](https://github.com/expo/eas-cli/releases/tag/v27.1.0) - 2026-10-28
+
+### 🎉 New features
+
+- [eas-cli] Display queued workflow runs: `workflow:run --wait` and `workflow:status` show a run waiting for its concurrency group and the run blocking it, and `workflow:cancel` includes queued runs in its selection list. ([#4258](https://github.com/expo/eas-cli/pull/4258) by [@hSATAC](https://github.com/hSATAC))
+- [eas-cli] Upload the workflow files that `uses` jobs reference, including nested ones, when running a local workflow file with `eas workflow:run`. ([#4769](https://github.com/expo/eas-cli/pull/4769) by [@sswrk](https://github.com/sswrk))
+
+### 🐛 Bug fixes
+
+- [build-tools] Explain App Store Connect error 90189 as a duplicate build number. ([#3461](https://github.com/expo/eas-cli/pull/3461) by [@sjchmiela](https://github.com/sjchmiela))
+- [eas-cli] Fail the command when EAS CLI cannot pull environment variables from EAS servers, instead of continuing without them. ([#4774](https://github.com/expo/eas-cli/pull/4774) by [@wschurman](https://github.com/wschurman))
+- [eas-cli] Format the generated root changelog before committing a release. ([#4773](https://github.com/expo/eas-cli/pull/4773) by [@gwdp](https://github.com/gwdp))
+- [build-tools][worker] Put the `NPM_TOKEN` registry credential in the builder's npm user config on EAS Build (`~/.npmrc`, or the file `NPM_CONFIG_USERCONFIG` names), where pnpm 10.34.2+ and 11.5.3+ still expand `${NPM_TOKEN}` (they ignore it in a project-level `.npmrc`). Explain what to change when the project's pnpm version needs a newer Node.js than the build runs, including when eas.json sets `node` or `pnpm`. ([#4729](https://github.com/expo/eas-cli/pull/4729) by [@hSATAC](https://github.com/hSATAC))
+- [build-tools] Install `@expo/repack-app` for the `eas/repack` step with npm in a sandbox that sees only `PATH` and its own `HOME`, so the build machine's npm and Yarn configuration cannot break the install, fetch it through the EAS npm cache when the job uses one, and show the installer output in the build log. The step no longer looks the version up separately before installing. When the npm cache fails, the install retries against the public registry like the project install does; the `eas/run_agent` agent CLI install shares the same helper and gains the same retry. ([#4728](https://github.com/expo/eas-cli/pull/4728) by [@hSATAC](https://github.com/hSATAC))
+- [eas-cli] Honor the `--non-interactive` flag in `workflow:cancel`; it was parsed but never applied, so automation could hang on the interactive picker. ([#4258](https://github.com/expo/eas-cli/pull/4258) by [@hSATAC](https://github.com/hSATAC))
+- [eas-cli] Stop reporting a finish time for workflow runs that have not finished: `workflow:runs` reports `finishedAt` only for runs in a final status. ([#4258](https://github.com/expo/eas-cli/pull/4258) by [@hSATAC](https://github.com/hSATAC))
+
 ## [27.0.0](https://github.com/expo/eas-cli/releases/tag/v27.0.0) - 2026-10-27
 
 ### 🛠 Breaking changes
@@ -26,6 +89,7 @@ This is the log of notable changes to EAS CLI and related packages.
 - [eas-cli] Require explicit `host:` simulator-host upload paths and report missing local files. ([#4683](https://github.com/expo/eas-cli/pull/4683) by [@gwdp](https://github.com/gwdp))
 
   Missing local absolute paths now require the `host:` prefix. Actions that require upload IDs accept local files and reject host paths with an explanation.
+
 - [build-tools] Handle a device session stopped during startup as normal cleanup instead of reporting a startup error. ([#4716](https://github.com/expo/eas-cli/pull/4716) by [@gwdp](https://github.com/gwdp))
 - [build-tools] Support idle timeouts for iOS web-preview-only sessions, resetting the timer when preview input arrives. ([#4731](https://github.com/expo/eas-cli/pull/4731) by [@gwdp](https://github.com/gwdp))
 

cli-versions.json

@@ -1,4 +1,4 @@
 {
-  "STAGING": "26.0.0",
-  "PRODUCTION": "26.0.0"
+  "STAGING": "27.2.0",
+  "PRODUCTION": "27.2.0"
 }

lerna.json

@@ -1,5 +1,5 @@
 {
   "npmClient": "yarn",
-  "version": "27.0.0",
+  "version": "27.3.0",
   "$schema": "node_modules/lerna/schemas/lerna-schema.json"
 }

packages/build-tools/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @expo/build-tools
 
+## 27.3.0
+
+### Patch Changes
+
+- Stop warmup in the background for jobs that do not use the warm Simulator, so job setup does not wait for it. Before build-tools boots or clones a Simulator, it waits until the launcher's state file records that cleanup finished, and fails if cleanup does not finish in time. ([#4721](https://github.com/expo/eas-cli/pull/4721) by [@gwdp](https://github.com/gwdp))
+- Recover unhealthy device-session tunnels without changing their URLs and block further traffic when shutdown starts, even if ngrok cleanup times out. ([#4526](https://github.com/expo/eas-cli/pull/4526) by [@gwdp](https://github.com/gwdp))
+- Stop sending the SSH host when registering an SSH session. ([#4784](https://github.com/expo/eas-cli/pull/4784) by [@AHGIJMKLKKZNPJKQR](https://github.com/AHGIJMKLKKZNPJKQR))
+
+## 27.2.0
+
+### Minor Changes
+
+- Use single-device previews when the session already has a valid device ID. ([#4733](https://github.com/expo/eas-cli/pull/4733) by [@gwdp](https://github.com/gwdp))
+
+### Patch Changes
+
+- Explain missing background task identifiers reported by App Store Connect. ([#3465](https://github.com/expo/eas-cli/pull/3465) by [@sjchmiela](https://github.com/sjchmiela))
+- Explain App Store Connect NOT_AUTHORIZED responses in the shared API client. ([#3462](https://github.com/expo/eas-cli/pull/3462) by [@sjchmiela](https://github.com/sjchmiela))
+- Explain App Store Connect UNEXPECTED_ERROR responses in the shared API client. ([#3467](https://github.com/expo/eas-cli/pull/3467) by [@sjchmiela](https://github.com/sjchmiela))
+- Explain missing app icons reported by App Store Connect, including codes 90022 and 90023, while preserving Apple’s validation details. ([#3466](https://github.com/expo/eas-cli/pull/3466) by [@sjchmiela](https://github.com/sjchmiela))
+- List failed Google Play commit attempts in order, including network failures, when the outcome is uncertain. ([#4660](https://github.com/expo/eas-cli/pull/4660) by [@sjchmiela](https://github.com/sjchmiela))
+- Fix a five-minute cleanup delay when a device session is canceled during startup and its screen recorder fails before connecting. ([#4761](https://github.com/expo/eas-cli/pull/4761) by [@gwdp](https://github.com/gwdp))
+- Handle TURN requests for a stopped device session without reporting a warning. ([#4762](https://github.com/expo/eas-cli/pull/4762) by [@gwdp](https://github.com/gwdp))
+- Preserve indented and incomplete Xcode compiler errors in formatted build logs, including the final diagnostic when logging stops. ([#4365](https://github.com/expo/eas-cli/pull/4365) by [@sjchmiela](https://github.com/sjchmiela))
+
+## 27.1.0
+
+### Patch Changes
+
+- Explain App Store Connect error 90189 as a duplicate build number. ([#3461](https://github.com/expo/eas-cli/pull/3461) by [@sjchmiela](https://github.com/sjchmiela))
+- Put the `NPM_TOKEN` registry credential in the builder's npm user config on EAS Build (`~/.npmrc`, or the file `NPM_CONFIG_USERCONFIG` names), where pnpm 10.34.2+ and 11.5.3+ still expand `${NPM_TOKEN}` (they ignore it in a project-level `.npmrc`). Explain what to change when the project's pnpm version needs a newer Node.js than the build runs, including when eas.json sets `node` or `pnpm`. ([#4729](https://github.com/expo/eas-cli/pull/4729) by [@hSATAC](https://github.com/hSATAC))
+- Install `@expo/repack-app` for the `eas/repack` step with npm in a sandbox that sees only `PATH` and its own `HOME`, so the build machine's npm and Yarn configuration cannot break the install, fetch it through the EAS npm cache when the job uses one, and show the installer output in the build log. The step no longer looks the version up separately before installing. When the npm cache fails, the install retries against the public registry like the project install does; the `eas/run_agent` agent CLI install shares the same helper and gains the same retry. ([#4728](https://github.com/expo/eas-cli/pull/4728) by [@hSATAC](https://github.com/hSATAC))
+
 ## 27.0.0
 
 ### Patch Changes

packages/build-tools/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/build-tools",
-  "version": "27.0.0",
+  "version": "27.3.0",
   "bugs": "https://github.com/expo/eas-cli/issues",
   "license": "BUSL-1.1",
   "author": "Expo <[email protected]>",
@@ -42,18 +42,18 @@
   "dependencies": {
     "@expo/config": "55.0.10",
     "@expo/config-plugins": "55.0.7",
-    "@expo/downloader": "27.0.0",
-    "@expo/eas-build-job": "27.0.0",
+    "@expo/downloader": "27.3.0",
+    "@expo/eas-build-job": "27.3.0",
     "@expo/env": "^0.4.0",
-    "@expo/logger": "27.0.0",
+    "@expo/logger": "27.3.0",
     "@expo/package-manager": "1.9.10",
     "@expo/plist": "^0.3.5",
     "@expo/results": "^1.0.0",
     "@expo/spawn-async": "1.7.2",
-    "@expo/steps": "27.0.0",
-    "@expo/template-file": "27.0.0",
-    "@expo/turtle-spawn": "27.0.0",
-    "@expo/xcpretty": "^4.3.1",
+    "@expo/steps": "27.3.0",
+    "@expo/template-file": "27.3.0",
+    "@expo/turtle-spawn": "27.3.0",
+    "@expo/xcpretty": "^4.4.7",
     "@ngrok/ngrok": "1.7.0",
     "@sentry/node": "7.77.0",
     "@urql/core": "^6.0.1",

packages/build-tools/src/buildErrors/__tests__/detectError.test.ts

@@ -125,6 +125,31 @@ describe(resolveBuildPhaseErrorAsync, () => {
     expect(err.trackingCode).toBeUndefined();
   });
 
+  it('explains that the pnpm version needs a newer Node.js than the build runs', async () => {
+    const fakeError = new Error();
+    const err = await resolveBuildPhaseErrorAsync(
+      fakeError,
+      [
+        'Running "pnpm install --frozen-lockfile" in /home/expo/workingdir/build directory',
+        'warn: This version of pnpm requires at least Node.js v22.13',
+        'warn: The current version of Node.js is v20.19.4',
+        'warn: Visit https://r.pnpm.io/comp to see the list of past pnpm versions with respective Node.js version support.',
+        'Error [ERR_UNKNOWN_BUILTIN_MODULE]: No such built-in module: node:sqlite',
+      ],
+      {
+        job: { platform: Platform.ANDROID } as Job,
+        phase: BuildPhase.INSTALL_DEPENDENCIES,
+        env: {},
+      },
+      '/fake/path'
+    );
+    expect(err.errorCode).toBe('EAS_BUILD_PNPM_UNSUPPORTED_NODE_VERSION_ERROR');
+    expect(err.message).toBe(
+      'This build uses a pnpm version that requires Node.js 22.13.0 or newer, but runs Node.js 20.19.4. You can fix it by either:\n- setting "node" to "22.13.0" or a newer version in the build profile in eas.json\n- using a pnpm version that supports Node.js 20.19.4: change "packageManager" in package.json if your project sets it, and set "pnpm" in the build profile in eas.json'
+    );
+    expect(err.docsUrl).toBe('https://docs.expo.dev/eas/json/');
+  });
+
   it('detects xcode line error', async () => {
     vol.fromJSON({
       '/path/to/xcodelogs.log': originalFs.readFileSync(

packages/build-tools/src/buildErrors/pnpmUnsupportedNodeVersionError.ts

@@ -0,0 +1,33 @@
+import { errors } from '@expo/eas-build-job';
+import nullthrows from 'nullthrows';
+import semver from 'semver';
+
+import { ErrorHandler } from './errors.types';
+
+// example log: "warn: This version of pnpm requires at least Node.js v22.13" followed by "warn: The current version of Node.js is v20.19.4"
+const PNPM_UNSUPPORTED_NODE_VERSION_REGEXP =
+  /This version of pnpm requires at least Node\.js v([\d.]+)\n.*The current version of Node\.js is v([\d.]+)/;
+
+function createPnpmUnsupportedNodeVersionError(matchResult: RegExpMatchArray): errors.UserError {
+  const [, requiredNodeVersion, currentNodeVersion] = matchResult;
+  const minimumNodeVersion = nullthrows(semver.coerce(requiredNodeVersion)).version;
+  return new errors.UserError(
+    'EAS_BUILD_PNPM_UNSUPPORTED_NODE_VERSION_ERROR',
+    `This build uses a pnpm version that requires Node.js ${minimumNodeVersion} or newer, but runs Node.js ${currentNodeVersion}. You can fix it by either:
+- setting "node" to "${minimumNodeVersion}" or a newer version in the build profile in eas.json
+- using a pnpm version that supports Node.js ${currentNodeVersion}: change "packageManager" in package.json if your project sets it, and set "pnpm" in the build profile in eas.json`,
+    { docsUrl: 'https://docs.expo.dev/eas/json/' }
+  );
+}
+
+export const pnpmUnsupportedNodeVersionErrorHandler: ErrorHandler<errors.UserError> = {
+  regexp: PNPM_UNSUPPORTED_NODE_VERSION_REGEXP,
+  createError: createPnpmUnsupportedNodeVersionError,
+};
+
+export function detectPnpmUnsupportedNodeVersionError(
+  output: string
+): errors.UserError | undefined {
+  const match = output.match(PNPM_UNSUPPORTED_NODE_VERSION_REGEXP);
+  return match ? createPnpmUnsupportedNodeVersionError(match) : undefined;
+}

packages/build-tools/src/buildErrors/userErrorHandlers.ts

@@ -1,6 +1,7 @@
 import { BuildMode, BuildPhase, Platform, Workflow, errors } from '@expo/eas-build-job';
 
 import { ErrorHandler, XCODE_BUILD_PHASE } from './errors.types';
+import { pnpmUnsupportedNodeVersionErrorHandler } from './pnpmUnsupportedNodeVersionError';
 
 import UserError = errors.UserError;
 
@@ -211,6 +212,7 @@ You are seeing this error because either:
       return undefined;
     },
   },
+  pnpmUnsupportedNodeVersionErrorHandler,
   {
     platform: Platform.IOS,
     phase: XCODE_BUILD_PHASE,

packages/build-tools/src/common/__tests__/xcpretty.test.ts

@@ -3,6 +3,7 @@ import { EventEmitter } from 'events';
 import spawnAsync from '@expo/spawn-async';
 import { ExpoRunFormatter } from '@expo/xcpretty';
 import fg from 'fast-glob';
+import { vol } from 'memfs';
 
 import { createMockLogger } from '../../__tests__/utils/logger';
 import { Sentry } from '../../sentry';
@@ -59,6 +60,47 @@ describe(XcodeBuildLogger, () => {
     expect(Sentry.capture).not.toHaveBeenCalled();
   });
 
+  it('flushes the final incomplete compiler error when the log reader is interrupted', async () => {
+    const { ExpoRunFormatter: RealFormatter } =
+      jest.requireActual<typeof import('@expo/xcpretty')>('@expo/xcpretty');
+    jest.mocked(ExpoRunFormatter.create).mockImplementation(RealFormatter.create);
+
+    let rejectReader!: (error: Error) => void;
+    const spawnPromise = Object.assign(
+      new Promise<never>((_resolve, reject) => {
+        rejectReader = reject;
+      }),
+      {
+        child: {
+          stdout,
+          kill: () =>
+            rejectReader(Object.assign(new Error('tail interrupted'), { signal: 'SIGINT' })),
+        },
+      }
+    );
+    jest.mocked(spawnAsync).mockReturnValue(spawnPromise as any);
+    const diagnostics =
+      '/project/First.swift:12:3: error: first compiler error\n' +
+      '    /project/Last.swift:20:4: error: final compiler error\n';
+    vol.fromJSON({ '/logs/build.log': diagnostics });
+    const logger = createMockLogger();
+    const buildLogger = new XcodeBuildLogger(logger, '/project');
+    await buildLogger.watchLogFiles('/logs');
+    stdout.emit('data', diagnostics);
+
+    await buildLogger.flush();
+
+    const output = jest
+      .mocked(logger.info)
+      .mock.calls.map(([line]) => String(line))
+      .join('\n');
+    expect(output).toContain('first compiler error');
+    expect(output).toContain('final compiler error');
+    expect(output).toContain('Last.swift:20:4');
+    expect(output).toContain('2 error(s)');
+    expect(output.match(/final compiler error/g)).toHaveLength(1);
+  });
+
   it('falls back to raw logs when the formatter throws', async () => {
     const logger = createMockLogger();
     await startWatchingAsync(logger);

packages/build-tools/src/common/installDependencies.ts

@@ -4,6 +4,7 @@ import path from 'path';
 
 import { BuildContext } from '../context';
 import { Sentry } from '../sentry';
+import { NpmCacheRegistryInstallError, isNpmCacheInstallFailure } from '../utils/npmCacheRegistry';
 import { PackageManager, findPackagerRootDir } from '../utils/packageManager';
 import { isUsingModernYarnVersion } from '../utils/project';
 
@@ -196,10 +197,6 @@ export function resolvePackagerDir(ctx: BuildContext<Job>): string {
   return packagerRunDir;
 }
 
-function isNpmCacheInstallFailure(err: unknown, npmCacheUrl: string): boolean {
-  return getErrorOutput(err).includes(npmCacheUrl);
-}
-
 function isNpmCacheRegistryErrorLine(line: string, npmCacheUrl: string): boolean {
   return (
     line.includes(npmCacheUrl) &&
@@ -207,24 +204,9 @@ function isNpmCacheRegistryErrorLine(line: string, npmCacheUrl: string): boolean
   );
 }
 
-function getErrorOutput(err: unknown): string {
-  if (!(err instanceof Error)) {
-    return '';
-  }
-  const { stdout, stderr } = err as Error & { stdout?: string; stderr?: string };
-  return [stdout, stderr].filter(Boolean).join('\n');
-}
-
 class NpmCacheRegistryNonFatalError extends SystemError {
   override name = 'NpmCacheRegistryNonFatalError';
   constructor() {
     super('Non-fatal npm cache registry error during dependency install');
   }
 }
-
-class NpmCacheRegistryInstallError extends SystemError {
-  override name = 'NpmCacheRegistryInstallError';
-  constructor(cause: unknown) {
-    super('Failed to install dependencies using npm cache registry', { cause });
-  }
-}

packages/build-tools/src/common/setup.ts

@@ -71,7 +71,12 @@ export async function setupAsync<TJob extends BuildJob>(
       }
     );
 
-    await setUpNpmrcAsync(ctx, ctx.logger);
+    await setUpNpmrcAsync({
+      projectTargetDirectory: ctx.buildDirectory,
+      workingDirectory: ctx.getReactNativeProjectDirectory(),
+      env: ctx.env,
+      logger: ctx.logger,
+    });
     if (ctx.job.platform === Platform.IOS && ctx.env.EAS_BUILD_RUNNER === 'eas-build') {
       await deleteXcodeEnvLocalIfExistsAsync(ctx as BuildContext<Ios.Job>);
     }

packages/build-tools/src/common/xcpretty.ts

@@ -80,9 +80,12 @@ export class XcodeBuildLogger {
           this.logger.info(data.toString());
         }
       });
-      await this.logReaderPromise;
-
-      this.logger.info(formatter.getBuildSummary());
+      try {
+        await this.logReaderPromise;
+      } finally {
+        // flush() interrupts tail, but the formatter may still hold a final compiler diagnostic.
+        this.logger.info(formatter.getBuildSummary());
+      }
     } catch (err: any) {
       if (!this.flushing) {
         this.loggerError = err;

packages/build-tools/src/index.ts

@@ -34,6 +34,7 @@ export { formatSecondsForLog } from './utils/formatDuration';
 export { findAndUploadXcodeBuildLogsAsync } from './ios/xcodeBuildLogs';
 
 export { Hook, runHookIfPresent } from './utils/hooks';
+export { detectPnpmUnsupportedNodeVersionError } from './buildErrors/pnpmUnsupportedNodeVersionError';
 
 export { parseGradleProfile, formatGradleProfileReport } from './android/gradleProfile';
 export type { GradleProfileTask } from './android/gradleProfile';

packages/build-tools/src/steps/functions/__tests__/repack.test.ts

@@ -1,8 +1,10 @@
 import { type bunyan } from '@expo/logger';
+import turtleSpawnAsync from '@expo/turtle-spawn';
 import assert from 'node:assert';
 import fg from 'fast-glob';
 import { vol } from 'memfs';
 import path from 'node:path';
+import resolveFrom from 'resolve-from';
 
 import { createGlobalContextMock } from '../../../__tests__/utils/context';
 import { createTestAndroidJob, createTestIosJob } from '../../../__tests__/utils/job';
@@ -17,17 +19,100 @@ import {
 } from '../repack';
 
 jest.mock('fs');
-jest.mock('@expo/spawn-async');
+jest.mock('@expo/turtle-spawn', () => ({ __esModule: true, default: jest.fn() }));
 jest.mock('@expo/repack-app');
-jest.mock('resolve-from', () => jest.fn((_, moduleName) => moduleName));
+jest.mock('resolve-from', () => jest.fn(() => '@expo/repack-app'));
 jest.mock('../../utils/ios/credentials/manager');
 
 describe(createRepackBuildFunction, () => {
+  beforeEach(() => {
+    jest.mocked(turtleSpawnAsync).mockImplementation((async (_command: string, args: string[]) => {
+      const sandbox = args[args.indexOf('--prefix') + 1];
+      const packageName = args[args.length - 1].replace(/@[^@/]*$/, '');
+      vol.fromJSON({
+        [path.join(sandbox, 'node_modules', packageName, 'package.json')]: JSON.stringify({
+          version: '2.0.0-next.1',
+        }),
+      });
+    }) as unknown as typeof turtleSpawnAsync);
+  });
+
   afterEach(() => {
     jest.restoreAllMocks();
     vol.reset();
   });
 
+  it('installs the repack package with npm in a sandbox whose env is only PATH and HOME, through the npm cache registry', async () => {
+    const globalCtx = createGlobalContextMock({
+      staticContextContent: {
+        job: {},
+      },
+    });
+    globalCtx.updateEnv({
+      PATH: '/usr/local/bin:/usr/bin',
+      EAS_BUILD_NPM_CACHE_URL: 'https://npm-cache.expo.test',
+      NPM_TOKEN: 'secret',
+    });
+    const repack = createRepackBuildFunction();
+    const repackStep = repack.createBuildStepFromFunctionCall(globalCtx, {
+      callInputs: {
+        platform: 'ios',
+        source_app_path: '/path/to/source_app.ipa',
+        repack_package: '@scope/fork',
+        repack_version: 'next',
+      },
+    });
+    const logInfo = jest.spyOn(repackStep.ctx.logger, 'info');
+
+    await repackStep.executeAsync();
+
+    const [installCall] = jest.mocked(turtleSpawnAsync).mock.calls;
+    const npmEnv = installCall[2]?.env;
+    assert(npmEnv);
+    expect(Object.keys(npmEnv).sort()).toEqual(['HOME', 'PATH']);
+    expect(npmEnv.PATH).toMatch(/\/usr\/local\/bin:\/usr\/bin$/);
+    expect(installCall).toEqual([
+      'npm',
+      [
+        'install',
+        '--prefix',
+        npmEnv.HOME,
+        '--no-save',
+        '--package-lock=false',
+        '--no-audit',
+        '--no-fund',
+        '--no-update-notifier',
+        '--registry',
+        'https://npm-cache.expo.test',
+        '@scope/fork@next',
+      ],
+      { env: npmEnv, logger: repackStep.ctx.logger },
+    ]);
+    expect(logInfo).toHaveBeenCalledWith('Using repack from: @scope/fork@next (2.0.0-next.1)');
+    expect(resolveFrom).toHaveBeenCalledWith(npmEnv.HOME, '@scope/fork');
+  });
+
+  it('installs the repack package from the default registry when the job has no npm cache', async () => {
+    const globalCtx = createGlobalContextMock({
+      staticContextContent: {
+        job: {},
+      },
+    });
+    globalCtx.updateEnv({ PATH: '/usr/local/bin:/usr/bin' });
+    const repack = createRepackBuildFunction();
+    const repackStep = repack.createBuildStepFromFunctionCall(globalCtx, {
+      callInputs: {
+        platform: 'ios',
+        source_app_path: '/path/to/source_app.ipa',
+      },
+    });
+
+    await repackStep.executeAsync();
+
+    const [installCall] = jest.mocked(turtleSpawnAsync).mock.calls;
+    expect(installCall[1]).not.toContain('--registry');
+  });
+
   it('should set generated output path for successful repack', async () => {
     const repack = createRepackBuildFunction();
     const repackStep = repack.createBuildStepFromFunctionCall(

packages/build-tools/src/steps/functions/__tests__/runAgent.test.ts

@@ -103,7 +103,7 @@ describe(createRunAgentBuildFunction, () => {
     );
     const npmEnv = installMock.mock.calls[0][2]!.env!;
     const agentEnv = spawnMock.mock.calls[0][2].env!;
-    expect(Object.keys(npmEnv).sort()).toEqual(['HOME', 'LANG', 'PATH', 'TMPDIR']);
+    expect(Object.keys(npmEnv).sort()).toEqual(['HOME', 'PATH']);
     expect(Object.keys(agentEnv).sort()).toEqual([
       'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC',
       'CLAUDE_CODE_OAUTH_TOKEN',

packages/build-tools/src/steps/functions/__tests__/startAppiumRemoteSession.test.ts

@@ -382,6 +382,29 @@ describe('createStartAppiumRemoteSessionBuildFunction session lifecycle', () =>
     );
   }
 
+  it('passes the existing Android selection to the preview host', async () => {
+    stopAppium.mockResolvedValue(undefined);
+    await runSessionAsync(logger);
+    expect(startDeviceSessionHostAsync).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ previewDeviceId: 'emulator-5554' })
+    );
+  });
+
+  it('passes the selected iOS preview target without enabling Simulator startup', async () => {
+    stopAppium.mockResolvedValue(undefined);
+    const udid = 'AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA';
+    jest
+      .mocked(IosSimulatorUtils.getAvailableDevicesAsync)
+      .mockResolvedValue([{ udid }, { udid: 'BBBBBBBB-BBBB-BBBB-BBBB-BBBBBBBBBBBB' }] as Awaited<
+        ReturnType<typeof IosSimulatorUtils.getAvailableDevicesAsync>
+      >);
+    await runSessionAsync(logger, undefined, BuildRuntimePlatform.DARWIN);
+    const options = jest.mocked(startDeviceSessionHostAsync).mock.calls[0][1];
+    expect(options).toHaveProperty('previewDeviceId', udid);
+    expect(options.iosSimulatorUdid).toBeUndefined();
+  });
+
   it.each([false, true])(
     'preserves preview settings with Simulator startup %s',
     async bootSimulator => {

packages/build-tools/src/steps/functions/__tests__/submitToGooglePlay.test.ts

@@ -198,7 +198,10 @@ it('does not delete the edit or publish outputs when commit outcome is unknown',
       return [204];
     });
   const task = submission();
-  await expect(task.run()).rejects.toBeInstanceOf(SystemError);
+  const error = await task.run().catch(error => error);
+  expect(error).toBeInstanceOf(SystemError);
+  expect((error as Error).message).toContain('HTTP 404');
+  expect((error as Error).message).toContain('Could not confirm whether Google Play saved');
   expect(deleted).toBe(false);
   expect(task.setters.every(set => set.mock.calls.length === 0)).toBe(true);
 });

packages/build-tools/src/steps/functions/__tests__/uploadToAsc.test.ts

@@ -1,7 +1,17 @@
+import { UserError } from '@expo/eas-build-job';
+import fs from 'fs-extra';
+
+import { createGlobalContextMock } from '../../../__tests__/utils/context';
+import { AscApiClient } from '../../utils/ios/AscApiClient';
+import { AscApiUtils } from '../../utils/ios/AscApiUtils';
 import {
+  createUploadToAscBuildFunction,
   isClosedVersionTrainError,
   isInvalidBundleIdentifierError,
+  isMissingAppIconsError,
+  isMissingBackgroundTaskIdentifiersError,
   isMissingPurposeStringError,
+  isRedundantBinaryUploadError,
   isSdkVersionIssueError,
   parseMissingUsageDescriptionKeys,
 } from '../uploadToAsc';
@@ -45,6 +55,20 @@ describe(isInvalidBundleIdentifierError, () => {
   });
 });
 
+describe(isRedundantBinaryUploadError, () => {
+  it('returns true when all errors are redundant-binary-upload codes', () => {
+    expect(isRedundantBinaryUploadError([{ code: '90189' }, { code: '90189' }])).toBe(true);
+  });
+
+  it('returns false when any other error code is present', () => {
+    expect(isRedundantBinaryUploadError([{ code: '90189' }, { code: '90062' }])).toBe(false);
+  });
+
+  it('returns false when there are no errors', () => {
+    expect(isRedundantBinaryUploadError([])).toBe(false);
+  });
+});
+
 describe(isMissingPurposeStringError, () => {
   it('returns true when all errors are missing-purpose-string codes', () => {
     expect(isMissingPurposeStringError([{ code: '90683' }, { code: '90683' }])).toBe(true);
@@ -73,6 +97,41 @@ describe(isSdkVersionIssueError, () => {
   });
 });
 
+describe(isMissingBackgroundTaskIdentifiersError, () => {
+  it('returns true when all errors are missing BG task identifiers codes', () => {
+    expect(isMissingBackgroundTaskIdentifiersError([{ code: '90771' }, { code: '90771' }])).toBe(
+      true
+    );
+  });
+
+  it('returns false when any other error code is present', () => {
+    expect(isMissingBackgroundTaskIdentifiersError([{ code: '90771' }, { code: '90062' }])).toBe(
+      false
+    );
+  });
+
+  it('returns false when there are no errors', () => {
+    expect(isMissingBackgroundTaskIdentifiersError([])).toBe(false);
+  });
+});
+
+describe(isMissingAppIconsError, () => {
+  it.each([['90391', '90713', '90713'], ['90713', '90022', '90023'], ['90022'], ['90023']])(
+    'recognizes missing-icon validation codes %j',
+    (...codes) => {
+      expect(isMissingAppIconsError(codes.map(code => ({ code })))).toBe(true);
+    }
+  );
+
+  it('returns false when any other error code is present', () => {
+    expect(isMissingAppIconsError([{ code: '90391' }, { code: '90771' }])).toBe(false);
+  });
+
+  it('returns false when there are no errors', () => {
+    expect(isMissingAppIconsError([])).toBe(false);
+  });
+});
+
 describe(parseMissingUsageDescriptionKeys, () => {
   it('extracts missing UsageDescription keys from ASC messages', () => {
     expect(
@@ -110,3 +169,176 @@ describe(parseMissingUsageDescriptionKeys, () => {
     ).toEqual([]);
   });
 });
+
+describe(createUploadToAscBuildFunction, () => {
+  it('keeps Apple duplicate-build details in the public error and the full state as its cause', async () => {
+    const state = {
+      state: 'FAILED',
+      errors: [
+        {
+          code: '90189',
+          description: 'Redundant Binary Upload. Build number 1 was already uploaded.',
+        },
+      ],
+      warnings: [{ code: 'WARNING', description: 'Apple warning.' }],
+      infos: [{ code: 'INFO', description: 'Apple information.' }],
+    };
+    await fs.writeFile('/app.ipa', 'ipa');
+    await fs.writeFile('/key.json', '{}');
+    jest.spyOn(AscApiUtils, 'loadApiKeyAsync').mockResolvedValue({} as never);
+    jest.spyOn(AscApiUtils, 'getAppInfoAsync').mockResolvedValue({
+      data: { attributes: { name: 'App', bundleId: 'com.example.app' } },
+    } as never);
+    jest.spyOn(AscApiUtils, 'createBuildUploadAsync').mockResolvedValue({
+      data: { id: 'upload-id' },
+    } as never);
+    jest.spyOn(AscApiUtils, 'commitBuildUploadFileAsync').mockResolvedValue(undefined as never);
+    jest.spyOn(AscApiClient.prototype, 'postAsync').mockResolvedValue({
+      data: { id: 'file-id', attributes: { uploadOperations: [] } },
+    } as never);
+    jest
+      .spyOn(AscApiClient.prototype, 'getAsync')
+      .mockResolvedValueOnce({
+        data: { attributes: { assetDeliveryState: { state: 'COMPLETE' } } },
+      } as never)
+      .mockResolvedValueOnce({ data: { attributes: { state } } } as never);
+    try {
+      const step = createUploadToAscBuildFunction().createBuildStepFromFunctionCall(
+        createGlobalContextMock({ staticContextContent: { job: {} } }),
+        {
+          callInputs: {
+            ipa_path: '/app.ipa',
+            asc_api_key_path: '/key.json',
+            apple_app_identifier: 'app-id',
+            bundle_version: '1',
+            bundle_short_version: '1.0',
+            wait_for_processing: true,
+          },
+        }
+      );
+      const error = await step.executeAsync().catch(error => error);
+      expect(error).toBeInstanceOf(UserError);
+      expect(error.errorCode).toBe('EAS_UPLOAD_TO_ASC_VERSION_DUPLICATE');
+      expect(error.cause).toEqual(state);
+      expect(error.toExternalExpoError().message).toContain(
+        'Redundant Binary Upload. Build number 1 was already uploaded. (90189)'
+      );
+    } finally {
+      jest.restoreAllMocks();
+    }
+  });
+});
+
+describe(createUploadToAscBuildFunction, () => {
+  it('keeps Apple background-task details in the public error and the full state as its cause', async () => {
+    const state = {
+      state: 'FAILED',
+      errors: [
+        {
+          code: '90771',
+          description:
+            'Missing BGTaskSchedulerPermittedIdentifiers while UIBackgroundModes includes processing.',
+        },
+      ],
+      warnings: [{ code: 'WARNING', description: 'Apple warning.' }],
+      infos: [{ code: 'INFO', description: 'Apple information.' }],
+    };
+    await fs.writeFile('/app.ipa', 'ipa');
+    await fs.writeFile('/key.json', '{}');
+    jest.spyOn(AscApiUtils, 'loadApiKeyAsync').mockResolvedValue({} as never);
+    jest.spyOn(AscApiUtils, 'getAppInfoAsync').mockResolvedValue({
+      data: { attributes: { name: 'App', bundleId: 'com.example.app' } },
+    } as never);
+    jest.spyOn(AscApiUtils, 'createBuildUploadAsync').mockResolvedValue({
+      data: { id: 'upload-id' },
+    } as never);
+    jest.spyOn(AscApiUtils, 'commitBuildUploadFileAsync').mockResolvedValue(undefined as never);
+    jest.spyOn(AscApiClient.prototype, 'postAsync').mockResolvedValue({
+      data: { id: 'file-id', attributes: { uploadOperations: [] } },
+    } as never);
+    jest
+      .spyOn(AscApiClient.prototype, 'getAsync')
+      .mockResolvedValueOnce({
+        data: { attributes: { assetDeliveryState: { state: 'COMPLETE' } } },
+      } as never)
+      .mockResolvedValueOnce({ data: { attributes: { state } } } as never);
+    try {
+      const step = createUploadToAscBuildFunction().createBuildStepFromFunctionCall(
+        createGlobalContextMock({ staticContextContent: { job: {} } }),
+        {
+          callInputs: {
+            ipa_path: '/app.ipa',
+            asc_api_key_path: '/key.json',
+            apple_app_identifier: 'app-id',
+            bundle_version: '1',
+            bundle_short_version: '1.0',
+            wait_for_processing: true,
+          },
+        }
+      );
+      const error = await step.executeAsync().catch(error => error);
+      expect(error).toBeInstanceOf(UserError);
+      expect(error.errorCode).toBe('EAS_UPLOAD_TO_ASC_MISSING_BG_TASK_IDENTIFIERS');
+      expect(error.cause).toEqual(state);
+      expect(error.toExternalExpoError().message).toContain(
+        'Missing BGTaskSchedulerPermittedIdentifiers while UIBackgroundModes includes processing. (90771)'
+      );
+    } finally {
+      jest.restoreAllMocks();
+    }
+  });
+});
+
+describe(createUploadToAscBuildFunction, () => {
+  it('keeps Apple validation details in the public error and the full state as its cause', async () => {
+    const state = {
+      state: 'FAILED',
+      errors: [{ code: '90713', description: 'Missing CFBundleIconName in Watch.app.' }],
+      warnings: [{ code: 'WARNING', description: 'Apple warning.' }],
+      infos: [{ code: 'INFO', description: 'Apple information.' }],
+    };
+    await fs.writeFile('/app.ipa', 'ipa');
+    await fs.writeFile('/key.json', '{}');
+    jest.spyOn(AscApiUtils, 'loadApiKeyAsync').mockResolvedValue({} as never);
+    jest.spyOn(AscApiUtils, 'getAppInfoAsync').mockResolvedValue({
+      data: { attributes: { name: 'App', bundleId: 'com.example.app' } },
+    } as never);
+    jest.spyOn(AscApiUtils, 'createBuildUploadAsync').mockResolvedValue({
+      data: { id: 'upload-id' },
+    } as never);
+    jest.spyOn(AscApiUtils, 'commitBuildUploadFileAsync').mockResolvedValue(undefined as never);
+    jest.spyOn(AscApiClient.prototype, 'postAsync').mockResolvedValue({
+      data: { id: 'file-id', attributes: { uploadOperations: [] } },
+    } as never);
+    jest
+      .spyOn(AscApiClient.prototype, 'getAsync')
+      .mockResolvedValueOnce({
+        data: { attributes: { assetDeliveryState: { state: 'COMPLETE' } } },
+      } as never)
+      .mockResolvedValueOnce({ data: { attributes: { state } } } as never);
+    try {
+      const step = createUploadToAscBuildFunction().createBuildStepFromFunctionCall(
+        createGlobalContextMock({ staticContextContent: { job: {} } }),
+        {
+          callInputs: {
+            ipa_path: '/app.ipa',
+            asc_api_key_path: '/key.json',
+            apple_app_identifier: 'app-id',
+            bundle_version: '1',
+            bundle_short_version: '1.0',
+            wait_for_processing: true,
+          },
+        }
+      );
+      const error = await step.executeAsync().catch(error => error);
+      expect(error).toBeInstanceOf(UserError);
+      expect(error.errorCode).toBe('EAS_UPLOAD_TO_ASC_MISSING_APP_ICONS');
+      expect(error.cause).toEqual(state);
+      expect(error.toExternalExpoError().message).toContain(
+        'Missing CFBundleIconName in Watch.app. (90713)'
+      );
+    } finally {
+      jest.restoreAllMocks();
+    }
+  });
+});

packages/build-tools/src/steps/functions/__tests__/useNpmToken.test.ts

@@ -0,0 +1,39 @@
+import spawn from '@expo/turtle-spawn';
+import { vol } from 'memfs';
+
+import { createGlobalContextMock } from '../../../__tests__/utils/context';
+import { NpmrcAuthTokenLine } from '../../../templates/npmrc';
+import { createSetUpNpmrcBuildFunction } from '../useNpmToken';
+
+jest.mock('fs');
+jest.mock('@expo/turtle-spawn', () => ({ __esModule: true, default: jest.fn() }));
+
+const projectTargetDirectory = '/workingdir/project';
+const homeDirectory = '/home/expo';
+
+describe(createSetUpNpmrcBuildFunction, () => {
+  beforeEach(async () => {
+    vol.reset();
+    await vol.promises.mkdir(projectTargetDirectory, { recursive: true });
+    await vol.promises.mkdir(homeDirectory, { recursive: true });
+    jest.mocked(spawn).mockResolvedValue({ stdout: `${homeDirectory}/.npmrc\n` } as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('adds the NPM_TOKEN placeholder from the step env to ~/.npmrc on EAS Build', async () => {
+    const globalCtx = createGlobalContextMock({ projectTargetDirectory });
+    globalCtx.updateEnv({ NPM_TOKEN: 'npm_secret_token', EAS_BUILD_RUNNER: 'eas-build' });
+    const step = createSetUpNpmrcBuildFunction().createBuildStepFromFunctionCall(globalCtx, {
+      callInputs: {},
+    });
+
+    await step.executeAsync();
+
+    expect(await vol.promises.readFile(`${homeDirectory}/.npmrc`, 'utf8')).toContain(
+      NpmrcAuthTokenLine
+    );
+  });
+});

packages/build-tools/src/steps/functions/repack.ts

@@ -23,7 +23,7 @@ import resolveFrom from 'resolve-from';
 
 import { COMMON_FASTLANE_ENV } from '../../common/fastlane';
 import IosCredentialsManager from '../utils/ios/credentials/manager';
-import { resolvePackageVersionAsync } from '../../utils/packageManager';
+import { installIsolatedNpmPackageAsync } from '../../utils/installIsolatedNpmPackageAsync';
 
 export function createRepackBuildFunction(): BuildFunction {
   return new BuildFunction({
@@ -121,18 +121,12 @@ export function createRepackBuildFunction(): BuildFunction {
         : undefined;
       const jsBundleOnly = (inputs.js_bundle_only.value as boolean | undefined) ?? false;
 
-      const resolvedRepackVersion =
-        (await resolvePackageVersionAsync({
-          logger: stepsCtx.logger,
-          packageName: inputs.repack_package.value as string,
-          distTag: inputs.repack_version.value as string,
-        })) ?? (inputs.repack_version.value as string);
-      stepsCtx.logger.info(
-        `Using repack from: ${inputs.repack_package.value}@${inputs.repack_version.value} (${resolvedRepackVersion})`
-      );
       const repackApp = await installAndImportRepackAsync({
         packageName: inputs.repack_package.value as string,
-        version: resolvedRepackVersion,
+        versionSpec: inputs.repack_version.value as string,
+        pathEnv: env.PATH,
+        npmCacheUrl: env.EAS_BUILD_NPM_CACHE_URL,
+        logger: stepsCtx.logger,
       });
       const { repackAppIosAsync, repackAppAndroidAsync } = repackApp;
 
@@ -226,16 +220,28 @@ function createOutputPath({
  */
 async function installAndImportRepackAsync({
   packageName,
-  version,
+  versionSpec,
+  pathEnv,
+  npmCacheUrl,
+  logger,
 }: {
   packageName: string;
-  version: string;
+  versionSpec: string;
+  pathEnv: string | undefined;
+  npmCacheUrl: string | undefined;
+  logger: bunyan;
 }): Promise<typeof import('@expo/repack-app')> {
   const sandbox = await fs.promises.mkdtemp(path.join(os.tmpdir(), `repack-package-root-`));
-  await spawnAsync('yarn', ['add', `${packageName}@${version}`], {
-    stdio: 'inherit',
-    cwd: sandbox,
+  await installIsolatedNpmPackageAsync({
+    packageSpec: `${packageName}@${versionSpec}`,
+    directory: sandbox,
+    npmCacheUrl,
+    pathEnv,
+    logger,
   });
+  const packageJsonPath = path.join(sandbox, 'node_modules', packageName, 'package.json');
+  const { version } = JSON.parse(await fs.promises.readFile(packageJsonPath, 'utf8'));
+  logger.info(`Using repack from: ${packageName}@${versionSpec} (${version})`);
   return require(resolveFrom(sandbox, packageName));
 }
 

packages/build-tools/src/steps/functions/startAgentDeviceRemoteSession.ts

@@ -167,6 +167,7 @@ export async function runAgentDeviceRemoteSessionAsync(
       subdomainPrefix: 'agent-device',
       baseDomain: ngrokTunnelDomain,
       authtoken: ngrokAuthtoken,
+      healthCheck: { path: '/health' },
       logger: taskLogger,
     });
     tasks.signal.throwIfAborted();

packages/build-tools/src/steps/functions/startAppiumRemoteSession.ts

@@ -157,6 +157,7 @@ export function createStartAppiumRemoteSessionBuildFunction(
       const startHost = () =>
         startDeviceSessionHostAsync(ctx, {
           ...iosStartup,
+          previewDeviceId: device.udid,
           separateLogPhase: true,
           runtimePlatform,
           env,
@@ -273,11 +274,11 @@ export function createStartAppiumRemoteSessionBuildFunction(
           subdomainPrefix: 'appium',
           baseDomain: ngrokTunnelDomain,
           authtoken: ngrokAuthtoken,
+          healthCheck: { path: '/status' },
           logger,
         });
 
-        // expo-device-hub has no serial-selection flag. Device run session workflows must expose
-        // a single booted Android emulator so the Hub and Appium resolve the same device.
+        // The preview host uses the same device selected for Appium.
         const launchDescription = describeServeSimLaunch(launch);
         if (launchDescription) {
           logger.info(launchDescription);

packages/build-tools/src/steps/functions/startArgentRemoteSession.ts

@@ -340,6 +340,7 @@ export function createStartArgentRemoteSessionBuildFunction(
           baseDomain: ngrokTunnelDomain,
           authtoken: ngrokAuthtoken,
           rewriteHostHeader: true,
+          healthCheck: { path: '/tools', statuses: [200, 401] },
           logger,
         });
         const publicToolsUrl = toolsTunnel.url;

packages/build-tools/src/steps/functions/uploadToAsc.ts

@@ -262,6 +262,45 @@ export function createUploadToAscBuildFunction(): BuildFunction {
               }
             );
           }
+          if (isRedundantBinaryUploadError(errors)) {
+            throw new UserError(
+              'EAS_UPLOAD_TO_ASC_VERSION_DUPLICATE',
+              `Increment Build Number: Build number ${bundleVersion} for app version ${bundleShortVersion} has already been used. ` +
+                'App Store Connect requires unique build numbers within each app version (version train). ' +
+                'Increment it by setting ios.buildNumber in app.json, or set "autoIncrement": true in eas.json (recommended). Then rebuild and resubmit.' +
+                `\n\nApp Store Connect errors:\n${itemizeMessages(errors)}`,
+              {
+                docsUrl: 'https://docs.expo.dev/build-reference/app-versions/',
+                cause: state,
+              }
+            );
+          }
+          if (isMissingBackgroundTaskIdentifiersError(errors)) {
+            throw new UserError(
+              'EAS_UPLOAD_TO_ASC_MISSING_BG_TASK_IDENTIFIERS',
+              'Build upload was rejected by App Store Connect because Info.plist is missing `BGTaskSchedulerPermittedIdentifiers` while `UIBackgroundModes` includes `processing`. ' +
+                'In an Expo project, add `BGTaskSchedulerPermittedIdentifiers` to `ios.infoPlist` in your app config and include every background task identifier the app schedules. ' +
+                'If you do not use Continuous Native Generation (CNG), add the same key to the native target Info.plist. Then rebuild and submit again.' +
+                `\n\nApp Store Connect errors:\n${itemizeMessages(errors)}`,
+              {
+                docsUrl: 'https://docs.expo.dev/versions/latest/config/app/#infoplist',
+                cause: state,
+              }
+            );
+          }
+          if (isMissingAppIconsError(errors)) {
+            throw new UserError(
+              'EAS_UPLOAD_TO_ASC_MISSING_APP_ICONS',
+              'Build upload was rejected by App Store Connect because required app icons are missing or misconfigured in one of the iOS bundles. ' +
+                'In an Expo project, check your icon config (`expo.icon`, `ios.icon`) and any custom native targets or plugins that create extra bundles, such as watch extensions. ' +
+                'Make sure the affected target has the required icon assets and Info.plist icon keys (for example `CFBundleIconName` / `CFBundleIconFiles`), then rebuild and submit again.' +
+                `\n\nApp Store Connect errors:\n${itemizeMessages(errors)}`,
+              {
+                docsUrl: 'https://docs.expo.dev/develop/user-interface/splash-screen-and-app-icon/',
+                cause: state,
+              }
+            );
+          }
           if (isInvalidBundleIdentifierError(errors)) {
             const ipaInfoResult = await asyncResult(readIpaInfoAsync(ipaPath));
             const ipaBundleIdentifier = ipaInfoResult.ok
@@ -344,6 +383,21 @@ export function isSdkVersionIssueError(messages: { code: string }[]): boolean {
   return messages.length > 0 && messages.every(message => message.code === '90725');
 }
 
+export function isRedundantBinaryUploadError(messages: { code: string }[]): boolean {
+  return messages.length > 0 && messages.every(message => message.code === '90189');
+}
+
+export function isMissingBackgroundTaskIdentifiersError(messages: { code: string }[]): boolean {
+  return messages.length > 0 && messages.every(message => message.code === '90771');
+}
+
+export function isMissingAppIconsError(messages: { code: string }[]): boolean {
+  return (
+    messages.length > 0 &&
+    messages.every(message => ['90022', '90023', '90391', '90713'].includes(message.code))
+  );
+}
+
 export function isInvalidBundleIdentifierError(messages: { code: string }[]): boolean {
   return (
     messages.length > 0 && messages.every(message => ['90054', '90055'].includes(message.code))

packages/build-tools/src/steps/functions/useNpmToken.ts

@@ -1,9 +1,6 @@
 import { BuildFunction } from '@expo/steps';
-import fs from 'fs-extra';
-import path from 'path';
 
-import { NpmrcTemplate } from '../../templates/npmrc';
-import { findPackagerRootDir } from '../../utils/packageManager';
+import { setUpNpmrcAsync } from '../../utils/npmrc';
 
 export function createSetUpNpmrcBuildFunction(): BuildFunction {
   return new BuildFunction({
@@ -12,28 +9,12 @@ export function createSetUpNpmrcBuildFunction(): BuildFunction {
     name: 'Use NPM_TOKEN',
     __metricsId: 'eas/use_npm_token',
     fn: async (stepCtx, { env }) => {
-      const { logger } = stepCtx;
-      if (env.NPM_TOKEN) {
-        logger.info('We detected that you set the NPM_TOKEN environment variable');
-        const projectNpmrcPath = path.join(stepCtx.global.projectTargetDirectory, '.npmrc');
-        if (await fs.pathExists(projectNpmrcPath)) {
-          logger.info('.npmrc already exists in your project directory, skipping generation');
-        } else {
-          logger.info('Creating .npmrc in your project directory with the following contents:');
-          logger.info(NpmrcTemplate);
-          await fs.writeFile(projectNpmrcPath, NpmrcTemplate);
-        }
-      } else {
-        const projectNpmrcPath = path.join(findPackagerRootDir(stepCtx.workingDirectory), '.npmrc');
-        if (await fs.pathExists(projectNpmrcPath)) {
-          logger.info(
-            `.npmrc found at ${path.relative(
-              stepCtx.global.projectTargetDirectory,
-              projectNpmrcPath
-            )}`
-          );
-        }
-      }
+      await setUpNpmrcAsync({
+        projectTargetDirectory: stepCtx.global.projectTargetDirectory,
+        workingDirectory: stepCtx.workingDirectory,
+        env,
+        logger: stepCtx.logger,
+      });
     },
   });
 }

packages/build-tools/src/steps/utils/IosSimulatorRecordingUtils.ts

@@ -36,7 +36,7 @@ const SERVE_SIM_LEASE_FINALIZE_TIMEOUT_MS =
 const SERVE_SIM_FINISH_TIMEOUT_MS =
   SERVE_SIM_CONTROL_REQUEST_TIMEOUT_MS + SERVE_SIM_LEASE_FINALIZE_TIMEOUT_MS;
 const SERVE_SIM_FORCE_STOP_TIMEOUT_MS = 5_000;
-const SERVE_SIM_RECORDING_STARTED = 'serve-sim:recording-started';
+const SERVE_SIM_RECORDING_STARTED_LINE = /(?:^|\n)serve-sim:recording-started\r?\n/;
 // The serve-sim package the session host started; every recorder runs `record-video` from it.
 let serveSimPackageSpec: string | null = null;
 
@@ -507,14 +507,19 @@ function captureProcessOutput(recordingProcess: ChildProcess): {
 } {
   let output = '';
   let started = false;
-  const appendChunk = (chunk: Buffer | string): void => {
-    output = `${output}${chunk.toString()}`;
-    if (output.includes(SERVE_SIM_RECORDING_STARTED)) {
-      started = true;
-    }
-    output = output.slice(-16_384);
+  const captureStreamOutput = (stream: ChildProcess['stdout']): void => {
+    let streamOutput = '';
+    stream?.on('data', (chunk: Buffer | string) => {
+      const text = chunk.toString();
+      output = `${output}${text}`.slice(-16_384);
+      streamOutput = `${streamOutput}${text}`;
+      if (SERVE_SIM_RECORDING_STARTED_LINE.test(streamOutput)) {
+        started = true;
+      }
+      streamOutput = streamOutput.slice(-16_384);
+    });
   };
-  recordingProcess.stdout?.on('data', appendChunk);
-  recordingProcess.stderr?.on('data', appendChunk);
+  captureStreamOutput(recordingProcess.stdout);
+  captureStreamOutput(recordingProcess.stderr);
   return { getOutput: () => output, hasStarted: () => started };
 }

packages/build-tools/src/steps/utils/__tests__/IosSimulatorRecordingUtils.test.ts

@@ -144,7 +144,10 @@ test('starts serve-sim record-video and returns only a finalized recording', asy
   const finishing = IosSimulatorRecordingUtils.finishAsync({ logger });
   await setTimeout(20);
   expect(child.kill).not.toHaveBeenCalled();
-  stderr.write('serve-sim:recording-started\n');
+  child.stdout?.emit('data', 'Downloading');
+  stderr.write('serve-sim:recording-');
+  child.stdout?.emit('data', ' package');
+  stderr.write('started\r\n');
   stderr.write('x'.repeat(17_000));
   const recordings = await finishing;
 
@@ -362,6 +365,32 @@ test('keeps a recorder active after its package-manager wrapper exits', async ()
   expect(recordings).toHaveLength(1);
 });
 
+test('does not mistake bundled source in an error for a recording start', async () => {
+  let currentTime = Date.now();
+  jest.spyOn(Date, 'now').mockImplementation(() => currentTime);
+  jest
+    .mocked(readServeSimServersAsync)
+    .mockResolvedValue([{ udid, url: 'http://127.0.0.1:43563', token: 'session-token' }]);
+  const recorder = mockRecorder();
+
+  await IosSimulatorRecordingUtils.startAsync({ env, logger });
+  await waitForRecorderSpawnAsync();
+  recorder.child.stderr?.emit(
+    'data',
+    'const marker = "serve-sim:recording-started";\nError: No running serve-sim session found.\n'
+  );
+  recorder.fail(new Error('recorder exited before connecting'));
+
+  const finishing = IosSimulatorRecordingUtils.finishAsync({ logger });
+  try {
+    expect(await Promise.race([finishing.then(() => true), setTimeout(250, false)])).toBe(true);
+  } finally {
+    currentTime += 311_000;
+    await finishing;
+  }
+  expect(recorder.child.kill).not.toHaveBeenCalled();
+});
+
 test('does not signal a recorder that exits before it reports its start', async () => {
   let currentTime = Date.now();
   jest.spyOn(Date, 'now').mockImplementation(() => currentTime);

packages/build-tools/src/steps/utils/__tests__/agentRun.test.ts

@@ -186,6 +186,7 @@ describe(runAgentAsync, () => {
         '--package-lock=false',
         '--no-audit',
         '--no-fund',
+        '--no-update-notifier',
         '--registry',
         'https://npm-cache.expo.test',
         '@anthropic-ai/[email protected]',

packages/build-tools/src/steps/utils/__tests__/deviceRunSessionWorkerApiCallers.test.ts

@@ -7,6 +7,7 @@ import { setImmediate } from 'node:timers/promises';
 
 import { type CustomBuildContext } from '../../../customBuildContext';
 import RemoteLoggerStream from '../../../logging/RemoteLoggerStream';
+import { Sentry } from '../../../sentry';
 import { turtleFetch } from '../../../utils/turtleFetch';
 import { downloadBuildAsync } from '../../functions/downloadBuild';
 import { uploadDeviceRunSessionArtifactAsync } from '../deviceRunSessionArtifacts';
@@ -266,6 +267,48 @@ describe('with a device run session token', () => {
     expect(jest.mocked(turtleFetch)).toHaveBeenCalledTimes(1);
   });
 
+  it('handles a stopped-session TURN response without a warning or retry', async () => {
+    const ctx = createCtx({ withToken: true });
+    jest
+      .mocked(turtleFetch)
+      .mockResolvedValueOnce(
+        jsonResponse(
+          { errors: [{ code: 'DEVICE_RUN_SESSION_ALREADY_STOPPED', message: 'Stopped.' }] },
+          400
+        )
+      );
+
+    await expect(fetchWebPreviewTurnArgsAsync(ctx, { logger })).resolves.toEqual([]);
+
+    expect(logger.info).toHaveBeenCalledWith(
+      'Device run session was stopped before TURN credentials were fetched.'
+    );
+    expect(logger.warn).not.toHaveBeenCalled();
+    expect(Sentry.capture).not.toHaveBeenCalled();
+    expect(turtleFetch).toHaveBeenCalledTimes(1);
+  });
+
+  it.each([undefined, 'VALIDATION_ERROR'])(
+    'still warns on a TURN failure with code %s',
+    async code => {
+      const ctx = createCtx({ withToken: true });
+      jest
+        .mocked(turtleFetch)
+        .mockResolvedValueOnce(
+          jsonResponse(
+            { errors: [{ code, message: 'Device run session has already stopped.' }] },
+            400
+          )
+        );
+
+      await expect(fetchWebPreviewTurnArgsAsync(ctx, { logger })).resolves.toEqual([]);
+
+      expect(logger.warn).toHaveBeenCalled();
+      expect(Sentry.capture).toHaveBeenCalled();
+      expect(turtleFetch).toHaveBeenCalledTimes(1);
+    }
+  );
+
   it('creates artifact upload sessions through the worker API', async () => {
     const ctx = createCtx({ withToken: true });
     jest.mocked(turtleFetch).mockResolvedValueOnce(

packages/build-tools/src/steps/utils/__tests__/deviceSessionHost.test.ts

@@ -24,6 +24,7 @@ import {
   uploadDeviceRunSessionScreenRecordingsAsync,
 } from '../deviceRunSessionScreenRecordings';
 import {
+  captureDeviceRunSessionPreviewAsync,
   ensureMacosPreviewEncoderInstalledAsync,
   startDeviceRunSessionPreview,
 } from '../deviceRunSessionPreview';
@@ -68,6 +69,7 @@ jest.mock('../remoteDeviceRunSession', () => ({
 jest.mock('../deviceRunSessionPreview', () => ({
   ...jest.requireActual('../deviceRunSessionPreview'),
   ensureMacosPreviewEncoderInstalledAsync: jest.fn(),
+  captureDeviceRunSessionPreviewAsync: jest.fn(),
   startDeviceRunSessionPreview: jest.fn(),
 }));
 jest.mock('../deviceRunSessionScreenRecordings', () => ({
@@ -191,6 +193,91 @@ afterEach(async () => {
   );
 });
 
+it.each([undefined, '', 'invalid serial', 'all', 'booted'])(
+  'starts Hub without adding a device restriction for %j',
+  async previewDeviceId => {
+    const host = await startDeviceSessionHostAsync(ctx, {
+      runtimePlatform: BuildRuntimePlatform.LINUX,
+      env,
+      logger,
+      timeoutMs: 10_000,
+      previewDeviceId,
+    });
+    try {
+      expect(jest.mocked(spawnDetached).mock.calls[0][0].args).not.toContain('--single-device');
+    } finally {
+      await host.finishAsync();
+    }
+  }
+);
+
+it('uses the supplied Android serial for Hub and thumbnails without selecting another device', async () => {
+  jest.mocked(turtleFetch).mockResolvedValue({
+    ok: true,
+    json: async () => ({ status: 'ready', device: 'no-device-id' }),
+  } as Awaited<ReturnType<typeof turtleFetch>>);
+  const host = await startDeviceSessionHostAsync(ctx, {
+    runtimePlatform: BuildRuntimePlatform.LINUX,
+    env,
+    logger,
+    timeoutMs: 10_000,
+    previewDeviceId: 'emulator-5556',
+  });
+  try {
+    const args = jest.mocked(spawnDetached).mock.calls[0][0].args;
+    expect(
+      args.slice(args.indexOf('--single-device'), args.indexOf('--single-device') + 2)
+    ).toEqual(['--single-device', 'emulator-5556']);
+    await new Promise(resolve => setImmediate(resolve));
+    await jest
+      .mocked(startDeviceRunSessionPreview)
+      .mock.calls[0][0].captureAsync(new AbortController().signal);
+    expect(captureDeviceRunSessionPreviewAsync).toHaveBeenCalledWith(
+      expect.objectContaining({ device: 'emulator-5556' })
+    );
+  } finally {
+    await host.finishAsync();
+  }
+});
+
+it('pins an already-booted iOS preview without taking over boot or setup', async () => {
+  const udid = 'AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA';
+  jest.mocked(turtleFetch).mockResolvedValue({
+    ok: true,
+    json: async () => ({ status: 'ready', device: udid }),
+  } as Awaited<ReturnType<typeof turtleFetch>>);
+  const host = await startDeviceSessionHostAsync(ctx, {
+    runtimePlatform: BuildRuntimePlatform.DARWIN,
+    env,
+    logger,
+    timeoutMs: 10_000,
+    previewDeviceId: udid,
+  });
+  try {
+    const args = jest.mocked(spawnDetached).mock.calls[0][0].args;
+    expect(
+      args.slice(args.indexOf('--single-device'), args.indexOf('--single-device') + 2)
+    ).toEqual(['--single-device', udid]);
+    expect(IosSimulatorUtils.disableApsdAsync).not.toHaveBeenCalled();
+    expect(runServeSimActionAsync).not.toHaveBeenCalled();
+  } finally {
+    await host.finishAsync();
+  }
+});
+
+it('rejects readiness on a different Simulator from the selected preview target', async () => {
+  await expect(
+    startDeviceSessionHostAsync(ctx, {
+      runtimePlatform: BuildRuntimePlatform.DARWIN,
+      env,
+      logger,
+      timeoutMs: 10_000,
+      previewDeviceId: 'AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA',
+    })
+  ).rejects.toThrow('but this session requested AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA');
+  expect(stopServer).toHaveBeenCalled();
+});
+
 it('targets the selected Simulator in the serve-sim invocation', () => {
   expect(createServeSimArgs({ port: 4321, iosSimulatorUdid: 'session-udid' }).slice(0, 4)).toEqual([
     '@expo/serve-sim@latest',

packages/build-tools/src/steps/utils/__tests__/ngrokTunnel.test.ts

@@ -0,0 +1,873 @@
+import { type bunyan } from '@expo/logger';
+import * as ngrok from '@ngrok/ngrok';
+import { once } from 'node:events';
+import { createServer } from 'node:http';
+import WebSocket, { WebSocketServer } from 'ws';
+import { type AddressInfo, createConnection, createServer as createTcpServer } from 'node:net';
+
+import { turtleFetch } from '../../../utils/turtleFetch';
+import { startNgrokTunnelAsync } from '../ngrokTunnel';
+
+jest.mock('@ngrok/ngrok');
+jest.mock('node:timers', () => ({
+  setTimeout: (...args: Parameters<typeof setTimeout>) => setTimeout(...args),
+  clearTimeout: (...args: Parameters<typeof clearTimeout>) => clearTimeout(...args),
+}));
+jest.mock('../../../utils/turtleFetch');
+
+const { Response } = jest.requireActual<typeof import('node-fetch')>('node-fetch');
+const url = 'https://web-preview-fixed.example.test';
+const logger = { info: jest.fn(), warn: jest.fn() } as unknown as bunyan;
+const options = {
+  port: 4321,
+  subdomainPrefix: 'web-preview',
+  subdomainId: 'fixed',
+  baseDomain: 'example.test',
+  authtoken: 'token',
+  rewriteHostHeader: true,
+  healthCheck: { path: '/healthz' },
+  logger,
+};
+
+function listener(publicUrl = url) {
+  return { url: () => publicUrl, close: jest.fn().mockResolvedValue(undefined) };
+}
+
+let initial: ReturnType<typeof listener>;
+let replacement: ReturnType<typeof listener>;
+
+beforeEach(() => {
+  jest.useFakeTimers({ doNotFake: ['nextTick', 'setImmediate'] });
+  jest.clearAllMocks();
+  initial = listener();
+  replacement = listener();
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockResolvedValueOnce(initial as never)
+    .mockResolvedValue(replacement as never);
+  jest
+    .mocked(turtleFetch)
+    .mockReset()
+    .mockResolvedValue(new Response(undefined, { status: 200 }));
+});
+
+afterEach(() => {
+  jest.useRealTimers();
+});
+
+function failPublicProbes() {
+  jest.mocked(turtleFetch).mockImplementation(
+    async target =>
+      new Response(undefined, {
+        status: target.startsWith('https:') ? 503 : 200,
+      })
+  );
+}
+
+it('keeps tunnels without a health check unsupervised and closes them on stop', async () => {
+  const tunnel = await startNgrokTunnelAsync({ ...options, healthCheck: undefined });
+  await jest.advanceTimersByTimeAsync(90_000);
+  expect(turtleFetch).not.toHaveBeenCalled();
+  expect(ngrok.forward).toHaveBeenCalledTimes(1);
+  await tunnel.stopAsync();
+  expect(initial.close).toHaveBeenCalledTimes(1);
+});
+
+it('probes the public service and keeps a healthy listener open', async () => {
+  const tunnel = await startNgrokTunnelAsync(options);
+  try {
+    await jest.advanceTimersByTimeAsync(45_000);
+    expect(turtleFetch).toHaveBeenCalledTimes(3);
+    expect(turtleFetch).toHaveBeenCalledWith(
+      `${url}/healthz`,
+      'GET',
+      expect.objectContaining({
+        retries: 0,
+        redirect: 'manual',
+        headers: expect.objectContaining({ 'ngrok-skip-browser-warning': 'true' }),
+      })
+    );
+    expect(ngrok.forward).toHaveBeenCalledTimes(1);
+  } finally {
+    await tunnel.stopAsync();
+  }
+  expect(initial.close).toHaveBeenCalledTimes(1);
+  await jest.advanceTimersByTimeAsync(60_000);
+  expect(turtleFetch).toHaveBeenCalledTimes(3);
+});
+
+it('reopens after three failed public probes with a healthy local service, preserving the endpoint', async () => {
+  failPublicProbes();
+  const tunnel = await startNgrokTunnelAsync(options);
+  try {
+    await jest.advanceTimersByTimeAsync(30_000);
+    expect(initial.close).not.toHaveBeenCalled();
+    await jest.advanceTimersByTimeAsync(15_000);
+    expect(initial.close).toHaveBeenCalledTimes(1);
+    expect(ngrok.forward).toHaveBeenCalledTimes(2);
+    expect(jest.mocked(ngrok.forward).mock.calls[1][0]).toEqual({
+      addr: expect.any(Number),
+      authtoken: 'token',
+      domain: 'web-preview-fixed.example.test',
+      request_header_add: ['Host:localhost:4321'],
+      force_new_session: true,
+    });
+    expect(tunnel.url).toBe(url);
+    jest.mocked(turtleFetch).mockResolvedValue(new Response(undefined, { status: 200 }));
+    await jest.advanceTimersByTimeAsync(15_000);
+    expect(logger.info).toHaveBeenCalledWith(expect.stringContaining('healthy again'));
+  } finally {
+    await tunnel.stopAsync();
+  }
+  expect(replacement.close).toHaveBeenCalledTimes(1);
+});
+
+it('does not reopen when the local service is unhealthy', async () => {
+  jest.mocked(turtleFetch).mockResolvedValue(new Response(undefined, { status: 503 }));
+  const tunnel = await startNgrokTunnelAsync(options);
+  try {
+    await jest.advanceTimersByTimeAsync(90_000);
+    expect(ngrok.forward).toHaveBeenCalledTimes(1);
+    expect(initial.close).not.toHaveBeenCalled();
+  } finally {
+    await tunnel.stopAsync();
+  }
+});
+
+it('resets consecutive failures after a successful public probe', async () => {
+  failPublicProbes();
+  const tunnel = await startNgrokTunnelAsync(options);
+  try {
+    await jest.advanceTimersByTimeAsync(30_000);
+    jest.mocked(turtleFetch).mockResolvedValueOnce(new Response(undefined, { status: 200 }));
+    await jest.advanceTimersByTimeAsync(15_000);
+    await jest.advanceTimersByTimeAsync(30_000);
+    expect(ngrok.forward).toHaveBeenCalledTimes(1);
+  } finally {
+    await tunnel.stopAsync();
+  }
+});
+
+it('retries a failed reopen with backoff', async () => {
+  failPublicProbes();
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockResolvedValueOnce(initial as never)
+    .mockRejectedValueOnce(new Error('offline'))
+    .mockResolvedValue(replacement as never);
+  const tunnel = await startNgrokTunnelAsync(options);
+  try {
+    await jest.advanceTimersByTimeAsync(45_000);
+    expect(ngrok.forward).toHaveBeenCalledTimes(2);
+    await jest.advanceTimersByTimeAsync(1_999);
+    expect(ngrok.forward).toHaveBeenCalledTimes(2);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(ngrok.forward).toHaveBeenCalledTimes(3);
+  } finally {
+    await tunnel.stopAsync();
+  }
+});
+
+it('closes a listener that finishes opening after shutdown, with idempotent cleanup', async () => {
+  failPublicProbes();
+  let resolveOpening!: (value: ngrok.Listener) => void;
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockResolvedValueOnce(initial as never)
+    .mockReturnValueOnce(
+      new Promise(resolve => {
+        resolveOpening = resolve;
+      })
+    );
+  const tunnel = await startNgrokTunnelAsync(options);
+  await jest.advanceTimersByTimeAsync(45_000);
+  const stopping = tunnel.stopAsync();
+  expect(tunnel.stopAsync()).toBe(stopping);
+  const stopped = jest.fn();
+  void stopping.then(stopped);
+  await jest.advanceTimersByTimeAsync(0);
+  expect(stopped).not.toHaveBeenCalled();
+  resolveOpening(replacement as never);
+  await stopping;
+  expect(replacement.close).toHaveBeenCalledTimes(1);
+  await jest.advanceTimersByTimeAsync(120_000);
+  expect(ngrok.forward).toHaveBeenCalledTimes(2);
+});
+
+it('waits for a replacement acquired during shutdown to finish closing', async () => {
+  failPublicProbes();
+  let resolveOpening!: (value: ngrok.Listener) => void;
+  let resolveClose!: () => void;
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockResolvedValueOnce(initial as never)
+    .mockReturnValueOnce(new Promise(resolve => (resolveOpening = resolve)));
+  replacement.close.mockReturnValue(new Promise<void>(resolve => (resolveClose = resolve)));
+  const tunnel = await startNgrokTunnelAsync(options);
+  await jest.advanceTimersByTimeAsync(45_000);
+  let stopped = false;
+  const stopping = tunnel.stopAsync().then(() => {
+    stopped = true;
+  });
+  await jest.advanceTimersByTimeAsync(0);
+  resolveOpening(replacement as never);
+  await jest.advanceTimersByTimeAsync(0);
+  const stoppedBeforeClose = stopped;
+  resolveClose();
+  await jest.advanceTimersByTimeAsync(250);
+  await stopping;
+  expect(stoppedBeforeClose).toBe(false);
+  expect(replacement.close).toHaveBeenCalledTimes(1);
+});
+
+it.each([0, 4, 5, 10])('retires a reopen cancelled after %s promise turns', async turns => {
+  failPublicProbes();
+  let resolveOpening!: (value: ngrok.Listener) => void;
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockResolvedValueOnce(initial as never)
+    .mockReturnValueOnce(new Promise(resolve => (resolveOpening = resolve)));
+  const tunnel = await startNgrokTunnelAsync(options);
+  await jest.advanceTimersByTimeAsync(45_000);
+  resolveOpening(replacement as never);
+  for (let turn = 0; turn < turns; turn++) {
+    await Promise.resolve();
+  }
+  await tunnel.stopAsync();
+  await jest.advanceTimersByTimeAsync(0);
+  expect(replacement.close).toHaveBeenCalledTimes(1);
+});
+
+it('retries a rejected close when a reopen finishes after shutdown', async () => {
+  failPublicProbes();
+  let resolveOpening!: (value: ngrok.Listener) => void;
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockResolvedValueOnce(initial as never)
+    .mockReturnValueOnce(new Promise(resolve => (resolveOpening = resolve)));
+  const tunnel = await startNgrokTunnelAsync(options);
+  await jest.advanceTimersByTimeAsync(45_000);
+  const stopping = tunnel.stopAsync();
+  replacement.close.mockRejectedValueOnce(new Error('temporary unlisten failure'));
+  resolveOpening(replacement as never);
+  await jest.advanceTimersByTimeAsync(250);
+  await stopping;
+  expect(replacement.close).toHaveBeenCalledTimes(2);
+  const warnings = jest.mocked(logger.warn).mock.calls.length;
+  await jest.advanceTimersByTimeAsync(120_000);
+  expect(logger.warn).toHaveBeenCalledTimes(warnings);
+});
+
+it('fails stop if an in-flight reopen still has not settled by the stop deadline', async () => {
+  failPublicProbes();
+  let resolveOpening!: (value: ngrok.Listener) => void;
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockResolvedValueOnce(initial as never)
+    .mockReturnValueOnce(new Promise(resolve => (resolveOpening = resolve)));
+  const tunnel = await startNgrokTunnelAsync(options);
+  await jest.advanceTimersByTimeAsync(45_000);
+  const rejected = expect(tunnel.stopAsync()).rejects.toThrow(
+    'Ngrok tunnel web-preview-fixed.example.test stop timed out after 4000ms'
+  );
+  await jest.advanceTimersByTimeAsync(4_000);
+  await rejected;
+  expect(ngrok.forward).toHaveBeenCalledTimes(2);
+  resolveOpening(replacement as never);
+  await jest.advanceTimersByTimeAsync(0);
+  expect(replacement.close).toHaveBeenCalledTimes(1);
+});
+
+it('retries an old listener while a reopen outlasts shutdown', async () => {
+  failPublicProbes();
+  initial.close.mockRejectedValueOnce(new Error('agent disconnected'));
+  let resolveOpening!: (value: ngrok.Listener) => void;
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockResolvedValueOnce(initial as never)
+    .mockReturnValueOnce(new Promise(resolve => (resolveOpening = resolve)));
+  const tunnel = await startNgrokTunnelAsync(options);
+  await jest.advanceTimersByTimeAsync(45_000);
+  expect(initial.close).toHaveBeenCalledTimes(1);
+  const rejected = expect(tunnel.stopAsync()).rejects.toThrow(
+    'Ngrok tunnel web-preview-fixed.example.test stop timed out after 4000ms'
+  );
+  await jest.advanceTimersByTimeAsync(4_000);
+  await rejected;
+  const oldCloseCalls = initial.close.mock.calls.length;
+  resolveOpening(replacement as never);
+  await jest.advanceTimersByTimeAsync(0);
+  expect(oldCloseCalls).toBe(2);
+  expect(replacement.close).toHaveBeenCalledTimes(1);
+  expect(ngrok.forward).toHaveBeenCalledTimes(2);
+});
+
+it('fails stop if a pending reopen arrives but cannot be retired', async () => {
+  failPublicProbes();
+  let resolveOpening!: (value: ngrok.Listener) => void;
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockResolvedValueOnce(initial as never)
+    .mockReturnValueOnce(new Promise(resolve => (resolveOpening = resolve)));
+  replacement.close.mockRejectedValue(new Error('unlisten failed'));
+  const tunnel = await startNgrokTunnelAsync(options);
+  await jest.advanceTimersByTimeAsync(45_000);
+  const rejected = expect(tunnel.stopAsync()).rejects.toThrow(
+    'Ngrok tunnel web-preview-fixed.example.test stop timed out'
+  );
+  resolveOpening(replacement as never);
+  await jest.advanceTimersByTimeAsync(4_000);
+  await rejected;
+  expect(replacement.close.mock.calls.length).toBeGreaterThan(1);
+  expect(logger.warn).toHaveBeenCalledWith(
+    expect.objectContaining({ err: expect.any(Error) }),
+    'Could not retire late ngrok tunnel web-preview-fixed.example.test.'
+  );
+  const warnings = jest.mocked(logger.warn).mock.calls.length;
+  await jest.advanceTimersByTimeAsync(120_000);
+  expect(logger.warn).toHaveBeenCalledTimes(warnings);
+  expect(ngrok.forward).toHaveBeenCalledTimes(2);
+});
+
+it('rejects a changed public URL and closes the replacement', async () => {
+  failPublicProbes();
+  const changed = listener('https://different.example.test');
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockResolvedValueOnce(initial as never)
+    .mockResolvedValue(changed as never);
+  const tunnel = await startNgrokTunnelAsync(options);
+  try {
+    await jest.advanceTimersByTimeAsync(45_000);
+    expect(changed.close).toHaveBeenCalledTimes(1);
+    expect(tunnel.url).toBe(url);
+    expect(logger.warn).toHaveBeenCalledWith(
+      expect.objectContaining({ err: expect.any(Error) }),
+      expect.stringContaining('Could not reopen')
+    );
+  } finally {
+    await tunnel.stopAsync();
+  }
+});
+
+it('treats ngrok error responses as failures even if their status is accepted', async () => {
+  jest.mocked(turtleFetch).mockImplementation(
+    async target =>
+      new Response(undefined, {
+        status: 200,
+        headers: target.startsWith('https:') ? { 'ngrok-error-code': 'ERR_NGROK_3200' } : {},
+      })
+  );
+  const tunnel = await startNgrokTunnelAsync(options);
+  try {
+    await jest.advanceTimersByTimeAsync(45_000);
+    expect(ngrok.forward).toHaveBeenCalledTimes(2);
+  } finally {
+    await tunnel.stopAsync();
+  }
+});
+
+it('reopens on a fresh agent session even if closing the old listener fails', async () => {
+  failPublicProbes();
+  initial.close.mockRejectedValueOnce(new Error('agent disconnected'));
+  const tunnel = await startNgrokTunnelAsync(options);
+  try {
+    await jest.advanceTimersByTimeAsync(45_000);
+    expect(ngrok.forward).toHaveBeenCalledTimes(2);
+    expect(ngrok.forward).toHaveBeenLastCalledWith(
+      expect.objectContaining({ force_new_session: true })
+    );
+    expect(ngrok.disconnect).not.toHaveBeenCalled();
+  } finally {
+    await tunnel.stopAsync();
+  }
+  expect(initial.close).toHaveBeenCalledTimes(2);
+  expect(replacement.close).toHaveBeenCalledTimes(1);
+});
+
+it('retries a rejected close before reopening an endpoint that remains bound', async () => {
+  failPublicProbes();
+  let domainOccupied = true;
+  initial.close
+    .mockRejectedValueOnce(new Error('agent disconnected'))
+    .mockImplementation(async () => {
+      domainOccupied = false;
+    });
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockResolvedValueOnce(initial as never)
+    .mockImplementation(async () => {
+      if (domainOccupied) {
+        throw new Error('endpoint is still bound');
+      }
+      return replacement as never;
+    });
+  const tunnel = await startNgrokTunnelAsync(options);
+  try {
+    await jest.advanceTimersByTimeAsync(45_000);
+    expect(initial.close).toHaveBeenCalledTimes(1);
+    expect(ngrok.forward).toHaveBeenCalledTimes(2);
+    await jest.advanceTimersByTimeAsync(2_000);
+    expect(initial.close).toHaveBeenCalledTimes(2);
+    expect(ngrok.forward).toHaveBeenCalledTimes(3);
+    expect(tunnel.url).toBe(url);
+  } finally {
+    await tunnel.stopAsync();
+  }
+  expect(replacement.close).toHaveBeenCalledTimes(1);
+});
+
+it('retires an old listener even after its replacement is healthy', async () => {
+  failPublicProbes();
+  initial.close.mockRejectedValueOnce(new Error('agent disconnected'));
+  const tunnel = await startNgrokTunnelAsync(options);
+  try {
+    await jest.advanceTimersByTimeAsync(45_000);
+    expect(initial.close).toHaveBeenCalledTimes(1);
+    jest.mocked(turtleFetch).mockResolvedValue(new Response(undefined, { status: 200 }));
+    await jest.advanceTimersByTimeAsync(15_000);
+    expect(initial.close).toHaveBeenCalledTimes(2);
+    expect(ngrok.forward).toHaveBeenCalledTimes(2);
+  } finally {
+    await tunnel.stopAsync();
+  }
+});
+
+it('retries an old listener without repeating its close warning on every probe', async () => {
+  failPublicProbes();
+  initial.close.mockRejectedValue(new Error('old session disconnected'));
+  const tunnel = await startNgrokTunnelAsync(options);
+  await jest.advanceTimersByTimeAsync(45_000);
+  const warnings = jest.mocked(logger.warn).mock.calls.length;
+  expect(warnings).toBeGreaterThan(0);
+  jest.mocked(turtleFetch).mockResolvedValue(new Response(undefined, { status: 200 }));
+  await jest.advanceTimersByTimeAsync(120_000);
+  expect(initial.close.mock.calls.length).toBeGreaterThan(1);
+  expect(ngrok.forward).toHaveBeenCalledTimes(2);
+  expect(logger.warn).toHaveBeenCalledTimes(warnings);
+  const rejected = expect(tunnel.stopAsync()).rejects.toThrow(
+    'Ngrok tunnel web-preview-fixed.example.test stop timed out'
+  );
+  await jest.advanceTimersByTimeAsync(4_000);
+  await rejected;
+  expect(replacement.close).toHaveBeenCalledTimes(1);
+});
+
+it('retries a rejected close during shutdown', async () => {
+  const failure = new Error('agent disconnected');
+  initial.close.mockRejectedValueOnce(failure);
+  const tunnel = await startNgrokTunnelAsync(options);
+  const stopping = tunnel.stopAsync();
+  await jest.advanceTimersByTimeAsync(250);
+  await stopping;
+  expect(initial.close).toHaveBeenCalledTimes(2);
+  expect(logger.warn).toHaveBeenCalledTimes(1);
+  expect(logger.warn).toHaveBeenCalledWith(
+    { err: failure },
+    'Could not stop ngrok tunnel web-preview-fixed.example.test.'
+  );
+});
+
+it('logs the first close rejection once while bounded shutdown retries it', async () => {
+  const failure = new Error('agent disconnected');
+  initial.close.mockRejectedValue(failure);
+  const tunnel = await startNgrokTunnelAsync(options);
+  const rejected = expect(tunnel.stopAsync()).rejects.toThrow('stop timed out');
+  await jest.advanceTimersByTimeAsync(4_000);
+  await rejected;
+  expect(initial.close.mock.calls.length).toBeGreaterThan(1);
+  expect(logger.warn).toHaveBeenCalledTimes(1);
+  expect(logger.warn).toHaveBeenCalledWith(
+    { err: failure },
+    'Could not stop ngrok tunnel web-preview-fixed.example.test.'
+  );
+});
+
+it('bounds shutdown during recovery without duplicating a pending native close', async () => {
+  failPublicProbes();
+  let finishClose!: () => void;
+  initial.close.mockReturnValueOnce(new Promise<void>(resolve => (finishClose = resolve)));
+  const tunnel = await startNgrokTunnelAsync(options);
+  await jest.advanceTimersByTimeAsync(45_000);
+  const stopping = tunnel.stopAsync();
+  expect(tunnel.stopAsync()).toBe(stopping);
+  const rejected = expect(stopping).rejects.toThrow(
+    'Ngrok tunnel web-preview-fixed.example.test stop timed out after 4000ms'
+  );
+  await jest.advanceTimersByTimeAsync(4_000);
+  await rejected;
+  expect(initial.close).toHaveBeenCalledTimes(1);
+  expect(ngrok.forward).toHaveBeenCalledTimes(1);
+  const warnings = jest.mocked(logger.warn).mock.calls.length;
+  finishClose();
+  await jest.advanceTimersByTimeAsync(120_000);
+  expect(logger.warn).toHaveBeenCalledTimes(warnings);
+  expect(initial.close).toHaveBeenCalledTimes(1);
+});
+
+it('bounds a stalled listener close before reopening', async () => {
+  failPublicProbes();
+  initial.close.mockImplementationOnce(async () => await new Promise(() => {}));
+  const tunnel = await startNgrokTunnelAsync(options);
+  try {
+    await jest.advanceTimersByTimeAsync(49_999);
+    expect(ngrok.forward).toHaveBeenCalledTimes(1);
+    await jest.advanceTimersByTimeAsync(1);
+    expect(ngrok.forward).toHaveBeenCalledTimes(2);
+  } finally {
+    const stopping = tunnel.stopAsync();
+    const rejected = expect(stopping).rejects.toThrow(
+      'Ngrok tunnel web-preview-fixed.example.test stop timed out'
+    );
+    await jest.advanceTimersByTimeAsync(4_000);
+    await rejected;
+  }
+});
+
+it('does not queue more native opens while a timed-out open is still pending', async () => {
+  failPublicProbes();
+  let resolveOpening!: (value: ngrok.Listener) => void;
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockResolvedValueOnce(initial as never)
+    .mockReturnValueOnce(
+      new Promise(resolve => {
+        resolveOpening = resolve;
+      })
+    )
+    .mockResolvedValue(replacement as never);
+  const tunnel = await startNgrokTunnelAsync(options);
+  const late = listener();
+  try {
+    await jest.advanceTimersByTimeAsync(180_000);
+    expect(ngrok.forward).toHaveBeenCalledTimes(2);
+    resolveOpening(late as never);
+    await jest.advanceTimersByTimeAsync(30_000);
+    expect(late.close).toHaveBeenCalledTimes(1);
+    expect(ngrok.forward).toHaveBeenCalledTimes(3);
+  } finally {
+    await tunnel.stopAsync();
+  }
+  expect(replacement.close).toHaveBeenCalledTimes(1);
+});
+
+it('bounds initial tunnel creation and retires a late listener', async () => {
+  let resolveOpening!: (value: ngrok.Listener) => void;
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockReturnValueOnce(
+      new Promise(resolve => {
+        resolveOpening = resolve;
+      })
+    );
+  const opening = startNgrokTunnelAsync(options);
+  const rejected = expect(opening).rejects.toThrow('Ngrok tunnel open timed out');
+  await jest.advanceTimersByTimeAsync(15_000);
+  await rejected;
+  resolveOpening(initial as never);
+  await jest.advanceTimersByTimeAsync(0);
+  expect(initial.close).toHaveBeenCalledTimes(1);
+});
+
+it('retries a rejected close after initial tunnel creation timed out', async () => {
+  let resolveOpening!: (value: ngrok.Listener) => void;
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockReturnValueOnce(new Promise(resolve => (resolveOpening = resolve)));
+  const opening = startNgrokTunnelAsync(options);
+  const rejected = expect(opening).rejects.toThrow('Ngrok tunnel open timed out');
+  await jest.advanceTimersByTimeAsync(15_000);
+  await rejected;
+  initial.close.mockRejectedValueOnce(new Error('temporary unlisten failure'));
+  resolveOpening(initial as never);
+  await jest.advanceTimersByTimeAsync(250);
+  expect(initial.close).toHaveBeenCalledTimes(2);
+});
+
+it('retires only the late listener without blaming it for an older stuck listener', async () => {
+  failPublicProbes();
+  initial.close.mockRejectedValue(new Error('old session disconnected'));
+  let resolveOpening!: (value: ngrok.Listener) => void;
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockResolvedValueOnce(initial as never)
+    .mockReturnValueOnce(new Promise(resolve => (resolveOpening = resolve)))
+    .mockResolvedValue(replacement as never);
+  const tunnel = await startNgrokTunnelAsync(options);
+  try {
+    await jest.advanceTimersByTimeAsync(60_000);
+    const late = listener();
+    resolveOpening(late as never);
+    jest.mocked(turtleFetch).mockResolvedValue(new Response(undefined, { status: 200 }));
+    await jest.advanceTimersByTimeAsync(4_000);
+    expect(late.close).toHaveBeenCalledTimes(1);
+    expect(
+      jest
+        .mocked(logger.warn)
+        .mock.calls.some(([, message]) => message?.includes('Could not retire late'))
+    ).toBe(false);
+  } finally {
+    initial.close.mockResolvedValue(undefined);
+    await tunnel.stopAsync();
+  }
+});
+
+it('recovers using actual HTTP health probes with a local ngrok adapter', async () => {
+  const actualFetch = jest.requireActual<typeof import('node-fetch')>('node-fetch').default;
+  const realSetTimeout = jest.requireActual<typeof import('node:timers')>('node:timers').setTimeout;
+  let broken = true;
+  const local = createServer((_req, res) => {
+    res.writeHead(200);
+    res.end('healthy');
+  });
+  const publicServer = createServer((_req, res) => {
+    res.writeHead(broken ? 503 : 200);
+    res.end('probe');
+  });
+  await Promise.all(
+    [local, publicServer].map(
+      server => new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve))
+    )
+  );
+  const publicUrl = `http://127.0.0.1:${(publicServer.address() as AddressInfo).port}`;
+  let completedRequests = 0;
+  jest.mocked(turtleFetch).mockImplementation(async (target, method, requestOptions) => {
+    const response = await actualFetch(target, { ...requestOptions, method });
+    completedRequests++;
+    return response;
+  });
+  const first = listener(publicUrl);
+  const next = listener(publicUrl);
+  jest
+    .mocked(ngrok.forward)
+    .mockReset()
+    .mockResolvedValueOnce(first as never)
+    .mockImplementation(async () => {
+      broken = false;
+      return next as never;
+    });
+  const tunnel = await startNgrokTunnelAsync({
+    ...options,
+    port: (local.address() as AddressInfo).port,
+  });
+  try {
+    for (let count = 0; count < 3; count++) {
+      await jest.advanceTimersByTimeAsync(15_000);
+      for (let turns = 0; turns < 50 && completedRequests < (count + 1) * 2; turns++) {
+        await new Promise(resolve => realSetTimeout(resolve, 10));
+      }
+      expect(completedRequests).toBe((count + 1) * 2);
+    }
+    expect(ngrok.forward).toHaveBeenCalledTimes(2);
+    expect(first.close).toHaveBeenCalledTimes(1);
+    expect((await actualFetch(`${tunnel.url}/healthz`)).status).toBe(200);
+  } finally {
+    await tunnel.stopAsync();
+    await Promise.all(
+      [local, publicServer].map(
+        server =>
+          new Promise<void>((resolve, reject) =>
+            server.close(err => (err ? reject(err) : resolve()))
+          )
+      )
+    );
+  }
+  expect(next.close).toHaveBeenCalledTimes(1);
+});
+
+it('blocks HTTP and existing WebSockets on Stop even when ngrok cannot close', async () => {
+  jest.useRealTimers();
+  const actualFetch = jest.requireActual<typeof import('node-fetch')>('node-fetch').default;
+  let requests = 0;
+  let messages = 0;
+  const backend = createServer((_request, response) => {
+    requests++;
+    response.end('owned backend');
+  });
+  const websockets = new WebSocketServer({ server: backend });
+  websockets.on('connection', socket => {
+    socket.on('message', data => {
+      messages++;
+      socket.send(data);
+    });
+  });
+  backend.listen(0, '127.0.0.1');
+  await once(backend, 'listening');
+  const backendPort = (backend.address() as AddressInfo).port;
+  const tunnel = await startNgrokTunnelAsync({
+    ...options,
+    port: backendPort,
+    healthCheck: undefined,
+  });
+  const targetPort = (jest.mocked(ngrok.forward).mock.calls[0][0] as ngrok.Config).addr;
+  const targetUrl = `http://127.0.0.1:${targetPort}`;
+  const socket = new WebSocket(`ws://127.0.0.1:${targetPort}`);
+  const opened = once(socket, 'open');
+  try {
+    expect(await (await actualFetch(targetUrl)).text()).toBe('owned backend');
+    await opened;
+    const echoed = once(socket, 'message');
+    socket.send('before-stop');
+    expect((await echoed)[0].toString()).toBe('before-stop');
+    const closed = once(socket, 'close');
+    initial.close.mockRejectedValue(new Error('agent disconnected'));
+    const stopping = tunnel.stopAsync();
+    const rejected = expect(stopping).rejects.toThrow('stop timed out after 4000ms');
+    await expect(actualFetch(targetUrl, { timeout: 1_000 })).rejects.toThrow();
+    await closed;
+    expect(requests).toBe(1);
+    expect(messages).toBe(1);
+    expect(await (await actualFetch(`http://127.0.0.1:${backendPort}`)).text()).toBe(
+      'owned backend'
+    );
+    await rejected;
+    await expect(actualFetch(targetUrl, { timeout: 1_000 })).rejects.toThrow();
+    expect(requests).toBe(2);
+    expect(messages).toBe(1);
+    const competing = createTcpServer();
+    const conflict = once(competing, 'error');
+    competing.listen(targetPort as number, '127.0.0.1');
+    expect((await conflict)[0]).toMatchObject({ code: 'EADDRINUSE' });
+  } finally {
+    socket.terminate();
+    for (const client of websockets.clients) {
+      client.terminate();
+    }
+    websockets.close();
+    backend.closeAllConnections();
+    await new Promise<void>(resolve => backend.close(() => resolve()));
+    await tunnel.stopAsync().catch(() => {});
+  }
+});
+
+it('releases its local target when initial tunnel creation fails', async () => {
+  jest.useRealTimers();
+  jest.mocked(ngrok.forward).mockReset().mockRejectedValue(new Error('forward failed'));
+  await expect(startNgrokTunnelAsync(options)).rejects.toThrow('forward failed');
+  const targetPort = (jest.mocked(ngrok.forward).mock.calls[0][0] as ngrok.Config).addr;
+  const server = createServer();
+  server.listen(targetPort as number, '127.0.0.1');
+  await once(server, 'listening');
+  await new Promise<void>(resolve => server.close(() => resolve()));
+});
+
+it('preserves a full response for a half-closed slow reader', async () => {
+  jest.useRealTimers();
+  const payload = Buffer.alloc(4 * 1024 * 1024, 37);
+  const backend = createTcpServer({ allowHalfOpen: true }, socket => {
+    socket.resume();
+    socket.on('end', () => socket.end(payload));
+  });
+  backend.listen(0, '127.0.0.1');
+  await once(backend, 'listening');
+  const tunnel = await startNgrokTunnelAsync({
+    ...options,
+    port: (backend.address() as AddressInfo).port,
+    healthCheck: undefined,
+  });
+  const targetPort = (jest.mocked(ngrok.forward).mock.calls[0][0] as ngrok.Config).addr as number;
+  const socket = createConnection({ host: '127.0.0.1', port: targetPort, allowHalfOpen: true });
+  try {
+    const chunks: Buffer[] = [];
+    socket.on('data', chunk => chunks.push(chunk));
+    const ended = once(socket, 'end');
+    socket.pause();
+    socket.end('request');
+    await new Promise(resolve => setTimeout(resolve, 100));
+    socket.resume();
+    await ended;
+    expect(Buffer.concat(chunks).equals(payload)).toBe(true);
+  } finally {
+    socket.destroy();
+    await tunnel.stopAsync();
+    await new Promise<void>(resolve => backend.close(() => resolve()));
+  }
+});
+
+it.each(['resolve', 'reject'])(
+  'releases the target after timed-out startup later %s',
+  async outcome => {
+    let resolveOpening!: (value: ngrok.Listener) => void;
+    let rejectOpening!: (error: Error) => void;
+    jest
+      .mocked(ngrok.forward)
+      .mockReset()
+      .mockReturnValue(
+        new Promise((resolve, reject) => {
+          resolveOpening = resolve;
+          rejectOpening = reject;
+        })
+      );
+    const opening = startNgrokTunnelAsync(options);
+    const rejected = expect(opening).rejects.toThrow('open timed out');
+    await new Promise<void>(resolve => setImmediate(resolve));
+    await jest.advanceTimersByTimeAsync(15_000);
+    await rejected;
+    const targetPort = (jest.mocked(ngrok.forward).mock.calls[0][0] as ngrok.Config).addr as number;
+    if (outcome === 'resolve') {
+      resolveOpening(replacement as never);
+    } else {
+      rejectOpening(new Error('forward failed'));
+    }
+    await jest.advanceTimersByTimeAsync(0);
+    const server = createTcpServer();
+    server.listen(targetPort, '127.0.0.1');
+    await once(server, 'listening');
+    await new Promise<void>(resolve => server.close(() => resolve()));
+  }
+);
+
+it('drains a full upload when the backend ends its response early', async () => {
+  jest.useRealTimers();
+  const payload = Buffer.alloc(4 * 1024 * 1024, 51);
+  let received!: Buffer;
+  let receivedRequest!: () => void;
+  const completed = new Promise<void>(resolve => {
+    receivedRequest = resolve;
+  });
+  const backend = createTcpServer({ allowHalfOpen: true }, socket => {
+    const chunks: Buffer[] = [];
+    socket.on('data', chunk => chunks.push(chunk));
+    socket.on('end', () => {
+      received = Buffer.concat(chunks);
+      receivedRequest();
+    });
+    socket.pause();
+    socket.end('early response');
+    setTimeout(() => socket.resume(), 100);
+  });
+  backend.listen(0, '127.0.0.1');
+  await once(backend, 'listening');
+  const tunnel = await startNgrokTunnelAsync({
+    ...options,
+    port: (backend.address() as AddressInfo).port,
+    healthCheck: undefined,
+  });
+  const targetPort = (jest.mocked(ngrok.forward).mock.calls[0][0] as ngrok.Config).addr as number;
+  const socket = createConnection({ host: '127.0.0.1', port: targetPort, allowHalfOpen: true });
+  try {
+    socket.resume();
+    socket.end(payload);
+    await completed;
+    expect(received.equals(payload)).toBe(true);
+  } finally {
+    socket.destroy();
+    await tunnel.stopAsync();
+    await new Promise<void>(resolve => backend.close(() => resolve()));
+  }
+});

packages/build-tools/src/steps/utils/__tests__/remoteDeviceRunSession.test.ts

@@ -530,6 +530,22 @@ describe(describeServeSimLaunch, () => {
   });
 });
 
+it('only pins hosts when a valid device ID is supplied', () => {
+  const udid = 'AAAAAAAA-AAAA-AAAA-AAAA-AAAAAAAAAAAA';
+  expect(createServeSimArgs({ port: 4321, iosSimulatorUdid: udid })).toEqual(
+    expect.arrayContaining(['--single-device', udid])
+  );
+  for (const iosSimulatorUdid of [undefined, '', 'booted', 'iPhone 17']) {
+    expect(createServeSimArgs({ port: 4321, iosSimulatorUdid })).not.toContain('--single-device');
+  }
+  expect(createExpoDeviceHubArgs({ port: 4321, device: 'emulator-5554' })).toEqual(
+    expect.arrayContaining(['--single-device', 'emulator-5554'])
+  );
+  for (const device of [undefined, '', 'all', 'booted', 'invalid serial']) {
+    expect(createExpoDeviceHubArgs({ port: 4321, device })).not.toContain('--single-device');
+  }
+});
+
 describe(createServeSimArgs, () => {
   it('uses the latest Expo package and applies the EAS streaming policy', () => {
     expect(
@@ -916,7 +932,7 @@ describe(waitForWebPreviewReadyAsync, () => {
 
 describe(startNgrokTunnelAsync, () => {
   it.each(['rejected', 'stalled'] as const)(
-    'retains a %s close failure on repeated stops',
+    'bounds %s listener retirement and reuses the stop promise',
     async mode => {
       jest.useFakeTimers();
       try {
@@ -938,14 +954,12 @@ describe(startNgrokTunnelAsync, () => {
           logger: createLoggerMock(),
         });
         const stopping = tunnel.stopAsync();
-        const assertion = expect(stopping).rejects.toThrow(
-          mode === 'rejected' ? 'close failed' : 'Ngrok tunnel stop timed out after 4000ms.'
-        );
+        const assertion = expect(stopping).rejects.toThrow(/stop timed out after 4000ms/);
         expect(tunnel.stopAsync()).toBe(stopping);
         await jest.advanceTimersByTimeAsync(4_000);
         await assertion;
         await expect(tunnel.stopAsync()).rejects.toThrow();
-        expect(close).toHaveBeenCalledTimes(1);
+        expect(close).toHaveBeenCalled();
       } finally {
         jest.useRealTimers();
       }
@@ -969,7 +983,7 @@ describe(startNgrokTunnelAsync, () => {
 
     expect(ngrok.forward).toHaveBeenCalledWith(
       expect.objectContaining({
-        addr: 4321,
+        addr: expect.any(Number),
         authtoken: 'token',
         domain: expect.stringMatching(/^web-preview-[a-f0-9]{32}\.eas-simulator\.ngrok\.dev$/),
       })
@@ -1286,7 +1300,10 @@ describe(startDeviceSessionHostAsync, () => {
         recordingDirectory,
       }),
     ]);
-    expect(ngrok.forward).toHaveBeenCalledWith(expect.objectContaining({ addr: port }));
+    expect(ngrok.forward).toHaveBeenCalledWith(
+      expect.objectContaining({ addr: expect.any(Number) })
+    );
+    expect(ngrok.forward).not.toHaveBeenCalledWith(expect.objectContaining({ addr: port }));
     expect(preview.apiUrl).toBe('https://android-preview.example.test');
 
     await host.finishAsync();
@@ -1422,7 +1439,10 @@ describe(startDeviceSessionHostAsync, () => {
         packageVersion,
       }),
     ]);
-    expect(ngrok.forward).toHaveBeenCalledWith(expect.objectContaining({ addr: port }));
+    expect(ngrok.forward).toHaveBeenCalledWith(
+      expect.objectContaining({ addr: expect.any(Number) })
+    );
+    expect(ngrok.forward).not.toHaveBeenCalledWith(expect.objectContaining({ addr: port }));
     expect(preview.apiUrl).toBe('https://ios-preview.example.test');
 
     await host.finishAsync();

packages/build-tools/src/steps/utils/agentRun.ts

@@ -1,6 +1,5 @@
 import { SystemError, UserError } from '@expo/eas-build-job';
 import { type bunyan } from '@expo/logger';
-import turtleSpawn from '@expo/turtle-spawn';
 import { spawn } from 'node:child_process';
 import { once } from 'node:events';
 import fs from 'node:fs/promises';
@@ -13,6 +12,7 @@ import { type AgentCli, type AgentInvocation, type AgentLogMessage } from './age
 import { CLAUDE_CODE_CLI, prepareClaudeCodeAsync } from './agents/claude';
 import { CODEX_CLI, prepareCodexAsync } from './agents/codex';
 import { Sentry } from '../../sentry';
+import { installIsolatedNpmPackageAsync } from '../../utils/installIsolatedNpmPackageAsync';
 import { killProcessGroup } from '../../utils/processes';
 
 export type AgentKind = 'claude-code' | 'codex';
@@ -76,17 +76,13 @@ export async function runAgentAsync({
     const { packageSpec, bin, formatOutputLine } = AGENT_CLIS[agentKind];
     logger.info(`Installing ${packageSpec}.`);
     try {
-      await turtleSpawn(
-        'npm',
-        [
-          'install',
-          ...['--prefix', cliDirectory],
-          ...['--no-save', '--package-lock=false', '--no-audit', '--no-fund'],
-          ...(npmCacheUrl ? ['--registry', npmCacheUrl] : []),
-          packageSpec,
-        ],
-        { env: minimalEnv, signal }
-      );
+      await installIsolatedNpmPackageAsync({
+        packageSpec,
+        directory: cliDirectory,
+        npmCacheUrl,
+        pathEnv,
+        signal,
+      });
     } catch (error) {
       signal.throwIfAborted();
       throw new SystemError(

packages/build-tools/src/steps/utils/android/GooglePlayUtils.ts

@@ -144,6 +144,7 @@ export namespace GooglePlayUtils {
       signal?: AbortSignal;
     }
   ): Promise<void> {
+    const attempts: unknown[] = [];
     const sendCommitAsync = async ({
       changesNotSentForReview,
     }: {
@@ -161,6 +162,7 @@ export namespace GooglePlayUtils {
           throw new SystemError('Google did not confirm the committed edit.');
         }
       } catch (error) {
+        attempts.push(...(error instanceof AggregateError ? error.errors : [error]));
         if (error instanceof GooglePlayAuthRequestError) {
           throw error;
         }
@@ -168,8 +170,14 @@ export namespace GooglePlayUtils {
           !(error instanceof GooglePlayApiError) ||
           GooglePlayApiError.isRetryableStatus(error.status)
         ) {
+          const attemptMessages = attempts
+            .map(
+              (attempt, index) =>
+                `${index + 1}. ${attempt instanceof Error ? attempt.message : String(attempt)}`
+            )
+            .join('\n');
           throw new GooglePlayCommitOutcomeUnknownError(
-            `Could not confirm whether Google Play saved the release for ${packageName}. Check its release status at https://play.google.com/console/ before submitting again.`,
+            `Could not confirm whether Google Play saved the release for ${packageName}. Check its release status at https://play.google.com/console/ before submitting again.\n\nCommit attempts:\n${attemptMessages}`,
             { cause: error, metadata: GooglePlayApiError.getErrorMetadata(error) }
           );
         }

packages/build-tools/src/steps/utils/android/__tests__/GooglePlaySubmission.test.ts

@@ -84,6 +84,41 @@ it.each([408, 429, 503])('retries a transient HTTP %s commit on the same edit',
   api().post(`${editPath}:commit`).query({}).reply(200, { id: 'edit' });
   await expect(commit()).resolves.toBeUndefined();
 });
+it('shows failed commit attempts in order across processing, HTTP, and network retries', async () => {
+  mockToken();
+  api()
+    .post(`${editPath}:commit`)
+    .query({})
+    .reply(400, { error: { message: pendingUploadMessage } });
+  api().post(`${editPath}:commit`).query({}).reply(503);
+  api()
+    .post(`${editPath}:commit`)
+    .query({})
+    .replyWithError(Object.assign(new Error('Lost commit response'), { code: 'ECONNRESET' }));
+  const message = 'You must let us know whether your app includes any health features.';
+  api().post(`${editPath}:commit`).query({}).reply(403, { error: { message } });
+  const error = await commit().catch(error => error);
+  const mapped = GooglePlayUtils.mapGooglePlayError(error, packageName);
+  expect(mapped).toBeInstanceOf(GooglePlayCommitOutcomeUnknownError);
+  expect((mapped as Error).message).toContain(`Google Play request failed (HTTP 403): ${message}`);
+  expect((mapped as Error).message).toContain('Could not confirm whether Google Play saved');
+  expect((mapped as Error).message).toContain('https://play.google.com/console/');
+  expect(mapped).toMatchObject({
+    metadata: { googlePlayErrorResponse: JSON.stringify({ error: { message } }) },
+    cause: expect.any(AggregateError),
+  });
+  const attempts = (mapped as Error).message.split('Commit attempts:\n')[1]?.split('\n');
+  expect(attempts).toEqual([
+    `1. Google Play request failed (HTTP 400): ${pendingUploadMessage}`,
+    '2. Google Play request failed (HTTP 503).',
+    '3. Google Play request failed before a response was received.',
+    `4. Google Play request failed (HTTP 403): ${message}`,
+  ]);
+  expect(((mapped as Error).cause as AggregateError).errors).toHaveLength(3);
+  expect(((mapped as Error).cause as AggregateError).errors[1]).toMatchObject({
+    cause: { code: 'ECONNRESET' },
+  });
+});
 it('preserves cancellation before commit is sent', async () => {
   const controller = new AbortController();
   const reason = new Error('cancelled before commit');
@@ -250,7 +285,9 @@ it('keeps the last Google Play error response when the commit outcome is unknown
     .query({})
     .times(6)
     .reply(503, { error: { message: 'Backend error' } });
-  await expect(commit()).rejects.toMatchObject({
+  const error = await commit().catch(error => error);
+  expect(error.message).toContain('Google Play request failed (HTTP 503): Backend error');
+  expect(error).toMatchObject({
     metadata: {
       googlePlayRequestPath: `${editPath}:commit`,
       googlePlayErrorResponse: JSON.stringify({ error: { message: 'Backend error' } }),

packages/build-tools/src/steps/utils/deviceSessionHost.ts

@@ -55,6 +55,8 @@ import { IosSimulatorUtils, type IosSimulatorUuid } from '../../utils/IosSimulat
 import { createStartupTasks } from './startupTasks';
 
 const WEB_PREVIEW_HOST = '127.0.0.1';
+const IOS_SIMULATOR_UDID = /^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
+const ANDROID_DEVICE_SERIAL = /^(?!all$|booted$)[A-Za-z0-9][A-Za-z0-9._:-]*$/;
 const SERVE_SIM_PACKAGE_NAME = '@expo/serve-sim';
 const SERVE_SIM_MAX_DIMENSION = '1600';
 const SERVE_SIM_MJPEG_QUALITY = '0.55';
@@ -157,6 +159,9 @@ export function createServeSimArgs({
   return [
     createServeSimPackageSpec(packageVersion),
     ...(iosSimulatorUdid ? [iosSimulatorUdid] : []),
+    ...(iosSimulatorUdid && IOS_SIMULATOR_UDID.test(iosSimulatorUdid)
+      ? ['--single-device', iosSimulatorUdid]
+      : []),
     '--port',
     String(port),
     '--host',
@@ -198,6 +203,7 @@ export function createServeSimArgs({
 
 export function createExpoDeviceHubArgs({
   port,
+  device,
   turnArgs = [],
   websiteArgs = [],
   frameAncestorArgs: frameArgs = [],
@@ -206,6 +212,7 @@ export function createExpoDeviceHubArgs({
   recordingDirectory,
 }: {
   port: number;
+  device?: string;
   turnArgs?: string[];
   websiteArgs?: string[];
   frameAncestorArgs?: string[];
@@ -215,6 +222,7 @@ export function createExpoDeviceHubArgs({
 }): string[] {
   return [
     createExpoDeviceHubPackageSpec(packageVersion),
+    ...(device && ANDROID_DEVICE_SERIAL.test(device) ? ['--single-device', device] : []),
     '--port',
     String(port),
     '--host',
@@ -387,6 +395,8 @@ type DeviceSessionHostOptions = {
   /** Origins whose pages may call the preview host's API, in addition to the website origins. */
   corsOrigins?: string[];
   iosSimulatorUdid?: string;
+  /** Selected preview target; does not enable Simulator boot or setup. */
+  previewDeviceId?: string;
   installAppPath?: string;
   bootEnv?: Record<string, string>;
   application?: Promise<ServeSimApplicationOptions | void>;
@@ -431,6 +441,7 @@ async function startDeviceSessionHostInternalAsync(
     signal,
     packageVersion,
     iosSimulatorUdid,
+    previewDeviceId,
     installAppPath,
     application,
     onStartupError,
@@ -479,6 +490,10 @@ async function startDeviceSessionHostInternalAsync(
   if (isAndroid) {
     await ensureFfmpegInstalledOnceAsync({ runtimePlatform, env, logger });
   }
+  const deviceIdPattern = isAndroid ? ANDROID_DEVICE_SERIAL : IOS_SIMULATOR_UDID;
+  const validPreviewDevice =
+    previewDeviceId && deviceIdPattern.test(previewDeviceId) ? previewDeviceId : undefined;
+  const previewDevice = isAndroid ? validPreviewDevice : (iosSimulatorUdid ?? validPreviewDevice);
   const recording: AndroidSessionRecording | null = isAndroid
     ? {
         deviceRunSessionId: getDeviceRunSessionIdOrThrow(env),
@@ -506,6 +521,7 @@ async function startDeviceSessionHostInternalAsync(
     isAndroid
       ? createExpoDeviceHubArgs({
           port,
+          device: previewDevice,
           turnArgs,
           packageVersion,
           recordingDirectory: recording?.directory,
@@ -517,7 +533,7 @@ async function startDeviceSessionHostInternalAsync(
           port,
           turnArgs,
           packageVersion,
-          iosSimulatorUdid,
+          iosSimulatorUdid: previewDevice,
           websiteArgs: websiteOriginArgs(env),
           frameAncestorArgs: frameAncestorArgs(frameAncestors),
           corsOriginArgs: corsOriginArgs(corsOrigins),
@@ -607,6 +623,7 @@ async function startDeviceSessionHostInternalAsync(
           subdomainId,
           baseDomain,
           authtoken,
+          healthCheck: { path: isAndroid ? '/readyz' : '/healthz' },
           logger,
         });
         if (finishTask) {
@@ -762,9 +779,9 @@ async function startDeviceSessionHostInternalAsync(
     }
     logger.info(`Waiting for ${serverName} to become ready.`);
     const device = (await readiness).enforceValue();
-    if (iosSimulatorUdid && device.toLowerCase() !== iosSimulatorUdid.toLowerCase()) {
+    if (!isAndroid && previewDevice && device.toLowerCase() !== previewDevice.toLowerCase()) {
       throw new SystemError(
-        `serve-sim became ready on ${device}, but this session requested ${iosSimulatorUdid}.`
+        `serve-sim became ready on ${device}, but this session requested ${previewDevice}.`
       );
     }
     hostReady = true;
@@ -807,7 +824,7 @@ async function startDeviceSessionHostInternalAsync(
           captureAsync: signal =>
             captureDeviceRunSessionPreviewAsync({
               runtimePlatform,
-              device,
+              device: previewDevice ?? device,
               env,
               signal,
             }),

packages/build-tools/src/steps/utils/ios/AscApiClient.ts

@@ -1,4 +1,4 @@
-import { UserError } from '@expo/eas-build-job';
+import { SystemError, UserError } from '@expo/eas-build-job';
 import { bunyan } from '@expo/logger';
 import { asyncResult } from '@expo/results';
 import * as jose from 'jose';
@@ -617,6 +617,24 @@ export class AscApiClient {
       );
       if (parsedAscErrorResponse.ok) {
         const errors = parsedAscErrorResponse.value.errors.map(ascError => {
+          if (response.status === 401 && ascError.code === 'NOT_AUTHORIZED') {
+            return new UserError(
+              'EAS_ASC_INVALID_AUTH',
+              'App Store Connect rejected the API authentication credentials. ' +
+                'Check that the API key is active and belongs to the correct App Store Connect account. ' +
+                'If the key is stored in EAS credentials, replace or reconfigure it. ' +
+                'For a local key, check `key_id` and `key`, and `issuer_id` for a team key. Then try again.',
+              { cause: ascError, docsUrl: 'https://docs.expo.dev/submit/ios/' }
+            );
+          }
+          if (response.status === 500 && ascError.code === 'UNEXPECTED_ERROR') {
+            return new SystemError(
+              'App Store Connect returned an unexpected server error. ' +
+                'Check Apple’s service status at https://developer.apple.com/system-status/ and verify whether the requested operation completed in App Store Connect before trying again. ' +
+                'If the error continues, try again later or contact Apple Developer Support.',
+              { cause: ascError, trackingCode: 'EAS_ASC_SERVER_ERROR' }
+            );
+          }
           if (ascError.code === 'FORBIDDEN.REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED') {
             return new UserError(
               'EAS_ASC_REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED',

packages/build-tools/src/steps/utils/ios/__tests__/AscApiClient.test.ts

@@ -1,4 +1,4 @@
-import { UserError } from '@expo/eas-build-job';
+import { SystemError, UserError } from '@expo/eas-build-job';
 import * as jose from 'jose';
 import nock from 'nock';
 
@@ -85,6 +85,57 @@ describe(AscApiClient, () => {
     }
   );
 
+  it.each([false, true])(
+    'explains NOT_AUTHORIZED without losing other errors (mixed: %s)',
+    async mixed => {
+      const known = { status: '401', code: 'NOT_AUTHORIZED' };
+      const other = { status: '401', code: 'OTHER_ERROR' };
+      const scope = nock('https://api.appstoreconnect.apple.com')
+        .get('/v1/apps/app')
+        .query(true)
+        .reply(401, { errors: mixed ? [known, other] : [known] });
+      const error = await client
+        .getAsync('/v1/apps/:id', { 'fields[apps]': ['bundleId', 'name'] }, { id: 'app' })
+        .catch(error => error);
+      const mapped = mixed ? error.errors[0] : error;
+      expect(mapped).toBeInstanceOf(UserError);
+      expect(mapped).toMatchObject({ errorCode: 'EAS_ASC_INVALID_AUTH', cause: known });
+      if (mixed) {
+        expect(error).toBeInstanceOf(AggregateError);
+        expect(error.errors[1]).toBeInstanceOf(AscApiRequestError);
+        expect(error.errors[1].code).toBe('OTHER_ERROR');
+      }
+      expect(scope.isDone()).toBe(true);
+    }
+  );
+
+  it.each([false, true])(
+    'explains UNEXPECTED_ERROR without losing other errors (mixed: %s)',
+    async mixed => {
+      const known = { status: '500', code: 'UNEXPECTED_ERROR' };
+      const other = { status: '500', code: 'OTHER_ERROR' };
+      const scope = nock('https://api.appstoreconnect.apple.com')
+        .get('/v1/apps/app')
+        .query(true)
+        .reply(500, { errors: mixed ? [known, other] : [known] });
+      const error = await client
+        .getAsync('/v1/apps/:id', { 'fields[apps]': ['bundleId', 'name'] }, { id: 'app' })
+        .catch(error => error);
+      const mapped = mixed ? error.errors[0] : error;
+      expect(mapped).toBeInstanceOf(SystemError);
+      expect(mapped).toMatchObject({
+        trackingCode: 'EAS_ASC_SERVER_ERROR',
+        cause: known,
+      });
+      if (mixed) {
+        expect(error).toBeInstanceOf(AggregateError);
+        expect(error.errors[1]).toBeInstanceOf(AscApiRequestError);
+        expect(error.errors[1].code).toBe('OTHER_ERROR');
+      }
+      expect(scope.isDone()).toBe(true);
+    }
+  );
+
   it('fetches app info', async () => {
     const appId = '1491144534';
     const responseFixture = require('./fixtures/apps/get-apps-200.json');

packages/build-tools/src/steps/utils/ios/__tests__/AscApiUtils.test.ts

@@ -391,7 +391,9 @@ describe('commitBuildUploadFileAsync', () => {
       .reply(status, { errors: [{ code }] });
     await expect(
       AscApiUtils.commitBuildUploadFileAsync({ client, fileId: 'file', logger })
-    ).rejects.toMatchObject({ status, code });
+    ).rejects.toMatchObject(
+      code === 'NOT_AUTHORIZED' ? { errorCode: 'EAS_ASC_INVALID_AUTH' } : { status, code }
+    );
   });
 
   it('does not commit when the initial state read fails', async () => {

packages/build-tools/src/steps/utils/ngrokTunnel.ts

@@ -0,0 +1,368 @@
+import { SystemError } from '@expo/eas-build-job';
+import { type bunyan } from '@expo/logger';
+import * as ngrok from '@ngrok/ngrok';
+import { randomBytes } from 'node:crypto';
+import { once } from 'node:events';
+import { type AddressInfo, type Socket, createConnection, createServer } from 'node:net';
+import { clearTimeout, setTimeout } from 'node:timers';
+
+import { turtleFetch } from '../../utils/turtleFetch';
+import { withDeviceRunSessionTimeoutAsync } from './deviceRunSessionTimeout';
+
+const PROBE_INTERVAL_MS = 15_000;
+const FAILURE_THRESHOLD = 3;
+const STOP_TIMEOUT_MS = 4_000;
+
+export type NgrokTunnelHandle = {
+  url: string;
+  subdomainId: string;
+  stopAsync: () => Promise<void>;
+};
+
+export async function startNgrokTunnelAsync({
+  port,
+  subdomainPrefix,
+  subdomainId = randomBytes(16).toString('hex'),
+  baseDomain,
+  authtoken,
+  rewriteHostHeader,
+  healthCheck,
+  logger,
+}: {
+  port: number;
+  subdomainPrefix: string;
+  subdomainId?: string;
+  baseDomain: string;
+  authtoken: string;
+  rewriteHostHeader?: boolean;
+  healthCheck?: { path: string; statuses?: number[] };
+  logger: bunyan;
+}): Promise<NgrokTunnelHandle> {
+  const domain = `${subdomainPrefix}-${subdomainId}.${baseDomain}`;
+  const controller = new AbortController();
+  const { signal } = controller;
+  const sockets = new Set<Socket>();
+  const target = createServer({ allowHalfOpen: true }, client => {
+    if (signal.aborted) {
+      client.destroy();
+      return;
+    }
+    const upstream = createConnection({ host: '127.0.0.1', port, allowHalfOpen: true });
+    for (const socket of [client, upstream]) {
+      sockets.add(socket);
+      socket.on('error', () => {
+        client.destroy();
+        upstream.destroy();
+      });
+      socket.on('close', () => sockets.delete(socket));
+    }
+    client.pipe(upstream).pipe(client);
+  });
+  target.listen(0, '127.0.0.1');
+  await once(target, 'listening');
+  target.unref();
+  signal.addEventListener(
+    'abort',
+    () => {
+      for (const socket of sockets) {
+        socket.destroy();
+      }
+    },
+    { once: true }
+  );
+  const config: ngrok.Config = {
+    addr: (target.address() as AddressInfo).port,
+    authtoken,
+    domain,
+    ...(rewriteHostHeader ? { request_header_add: [`Host:localhost:${port}`] } : {}),
+  };
+
+  const ownedListeners = new Set<ngrok.Listener>();
+  const retiredListeners = new Set<ngrok.Listener>();
+  const closingListeners = new Map<ngrok.Listener, Promise<void>>();
+  let pendingOpen: Promise<ngrok.Listener> | undefined;
+  let currentListener: ngrok.Listener | undefined;
+  function releaseTarget(): void {
+    if (signal.aborted && !pendingOpen && ownedListeners.size === 0 && target.listening) {
+      target.close();
+    }
+  }
+
+  async function closeAsync(
+    listener: ngrok.Listener,
+    closeSignal: AbortSignal,
+    logFailure = true
+  ): Promise<void> {
+    retiredListeners.add(listener);
+    let closing = closingListeners.get(listener);
+    if (!closing) {
+      closing = Promise.resolve().then(async () => await listener.close());
+      closingListeners.set(listener, closing);
+      void closing.then(
+        () => {
+          closingListeners.delete(listener);
+          retiredListeners.delete(listener);
+          ownedListeners.delete(listener);
+          releaseTarget();
+        },
+        () => closingListeners.delete(listener)
+      );
+    }
+    try {
+      await withDeviceRunSessionTimeoutAsync(
+        { name: 'Ngrok tunnel close', timeoutMs: 5_000, signal: closeSignal },
+        async () => await closing
+      );
+    } catch (err) {
+      if (logFailure && !closeSignal.aborted) {
+        logger.warn({ err }, `Could not stop ngrok tunnel ${domain}.`);
+      }
+    }
+  }
+
+  async function retireListenersAsync(retirementSignal: AbortSignal): Promise<void> {
+    let logFailure = true;
+    while (retiredListeners.size > 0) {
+      retirementSignal.throwIfAborted();
+      await Promise.all(
+        [...retiredListeners].map(retired => closeAsync(retired, retirementSignal, logFailure))
+      );
+      logFailure = false;
+      if (retiredListeners.size > 0) {
+        await waitAsync(250, retirementSignal);
+      }
+    }
+  }
+
+  async function retireLateListenerAsync(listener: ngrok.Listener): Promise<void> {
+    retiredListeners.add(listener);
+    try {
+      await withDeviceRunSessionTimeoutAsync(
+        { name: 'Late ngrok tunnel retirement', timeoutMs: STOP_TIMEOUT_MS },
+        async retirementSignal => {
+          while (retiredListeners.has(listener)) {
+            retirementSignal.throwIfAborted();
+            await closeAsync(listener, retirementSignal, false);
+            if (retiredListeners.has(listener)) {
+              await waitAsync(250, retirementSignal);
+            }
+          }
+        }
+      );
+    } catch (err) {
+      logger.warn({ err }, `Could not retire late ngrok tunnel ${domain}.`);
+    }
+  }
+
+  async function openAsync(forceNewSession = false): Promise<ngrok.Listener> {
+    if (pendingOpen) {
+      throw new SystemError(`A previous ngrok tunnel open for ${domain} is still pending.`);
+    }
+    let acquired: ngrok.Listener | undefined;
+    let retirement: Promise<void> | undefined;
+    const retireAcquired = () => {
+      if (acquired) {
+        retirement ??= retireLateListenerAsync(acquired);
+      }
+    };
+    try {
+      return await withDeviceRunSessionTimeoutAsync(
+        { name: 'Ngrok tunnel open', timeoutMs: 15_000, signal },
+        async openSignal => {
+          openSignal.throwIfAborted();
+          const opening = ngrok
+            .forward({
+              ...config,
+              ...(forceNewSession ? { force_new_session: true } : {}),
+            })
+            .then(listener => {
+              acquired = listener;
+              ownedListeners.add(listener);
+              return listener;
+            })
+            .finally(() => {
+              pendingOpen = undefined;
+            });
+          pendingOpen = opening;
+          void opening
+            .then(() => {
+              if (openSignal.aborted) {
+                retireAcquired();
+              }
+            })
+            .catch(() => releaseTarget());
+          const listener = await opening;
+          openSignal.throwIfAborted();
+          return listener;
+        }
+      );
+    } catch (err) {
+      retireAcquired();
+      throw err;
+    }
+  }
+
+  logger.info(`Starting ngrok tunnel ${domain} -> http://localhost:${port}.`);
+  let publicUrl: string | null;
+  try {
+    currentListener = await openAsync();
+    publicUrl = currentListener.url();
+    if (!publicUrl) {
+      await closeAsync(currentListener, signal);
+      currentListener = undefined;
+      throw new SystemError(`ngrok tunnel for ${domain} did not return a public URL.`);
+    }
+  } catch (error) {
+    controller.abort();
+    releaseTarget();
+    throw error;
+  }
+
+  const url = publicUrl;
+
+  async function probeAsync(
+    baseUrl: string,
+    { path, statuses = [200] }: NonNullable<typeof healthCheck>
+  ): Promise<boolean> {
+    try {
+      return await withDeviceRunSessionTimeoutAsync(
+        { name: 'Ngrok tunnel health probe', timeoutMs: 5_000, signal },
+        async probeSignal => {
+          const requestController = new AbortController();
+          try {
+            const response = await turtleFetch(new URL(path, baseUrl).href, 'GET', {
+              retries: 0,
+              redirect: 'manual',
+              shouldThrowOnNotOk: false,
+              headers: { 'ngrok-skip-browser-warning': 'true', 'Cache-Control': 'no-cache' },
+              signal: AbortSignal.any([probeSignal, requestController.signal]),
+            });
+            return !response.headers.has('ngrok-error-code') && statuses.includes(response.status);
+          } finally {
+            requestController.abort();
+          }
+        }
+      );
+    } catch {
+      return false;
+    }
+  }
+
+  async function superviseAsync(check: NonNullable<typeof healthCheck>): Promise<void> {
+    let failures = 0;
+    let attempts = 0;
+    let localUnhealthy = false;
+    while (
+      await waitAsync(
+        currentListener || localUnhealthy
+          ? PROBE_INTERVAL_MS
+          : Math.min(1_000 * 2 ** Math.min(attempts, 5), 30_000),
+        signal
+      )
+    ) {
+      await Promise.all([...retiredListeners].map(retired => closeAsync(retired, signal, false)));
+      if (signal.aborted) {
+        return;
+      }
+      if (currentListener && (await probeAsync(url, check))) {
+        if (failures > 0 || attempts > 0 || localUnhealthy) {
+          logger.info(`Ngrok tunnel ${domain} is healthy again.`);
+        }
+        failures = 0;
+        attempts = 0;
+        localUnhealthy = false;
+        continue;
+      }
+      if (signal.aborted) {
+        return;
+      }
+      if (!(await probeAsync(`http://127.0.0.1:${port}`, check))) {
+        if (!localUnhealthy && !signal.aborted) {
+          logger.warn(`Local service on port ${port} is unhealthy; waiting for it to recover.`);
+        }
+        localUnhealthy = true;
+        failures = 0;
+        continue;
+      }
+      localUnhealthy = false;
+      if (currentListener) {
+        failures++;
+        if (failures < FAILURE_THRESHOLD) {
+          continue;
+        }
+        logger.warn(`Ngrok tunnel ${domain} failed ${failures} health probes; reopening it.`);
+        await closeAsync(currentListener, signal);
+        currentListener = undefined;
+      }
+      if (signal.aborted) {
+        return;
+      }
+      attempts++;
+      try {
+        const reopened = await openAsync(/* forceNewSession */ true);
+        if (reopened.url() !== url) {
+          await closeAsync(reopened, signal);
+          throw new SystemError(
+            `Reopened ngrok tunnel for ${domain} returned a different public URL.`
+          );
+        }
+        currentListener = reopened;
+        failures = 0;
+      } catch (err) {
+        if (!signal.aborted && (attempts === 1 || attempts % 5 === 0)) {
+          logger.warn(
+            { err, attempt: attempts },
+            `Could not reopen ngrok tunnel ${domain}; will retry.`
+          );
+        }
+      }
+    }
+  }
+
+  const supervision = healthCheck
+    ? superviseAsync(healthCheck).catch(err => {
+        if (!signal.aborted) {
+          logger.warn({ err }, `Ngrok tunnel supervision stopped for ${domain}.`);
+        }
+      })
+    : Promise.resolve();
+  let stopTask: Promise<void> | undefined;
+  return {
+    url,
+    subdomainId,
+    stopAsync: () =>
+      (stopTask ??= (async () => {
+        controller.abort();
+        await withDeviceRunSessionTimeoutAsync(
+          { name: `Ngrok tunnel ${domain} stop`, timeoutMs: STOP_TIMEOUT_MS },
+          async stopSignal => {
+            await supervision;
+            if (currentListener) {
+              retiredListeners.add(currentListener);
+              currentListener = undefined;
+            }
+            await Promise.all([pendingOpen?.catch(() => {}), retireListenersAsync(stopSignal)]);
+            await retireListenersAsync(stopSignal);
+          }
+        );
+        releaseTarget();
+      })()),
+  };
+}
+
+function waitAsync(ms: number, signal: AbortSignal): Promise<boolean> {
+  if (signal.aborted) {
+    return Promise.resolve(false);
+  }
+  return new Promise(resolve => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve(false);
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener('abort', onAbort);
+      resolve(true);
+    }, ms);
+    signal.addEventListener('abort', onAbort, { once: true });
+  });
+}

packages/build-tools/src/steps/utils/remoteDeviceRunSession.ts

@@ -9,9 +9,7 @@ import {
   spawnAsync,
 } from '@expo/steps';
 import spawn from '@expo/turtle-spawn';
-import * as ngrok from '@ngrok/ngrok';
 import { z } from 'zod';
-import { randomBytes } from 'node:crypto';
 import fs from 'node:fs';
 import { createServer } from 'node:net';
 import path from 'node:path';
@@ -524,6 +522,14 @@ export async function fetchWebPreviewTurnArgsAsync(
     }
     return args;
   } catch (err) {
+    if (
+      err instanceof DeviceRunSessionWorkerApiError &&
+      err.code === 'DEVICE_RUN_SESSION_ALREADY_STOPPED'
+    ) {
+      logger.info('Device run session was stopped before TURN credentials were fetched.');
+      return [];
+    }
+
     const error = err instanceof Error ? err : new Error(String(err));
     Sentry.capture('Could not fetch Cloudflare TURN ICE servers', error, { level: 'warning' });
     logger.warn(
@@ -959,63 +965,7 @@ export async function findAvailablePortAsync(): Promise<number> {
   return address.port;
 }
 
-export type NgrokTunnelHandle = {
-  url: string;
-  subdomainId: string;
-  stopAsync: () => Promise<void>;
-};
-
-export async function startNgrokTunnelAsync({
-  port,
-  subdomainPrefix,
-  subdomainId: subdomainIdArg,
-  baseDomain,
-  authtoken,
-  rewriteHostHeader,
-  logger,
-}: {
-  port: number;
-  subdomainPrefix: string;
-  subdomainId?: string;
-  baseDomain: string;
-  authtoken: string;
-  rewriteHostHeader?: boolean;
-  logger: bunyan;
-}): Promise<NgrokTunnelHandle> {
-  const subdomainId = subdomainIdArg ?? randomBytes(16).toString('hex');
-  const domain = `${subdomainPrefix}-${subdomainId}.${baseDomain}`;
-  logger.info(`Starting ngrok tunnel ${domain} -> http://localhost:${port}.`);
-  // Run the ngrok agent in-process via the SDK; it keeps the session alive until
-  // the process exits, and the step blocks forever to hold it open.
-  const listener = await ngrok.forward({
-    addr: port,
-    authtoken,
-    domain,
-    ...(rewriteHostHeader ? { request_header_add: [`Host:localhost:${port}`] } : {}),
-  });
-  const url = listener.url();
-  if (!url) {
-    await listener.close();
-    throw new SystemError(`ngrok tunnel for ${domain} did not return a public URL.`);
-  }
-  let stopTask: Promise<void> | undefined;
-  return {
-    url,
-    subdomainId,
-    stopAsync: () =>
-      (stopTask ??= (async () => {
-        try {
-          await withDeviceRunSessionTimeoutAsync(
-            { name: 'Ngrok tunnel stop', timeoutMs: 4_000 },
-            async () => await listener.close()
-          );
-        } catch (error) {
-          logger.warn({ err: error }, `Could not stop ngrok tunnel ${domain}.`);
-          throw error;
-        }
-      })()),
-  };
-}
+export { type NgrokTunnelHandle, startNgrokTunnelAsync } from './ngrokTunnel';
 
 export async function waitForFileAsync<T>({
   filePath,

packages/build-tools/src/templates/npmrc.ts

@@ -1,3 +1,5 @@
-export const NpmrcTemplate = `//registry.npmjs.org/:_authToken=\${NPM_TOKEN}
+export const NpmrcAuthTokenLine = '//registry.npmjs.org/:_authToken=${NPM_TOKEN}';
+
+export const NpmrcTemplate = `${NpmrcAuthTokenLine}
 registry=https://registry.npmjs.org/
 `;

packages/build-tools/src/utils/IosSimulatorUtils.ts

@@ -7,6 +7,7 @@ import { setTimeout } from 'node:timers/promises';
 import { z } from 'zod';
 
 import { retryAsync } from './retry';
+import { waitForWarmSimulatorCleanupAsync } from './warmSimulatorCleanup';
 
 export type IosSimulatorUuid = string & z.BRAND<'IosSimulatorUuid'>;
 export type IosSimulatorName = string & z.BRAND<'IosSimulatorName'>;
@@ -119,6 +120,7 @@ export namespace IosSimulatorUtils {
     destinationDeviceName: IosSimulatorName;
     env: NodeJS.ProcessEnv;
   }): Promise<void> {
+    await waitForWarmSimulatorCleanupAsync(env);
     await spawn('xcrun', ['simctl', 'clone', sourceDeviceIdentifier, destinationDeviceName], {
       env,
     });
@@ -131,6 +133,7 @@ export namespace IosSimulatorUtils {
     deviceIdentifier: IosSimulatorUuid | IosSimulatorName;
     env: NodeJS.ProcessEnv;
   }): Promise<void> {
+    await waitForWarmSimulatorCleanupAsync(env);
     try {
       const devices = await getAvailableDevicesAsync({ env, filter: 'available' });
       const device = devices.find(
@@ -231,6 +234,7 @@ export namespace IosSimulatorUtils {
     env: NodeJS.ProcessEnv;
     launchdEnvironment?: Record<string, string>;
   }): Promise<void> {
+    await waitForWarmSimulatorCleanupAsync(env);
     const bootEnv = { ...env };
     for (const [name, value] of Object.entries(launchdEnvironment)) {
       bootEnv[`SIMCTL_CHILD_${name}`] = value;
@@ -253,6 +257,7 @@ export namespace IosSimulatorUtils {
     deviceIdentifier: IosSimulatorUuid | IosSimulatorName;
     env: NodeJS.ProcessEnv;
   }): Promise<{ udid: IosSimulatorUuid }> {
+    await waitForWarmSimulatorCleanupAsync(env);
     const bootstatusResult = await spawn(
       'xcrun',
       ['simctl', 'bootstatus', deviceIdentifier, '-b'],

packages/build-tools/src/utils/__tests__/IosSimulatorUtils.test.ts

@@ -5,6 +5,7 @@ import path from 'node:path';
 
 import { IosSimulatorUtils } from '../IosSimulatorUtils';
 import { retryAsync } from '../retry';
+import { waitForWarmSimulatorCleanupAsync } from '../warmSimulatorCleanup';
 
 jest.mock('@expo/turtle-spawn', () => ({
   __esModule: true,
@@ -14,6 +15,7 @@ jest.mock('@expo/turtle-spawn', () => ({
 jest.mock('../retry', () => ({
   retryAsync: jest.fn(async fn => await fn(0)),
 }));
+jest.mock('../warmSimulatorCleanup');
 
 const mockedSpawn = jest.mocked(spawn);
 
@@ -21,6 +23,7 @@ describe('IosSimulatorUtils', () => {
   beforeEach(() => {
     mockedSpawn.mockReset();
     mockedSpawn.mockResolvedValue({ stdout: '', stderr: '' } as any);
+    jest.mocked(waitForWarmSimulatorCleanupAsync).mockReset().mockResolvedValue(undefined);
   });
 
   describe(IosSimulatorUtils.getAvailableRuntimesAsync, () => {
@@ -151,6 +154,30 @@ describe('IosSimulatorUtils', () => {
       }) as any);
     }
 
+    it('waits for warm cleanup before checking device state and writing accessibility prefs', async () => {
+      let finishCleanup: (() => void) | undefined;
+      jest.mocked(waitForWarmSimulatorCleanupAsync).mockImplementationOnce(
+        async () =>
+          await new Promise<void>(resolve => {
+            finishCleanup = resolve;
+          })
+      );
+      mockAvailableDevices([device()]);
+
+      const setup = IosSimulatorUtils.enableAccessibilitySettingsAsync({
+        deviceIdentifier: device().udid as any,
+        env: {},
+      });
+      expect(mockedSpawn).not.toHaveBeenCalled();
+      expect(finishCleanup).toBeDefined();
+      finishCleanup?.();
+      await setup;
+
+      expect(mockedSpawn).toHaveBeenCalledWith('plutil', expect.anything(), {
+        env: {},
+      });
+    });
+
     it('writes accessibility prefs for an exact shutdown simulator match', async () => {
       mockAvailableDevices([
         device({

packages/build-tools/src/utils/__tests__/installIsolatedNpmPackageAsync.test.ts

@@ -0,0 +1,89 @@
+import spawn from '@expo/turtle-spawn';
+
+import { createMockLogger } from '../../__tests__/utils/logger';
+import { Sentry } from '../../sentry';
+import { installIsolatedNpmPackageAsync } from '../installIsolatedNpmPackageAsync';
+
+jest.mock('@expo/turtle-spawn', () => ({ __esModule: true, default: jest.fn() }));
+jest.mock('../../sentry', () => ({ Sentry: { capture: jest.fn() } }));
+
+const spawnMock = jest.mocked(spawn);
+const npmCacheUrl = 'https://npm-cache.expo.test';
+
+describe(installIsolatedNpmPackageAsync, () => {
+  it('retries without the npm cache registry when the install fails against it', async () => {
+    const logger = createMockLogger();
+    const cacheFailure = Object.assign(new Error('npm install exited with non-zero code: 1'), {
+      stderr: `npm error request to ${npmCacheUrl}/@scope%2ffork failed, reason: ECONNREFUSED`,
+    });
+    spawnMock.mockRejectedValueOnce(cacheFailure).mockResolvedValueOnce({} as never);
+
+    await installIsolatedNpmPackageAsync({
+      packageSpec: '@scope/fork@next',
+      directory: '/tmp/sandbox',
+      npmCacheUrl,
+      pathEnv: '/usr/bin',
+      logger,
+    });
+
+    expect(spawnMock).toHaveBeenCalledTimes(2);
+    expect(spawnMock.mock.calls[0][1]).toEqual(expect.arrayContaining(['--registry', npmCacheUrl]));
+    expect(spawnMock.mock.calls[1][1]).not.toContain('--registry');
+    expect(spawnMock.mock.calls[1][2]).toEqual({
+      env: { PATH: '/usr/bin', HOME: '/tmp/sandbox' },
+      logger,
+    });
+    expect(logger.warn).toHaveBeenCalledWith(
+      `Failed to install @scope/fork@next using the npm cache registry (${npmCacheUrl}). Retrying without the npm cache registry.`
+    );
+    expect(Sentry.capture).toHaveBeenCalledWith(
+      expect.objectContaining({ name: 'NpmCacheRegistryInstallError', cause: cacheFailure }),
+      { level: 'warning', extras: { packageSpec: '@scope/fork@next', npmCacheUrl } }
+    );
+  });
+
+  it('rethrows an install failure that does not mention the npm cache registry', async () => {
+    const error = Object.assign(new Error('npm install exited with non-zero code: 1'), {
+      stderr: 'npm error notarget No matching version found for @scope/fork@next.',
+    });
+    spawnMock.mockRejectedValueOnce(error);
+
+    await expect(
+      installIsolatedNpmPackageAsync({
+        packageSpec: '@scope/fork@next',
+        directory: '/tmp/sandbox',
+        npmCacheUrl,
+        pathEnv: '/usr/bin',
+      })
+    ).rejects.toBe(error);
+
+    expect(spawnMock).toHaveBeenCalledTimes(1);
+    expect(Sentry.capture).not.toHaveBeenCalled();
+  });
+
+  it('rethrows the cancellation of an install without retrying', async () => {
+    const controller = new AbortController();
+    const cancellation = new Error('cancelled');
+    spawnMock.mockImplementationOnce((() => {
+      controller.abort(cancellation);
+      return Promise.reject(
+        Object.assign(new Error('npm install was killed with SIGTERM'), {
+          stderr: `npm error request to ${npmCacheUrl}/@scope%2ffork failed`,
+        })
+      );
+    }) as unknown as typeof spawn);
+
+    await expect(
+      installIsolatedNpmPackageAsync({
+        packageSpec: '@scope/fork@next',
+        directory: '/tmp/sandbox',
+        npmCacheUrl,
+        pathEnv: '/usr/bin',
+        signal: controller.signal,
+      })
+    ).rejects.toBe(cancellation);
+
+    expect(spawnMock).toHaveBeenCalledTimes(1);
+    expect(Sentry.capture).not.toHaveBeenCalled();
+  });
+});

packages/build-tools/src/utils/__tests__/npmrc.test.ts

@@ -0,0 +1,120 @@
+import spawn from '@expo/turtle-spawn';
+import { vol } from 'memfs';
+
+import { createMockLogger } from '../../__tests__/utils/logger';
+import { NpmrcAuthTokenLine, NpmrcTemplate } from '../../templates/npmrc';
+import { setUpNpmrcAsync } from '../npmrc';
+
+jest.mock('fs');
+jest.mock('@expo/turtle-spawn', () => ({ __esModule: true, default: jest.fn() }));
+
+const projectTargetDirectory = '/workingdir/build';
+const homeDirectory = '/home/expo';
+
+describe(setUpNpmrcAsync, () => {
+  beforeEach(async () => {
+    vol.reset();
+    await vol.promises.mkdir(projectTargetDirectory, { recursive: true });
+    await vol.promises.mkdir(homeDirectory, { recursive: true });
+    jest.mocked(spawn).mockResolvedValue({ stdout: `${homeDirectory}/.npmrc\n` } as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('adds the NPM_TOKEN placeholder to ~/.npmrc on EAS Build and leaves the project .npmrc alone', async () => {
+    const projectContents = '//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}\n';
+    await vol.promises.writeFile(`${projectTargetDirectory}/.npmrc`, projectContents);
+    await vol.promises.writeFile(`${homeDirectory}/.npmrc`, 'fund=false');
+
+    await setUpNpmrcAsync({
+      projectTargetDirectory,
+      workingDirectory: projectTargetDirectory,
+      env: { NPM_TOKEN: 'npm_secret_token', EAS_BUILD_RUNNER: 'eas-build' },
+      logger: createMockLogger(),
+    });
+
+    expect(await vol.promises.readFile(`${homeDirectory}/.npmrc`, 'utf8')).toBe(
+      `fund=false\n${NpmrcAuthTokenLine}\n`
+    );
+    expect(await vol.promises.readFile(`${projectTargetDirectory}/.npmrc`, 'utf8')).toBe(
+      projectContents
+    );
+  });
+
+  it('adds the NPM_TOKEN placeholder to the user config file npm resolves from the build env', async () => {
+    await vol.promises.mkdir(`${homeDirectory}/npm`, { recursive: true });
+    jest.mocked(spawn).mockResolvedValueOnce({ stdout: `${homeDirectory}/npm/npmrc\n` } as never);
+    const env = {
+      NPM_TOKEN: 'npm_secret_token',
+      EAS_BUILD_RUNNER: 'eas-build',
+      NPM_CONFIG_USERCONFIG: '~/npm/npmrc',
+    };
+
+    await setUpNpmrcAsync({
+      projectTargetDirectory,
+      workingDirectory: projectTargetDirectory,
+      env,
+      logger: createMockLogger(),
+    });
+
+    expect(spawn).toHaveBeenCalledWith(
+      'npm',
+      ['config', 'get', 'userconfig'],
+      expect.objectContaining({ cwd: projectTargetDirectory, env })
+    );
+    expect(await vol.promises.readFile(`${homeDirectory}/npm/npmrc`, 'utf8')).toBe(
+      `\n${NpmrcAuthTokenLine}\n`
+    );
+    expect(vol.existsSync(`${homeDirectory}/.npmrc`)).toBe(false);
+  });
+
+  it('creates the project .npmrc and leaves the user npmrc alone on local builds', async () => {
+    await setUpNpmrcAsync({
+      projectTargetDirectory,
+      workingDirectory: projectTargetDirectory,
+      env: { NPM_TOKEN: 'npm_secret_token', EAS_BUILD_RUNNER: 'local-build-plugin' },
+      logger: createMockLogger(),
+    });
+
+    expect(await vol.promises.readFile(`${projectTargetDirectory}/.npmrc`, 'utf8')).toBe(
+      NpmrcTemplate
+    );
+    expect(vol.existsSync(`${homeDirectory}/.npmrc`)).toBe(false);
+  });
+
+  it('leaves an existing project .npmrc untouched on local builds', async () => {
+    const existingContents = 'registry=https://registry.example.com/\n';
+    await vol.promises.writeFile(`${projectTargetDirectory}/.npmrc`, existingContents);
+
+    await setUpNpmrcAsync({
+      projectTargetDirectory,
+      workingDirectory: projectTargetDirectory,
+      env: { NPM_TOKEN: 'npm_secret_token', EAS_BUILD_RUNNER: 'local-build-plugin' },
+      logger: createMockLogger(),
+    });
+
+    expect(await vol.promises.readFile(`${projectTargetDirectory}/.npmrc`, 'utf8')).toBe(
+      existingContents
+    );
+  });
+
+  it('reports an existing .npmrc when NPM_TOKEN is not set', async () => {
+    const logger = createMockLogger();
+    await vol.promises.writeFile(
+      `${projectTargetDirectory}/.npmrc`,
+      'registry=https://registry.example.com/\n'
+    );
+
+    await setUpNpmrcAsync({
+      projectTargetDirectory,
+      workingDirectory: projectTargetDirectory,
+      env: { EAS_BUILD_RUNNER: 'eas-build' },
+      logger,
+    });
+
+    expect(logger.info).toHaveBeenCalledWith('.npmrc found at .npmrc');
+    expect(vol.existsSync(`${homeDirectory}/.npmrc`)).toBe(false);
+  });
+});

packages/build-tools/src/utils/__tests__/packageManager.test.ts

@@ -1,9 +1,7 @@
 import { errors } from '@expo/eas-build-job';
-import { type bunyan } from '@expo/logger';
 import fs from 'fs-extra';
 import { vol } from 'memfs';
 import path from 'path';
-import semver from 'semver';
 
 import {
   PackageManager,
@@ -16,7 +14,6 @@ import {
   resolvePackageExec,
   resolvePackageInstall,
   resolvePackageManager,
-  resolvePackageVersionAsync,
   shouldUseFrozenLockfile,
 } from '../packageManager';
 
@@ -293,33 +290,6 @@ describe(resolvePackageInstall, () => {
   });
 });
 
-describe(resolvePackageVersionAsync, () => {
-  const logger = {
-    debug: jest.fn(),
-    info: jest.fn(),
-    warn: jest.fn(),
-    error: jest.fn(),
-  } as unknown as bunyan;
-
-  it('should resolve version from package name and dist tag', async () => {
-    const version = await resolvePackageVersionAsync({
-      logger,
-      packageName: '@expo/repack-app',
-      distTag: 'latest',
-    });
-    expect(semver.valid(version)).toBeTruthy();
-  });
-
-  it('should return null if version cannot be resolved', async () => {
-    const version = await resolvePackageVersionAsync({
-      logger,
-      packageName: '@expo/repack-app',
-      distTag: 'nonexistent-dist-tag',
-    });
-    expect(version).toBeNull();
-  });
-});
-
 describe(findPackagerRootDir, () => {
   beforeEach(() => {
     vol.reset();

packages/build-tools/src/utils/__tests__/turtleSshSession.test.ts

@@ -76,11 +76,7 @@ describe(getSshRelayServerUrl, () => {
 });
 
 describe(startSshSessionAsync, () => {
-  const config1: SshConnectionConfig = {
-    type: 'upterm-v1',
-    host: 'relay.expo.dev',
-    secret: 'secret-1',
-  };
+  const config1: SshConnectionConfig = { type: 'upterm-v1', secret: 'secret-1' };
   const config2: SshConnectionConfig = { ...config1, secret: 'secret-2' };
   const target = { type: 'JOB_RUN', id: 'jr-1' } as const;
 
@@ -133,7 +129,7 @@ describe(startSshSessionAsync, () => {
 
     expect(mutation).toHaveBeenCalledWith(expect.anything(), {
       target: { type: 'JOB_RUN', id: 'jr-1' },
-      connectionConfig: { ...config1, reconnecting: false, type: 'UPTERM_V1' },
+      connectionConfig: { type: 'UPTERM_V1', secret: 'secret-1', reconnecting: false },
       sessionSettings: { idleTimeoutSeconds: 900 },
     });
     expect(idleTimeoutSeconds).toBe(900);
@@ -155,7 +151,7 @@ describe(startSshSessionAsync, () => {
 
     expect(mutation).toHaveBeenCalledWith(expect.anything(), {
       target: { type: 'BUILD', id: 'b-1' },
-      connectionConfig: { ...config1, reconnecting: false, type: 'UPTERM_V1' },
+      connectionConfig: { type: 'UPTERM_V1', secret: 'secret-1', reconnecting: false },
       sessionSettings: { idleTimeoutSeconds: 900 },
     });
   });
@@ -242,7 +238,7 @@ describe(startSshSessionAsync, () => {
     );
     expect(mutation).toHaveBeenLastCalledWith(expect.anything(), {
       target: { type: 'JOB_RUN', id: 'jr-1' },
-      connectionConfig: { ...config2, reconnecting: false, type: 'UPTERM_V1' },
+      connectionConfig: { type: 'UPTERM_V1', secret: 'secret-2', reconnecting: false },
       sessionSettings: { idleTimeoutSeconds: 300 },
     });
   });
@@ -298,7 +294,7 @@ describe(startSshSessionAsync, () => {
     expect(host.redialAsync).toHaveBeenCalledTimes(1);
     expect(mutation).toHaveBeenLastCalledWith(expect.anything(), {
       target: { type: 'JOB_RUN', id: 'jr-1' },
-      connectionConfig: { ...config2, reconnecting: false, type: 'UPTERM_V1' },
+      connectionConfig: { type: 'UPTERM_V1', secret: 'secret-2', reconnecting: false },
       sessionSettings: { idleTimeoutSeconds: 300 },
     });
   });

packages/build-tools/src/utils/__tests__/upterm.test.ts

@@ -7,7 +7,6 @@ import { createMockLogger } from '../../__tests__/utils/logger';
 import { BuildContext } from '../../context';
 import { sleepAsync } from '../retry';
 import {
-  connectionConfigFromUptermSession,
   redactConnectionSecrets,
   redactSpawnErrorForLog,
   resolveUptermGcsObjectName,
@@ -42,49 +41,6 @@ describe(resolveUptermGcsObjectName, () => {
   });
 });
 
-describe(connectionConfigFromUptermSession, () => {
-  it('parses sessionId and host from session current fields', () => {
-    expect(
-      connectionConfigFromUptermSession({
-        sessionId: 'TOKENabc123',
-        host: 'ssh://relay.expo.dev:22',
-      })
-    ).toEqual({
-      type: 'upterm-v1',
-      host: 'relay.expo.dev',
-      secret: 'TOKENabc123',
-    });
-  });
-
-  it('accepts a bare hostname', () => {
-    expect(connectionConfigFromUptermSession({ sessionId: 'tok', host: 'relay.expo.dev' })).toEqual(
-      {
-        type: 'upterm-v1',
-        host: 'relay.expo.dev',
-        secret: 'tok',
-      }
-    );
-  });
-
-  it('keeps a non-default port so the CLI can pass it to ssh -p', () => {
-    expect(
-      connectionConfigFromUptermSession({
-        sessionId: 'tok',
-        host: 'ssh://relay.expo.dev:2222',
-      })
-    ).toEqual({
-      type: 'upterm-v1',
-      host: 'relay.expo.dev:2222',
-      secret: 'tok',
-    });
-  });
-
-  it('returns null when the host is not a parseable url', () => {
-    expect(connectionConfigFromUptermSession({ sessionId: 'tok', host: 'ssh://' })).toBeNull();
-    expect(connectionConfigFromUptermSession({ sessionId: 'tok', host: 'ssh://[' })).toBeNull();
-  });
-});
-
 describe(redactConnectionSecrets, () => {
   it('strips the userinfo secret from a connection string', () => {
     expect(
@@ -257,11 +213,7 @@ describe(startUptermHostAsync, () => {
       relayServerUrl: 'wss://relay.expo.dev',
     });
 
-    expect(host.connectionConfig).toEqual({
-      type: 'upterm-v1',
-      host: 'relay.expo.dev',
-      secret: 'TOKENx',
-    });
+    expect(host.connectionConfig).toEqual({ type: 'upterm-v1', secret: 'TOKENx' });
     expect(host.isAlive()).toBe(true);
     expect(mockedDownloadFile).not.toHaveBeenCalled();
     expect(mockedSpawn).toHaveBeenCalledWith('upterm', ['version'], {
@@ -369,6 +321,21 @@ describe(startUptermHostAsync, () => {
     );
   });
 
+  it('keeps polling until upterm reports a session id', async () => {
+    sessionStdout = JSON.stringify({ host: 'ssh://relay.expo.dev:22', clientCount: 0 });
+    mockedSleep.mockImplementationOnce(async () => {
+      sessionStdout = JSON.stringify({
+        sessionId: 'TOKENy',
+        host: 'ssh://relay.expo.dev:22',
+        clientCount: 0,
+      });
+    });
+
+    const host = await startUptermHostAsync(makeCtx(), { relayServerUrl: 'wss://r' });
+
+    expect(host.connectionConfig).toEqual({ type: 'upterm-v1', secret: 'TOKENy' });
+  });
+
   it('tears down and rethrows when the host never registers with the relay', async () => {
     jest.useFakeTimers();
     jest.setSystemTime(0);
@@ -420,11 +387,7 @@ describe(startUptermHostAsync, () => {
     const host = await startUptermHostAsync(makeCtx(), { relayServerUrl: 'wss://r' });
     const config = await host.redialAsync();
 
-    expect(config).toEqual({
-      type: 'upterm-v1',
-      host: 'relay.expo.dev',
-      secret: 'TOKENx',
-    });
+    expect(config).toEqual({ type: 'upterm-v1', secret: 'TOKENx' });
     expect(host.connectionConfig).toEqual(config);
   });
 
@@ -462,11 +425,7 @@ describe(startUptermHostAsync, () => {
     const host = await startUptermHostAsync(makeCtx(), { relayServerUrl: 'wss://r' });
     hostProcess.catch = () => new Promise<void>(() => {});
 
-    await expect(host.redialAsync()).resolves.toEqual({
-      type: 'upterm-v1',
-      host: 'relay.expo.dev',
-      secret: 'TOKENx',
-    });
+    await expect(host.redialAsync()).resolves.toEqual({ type: 'upterm-v1', secret: 'TOKENx' });
     expect(mockedSleep).toHaveBeenCalledWith(5_000);
   });
 

packages/build-tools/src/utils/__tests__/warmSimulatorCleanup.test.ts

@@ -0,0 +1,125 @@
+import spawn from '@expo/turtle-spawn';
+import fs from 'node:fs/promises';
+
+import { waitForWarmSimulatorCleanupAsync } from '../warmSimulatorCleanup';
+
+const STATE_FILE = '/tmp/expo-simulator-startup.json';
+const STARTUP_SCRIPT = '/usr/local/share/vm-tools/startup.sh';
+const platform = Object.getOwnPropertyDescriptor(process, 'platform')!;
+jest.mock('@expo/turtle-spawn');
+
+async function writeStateAsync(state: object): Promise<void> {
+  await fs.mkdir('/tmp', { recursive: true });
+  await fs.writeFile(STATE_FILE, JSON.stringify({ bootUuid: 'current-boot', ...state }));
+}
+
+beforeEach(() => {
+  Object.defineProperty(process, 'platform', { value: 'darwin' });
+  jest.mocked(spawn).mockResolvedValue({ stdout: 'current-boot\n' } as never);
+});
+afterEach(() => {
+  Object.defineProperty(process, 'platform', platform);
+});
+
+it('continues at once on a VM without warmup', async () => {
+  await expect(waitForWarmSimulatorCleanupAsync({})).resolves.toBeUndefined();
+  expect(spawn).not.toHaveBeenCalled();
+});
+
+it('ignores a previous boot cleanup record and reads the current boot only once', async () => {
+  await writeStateAsync({ status: 'disabled', bootUuid: 'old-boot' });
+  let finished = false;
+  const waiting = waitForWarmSimulatorCleanupAsync({}, { pollMs: 5 }).then(() => {
+    finished = true;
+  });
+  await new Promise(resolve => setTimeout(resolve, 30));
+  expect(finished).toBe(false);
+  await writeStateAsync({ status: 'disabled' });
+  await waiting;
+  expect(spawn).toHaveBeenCalledTimes(1);
+});
+
+it('does not accept a cleanup record without a boot ID', async () => {
+  await writeStateAsync({ status: 'disabled', bootUuid: undefined });
+  await expect(waitForWarmSimulatorCleanupAsync({}, { timeoutMs: 20, pollMs: 5 })).rejects.toThrow(
+    'Warm Simulator cleanup did not finish'
+  );
+});
+
+it.each(['failed', 'empty'])('fails closed when the current boot ID is %s', async mode => {
+  await writeStateAsync({ status: 'disabled' });
+  if (mode === 'failed') {
+    jest.mocked(spawn).mockRejectedValueOnce(new Error('sysctl failed'));
+  } else {
+    jest.mocked(spawn).mockResolvedValueOnce({ stdout: '' } as never);
+  }
+  await expect(waitForWarmSimulatorCleanupAsync({})).rejects.toThrow();
+});
+
+it('waits for cleanup when warmup is installed but has not written state yet', async () => {
+  await fs.mkdir('/usr/local/share/vm-tools', { recursive: true });
+  await fs.writeFile(STARTUP_SCRIPT, '');
+  let finished = false;
+  const waiting = waitForWarmSimulatorCleanupAsync({}, { pollMs: 5 }).then(() => {
+    finished = true;
+  });
+  await new Promise(resolve => setTimeout(resolve, 30));
+  expect(finished).toBe(false);
+  await writeStateAsync({ status: 'starting' });
+  await new Promise(resolve => setTimeout(resolve, 30));
+  expect(finished).toBe(false);
+  await writeStateAsync({ status: 'disabled' });
+  await waiting;
+});
+
+it('times out when installed warmup never writes state', async () => {
+  await fs.mkdir('/usr/local/share/vm-tools', { recursive: true });
+  await fs.writeFile(STARTUP_SCRIPT, '');
+  await expect(waitForWarmSimulatorCleanupAsync({}, { timeoutMs: 20, pollMs: 5 })).rejects.toThrow(
+    'Warm Simulator cleanup did not finish; the Simulator cannot be used.'
+  );
+});
+
+it('waits until the launcher records that cleanup finished', async () => {
+  await writeStateAsync({ status: 'ready' });
+  let finished = false;
+  const waiting = waitForWarmSimulatorCleanupAsync({}, { pollMs: 5 }).then(() => {
+    finished = true;
+  });
+  await new Promise(resolve => setTimeout(resolve, 30));
+  expect(finished).toBe(false);
+  await writeStateAsync({ status: 'stopping' });
+  await new Promise(resolve => setTimeout(resolve, 30));
+  expect(finished).toBe(false);
+  await writeStateAsync({ status: 'disabled' });
+  await waiting;
+  expect(finished).toBe(true);
+});
+
+it('fails with the recorded error when cleanup does not finish in time', async () => {
+  await writeStateAsync({ status: 'stopping', error: 'serve-sim did not exit' });
+  await expect(waitForWarmSimulatorCleanupAsync({}, { timeoutMs: 20, pollMs: 5 })).rejects.toThrow(
+    'Warm Simulator cleanup did not finish (serve-sim did not exit); the Simulator cannot be used.'
+  );
+});
+
+it('stops waiting when the job is cancelled', async () => {
+  await writeStateAsync({ status: 'stopping' });
+  const controller = new AbortController();
+  const waiting = waitForWarmSimulatorCleanupAsync({}, { pollMs: 5, signal: controller.signal });
+  controller.abort(new Error('cancelled'));
+  await expect(waiting).rejects.toThrow('cancelled');
+});
+
+it('does not wait for a job that uses the warm Simulator', async () => {
+  await writeStateAsync({ status: 'claimed' });
+  await expect(
+    waitForWarmSimulatorCleanupAsync({ EAS_USE_WARM_SIMULATOR: '1' }, { timeoutMs: 0 })
+  ).resolves.toBeUndefined();
+});
+
+it('does nothing outside macOS', async () => {
+  Object.defineProperty(process, 'platform', { value: 'linux' });
+  await writeStateAsync({ status: 'ready' });
+  await expect(waitForWarmSimulatorCleanupAsync({}, { timeoutMs: 0 })).resolves.toBeUndefined();
+});

packages/build-tools/src/utils/installIsolatedNpmPackageAsync.ts

@@ -0,0 +1,62 @@
+import { type bunyan } from '@expo/logger';
+import spawn from '@expo/turtle-spawn';
+
+import { NpmCacheRegistryInstallError, isNpmCacheInstallFailure } from './npmCacheRegistry';
+import { Sentry } from '../sentry';
+
+export async function installIsolatedNpmPackageAsync({
+  packageSpec,
+  directory,
+  npmCacheUrl,
+  pathEnv,
+  logger,
+  signal,
+}: {
+  packageSpec: string;
+  directory: string;
+  npmCacheUrl: string | undefined;
+  pathEnv: string | undefined;
+  logger?: bunyan;
+  signal?: AbortSignal;
+}): Promise<void> {
+  const installAsync = async (registryUrl: string | undefined): Promise<void> => {
+    await spawn(
+      'npm',
+      [
+        'install',
+        '--prefix',
+        directory,
+        '--no-save',
+        '--package-lock=false',
+        '--no-audit',
+        '--no-fund',
+        '--no-update-notifier',
+        ...(registryUrl ? ['--registry', registryUrl] : []),
+        packageSpec,
+      ],
+      // npm reads the user config in $HOME from any cwd, so the install directory doubles as HOME.
+      { env: { PATH: pathEnv, HOME: directory }, logger, signal }
+    );
+  };
+
+  if (!npmCacheUrl) {
+    await installAsync(undefined);
+    return;
+  }
+  try {
+    await installAsync(npmCacheUrl);
+  } catch (error) {
+    signal?.throwIfAborted();
+    if (!isNpmCacheInstallFailure(error, npmCacheUrl)) {
+      throw error;
+    }
+    logger?.warn(
+      `Failed to install ${packageSpec} using the npm cache registry (${npmCacheUrl}). Retrying without the npm cache registry.`
+    );
+    Sentry.capture(new NpmCacheRegistryInstallError(error), {
+      level: 'warning',
+      extras: { packageSpec, npmCacheUrl },
+    });
+    await installAsync(undefined);
+  }
+}

packages/build-tools/src/utils/npmCacheRegistry.ts

@@ -0,0 +1,20 @@
+import { SystemError } from '@expo/eas-build-job';
+
+export function isNpmCacheInstallFailure(err: unknown, npmCacheUrl: string): boolean {
+  return getErrorOutput(err).includes(npmCacheUrl);
+}
+
+function getErrorOutput(err: unknown): string {
+  if (!(err instanceof Error)) {
+    return '';
+  }
+  const { stdout, stderr } = err as Error & { stdout?: string; stderr?: string };
+  return [stdout, stderr].filter(Boolean).join('\n');
+}
+
+export class NpmCacheRegistryInstallError extends SystemError {
+  override name = 'NpmCacheRegistryInstallError';
+  constructor(cause: unknown) {
+    super('Failed to install dependencies using npm cache registry', { cause });
+  }
+}

packages/build-tools/src/utils/npmrc.ts

@@ -1,23 +1,56 @@
-import { Job } from '@expo/eas-build-job';
 import { bunyan } from '@expo/logger';
+import spawn from '@expo/turtle-spawn';
 import fs from 'fs-extra';
 import path from 'path';
 
 import { findPackagerRootDir } from './packageManager';
-import { BuildContext } from '../context';
-import { NpmrcTemplate } from '../templates/npmrc';
+import { NpmrcAuthTokenLine, NpmrcTemplate } from '../templates/npmrc';
 
-export async function setUpNpmrcAsync(ctx: BuildContext<Job>, logger: bunyan): Promise<void> {
-  if (ctx.env.NPM_TOKEN) {
-    await createNpmrcIfNotExistsAsync(ctx, logger);
+export async function setUpNpmrcAsync({
+  projectTargetDirectory,
+  workingDirectory,
+  env,
+  logger,
+}: {
+  projectTargetDirectory: string;
+  workingDirectory: string;
+  env: Record<string, string | undefined>;
+  logger: bunyan;
+}): Promise<void> {
+  if (!env.NPM_TOKEN) {
+    await logIfNpmrcExistsAsync(projectTargetDirectory, workingDirectory, logger);
+    return;
+  }
+  logger.info('We detected that you set the NPM_TOKEN environment variable');
+  // pnpm 10.34.2+ and 11.5.3+ ignore ${NPM_TOKEN} placeholders in a project-level .npmrc but expand them in ~/.npmrc
+  if (env.EAS_BUILD_RUNNER === 'eas-build') {
+    await addNpmTokenToUserNpmrcAsync(workingDirectory, env, logger);
   } else {
-    await logIfNpmrcExistsAsync(ctx, logger);
+    await createProjectNpmrcIfNotExistsAsync(projectTargetDirectory, logger);
   }
 }
 
-async function createNpmrcIfNotExistsAsync(ctx: BuildContext<Job>, logger: bunyan): Promise<void> {
-  logger.info('We detected that you set the NPM_TOKEN environment variable');
-  const projectNpmrcPath = path.join(ctx.buildDirectory, '.npmrc');
+async function addNpmTokenToUserNpmrcAsync(
+  workingDirectory: string,
+  env: Record<string, string | undefined>,
+  logger: bunyan
+): Promise<void> {
+  const userNpmrcPath = (
+    await spawn('npm', ['config', 'get', 'userconfig'], {
+      cwd: findPackagerRootDir(workingDirectory),
+      env,
+      stdio: 'pipe',
+    })
+  ).stdout.trim();
+  logger.info(`Adding "${NpmrcAuthTokenLine}" to ${userNpmrcPath}`);
+  await fs.appendFile(userNpmrcPath, `\n${NpmrcAuthTokenLine}\n`);
+}
+
+async function createProjectNpmrcIfNotExistsAsync(
+  projectTargetDirectory: string,
+  logger: bunyan
+): Promise<void> {
+  const projectNpmrcPath = path.join(projectTargetDirectory, '.npmrc');
   if (await fs.pathExists(projectNpmrcPath)) {
     logger.info('.npmrc already exists in your project directory, skipping generation');
   } else {
@@ -27,12 +60,13 @@ async function createNpmrcIfNotExistsAsync(ctx: BuildContext<Job>, logger: bunya
   }
 }
 
-async function logIfNpmrcExistsAsync(ctx: BuildContext<Job>, logger: bunyan): Promise<void> {
-  const projectNpmrcPath = path.join(
-    findPackagerRootDir(ctx.getReactNativeProjectDirectory()),
-    '.npmrc'
-  );
+async function logIfNpmrcExistsAsync(
+  projectTargetDirectory: string,
+  workingDirectory: string,
+  logger: bunyan
+): Promise<void> {
+  const projectNpmrcPath = path.join(findPackagerRootDir(workingDirectory), '.npmrc');
   if (await fs.pathExists(projectNpmrcPath)) {
-    logger.info(`.npmrc found at ${path.relative(ctx.buildDirectory, projectNpmrcPath)}`);
+    logger.info(`.npmrc found at ${path.relative(projectTargetDirectory, projectNpmrcPath)}`);
   }
 }

packages/build-tools/src/utils/packageManager.ts

@@ -1,5 +1,4 @@
 import { errors } from '@expo/eas-build-job';
-import { type bunyan } from '@expo/logger';
 import * as PackageManagerUtils from '@expo/package-manager';
 import { type BuildStepEnv } from '@expo/steps';
 import spawnAsync from '@expo/turtle-spawn';
@@ -126,34 +125,6 @@ export function resolvePackageInstall(
   }
 }
 
-/**
- * Get the version of a package from the dist-tags.
- * Returns null if the version cannot be resolved.
- */
-export async function resolvePackageVersionAsync({
-  logger,
-  packageName,
-  distTag,
-}: {
-  logger: bunyan;
-  packageName: string;
-  distTag: string;
-}): Promise<string | null> {
-  try {
-    const { stdout } = await spawnAsync('npm', ['view', packageName, 'dist-tags', '--json'], {
-      stdio: 'pipe',
-    });
-    const distTags = JSON.parse(stdout);
-    if (distTag in distTags) {
-      return distTags[distTag];
-    }
-  } catch (e: unknown) {
-    const message = e instanceof Error ? e.message : String(e);
-    logger.warn(`Unable to resolve version for ${packageName}@${distTag}: ${message}`);
-  }
-  return null;
-}
-
 export function findPackagerRootDir(currentDir: string): string {
   return PackageManagerUtils.resolveWorkspaceRoot(currentDir) ?? currentDir;
 }

packages/build-tools/src/utils/upterm.ts

@@ -37,11 +37,9 @@ const CONNECTION_STARTUP_TIMEOUT_MS = 60_000;
 const PROCESS_EXIT_TIMEOUT_MS = 5_000;
 const CLIENT_COUNT_READ_ATTEMPTS = 4;
 const CLIENT_COUNT_READ_RETRY_MS = 500;
-const DEFAULT_SSH_PORT = '22';
 
 export type SshConnectionConfig = {
   type: 'upterm-v1';
-  host: string;
   secret: string;
 };
 
@@ -55,30 +53,10 @@ export type UptermHost = {
 
 const UptermSessionJsonZ = z.object({
   sessionId: z.string().min(1),
-  host: z.string().min(1),
   clientCount: z.number().optional(),
 });
 type UptermSessionJson = z.infer<typeof UptermSessionJsonZ>;
 
-export function connectionConfigFromUptermSession(
-  parsed: Pick<UptermSessionJson, 'sessionId' | 'host'>
-): SshConnectionConfig | null {
-  let host = parsed.host;
-  if (host.includes('://')) {
-    let url: URL;
-    try {
-      url = new URL(host);
-    } catch {
-      return null;
-    }
-    host = url.port && url.port !== DEFAULT_SSH_PORT ? `${url.hostname}:${url.port}` : url.hostname;
-  }
-  if (!host) {
-    return null;
-  }
-  return { type: 'upterm-v1', host, secret: parsed.sessionId };
-}
-
 /**
  * Strip upterm session secrets out of text before it reaches a log or an error message. upterm
  * prints the session id as the userinfo of the connect line it advertises
@@ -196,10 +174,7 @@ async function waitForConnectionConfigAsync(
     if (adminSocketPath) {
       const session = await readCurrentSessionJsonAsync(uptermPath, adminSocketPath);
       if (session) {
-        const connectionConfig = connectionConfigFromUptermSession(session);
-        if (connectionConfig) {
-          return connectionConfig;
-        }
+        return { type: 'upterm-v1', secret: session.sessionId };
       }
     }
     if (Date.now() >= deadline) {

packages/build-tools/src/utils/warmSimulatorCleanup.ts

@@ -0,0 +1,61 @@
+import { SystemError } from '@expo/eas-build-job';
+import spawn from '@expo/turtle-spawn';
+import { existsSync } from 'node:fs';
+import fs from 'node:fs/promises';
+import { setTimeout as sleepAsync } from 'node:timers/promises';
+
+const LAUNCHER_STATE_FILE = '/tmp/expo-simulator-startup.json';
+const STARTUP_SCRIPT = '/usr/local/share/vm-tools/startup.sh';
+
+/**
+ * The worker stops warmup in the background for a job that does not use the warm Simulator. Wait
+ * here, before the job changes a Simulator, until the launcher records that its cleanup finished.
+ */
+export async function waitForWarmSimulatorCleanupAsync(
+  env: NodeJS.ProcessEnv,
+  {
+    timeoutMs = 150_000,
+    pollMs = 250,
+    signal,
+  }: { timeoutMs?: number; pollMs?: number; signal?: AbortSignal } = {}
+): Promise<void> {
+  if (process.platform !== 'darwin' || env.EAS_USE_WARM_SIMULATOR === '1') {
+    return;
+  }
+  const deadline = Date.now() + timeoutMs;
+  let bootUuid: string | undefined;
+  for (;;) {
+    signal?.throwIfAborted();
+    let state: { status?: unknown; error?: unknown; bootUuid?: unknown };
+    try {
+      state = JSON.parse(await fs.readFile(LAUNCHER_STATE_FILE, 'utf8'));
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT' && !existsSync(STARTUP_SCRIPT)) {
+        return;
+      }
+      // Warmup may still be loading; only disabled confirms cleanup on an enabled VM.
+      state = {};
+    }
+    if (state.status === 'disabled' && typeof state.bootUuid === 'string') {
+      bootUuid ??= (
+        await spawn('/usr/sbin/sysctl', ['-n', 'kern.bootsessionuuid'], {
+          signal,
+          timeout: Math.max(1, deadline - Date.now()),
+        })
+      ).stdout.trim();
+      if (!bootUuid) {
+        throw new SystemError('Could not read the current VM boot ID.');
+      }
+      if (state.bootUuid === bootUuid) {
+        return;
+      }
+    }
+    if (Date.now() >= deadline) {
+      throw new SystemError(
+        `Warm Simulator cleanup did not finish${typeof state.error === 'string' ? ` (${state.error})` : ''}; the Simulator cannot be used.`
+      );
+    }
+    // The signal is checked at each poll, so a cancelled job stops within one interval.
+    await sleepAsync(pollMs);
+  }
+}

packages/create-eas-build-function/CHANGELOG.md

@@ -1,5 +1,17 @@
 # create-eas-build-function
 
+## 27.3.0
+
+No changes in this release.
+
+## 27.2.0
+
+No changes in this release.
+
+## 27.1.0
+
+No changes in this release.
+
 ## 27.0.0
 
 No changes in this release.

packages/create-eas-build-function/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-eas-build-function",
-  "version": "27.0.0",
+  "version": "27.3.0",
   "description": "Create functions for use in EAS Build custom builds.",
   "keywords": [
     "expo",
@@ -35,7 +35,7 @@
     "clean": "rimraf ./build/ \"*.tsbuildinfo\""
   },
   "dependencies": {
-    "@expo/steps": "27.0.0"
+    "@expo/steps": "27.3.0"
   },
   "devDependencies": {
     "@expo/package-manager": "1.9.10",

packages/downloader/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @expo/downloader
 
+## 27.3.0
+
+No changes in this release.
+
+## 27.2.0
+
+No changes in this release.
+
+## 27.1.0
+
+No changes in this release.
+
 ## 27.0.0
 
 No changes in this release.

packages/downloader/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/downloader",
-  "version": "27.0.0",
+  "version": "27.3.0",
   "bugs": "https://github.com/expo/eas-cli/issues",
   "license": "BUSL-1.1",
   "author": "Expo <[email protected]>",

packages/eas-build-cache-provider/CHANGELOG.md

@@ -1,5 +1,17 @@
 # eas-build-cache-provider
 
+## 27.3.0
+
+No changes in this release.
+
+## 27.2.0
+
+No changes in this release.
+
+## 27.1.0
+
+No changes in this release.
+
 ## 27.0.0
 
 No changes in this release.

packages/eas-build-cache-provider/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eas-build-cache-provider",
-  "version": "27.0.0",
+  "version": "27.3.0",
   "description": "A build cache provider plugin for the Expo CLI",
   "homepage": "https://github.com/expo/eas-cli",
   "bugs": "https://github.com/expo/eas-cli/issues",

packages/eas-build-job/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @expo/eas-build-job
 
+## 27.3.0
+
+### Minor Changes
+
+- Add optional Observe error context to workflow jobs. ([#4787](https://github.com/expo/eas-cli/pull/4787) by [@AbbanMustafa](https://github.com/AbbanMustafa))
+
+## 27.2.0
+
+No changes in this release.
+
+## 27.1.0
+
+No changes in this release.
+
 ## 27.0.0
 
 No changes in this release.

packages/eas-build-job/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@expo/eas-build-job",
-  "version": "27.0.0",
+  "version": "27.3.0",
   "bugs": "https://github.com/expo/eas-cli/issues",
   "license": "MIT",
   "author": "Expo <[email protected]>",
@@ -25,9 +25,9 @@
     "clean": "rimraf node_modules dist coverage \"*.tsbuildinfo\""
   },
   "dependencies": {
-    "@expo/logger": "27.0.0",
+    "@expo/logger": "27.3.0",
     "@expo/results": "1.0.0",
-    "@expo/turtle-spawn": "27.0.0",
+    "@expo/turtle-spawn": "27.3.0",
     "joi": "^17.13.1",
     "semver": "^7.6.2",
     "zod": "^4.3.5"

packages/eas-build-job/src/__tests__/observeContext.test.ts

@@ -0,0 +1,95 @@
+import { ArchiveSourceType, BuildTrigger, StaticWorkflowInterpolationContextZ } from '../common';
+import { Generic } from '../generic';
+
+function createContext() {
+  return {
+    after: {},
+    needs: {},
+    workflow: {
+      id: 'workflow-id',
+      name: 'Investigate error',
+      filename: 'observe.yml',
+      url: 'https://expo.dev/accounts/example/workflows/workflow-id',
+    },
+    app: { id: '123e4567-e89b-42d3-a456-426614174000', slug: 'example' },
+    account: { id: 'account-id', name: 'example' },
+    observe: {
+      event: {
+        id: '123e4567-e89b-42d3-a456-426614174001',
+        type: 'new_error' as const,
+        occurredAt: '2026-10-29T12:00:00.000Z',
+        appId: '123e4567-e89b-42d3-a456-426614174000',
+        fingerprint: { value: 'error-fingerprint', version: 'v1' },
+        severity: 'fatal' as const,
+        environment: 'production',
+        platform: 'ios' as const,
+        deviceOs: 'iOS',
+        exception: { type: 'Error', message: 'Example error' },
+      },
+    },
+  };
+}
+
+describe('Observe workflow context', () => {
+  it('preserves the event when validating a generic job', () => {
+    const context = createContext();
+    const job = {
+      projectArchive: { type: ArchiveSourceType.GIT, gitCommitHash: 'abc123', gitRef: null },
+      steps: [{ run: 'echo "${{ observe.event.exception.message }}"', shell: 'sh' }],
+      secrets: { robotAccessToken: 'token', environmentSecrets: [] },
+      expoDevUrl: context.workflow.url,
+      builderEnvironment: { image: 'ubuntu', env: {} },
+      triggeredBy: BuildTrigger.GIT_BASED_INTEGRATION,
+      appId: context.app.id,
+      initiatingUserId: '123e4567-e89b-42d3-a456-426614174002',
+      workflowInterpolationContext: context,
+    };
+
+    const parsed = Generic.JobZ.parse(job);
+
+    expect(parsed.workflowInterpolationContext).toEqual(context);
+  });
+
+  it('accepts nullable event metadata and an omitted device OS', () => {
+    const context = createContext();
+    const nullableContext = {
+      ...context,
+      observe: {
+        event: {
+          ...context.observe.event,
+          fingerprint: { value: 'error-fingerprint', version: null },
+          severity: 'error',
+          environment: null,
+          platform: null,
+          deviceOs: undefined,
+          exception: { type: null, message: null },
+        },
+      },
+    };
+
+    expect(StaticWorkflowInterpolationContextZ.parse(nullableContext)).toEqual(nullableContext);
+  });
+
+  it('preserves additional event fields from a newer producer', () => {
+    const context = createContext();
+    const extendedContext = {
+      ...context,
+      observe: {
+        ...context.observe,
+        event: {
+          ...context.observe.event,
+          additionalMetadata: 'future value',
+          exception: { ...context.observe.event.exception, stacktrace: 'future stack trace' },
+        },
+      },
+    };
+
+    expect(StaticWorkflowInterpolationContextZ.parse(extendedContext)).toEqual(extendedContext);
+  });
+
+  it('rejects an Observe context without an event', () => {
+    expect(
+      StaticWorkflowInterpolationContextZ.safeParse({ ...createContext(), observe: {} }).success
+    ).toBe(false);
+  });
+});

packages/eas-build-job/src/common.ts

@@ -344,6 +344,24 @@ const SentryContextZ = z.looseObject({
   resolution_type: z.string().optional(),
 });
 
+const ObserveContextZ = z.looseObject({
+  event: z.looseObject({
+    id: z.uuid(),
+    type: z.literal('new_error'),
+    occurredAt: z.iso.datetime(),
+    appId: z.uuid(),
+    fingerprint: z.looseObject({
+      value: z.string().min(1),
+      version: z.string().min(1).nullable(),
+    }),
+    severity: z.enum(['fatal', 'error']),
+    environment: z.string().nullable(),
+    platform: z.enum(['ios', 'android']).nullable(),
+    deviceOs: z.string().optional(),
+    exception: z.looseObject({ type: z.string().nullable(), message: z.string().nullable() }),
+  }),
+});
+
 export const StaticWorkflowInterpolationContextZ = z.object({
   after: z.record(
     z.string(),
@@ -381,6 +399,7 @@ export const StaticWorkflowInterpolationContextZ = z.object({
   app_store_connect: AppStoreConnectContextZ.optional(),
   // We need to .optional() to support jobs that are not triggered by a Sentry event.
   sentry: SentryContextZ.optional(),
+  observe: ObserveContextZ.optional(),
 });
 
 export type StaticWorkflowInterpolationContext = z.infer<

packages/eas-cli/CHANGELOG.md

@@ -1,5 +1,38 @@
 # eas-cli
 
+## 27.3.0
+
+### Patch Changes
+
+- Bump `@expo/apple-utils` to `2.3.0` to fix iOS capability sync when App Store Connect rejects enabling, disabling or changing a capability. ([#4790](https://github.com/expo/eas-cli/pull/4790) by [@douglowder](https://github.com/douglowder))
+- Keep already linked App Groups, Merchant IDs and iCloud containers when capability sync links another identifier. ([#4584](https://github.com/expo/eas-cli/pull/4584) by [@ceydaakin](https://github.com/ceydaakin))
+
+## 27.2.0
+
+### Minor Changes
+
+- Add an experiment that suggests Expo Update to coding agents after a build when the Free plan account is within 5 builds of the platform limit. ([#4758](https://github.com/expo/eas-cli/pull/4758) by [@williamgrosset](https://github.com/williamgrosset))
+- Add `eas observe:traces` to list request trace spans (or a summary of span names and counts), `eas observe:trace` to display one trace as a span tree, and span rows in the `eas observe:session` timeline. ([#4772](https://github.com/expo/eas-cli/pull/4772) by [@kadikraman](https://github.com/kadikraman))
+- Show a one-time Expo Simulators hint after a successful build. ([#4768](https://github.com/expo/eas-cli/pull/4768) by [@FiberJW](https://github.com/FiberJW))
+
+### Patch Changes
+
+- Remove the Free plan build limit guidance experiment for coding agents from `eas build`. ([#4757](https://github.com/expo/eas-cli/pull/4757) by [@williamgrosset](https://github.com/williamgrosset))
+
+## 27.1.0
+
+### Minor Changes
+
+- Display queued workflow runs: `workflow:run --wait` and `workflow:status` show a run waiting for its concurrency group and the run blocking it, and `workflow:cancel` includes queued runs in its selection list. ([#4258](https://github.com/expo/eas-cli/pull/4258) by [@hSATAC](https://github.com/hSATAC))
+- Upload the workflow files that `uses` jobs reference, including nested ones, when running a local workflow file with `eas workflow:run`. ([#4769](https://github.com/expo/eas-cli/pull/4769) by [@sswrk](https://github.com/sswrk))
+
+### Patch Changes
+
+- Fail the command when EAS CLI cannot pull environment variables from EAS servers, instead of continuing without them. ([#4774](https://github.com/expo/eas-cli/pull/4774) by [@wschurman](https://github.com/wschurman))
+- Format the generated root changelog before committing a release. ([#4773](https://github.com/expo/eas-cli/pull/4773) by [@gwdp](https://github.com/gwdp))
+- Honor the `--non-interactive` flag in `workflow:cancel`; it was parsed but never applied, so automation could hang on the interactive picker. ([#4258](https://github.com/expo/eas-cli/pull/4258) by [@hSATAC](https://github.com/hSATAC))
+- Stop reporting a finish time for workflow runs that have not finished: `workflow:runs` reports `finishedAt` only for runs in a final status. ([#4258](https://github.com/expo/eas-cli/pull/4258) by [@hSATAC](https://github.com/hSATAC))
+
 ## 27.0.0
 
 ### Major Changes

packages/eas-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eas-cli",
-  "version": "27.0.0",
+  "version": "27.3.0",
   "description": "EAS command line tool",
   "keywords": [
     "cli",
@@ -44,16 +44,16 @@
     "copy-new-templates": "rimraf build/commandUtils/new/templates && mkdir -p build/commandUtils/new && cp -r src/commandUtils/new/templates build/commandUtils/new"
   },
   "dependencies": {
-    "@expo/apple-utils": "2.2.1",
+    "@expo/apple-utils": "2.3.0",
     "@expo/code-signing-certificates": "0.0.5",
     "@expo/config": "55.0.10",
     "@expo/config-plugins": "55.0.7",
-    "@expo/eas-build-job": "27.0.0",
-    "@expo/eas-json": "27.0.0",
+    "@expo/eas-build-job": "27.3.0",
+    "@expo/eas-json": "27.3.0",
     "@expo/env": "^1.0.0",
     "@expo/experimentation": "0.0.5",
     "@expo/json-file": "8.3.3",
-    "@expo/logger": "27.0.0",
+    "@expo/logger": "27.3.0",
     "@expo/multipart-body-parser": "2.0.0",
     "@expo/osascript": "2.1.4",
     "@expo/package-manager": "1.9.10",
@@ -65,7 +65,7 @@
     "@expo/results": "1.0.0",
     "@expo/rudder-sdk-node": "1.1.1",
     "@expo/spawn-async": "1.7.2",
-    "@expo/steps": "27.0.0",
+    "@expo/steps": "27.3.0",
     "@expo/timeago.js": "1.0.0",
     "@oclif/core": "^4.8.3",
     "@oclif/plugin-autocomplete": "^3.2.40",

packages/eas-cli/src/__tests__/commands/utils.ts

@@ -198,6 +198,28 @@ export function getMockEmptyWorkflowRunsFragment(): WorkflowRunFragment[] {
   return getMockWorkflowRunsFragment();
 }
 
+export function getMockWorkflowRunFragment(
+  status: WorkflowRunStatus,
+  overrides?: Partial<WorkflowRunFragment>
+): WorkflowRunFragment {
+  return {
+    id: `run-${status}`,
+    status,
+    triggerEventType: WorkflowRunTriggerEventType.Manual,
+    errors: [],
+    createdAt: '2022-01-01T00:00:00.000Z',
+    updatedAt: '2022-01-01T00:00:00.000Z',
+    gitCommitHash: '1234567890',
+    gitCommitMessage: 'commit message',
+    workflow: {
+      name: 'build',
+      id: 'build',
+      fileName: 'build.yml',
+    },
+    ...overrides,
+  };
+}
+
 export function getMockWorkflowRunsFragment(
   params?:
     | undefined
@@ -240,6 +262,7 @@ export function getMockWorkflowRunsFragment(
       status: WorkflowRunStatus.Failure,
       createdAt: '2022-01-01T00:00:00.000Z',
       updatedAt: '2022-01-01T00:00:00.000Z',
+      finalizedAt: '2022-01-01T00:00:00.000Z',
       gitCommitHash: '1234567890',
       gitCommitMessage: 'commit message',
       workflow: {
@@ -332,6 +355,7 @@ export function getMockWorkflowRunWithJobsFragment(
         id: mockProjectId,
         __typename: 'App',
         name: 'App',
+        slug: 'app',
         ownerAccount: {
           id: 'account-id',
           name: 'account-name',
@@ -364,6 +388,7 @@ export function getMockWorkflowRunWithBuildJobsFragment(
         id: mockProjectId,
         __typename: 'App',
         name: 'App',
+        slug: 'app',
         ownerAccount: {
           id: 'account-id',
           name: 'account-name',

packages/eas-cli/src/__tests__/commands/workflow-cancel-test.ts

@@ -0,0 +1,88 @@
+import {
+  getMockWorkflowRunFragment,
+  mockCommandContext,
+  mockProjectId,
+  mockTestCommand,
+} from './utils';
+import WorkflowRunCancel from '../../commands/workflow/cancel';
+import { WorkflowRunStatus } from '../../graphql/generated';
+import { WorkflowRunMutation } from '../../graphql/mutations/WorkflowRunMutation';
+import { AppQuery } from '../../graphql/queries/AppQuery';
+import { promptAsync } from '../../prompts';
+
+jest.mock('../../graphql/queries/AppQuery');
+jest.mock('../../graphql/mutations/WorkflowRunMutation');
+jest.mock('../../log');
+jest.mock('../../prompts');
+
+describe(WorkflowRunCancel, () => {
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  test('prompts with in-progress and queued runs and cancels the selected ones', async () => {
+    const ctx = mockCommandContext(WorkflowRunCancel, {
+      projectId: mockProjectId,
+    });
+    const inProgressRun = getMockWorkflowRunFragment(WorkflowRunStatus.InProgress);
+    const waitingRun = getMockWorkflowRunFragment(WorkflowRunStatus.Waiting);
+    jest
+      .mocked(AppQuery.byIdWorkflowRunsFilteredByStatusAsync)
+      .mockImplementation(async (_graphqlClient, _appId, status) =>
+        status === WorkflowRunStatus.InProgress ? [inProgressRun] : [waitingRun]
+      );
+    jest.mocked(promptAsync).mockResolvedValueOnce({ selectedRuns: [waitingRun.id] });
+
+    const cmd = mockTestCommand(WorkflowRunCancel, [], ctx);
+    await cmd.run();
+
+    expect(AppQuery.byIdWorkflowRunsFilteredByStatusAsync).toHaveBeenCalledWith(
+      ctx.loggedIn.graphqlClient,
+      mockProjectId,
+      WorkflowRunStatus.InProgress,
+      50
+    );
+    expect(AppQuery.byIdWorkflowRunsFilteredByStatusAsync).toHaveBeenCalledWith(
+      ctx.loggedIn.graphqlClient,
+      mockProjectId,
+      WorkflowRunStatus.Waiting,
+      50
+    );
+    const promptCall = jest.mocked(promptAsync).mock.calls[0][0] as any;
+    expect(promptCall.choices.map((choice: any) => choice.value)).toEqual([
+      inProgressRun.id,
+      waitingRun.id,
+    ]);
+    expect(WorkflowRunMutation.cancelWorkflowRunAsync).toHaveBeenCalledTimes(1);
+    expect(WorkflowRunMutation.cancelWorkflowRunAsync).toHaveBeenCalledWith(
+      ctx.loggedIn.graphqlClient,
+      { workflowRunId: waitingRun.id }
+    );
+  });
+
+  test('throws in non-interactive mode when no run IDs are given', async () => {
+    const ctx = mockCommandContext(WorkflowRunCancel, {
+      projectId: mockProjectId,
+    });
+    const cmd = mockTestCommand(WorkflowRunCancel, ['--non-interactive'], ctx);
+    await expect(cmd.run()).rejects.toThrow(
+      'Must supply workflow run IDs as arguments when in non-interactive mode'
+    );
+    expect(promptAsync).not.toHaveBeenCalled();
+  });
+
+  test('cancels the given run IDs without prompting in non-interactive mode', async () => {
+    const ctx = mockCommandContext(WorkflowRunCancel, {
+      projectId: mockProjectId,
+    });
+    const cmd = mockTestCommand(WorkflowRunCancel, ['--non-interactive', 'run-id-1'], ctx);
+    await cmd.run();
+    expect(AppQuery.byIdWorkflowRunsFilteredByStatusAsync).not.toHaveBeenCalled();
+    expect(promptAsync).not.toHaveBeenCalled();
+    expect(WorkflowRunMutation.cancelWorkflowRunAsync).toHaveBeenCalledTimes(1);
+    expect(WorkflowRunMutation.cancelWorkflowRunAsync).toHaveBeenCalledWith(
+      ctx.loggedIn.graphqlClient,
+      { workflowRunId: 'run-id-1' }
+    );
+  });
+});

packages/eas-cli/src/__tests__/commands/workflow-runs-test.ts

@@ -142,6 +142,7 @@ describe(WorkflowRunList, () => {
         triggerEventType: WorkflowRunTriggerEventType.Manual,
         createdAt: '2022-01-01T00:00:00.000Z',
         updatedAt: '2022-01-01T00:00:00.000Z',
+        finalizedAt: '2022-01-01T00:00:00.000Z',
         gitCommitHash: '1234567890',
         gitCommitMessage: 'commit message',
         errors: [],

packages/eas-cli/src/analytics/AnalyticsManager.ts

@@ -70,6 +70,8 @@ export enum BuildEvent {
   BUILD_REQUEST_SUCCESS = 'build cli build request success',
   BUILD_REQUEST_FAIL = 'build cli build request fail',
   FREE_TIER_LIMIT_CHECKOUT_PROMPT = 'build cli free tier limit checkout prompt',
+  FREE_TIER_NEAR_LIMIT_AGENT_UPDATES_TIP = 'build cli free tier near limit agent updates tip',
+  SIMULATORS_LAUNCH_HINT_SHOWN = 'build cli simulators launch hint shown',
 
   BUILD_STATUS_COMMAND = 'build cli build status',
 

packages/eas-cli/src/build/__tests__/freeTierLimitGuidance-test.ts

@@ -1,280 +0,0 @@
-import type { ExperimentationDefinition } from '@expo/experimentation';
-import { Platform } from '@expo/eas-build-job';
-
-import { getAgentTelemetryContext } from '../../analytics/agent';
-import { ExperimentOverrides } from '../../experimentation/ExperimentOverrides';
-import {
-  EMPTY_EXPERIMENTATION_DEFINITION,
-  ExperimentationClient,
-  createLoggerConfig,
-} from '../../experimentation/ExperimentationClient';
-import { LazyExperimentationClient } from '../../experimentation/LazyExperimentationClient';
-import { createMockAnalytics, findUnitsByValue } from '../../experimentation/__tests__/fixtures';
-import {
-  FREE_TIER_LIMIT_AGENT_GUIDANCE_EXPERIMENT_NAMESPACE,
-  getFreeTierLimitAgentGuidanceExperiment,
-  maybeAppendFreeTierLimitAgentGuidanceAsync,
-  resolveFreeTierLimitAgentGuidanceVariantAsync,
-} from '../freeTierLimitGuidance';
-
-jest.mock('../../analytics/agent');
-
-const EXPERIMENT_NAME = 'cli-build-free-tier-limit-agent-guidance';
-
-/** Every account is in the experiment: 50% control, 50% treatment. */
-const ACCOUNT_DEFINITION: ExperimentationDefinition = {
-  experiments: [
-    {
-      experimentName: EXPERIMENT_NAME,
-      paramDefinitions: {
-        variant: { type: 'uniform_choice', choices: ['control', 'treatment'] },
-      },
-      exposureLoggerType: 'rudderstack',
-    },
-  ],
-  namespaces: [
-    {
-      name: FREE_TIER_LIMIT_AGENT_GUIDANCE_EXPERIMENT_NAMESPACE,
-      numSegments: 1000,
-      segmentExperimentSetupDefinitions: [
-        {
-          method: 'ADD',
-          name: `${EXPERIMENT_NAME} full`,
-          experimentName: EXPERIMENT_NAME,
-          numSegments: 1000,
-        },
-      ],
-    },
-  ],
-};
-
-function createClient(): {
-  client: ExperimentationClient;
-  analytics: ReturnType<typeof createMockAnalytics>;
-} {
-  const analytics = createMockAnalytics();
-  const client = new ExperimentationClient(
-    {
-      user: EMPTY_EXPERIMENTATION_DEFINITION,
-      account: ACCOUNT_DEFINITION,
-      device: EMPTY_EXPERIMENTATION_DEFINITION,
-    },
-    { user: null, device: null },
-    ExperimentOverrides.empty(),
-    createLoggerConfig(analytics)
-  );
-  return { client, analytics };
-}
-
-/** Probes a throwaway client, so the exposures it logs do not affect the client under test. */
-function findAccountIdsByVariant(): Map<string, string> {
-  const { client } = createClient();
-  return findUnitsByValue(
-    accountId =>
-      client.getAccountNamespace(FREE_TIER_LIMIT_AGENT_GUIDANCE_EXPERIMENT_NAMESPACE, {
-        accountId,
-      }),
-    'variant',
-    'control',
-    ['control', 'treatment']
-  );
-}
-
-describe(getFreeTierLimitAgentGuidanceExperiment, () => {
-  it('returns the handle when the command has an experimentation client', () => {
-    const experimentation = new LazyExperimentationClient(async () => createClient().client);
-
-    expect(
-      getFreeTierLimitAgentGuidanceExperiment({ experimentation, accountId: 'account-id' })
-    ).toEqual({ experimentation, accountId: 'account-id' });
-  });
-
-  it('returns undefined when the command has no experimentation client', () => {
-    expect(getFreeTierLimitAgentGuidanceExperiment({ accountId: 'account-id' })).toBeUndefined();
-  });
-});
-
-describe(resolveFreeTierLimitAgentGuidanceVariantAsync, () => {
-  const accountIdsByVariant = findAccountIdsByVariant();
-  const treatmentAccountId = accountIdsByVariant.get('treatment')!;
-  const controlAccountId = accountIdsByVariant.get('control')!;
-
-  beforeEach(() => {
-    jest.resetAllMocks();
-    jest
-      .mocked(getAgentTelemetryContext)
-      .mockReturnValue({ id: 'claude-code', sessionId: 'session-1' });
-  });
-
-  it('does not load the client when no coding agent runs the CLI', async () => {
-    jest.mocked(getAgentTelemetryContext).mockReturnValue(null);
-    const loadAsync = jest.fn(async () => createClient().client);
-
-    expect(
-      await resolveFreeTierLimitAgentGuidanceVariantAsync({
-        experimentation: new LazyExperimentationClient(loadAsync),
-        accountId: treatmentAccountId,
-      })
-    ).toBe('control');
-    expect(loadAsync).not.toHaveBeenCalled();
-  });
-
-  it('loads the client once across repeated reads', async () => {
-    const { client, analytics } = createClient();
-    const loadAsync = jest.fn(async () => client);
-    const experiment = {
-      experimentation: new LazyExperimentationClient(loadAsync),
-      accountId: treatmentAccountId,
-    };
-
-    await resolveFreeTierLimitAgentGuidanceVariantAsync(experiment);
-    await resolveFreeTierLimitAgentGuidanceVariantAsync(experiment);
-
-    expect(loadAsync).toHaveBeenCalledTimes(1);
-    expect(analytics.logEvent).toHaveBeenCalledTimes(1);
-  });
-
-  it('returns control and logs no exposure when no coding agent runs the CLI', async () => {
-    jest.mocked(getAgentTelemetryContext).mockReturnValue(null);
-    const { client, analytics } = createClient();
-
-    expect(
-      await resolveFreeTierLimitAgentGuidanceVariantAsync({
-        experimentation: LazyExperimentationClient.fromClient(client),
-        accountId: treatmentAccountId,
-      })
-    ).toBe('control');
-    expect(analytics.logEvent).not.toHaveBeenCalled();
-  });
-
-  it('returns the account variant and logs the exposure once when a coding agent runs the CLI', async () => {
-    const { client, analytics } = createClient();
-
-    expect(
-      await resolveFreeTierLimitAgentGuidanceVariantAsync({
-        experimentation: LazyExperimentationClient.fromClient(client),
-        accountId: treatmentAccountId,
-      })
-    ).toBe('treatment');
-    expect(
-      await resolveFreeTierLimitAgentGuidanceVariantAsync({
-        experimentation: LazyExperimentationClient.fromClient(client),
-        accountId: treatmentAccountId,
-      })
-    ).toBe('treatment');
-
-    expect(analytics.logEvent).toHaveBeenCalledTimes(1);
-    expect(analytics.logEvent).toHaveBeenCalledWith('Experiment Viewed', {
-      experimentName: EXPERIMENT_NAME,
-      variationName: 'treatment',
-      unit: treatmentAccountId,
-    });
-  });
-
-  it('logs the exposure for control accounts too', async () => {
-    const { client, analytics } = createClient();
-
-    expect(
-      await resolveFreeTierLimitAgentGuidanceVariantAsync({
-        experimentation: LazyExperimentationClient.fromClient(client),
-        accountId: controlAccountId,
-      })
-    ).toBe('control');
-    expect(analytics.logEvent).toHaveBeenCalledWith('Experiment Viewed', {
-      experimentName: EXPERIMENT_NAME,
-      variationName: 'control',
-      unit: controlAccountId,
-    });
-  });
-
-  it('returns control and logs no exposure when the namespace is missing from the config', async () => {
-    const analytics = createMockAnalytics();
-    const client = new ExperimentationClient(
-      {
-        user: EMPTY_EXPERIMENTATION_DEFINITION,
-        account: EMPTY_EXPERIMENTATION_DEFINITION,
-        device: EMPTY_EXPERIMENTATION_DEFINITION,
-      },
-      { user: null, device: null },
-      ExperimentOverrides.empty(),
-      createLoggerConfig(analytics)
-    );
-
-    expect(
-      await resolveFreeTierLimitAgentGuidanceVariantAsync({
-        experimentation: LazyExperimentationClient.fromClient(client),
-        accountId: treatmentAccountId,
-      })
-    ).toBe('control');
-    expect(analytics.logEvent).not.toHaveBeenCalled();
-  });
-});
-
-describe(maybeAppendFreeTierLimitAgentGuidanceAsync, () => {
-  const treatmentAccountId = findAccountIdsByVariant().get('treatment')!;
-
-  beforeEach(() => {
-    jest.resetAllMocks();
-    jest
-      .mocked(getAgentTelemetryContext)
-      .mockReturnValue({ id: 'claude-code', sessionId: 'session-1' });
-  });
-
-  it('returns the message unchanged and logs no exposure when the command has no experimentation client', async () => {
-    expect(await maybeAppendFreeTierLimitAgentGuidanceAsync('Error 1', Platform.ANDROID, undefined)).toBe(
-      'Error 1'
-    );
-  });
-
-  it('logs the exposure and appends the guidance in the treatment arm', async () => {
-    const { client, analytics } = createClient();
-
-    expect(
-      await maybeAppendFreeTierLimitAgentGuidanceAsync('Error 1', Platform.IOS, {
-        experimentation: LazyExperimentationClient.fromClient(client),
-        accountId: treatmentAccountId,
-      })
-    ).toBe(
-      [
-        'Error 1',
-        'Fix: Human required: iOS builds for this account are blocked until the Free plan resets. Upgrading costs money, so an account owner or admin decides.',
-      ].join('\n')
-    );
-    expect(analytics.logEvent).toHaveBeenCalledTimes(1);
-    expect(analytics.logEvent).toHaveBeenCalledWith('Experiment Viewed', {
-      experimentName: EXPERIMENT_NAME,
-      variationName: 'treatment',
-      unit: treatmentAccountId,
-    });
-  });
-
-  it('returns the message unchanged in the control arm', async () => {
-    const client = ExperimentationClient.createDisabled(
-      new ExperimentOverrides(
-        new Map([
-          [FREE_TIER_LIMIT_AGENT_GUIDANCE_EXPERIMENT_NAMESPACE, new Map([['variant', 'control']])],
-        ])
-      )
-    );
-
-    expect(
-      await maybeAppendFreeTierLimitAgentGuidanceAsync('Error 1', Platform.ANDROID, {
-        experimentation: LazyExperimentationClient.fromClient(client),
-        accountId: treatmentAccountId,
-      })
-    ).toBe('Error 1');
-  });
-
-  it('returns the message unchanged and logs no exposure when no coding agent runs the CLI', async () => {
-    jest.mocked(getAgentTelemetryContext).mockReturnValue(null);
-    const { client, analytics } = createClient();
-
-    expect(
-      await maybeAppendFreeTierLimitAgentGuidanceAsync('Error 1', Platform.ANDROID, {
-        experimentation: LazyExperimentationClient.fromClient(client),
-        accountId: treatmentAccountId,
-      })
-    ).toBe('Error 1');
-    expect(analytics.logEvent).not.toHaveBeenCalled();
-  });
-});

packages/eas-cli/src/build/__tests__/freeTierNearLimitAgentUpdatesTip-test.ts

@@ -0,0 +1,880 @@
+import type { ExperimentationDefinition } from '@expo/experimentation';
+import { ExpoConfig } from '@expo/config';
+
+import { getAgentTelemetryContext } from '../../analytics/agent';
+import { createGraphqlClient } from '../../commandUtils/context/contextUtils/createGraphqlClient';
+import { ExperimentOverrides } from '../../experimentation/ExperimentOverrides';
+import {
+  EMPTY_EXPERIMENTATION_DEFINITION,
+  ExperimentationClient,
+  createLoggerConfig,
+} from '../../experimentation/ExperimentationClient';
+import { LazyExperimentationClient } from '../../experimentation/LazyExperimentationClient';
+import { createMockAnalytics, findUnitsByValue } from '../../experimentation/__tests__/fixtures';
+import {
+  AppPlatform,
+  BuildFragment,
+  BuildStatus,
+  EasServiceMetric,
+  UsageMetricType,
+} from '../../graphql/generated';
+import { UserPreferenceMutation } from '../../graphql/mutations/UserPreferenceMutation';
+import { AccountQuery } from '../../graphql/queries/AccountQuery';
+import { UserPreferenceQuery } from '../../graphql/queries/UserPreferenceQuery';
+import Log from '../../log';
+import { isExpoUpdatesInstalled, isUsingEASUpdate } from '../../project/projectUtils';
+import { LoggedInAuthenticationInfo } from '../../user/SessionManager';
+import { Actor } from '../../user/User';
+import {
+  FREE_TIER_NEAR_LIMIT_AGENT_UPDATES_TIP_EXPERIMENT_NAMESPACE,
+  FreeTierNearLimitAgentUpdatesTipExperiment,
+  FreeTierNearLimitAgentUpdatesTipPlatformProject,
+  formatFreeTierNearLimitAgentUpdatesTip,
+  getFreeTierBuildUsageAsync,
+  getFreeTierNearLimitAgentUpdatesTipExperiment,
+  getFreeTierNearLimitAgentUpdatesTipPreferenceKey,
+  isEligibleForFreeTierNearLimitAgentUpdatesTip,
+  isPlatformEligibleForFreeTierNearLimitAgentUpdatesTip,
+  isWithinFreeTierNearLimitBand,
+  maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync,
+  resolveFreeTierNearLimitAgentUpdatesTipVariantAsync,
+} from '../freeTierNearLimitAgentUpdatesTip';
+
+jest.mock('../../analytics/agent');
+jest.mock('../../commandUtils/context/contextUtils/createGraphqlClient');
+jest.mock('../../graphql/queries/AccountQuery');
+jest.mock('../../graphql/queries/UserPreferenceQuery');
+jest.mock('../../graphql/mutations/UserPreferenceMutation');
+jest.mock('../../project/projectUtils', () => ({
+  ...jest.requireActual('../../project/projectUtils'),
+  isExpoUpdatesInstalled: jest.fn(),
+  isUsingEASUpdate: jest.fn(),
+}));
+
+const EXPERIMENT_NAME = 'cli-build-free-tier-near-limit-agent-updates-tip';
+const ANALYTICS_EVENT_PROPERTIES = { tracking_id: 'tracking-id' };
+const EXP = { name: 'app', slug: 'app' } as ExpoConfig;
+const IOS_EXP = { name: 'app', slug: 'app', ios: { bundleIdentifier: 'com.app' } } as ExpoConfig;
+const USER = { __typename: 'User', id: 'user-id' } as Actor;
+const SSO_USER = { __typename: 'SSOUser', id: 'sso-user-id' } as Actor;
+const ROBOT = { __typename: 'Robot', id: 'robot-id' } as Actor;
+const PARTNER = { __typename: 'PartnerActor', id: 'partner-id' } as Actor;
+const AUTHENTICATION_INFO: LoggedInAuthenticationInfo = {
+  accessToken: 'access-token',
+  sessionSecret: null,
+};
+const GRAPHQL_CLIENT = {} as FreeTierNearLimitAgentUpdatesTipExperiment['graphqlClient'];
+
+const ANDROID_KEY = 'free-tier-near-limit-agent-updates-tip-shown/account-id/android';
+const IOS_KEY = 'free-tier-near-limit-agent-updates-tip-shown/account-id/ios';
+
+const ANDROID_TIP_11_OF_15 = [
+  "Tip: this account has used 11 of 15 Android builds on the Free plan this period. This project isn't set up for Expo Update, so every change needs a new build.",
+  'With Expo Update, JavaScript, styling and image changes reach installed builds without a new build. Setup takes effect from the next build, so it saves the most builds if done now.',
+  'Next: eas update:configure --non-interactive, then build once more.',
+  'Tell the user: this adds expo-updates and changes app.json and eas.json.',
+  'Docs: https://docs.expo.dev/eas-update/getting-started/',
+].join('\n');
+
+function accountDefinition(enrolledSegments: number): ExperimentationDefinition {
+  return {
+    experiments: [
+      {
+        experimentName: EXPERIMENT_NAME,
+        paramDefinitions: {
+          variant: { type: 'uniform_choice', choices: ['control', 'treatment'] },
+        },
+        exposureLoggerType: 'rudderstack',
+      },
+    ],
+    namespaces: [
+      {
+        name: FREE_TIER_NEAR_LIMIT_AGENT_UPDATES_TIP_EXPERIMENT_NAMESPACE,
+        numSegments: 1000,
+        segmentExperimentSetupDefinitions: [
+          {
+            method: 'ADD',
+            name: `${EXPERIMENT_NAME} rollout`,
+            experimentName: EXPERIMENT_NAME,
+            numSegments: enrolledSegments,
+          },
+        ],
+      },
+    ],
+  };
+}
+
+/** Every account is in the experiment: 50% control, 50% treatment. */
+const ACCOUNT_DEFINITION = accountDefinition(1000);
+
+/** Like the production soft launch: 20% of accounts are in the experiment. */
+const PARTIAL_ROLLOUT_DEFINITION = accountDefinition(200);
+
+function createClient(definition: ExperimentationDefinition = ACCOUNT_DEFINITION): {
+  client: ExperimentationClient;
+  analytics: ReturnType<typeof createMockAnalytics>;
+} {
+  const analytics = createMockAnalytics();
+  const client = new ExperimentationClient(
+    {
+      user: EMPTY_EXPERIMENTATION_DEFINITION,
+      account: definition,
+      device: EMPTY_EXPERIMENTATION_DEFINITION,
+    },
+    { user: null, device: null },
+    ExperimentOverrides.empty(),
+    createLoggerConfig(analytics)
+  );
+  return { client, analytics };
+}
+
+/**
+ * Probes a throwaway client, so the exposures it logs do not affect the client under test. The
+ * probe uses a null default, so accounts outside the rollout can be told apart from control.
+ */
+function findAccountIdsByVariant(
+  definition: ExperimentationDefinition,
+  variants: (string | null)[]
+): Map<string | null, string> {
+  const { client } = createClient(definition);
+  return findUnitsByValue(
+    accountId =>
+      client.getAccountNamespace(FREE_TIER_NEAR_LIMIT_AGENT_UPDATES_TIP_EXPERIMENT_NAMESPACE, {
+        accountId,
+      }),
+    'variant',
+    null,
+    variants
+  );
+}
+
+function createOverriddenClient(variant: string): ExperimentationClient {
+  return ExperimentationClient.createDisabled(
+    new ExperimentOverrides(
+      new Map([
+        [FREE_TIER_NEAR_LIMIT_AGENT_UPDATES_TIP_EXPERIMENT_NAMESPACE, new Map([['variant', variant]])],
+      ])
+    )
+  );
+}
+
+function project(
+  overrides: Partial<FreeTierNearLimitAgentUpdatesTipPlatformProject> = {}
+): FreeTierNearLimitAgentUpdatesTipPlatformProject {
+  return {
+    developmentClient: false,
+    projectDir: '/app',
+    projectId: 'project-id',
+    exp: EXP,
+    manifestHostOverride: null,
+    ...overrides,
+  };
+}
+
+function createExperiment(
+  accountId: string,
+  {
+    client = createClient().client,
+    runFromCI = false,
+    json = false,
+    isUser = true,
+    analytics = createMockAnalytics(),
+    projectByPlatform = { [AppPlatform.Android]: project(), [AppPlatform.Ios]: project() },
+  }: {
+    client?: ExperimentationClient;
+    runFromCI?: boolean;
+    json?: boolean;
+    isUser?: boolean;
+    analytics?: ReturnType<typeof createMockAnalytics>;
+    projectByPlatform?: FreeTierNearLimitAgentUpdatesTipExperiment['projectByPlatform'];
+  } = {}
+): FreeTierNearLimitAgentUpdatesTipExperiment {
+  return {
+    experimentation: LazyExperimentationClient.fromClient(client),
+    graphqlClient: GRAPHQL_CLIENT,
+    analytics,
+    analyticsEventProperties: ANALYTICS_EVENT_PROPERTIES,
+    accountId,
+    isUser,
+    runFromCI,
+    json,
+    projectByPlatform,
+  };
+}
+
+function build(platform: AppPlatform, status: BuildStatus = BuildStatus.Finished): BuildFragment {
+  return { id: `${platform}-build`, platform, status } as BuildFragment;
+}
+
+type PlatformUsage = { value: number; limit: number };
+
+function usageResponse({
+  subscriptionName = 'Free' as string | null,
+  android = { value: 11, limit: 15 } as PlatformUsage,
+  ios = { value: 3, limit: 15 } as PlatformUsage,
+  billingPeriodId = 'period-1',
+  platformBreakdown = true,
+} = {}): Awaited<ReturnType<typeof AccountQuery.getFreeTierBuildUsageAsync>> {
+  return {
+    id: 'account-id',
+    subscription: subscriptionName === null ? null : { id: 'subscription-id', name: subscriptionName },
+    billingPeriod: {
+      id: billingPeriodId,
+      start: '2026-10-01T00:00:00.000Z',
+      end: '2026-11-01T00:00:00.000Z',
+    },
+    usageMetrics: {
+      EAS_BUILD: {
+        id: 'eas-build',
+        planMetrics: [
+          {
+            id: 'builds',
+            serviceMetric: EasServiceMetric.Builds,
+            metricType: UsageMetricType.Build,
+            value: android.value + ios.value,
+            limit: android.limit + ios.limit,
+            platformBreakdown: platformBreakdown ? { android, ios } : null,
+          },
+        ],
+      },
+    },
+  };
+}
+
+const accountIdsByVariant = findAccountIdsByVariant(ACCOUNT_DEFINITION, ['control', 'treatment']);
+const treatmentAccountId = accountIdsByVariant.get('treatment')!;
+const controlAccountId = accountIdsByVariant.get('control')!;
+/** An account outside the partial rollout. */
+const notEnrolledAccountId = findAccountIdsByVariant(PARTIAL_ROLLOUT_DEFINITION, [null]).get(null)!;
+
+/** In-memory stand-in for the server-side user preference store, keyed by preference key. */
+let shownTips: Record<string, unknown>;
+let logSpy: jest.SpyInstance;
+
+beforeEach(() => {
+  jest.resetAllMocks();
+  shownTips = {};
+  jest
+    .mocked(UserPreferenceQuery.getValueAsync)
+    .mockImplementation(async (_graphqlClient, key) => shownTips[key] ?? null);
+  jest
+    .mocked(UserPreferenceMutation.setAsync)
+    .mockImplementation(async (_graphqlClient, key, value) => {
+      shownTips[key] = value;
+    });
+  jest.mocked(getAgentTelemetryContext).mockReturnValue({ id: 'claude-code', sessionId: 's-1' });
+  jest.mocked(createGraphqlClient).mockReturnValue(GRAPHQL_CLIENT);
+  jest.mocked(isExpoUpdatesInstalled).mockReturnValue(false);
+  jest.mocked(isUsingEASUpdate).mockReturnValue(false);
+  jest.mocked(AccountQuery.getFreeTierBuildUsageAsync).mockResolvedValue(usageResponse());
+  logSpy = jest.spyOn(Log, 'log').mockImplementation(() => {});
+});
+
+describe(getFreeTierNearLimitAgentUpdatesTipExperiment, () => {
+  const ctx = {
+    authenticationInfo: AUTHENTICATION_INFO,
+    analytics: createMockAnalytics(),
+    analyticsEventProperties: ANALYTICS_EVENT_PROPERTIES,
+    accountId: 'account-id',
+    user: USER,
+    developmentClient: false,
+    projectDir: '/app',
+    projectId: 'project-id',
+    exp: EXP,
+    easJsonCliConfig: { updateManifestHostOverride: 'https://u.example.com' },
+    runFromCI: false,
+  };
+
+  it('returns the handle when the command has an experimentation client', () => {
+    const experimentation = new LazyExperimentationClient(async () => createClient().client);
+
+    expect(
+      getFreeTierNearLimitAgentUpdatesTipExperiment(
+        { [AppPlatform.Android]: { ...ctx, experimentation } },
+        { json: true }
+      )
+    ).toEqual({
+      experimentation,
+      graphqlClient: GRAPHQL_CLIENT,
+      analytics: ctx.analytics,
+      analyticsEventProperties: ANALYTICS_EVENT_PROPERTIES,
+      accountId: 'account-id',
+      isUser: true,
+      runFromCI: false,
+      json: true,
+      projectByPlatform: {
+        [AppPlatform.Android]: {
+          developmentClient: false,
+          projectDir: '/app',
+          projectId: 'project-id',
+          exp: EXP,
+          manifestHostOverride: 'https://u.example.com',
+        },
+      },
+    });
+  });
+
+  it('keeps the project state of each platform', () => {
+    const experimentation = new LazyExperimentationClient(async () => createClient().client);
+
+    expect(
+      getFreeTierNearLimitAgentUpdatesTipExperiment(
+        {
+          [AppPlatform.Android]: { ...ctx, experimentation },
+          [AppPlatform.Ios]: {
+            ...ctx,
+            experimentation,
+            exp: IOS_EXP,
+            developmentClient: true,
+            easJsonCliConfig: undefined,
+          },
+        },
+        { json: false }
+      )?.projectByPlatform
+    ).toEqual({
+      [AppPlatform.Android]: project({ manifestHostOverride: 'https://u.example.com' }),
+      [AppPlatform.Ios]: project({ exp: IOS_EXP, developmentClient: true }),
+    });
+  });
+
+  it('creates one GraphQL client with a request timeout', () => {
+    const experimentation = new LazyExperimentationClient(async () => createClient().client);
+
+    getFreeTierNearLimitAgentUpdatesTipExperiment(
+      {
+        [AppPlatform.Android]: { ...ctx, experimentation },
+        [AppPlatform.Ios]: { ...ctx, experimentation },
+      },
+      { json: false }
+    );
+
+    expect(createGraphqlClient).toHaveBeenCalledTimes(1);
+    expect(createGraphqlClient).toHaveBeenCalledWith(AUTHENTICATION_INFO, {
+      requestTimeoutMs: 3000,
+    });
+  });
+
+  it.each([
+    ['a regular user', USER, true],
+    ['an SSO user', SSO_USER, true],
+    ['a robot', ROBOT, false],
+    ['a partner actor', PARTNER, false],
+  ])('marks %s with isUser %p', (_label, user, isUser) => {
+    const experimentation = new LazyExperimentationClient(async () => createClient().client);
+
+    expect(
+      getFreeTierNearLimitAgentUpdatesTipExperiment(
+        { [AppPlatform.Android]: { ...ctx, user, experimentation } },
+        { json: false }
+      )?.isUser
+    ).toBe(isUser);
+  });
+
+  it('returns undefined when the command has no experimentation client', () => {
+    expect(
+      getFreeTierNearLimitAgentUpdatesTipExperiment({ [AppPlatform.Android]: ctx }, { json: false })
+    ).toBeUndefined();
+  });
+
+  it('returns undefined when the command has no authentication info', () => {
+    const experimentation = new LazyExperimentationClient(async () => createClient().client);
+
+    expect(
+      getFreeTierNearLimitAgentUpdatesTipExperiment(
+        { [AppPlatform.Android]: { ...ctx, authenticationInfo: undefined, experimentation } },
+        { json: false }
+      )
+    ).toBeUndefined();
+    expect(createGraphqlClient).not.toHaveBeenCalled();
+  });
+
+  it('returns undefined without build contexts', () => {
+    expect(getFreeTierNearLimitAgentUpdatesTipExperiment({}, { json: false })).toBeUndefined();
+  });
+});
+
+describe(isEligibleForFreeTierNearLimitAgentUpdatesTip, () => {
+  it('accepts agent runs', () => {
+    expect(isEligibleForFreeTierNearLimitAgentUpdatesTip(createExperiment('account-id'))).toBe(true);
+  });
+
+  it('rejects runs without a coding agent', () => {
+    jest.mocked(getAgentTelemetryContext).mockReturnValue(null);
+
+    expect(isEligibleForFreeTierNearLimitAgentUpdatesTip(createExperiment('account-id'))).toBe(false);
+  });
+
+  it('rejects runs from CI', () => {
+    expect(
+      isEligibleForFreeTierNearLimitAgentUpdatesTip(createExperiment('account-id', { runFromCI: true }))
+    ).toBe(false);
+  });
+
+  it('rejects robot and partner actors, which cannot store user preferences', () => {
+    expect(
+      isEligibleForFreeTierNearLimitAgentUpdatesTip(createExperiment('account-id', { isUser: false }))
+    ).toBe(false);
+  });
+
+  it('rejects --json runs', () => {
+    expect(
+      isEligibleForFreeTierNearLimitAgentUpdatesTip(createExperiment('account-id', { json: true }))
+    ).toBe(false);
+  });
+});
+
+describe(isPlatformEligibleForFreeTierNearLimitAgentUpdatesTip, () => {
+  it('accepts a project without Expo Update', () => {
+    expect(isPlatformEligibleForFreeTierNearLimitAgentUpdatesTip(project())).toBe(true);
+  });
+
+  it('accepts a project with expo-updates installed but no Expo Update URL', () => {
+    jest.mocked(isExpoUpdatesInstalled).mockReturnValue(true);
+
+    expect(isPlatformEligibleForFreeTierNearLimitAgentUpdatesTip(project())).toBe(true);
+  });
+
+  it('rejects a project that is already set up for Expo Update', () => {
+    jest.mocked(isExpoUpdatesInstalled).mockReturnValue(true);
+    jest.mocked(isUsingEASUpdate).mockReturnValue(true);
+
+    expect(isPlatformEligibleForFreeTierNearLimitAgentUpdatesTip(project())).toBe(false);
+    expect(isUsingEASUpdate).toHaveBeenCalledWith(EXP, 'project-id', null);
+  });
+
+  it('rejects development builds, which load JavaScript from the dev server', () => {
+    expect(
+      isPlatformEligibleForFreeTierNearLimitAgentUpdatesTip(project({ developmentClient: true }))
+    ).toBe(false);
+  });
+});
+
+describe(isWithinFreeTierNearLimitBand, () => {
+  it.each([
+    [9, false],
+    [10, true],
+    [11, true],
+    [14, true],
+    [15, false],
+    [16, false],
+  ])('used %s of 15 → %s', (used, expected) => {
+    expect(isWithinFreeTierNearLimitBand({ used, limit: 15 })).toBe(expected);
+  });
+
+  it('is false without a limit', () => {
+    expect(isWithinFreeTierNearLimitBand({ used: 0, limit: 0 })).toBe(false);
+  });
+});
+
+describe(getFreeTierBuildUsageAsync, () => {
+  it('returns the per-platform usage for a Free account', async () => {
+    expect(await getFreeTierBuildUsageAsync(createExperiment('account-id'))).toEqual({
+      billingPeriodId: 'period-1',
+      byPlatform: {
+        [AppPlatform.Android]: { used: 11, limit: 15 },
+        [AppPlatform.Ios]: { used: 3, limit: 15 },
+      },
+    });
+    expect(AccountQuery.getFreeTierBuildUsageAsync).toHaveBeenCalledWith(
+      expect.anything(),
+      'account-id',
+      expect.any(Date)
+    );
+  });
+
+  it('treats an account without a subscription as Free', async () => {
+    jest
+      .mocked(AccountQuery.getFreeTierBuildUsageAsync)
+      .mockResolvedValue(usageResponse({ subscriptionName: null }));
+
+    expect(await getFreeTierBuildUsageAsync(createExperiment('account-id'))).not.toBeNull();
+  });
+
+  it('returns null for a paid plan', async () => {
+    jest
+      .mocked(AccountQuery.getFreeTierBuildUsageAsync)
+      .mockResolvedValue(usageResponse({ subscriptionName: 'Starter' }));
+
+    expect(await getFreeTierBuildUsageAsync(createExperiment('account-id'))).toBeNull();
+  });
+
+  it('returns null without a platform breakdown', async () => {
+    jest
+      .mocked(AccountQuery.getFreeTierBuildUsageAsync)
+      .mockResolvedValue(usageResponse({ platformBreakdown: false }));
+
+    expect(await getFreeTierBuildUsageAsync(createExperiment('account-id'))).toBeNull();
+  });
+});
+
+describe(resolveFreeTierNearLimitAgentUpdatesTipVariantAsync, () => {
+  it('returns the account variant and logs the exposure once', async () => {
+    const { client, analytics } = createClient();
+    const experiment = createExperiment(treatmentAccountId, { client });
+
+    expect(await resolveFreeTierNearLimitAgentUpdatesTipVariantAsync(experiment)).toBe('treatment');
+    expect(await resolveFreeTierNearLimitAgentUpdatesTipVariantAsync(experiment)).toBe('treatment');
+
+    expect(analytics.logEvent).toHaveBeenCalledTimes(1);
+    expect(analytics.logEvent).toHaveBeenCalledWith('Experiment Viewed', {
+      experimentName: EXPERIMENT_NAME,
+      variationName: 'treatment',
+      unit: treatmentAccountId,
+    });
+  });
+
+  it('logs the exposure for control accounts too', async () => {
+    const { client, analytics } = createClient();
+
+    expect(
+      await resolveFreeTierNearLimitAgentUpdatesTipVariantAsync(
+        createExperiment(controlAccountId, { client })
+      )
+    ).toBe('control');
+    expect(analytics.logEvent).toHaveBeenCalledWith('Experiment Viewed', {
+      experimentName: EXPERIMENT_NAME,
+      variationName: 'control',
+      unit: controlAccountId,
+    });
+  });
+
+  it('returns control and logs no exposure for an account outside the rollout', async () => {
+    const { client, analytics } = createClient(PARTIAL_ROLLOUT_DEFINITION);
+
+    expect(
+      await resolveFreeTierNearLimitAgentUpdatesTipVariantAsync(
+        createExperiment(notEnrolledAccountId, { client })
+      )
+    ).toBe('control');
+    expect(analytics.logEvent).not.toHaveBeenCalled();
+  });
+
+  it('returns control and logs no exposure when the namespace is missing from the config', async () => {
+    const { client, analytics } = createClient(EMPTY_EXPERIMENTATION_DEFINITION);
+
+    expect(
+      await resolveFreeTierNearLimitAgentUpdatesTipVariantAsync(
+        createExperiment(treatmentAccountId, { client })
+      )
+    ).toBe('control');
+    expect(analytics.logEvent).not.toHaveBeenCalled();
+  });
+});
+
+describe(getFreeTierNearLimitAgentUpdatesTipPreferenceKey, () => {
+  it('scopes the key to the account and the lowercase platform', () => {
+    expect(getFreeTierNearLimitAgentUpdatesTipPreferenceKey('account-id', AppPlatform.Android)).toBe(
+      ANDROID_KEY
+    );
+    expect(getFreeTierNearLimitAgentUpdatesTipPreferenceKey('account-id', AppPlatform.Ios)).toBe(
+      IOS_KEY
+    );
+  });
+});
+
+describe(formatFreeTierNearLimitAgentUpdatesTip, () => {
+  it('formats the Android tip', () => {
+    expect(
+      formatFreeTierNearLimitAgentUpdatesTip({ platform: AppPlatform.Android, used: 11, limit: 15 })
+    ).toBe(ANDROID_TIP_11_OF_15);
+  });
+
+  it('formats the iOS tip', () => {
+    expect(
+      formatFreeTierNearLimitAgentUpdatesTip({ platform: AppPlatform.Ios, used: 14, limit: 15 })
+    ).toContain('Tip: this account has used 14 of 15 iOS builds on the Free plan this period.');
+  });
+});
+
+describe(maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync, () => {
+  function treatmentExperiment(
+    options: Parameters<typeof createExperiment>[1] = {}
+  ): FreeTierNearLimitAgentUpdatesTipExperiment {
+    return createExperiment('account-id', {
+      client: createOverriddenClient('treatment'),
+      ...options,
+    });
+  }
+
+  it('does nothing when the command has no experiment handle', async () => {
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync([build(AppPlatform.Android)], undefined);
+
+    expect(AccountQuery.getFreeTierBuildUsageAsync).not.toHaveBeenCalled();
+    expect(logSpy).not.toHaveBeenCalled();
+  });
+
+  it('requests no usage for ineligible runs', async () => {
+    jest.mocked(getAgentTelemetryContext).mockReturnValue(null);
+
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync(
+      [build(AppPlatform.Android)],
+      treatmentExperiment()
+    );
+
+    expect(AccountQuery.getFreeTierBuildUsageAsync).not.toHaveBeenCalled();
+    expect(logSpy).not.toHaveBeenCalled();
+  });
+
+  it('requests no usage when no build finished', async () => {
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync(
+      [build(AppPlatform.Android, BuildStatus.Errored), null],
+      treatmentExperiment()
+    );
+
+    expect(AccountQuery.getFreeTierBuildUsageAsync).not.toHaveBeenCalled();
+    expect(logSpy).not.toHaveBeenCalled();
+  });
+
+  it('requests no usage when no finished platform is eligible', async () => {
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync(
+      [build(AppPlatform.Android)],
+      treatmentExperiment({
+        projectByPlatform: { [AppPlatform.Android]: project({ developmentClient: true }) },
+      })
+    );
+
+    expect(AccountQuery.getFreeTierBuildUsageAsync).not.toHaveBeenCalled();
+    expect(logSpy).not.toHaveBeenCalled();
+  });
+
+  it('checks each platform against its own build context', async () => {
+    // Only the iOS build evaluated a config with the Expo Update URL.
+    jest.mocked(isExpoUpdatesInstalled).mockReturnValue(true);
+    jest.mocked(isUsingEASUpdate).mockImplementation(exp => exp === IOS_EXP);
+    jest
+      .mocked(AccountQuery.getFreeTierBuildUsageAsync)
+      .mockResolvedValue(usageResponse({ ios: { value: 14, limit: 15 } }));
+
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync(
+      [build(AppPlatform.Android), build(AppPlatform.Ios)],
+      treatmentExperiment({
+        projectByPlatform: {
+          [AppPlatform.Android]: project(),
+          [AppPlatform.Ios]: project({ exp: IOS_EXP }),
+        },
+      })
+    );
+
+    expect(logSpy).toHaveBeenCalledTimes(1);
+    expect(logSpy).toHaveBeenCalledWith(ANDROID_TIP_11_OF_15);
+    expect(shownTips).toEqual({ [ANDROID_KEY]: { billingPeriodId: 'period-1' } });
+  });
+
+  it('prints the tip in the treatment arm and remembers it for the billing period', async () => {
+    const experiment = treatmentExperiment();
+
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync([build(AppPlatform.Android)], experiment);
+
+    expect(logSpy).toHaveBeenCalledWith(ANDROID_TIP_11_OF_15);
+    expect(shownTips).toEqual({ [ANDROID_KEY]: { billingPeriodId: 'period-1' } });
+    expect(UserPreferenceMutation.setAsync).toHaveBeenCalledWith(GRAPHQL_CLIENT, ANDROID_KEY, {
+      billingPeriodId: 'period-1',
+    });
+    expect(experiment.analytics.logEvent).toHaveBeenCalledWith(
+      'build cli free tier near limit agent updates tip',
+      {
+        ...ANALYTICS_EVENT_PROPERTIES,
+        platform: AppPlatform.Android,
+        builds_used: 11,
+        builds_limit: 15,
+      }
+    );
+  });
+
+  it('prints nothing and writes no marker in the control arm, but records the exposure', async () => {
+    const { client, analytics } = createClient();
+    const experiment = createExperiment(controlAccountId, { client, analytics });
+
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync([build(AppPlatform.Android)], experiment);
+
+    expect(logSpy).not.toHaveBeenCalled();
+    expect(shownTips).toEqual({});
+    expect(UserPreferenceMutation.setAsync).not.toHaveBeenCalled();
+    expect(analytics.logEvent).toHaveBeenCalledWith('Experiment Viewed', {
+      experimentName: EXPERIMENT_NAME,
+      variationName: 'control',
+      unit: controlAccountId,
+    });
+    expect(analytics.logEvent).not.toHaveBeenCalledWith(
+      'build cli free tier near limit agent updates tip',
+      expect.anything()
+    );
+  });
+
+  it('does nothing for an account outside the experiment', async () => {
+    const { client, analytics } = createClient(PARTIAL_ROLLOUT_DEFINITION);
+    const experiment = createExperiment(notEnrolledAccountId, { client, analytics });
+
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync([build(AppPlatform.Android)], experiment);
+
+    expect(logSpy).not.toHaveBeenCalled();
+    expect(analytics.logEvent).not.toHaveBeenCalled();
+    expect(shownTips).toEqual({});
+    expect(UserPreferenceMutation.setAsync).not.toHaveBeenCalled();
+  });
+
+  it('logs the exposure only after the usage checks pass', async () => {
+    const { client, analytics } = createClient();
+    jest
+      .mocked(AccountQuery.getFreeTierBuildUsageAsync)
+      .mockResolvedValue(usageResponse({ android: { value: 9, limit: 15 } }));
+
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync(
+      [build(AppPlatform.Android)],
+      createExperiment(treatmentAccountId, { client, analytics })
+    );
+
+    expect(analytics.logEvent).not.toHaveBeenCalled();
+    expect(logSpy).not.toHaveBeenCalled();
+    expect(UserPreferenceQuery.getValueAsync).not.toHaveBeenCalled();
+    expect(UserPreferenceMutation.setAsync).not.toHaveBeenCalled();
+  });
+
+  it('does nothing for paid plans', async () => {
+    jest
+      .mocked(AccountQuery.getFreeTierBuildUsageAsync)
+      .mockResolvedValue(usageResponse({ subscriptionName: 'Production' }));
+    const experiment = treatmentExperiment();
+
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync([build(AppPlatform.Android)], experiment);
+
+    expect(logSpy).not.toHaveBeenCalled();
+    expect(experiment.analytics.logEvent).not.toHaveBeenCalled();
+  });
+
+  it('does not repeat the tip within the same billing period for this user', async () => {
+    shownTips = { [ANDROID_KEY]: { billingPeriodId: 'period-1' } };
+    const experiment = treatmentExperiment();
+
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync([build(AppPlatform.Android)], experiment);
+
+    expect(UserPreferenceQuery.getValueAsync).toHaveBeenCalledWith(GRAPHQL_CLIENT, ANDROID_KEY);
+    expect(logSpy).not.toHaveBeenCalled();
+    expect(experiment.analytics.logEvent).not.toHaveBeenCalled();
+    expect(UserPreferenceMutation.setAsync).not.toHaveBeenCalled();
+  });
+
+  it('shows the tip again in a new billing period', async () => {
+    const otherAccountIosKey = 'free-tier-near-limit-agent-updates-tip-shown/other-account/ios';
+    shownTips = {
+      [ANDROID_KEY]: { billingPeriodId: 'period-0' },
+      [otherAccountIosKey]: { billingPeriodId: 'period-1' },
+    };
+
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync(
+      [build(AppPlatform.Android)],
+      treatmentExperiment()
+    );
+
+    expect(logSpy).toHaveBeenCalledWith(ANDROID_TIP_11_OF_15);
+    expect(shownTips).toEqual({
+      [ANDROID_KEY]: { billingPeriodId: 'period-1' },
+      [otherAccountIosKey]: { billingPeriodId: 'period-1' },
+    });
+  });
+
+  it('treats a malformed stored preference as not shown', async () => {
+    shownTips = { [ANDROID_KEY]: 'period-1' };
+
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync(
+      [build(AppPlatform.Android)],
+      treatmentExperiment()
+    );
+
+    expect(logSpy).toHaveBeenCalledWith(ANDROID_TIP_11_OF_15);
+    expect(shownTips).toEqual({ [ANDROID_KEY]: { billingPeriodId: 'period-1' } });
+  });
+
+  it('checks each finished platform with one usage request', async () => {
+    jest
+      .mocked(AccountQuery.getFreeTierBuildUsageAsync)
+      .mockResolvedValue(usageResponse({ ios: { value: 14, limit: 15 } }));
+
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync(
+      [build(AppPlatform.Android), build(AppPlatform.Ios)],
+      treatmentExperiment()
+    );
+
+    expect(AccountQuery.getFreeTierBuildUsageAsync).toHaveBeenCalledTimes(1);
+    expect(logSpy).toHaveBeenCalledTimes(2);
+    expect(logSpy).toHaveBeenCalledWith(ANDROID_TIP_11_OF_15);
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining('used 14 of 15 iOS builds on the Free plan')
+    );
+    expect(shownTips).toEqual({
+      [ANDROID_KEY]: { billingPeriodId: 'period-1' },
+      [IOS_KEY]: { billingPeriodId: 'period-1' },
+    });
+  });
+
+  it('skips platforms outside the band', async () => {
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync(
+      [build(AppPlatform.Android), build(AppPlatform.Ios)],
+      treatmentExperiment()
+    );
+
+    expect(logSpy).toHaveBeenCalledTimes(1);
+    expect(logSpy).toHaveBeenCalledWith(ANDROID_TIP_11_OF_15);
+    expect(shownTips).toEqual({ [ANDROID_KEY]: { billingPeriodId: 'period-1' } });
+  });
+
+  it('still shows the tip and logs the events when the marker write fails', async () => {
+    jest.mocked(UserPreferenceMutation.setAsync).mockRejectedValue(new Error('forbidden'));
+    const { client, analytics } = createClient();
+    const experiment = createExperiment(treatmentAccountId, { client, analytics });
+
+    await expect(
+      maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync([build(AppPlatform.Android)], experiment)
+    ).resolves.toBeUndefined();
+
+    expect(logSpy).toHaveBeenCalledWith(ANDROID_TIP_11_OF_15);
+    expect(analytics.logEvent).toHaveBeenCalledWith('Experiment Viewed', {
+      experimentName: EXPERIMENT_NAME,
+      variationName: 'treatment',
+      unit: treatmentAccountId,
+    });
+    expect(analytics.logEvent).toHaveBeenCalledWith(
+      'build cli free tier near limit agent updates tip',
+      expect.objectContaining({ platform: AppPlatform.Android })
+    );
+    expect(shownTips).toEqual({});
+  });
+
+  it('still checks the next platform when a marker write fails', async () => {
+    jest
+      .mocked(UserPreferenceMutation.setAsync)
+      .mockRejectedValueOnce(new Error('forbidden'))
+      .mockImplementation(async (_graphqlClient, key, value) => {
+        shownTips[key] = value;
+      });
+    jest
+      .mocked(AccountQuery.getFreeTierBuildUsageAsync)
+      .mockResolvedValue(usageResponse({ ios: { value: 14, limit: 15 } }));
+
+    await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync(
+      [build(AppPlatform.Android), build(AppPlatform.Ios)],
+      treatmentExperiment()
+    );
+
+    expect(logSpy).toHaveBeenCalledTimes(2);
+    expect(logSpy).toHaveBeenCalledWith(ANDROID_TIP_11_OF_15);
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining('used 14 of 15 iOS builds on the Free plan')
+    );
+    expect(shownTips).toEqual({ [IOS_KEY]: { billingPeriodId: 'period-1' } });
+  });
+
+  it('fails open when the usage request fails', async () => {
+    jest
+      .mocked(AccountQuery.getFreeTierBuildUsageAsync)
+      .mockRejectedValue(new Error('network down'));
+    const experiment = treatmentExperiment();
+
+    await expect(
+      maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync([build(AppPlatform.Android)], experiment)
+    ).resolves.toBeUndefined();
+
+    expect(logSpy).not.toHaveBeenCalled();
+    expect(experiment.analytics.logEvent).not.toHaveBeenCalled();
+  });
+});

packages/eas-cli/src/build/__tests__/handleBuildRequestError-test.ts

@@ -5,12 +5,8 @@ import { GraphQLError } from 'graphql/error';
 import { v4 as uuidv4 } from 'uuid';
 
 import { getErrorAsync } from '../../__tests__/commands/utils';
-import { getAgentTelemetryContext } from '../../analytics/agent';
 import { EasCommandError } from '../../commandUtils/errors';
 import Build from '../../commands/build';
-import { ExperimentOverrides } from '../../experimentation/ExperimentOverrides';
-import { ExperimentationClient } from '../../experimentation/ExperimentationClient';
-import { LazyExperimentationClient } from '../../experimentation/LazyExperimentationClient';
 import Log, { link } from '../../log';
 import { handleBuildRequestErrorAsync } from '../build';
 import {
@@ -30,12 +26,7 @@ import {
   FreeTierLimitCheckoutExperiment,
   maybeOfferFreeTierLimitCheckoutAsync,
 } from '../freeTierLimitCheckout';
-import {
-  FREE_TIER_LIMIT_AGENT_GUIDANCE_EXPERIMENT_NAMESPACE,
-  FreeTierLimitAgentGuidanceExperiment,
-} from '../freeTierLimitGuidance';
 
-jest.mock('../../analytics/agent');
 jest.mock('../freeTierLimitCheckout', () => ({
   ...jest.requireActual('../freeTierLimitCheckout'),
   maybeOfferFreeTierLimitCheckoutAsync: jest.fn(),
@@ -45,26 +36,9 @@ const CHECKOUT_EXPERIMENT = { accountId: 'account-id' } as FreeTierLimitCheckout
 
 beforeEach(() => {
   jest.resetAllMocks();
-  jest.mocked(getAgentTelemetryContext).mockReturnValue(null);
   jest.mocked(maybeOfferFreeTierLimitCheckoutAsync).mockResolvedValue(false);
 });
 
-/** An experiment handle whose client is forced to the given variant through an override. */
-function createExperiment(variant: string): FreeTierLimitAgentGuidanceExperiment {
-  return {
-    accountId: 'account-id',
-    experimentation: LazyExperimentationClient.fromClient(
-      ExperimentationClient.createDisabled(
-        new ExperimentOverrides(
-          new Map([
-            [FREE_TIER_LIMIT_AGENT_GUIDANCE_EXPERIMENT_NAMESPACE, new Map([['variant', variant]])],
-          ])
-        )
-      )
-    ),
-  };
-}
-
 const EXPECTED_STRINGIFIED_GRAPHQL_ERROR_JSON = `Build request error details:
 {
   "message": "[GraphQL] Error 1\\n[GraphQL] Error 2\\n[GraphQL] Error 3",
@@ -357,115 +331,6 @@ describe(Build.name, () => {
           );
         });
       });
-      describe('for free tier limit errors in the agent guidance experiment', () => {
-        beforeEach(() => {
-          jest
-            .mocked(getAgentTelemetryContext)
-            .mockReturnValue({ id: 'claude-code', sessionId: 'session-1' });
-        });
-
-        it('appends the human required block for Android in the treatment arm', async () => {
-          const platform = Platform.ANDROID;
-          const accountName = 'test-account';
-          const graphQLError = getGraphQLError('Error 1', 'EAS_BUILD_FREE_TIER_LIMIT_EXCEEDED');
-          const error = new CombinedError({ graphQLErrors: [graphQLError] });
-
-          const handleBuildRequestErrorThrownError = await getErrorAsync<EasBuildFreeTierLimitExceededError>(
-            async () => {
-              await handleBuildRequestErrorAsync(error, platform, accountName, createExperiment('treatment'));
-            }
-          );
-
-          assertReThrownError(
-            handleBuildRequestErrorThrownError,
-            EasBuildFreeTierLimitExceededError,
-            [
-              'Error 1',
-              'Run eas billing:subscribe starter --account test-account to upgrade to the Starter plan.',
-              'Fix: Human required: Android builds for this account are blocked until the Free plan resets. Upgrading costs money, so an account owner or admin decides.',
-            ].join('\n')
-          );
-        });
-
-        it('appends the human required block for iOS in the treatment arm', async () => {
-          const platform = Platform.IOS;
-          const accountName = 'test-account';
-          const graphQLError = getGraphQLError('Error 1', 'EAS_BUILD_FREE_TIER_IOS_LIMIT_EXCEEDED');
-          const error = new CombinedError({ graphQLErrors: [graphQLError] });
-
-          const handleBuildRequestErrorThrownError =
-            await getErrorAsync<EasBuildFreeTierIosLimitExceededError>(async () => {
-              await handleBuildRequestErrorAsync(error, platform, accountName, createExperiment('treatment'));
-            });
-
-          assertReThrownError(
-            handleBuildRequestErrorThrownError,
-            EasBuildFreeTierIosLimitExceededError,
-            [
-              'Error 1',
-              'Run eas billing:subscribe starter --account test-account to upgrade to the Starter plan.',
-              'Fix: Human required: iOS builds for this account are blocked until the Free plan resets. Upgrading costs money, so an account owner or admin decides.',
-            ].join('\n')
-          );
-        });
-
-        it('does not append the block in the control arm', async () => {
-          const platform = Platform.ANDROID;
-          const accountName = 'test-account';
-          const graphQLError = getGraphQLError('Error 1', 'EAS_BUILD_FREE_TIER_LIMIT_EXCEEDED');
-          const error = new CombinedError({ graphQLErrors: [graphQLError] });
-
-          const handleBuildRequestErrorThrownError = await getErrorAsync<EasBuildFreeTierLimitExceededError>(
-            async () => {
-              await handleBuildRequestErrorAsync(error, platform, accountName, createExperiment('control'));
-            }
-          );
-
-          assertReThrownError(
-            handleBuildRequestErrorThrownError,
-            EasBuildFreeTierLimitExceededError,
-            'Error 1\nRun eas billing:subscribe starter --account test-account to upgrade to the Starter plan.'
-          );
-        });
-
-        it('does not append the block when no coding agent runs the CLI', async () => {
-          jest.mocked(getAgentTelemetryContext).mockReturnValue(null);
-          const platform = Platform.ANDROID;
-          const accountName = 'test-account';
-          const graphQLError = getGraphQLError('Error 1', 'EAS_BUILD_FREE_TIER_LIMIT_EXCEEDED');
-          const error = new CombinedError({ graphQLErrors: [graphQLError] });
-
-          const handleBuildRequestErrorThrownError = await getErrorAsync<EasBuildFreeTierLimitExceededError>(
-            async () => {
-              await handleBuildRequestErrorAsync(error, platform, accountName, createExperiment('treatment'));
-            }
-          );
-
-          assertReThrownError(
-            handleBuildRequestErrorThrownError,
-            EasBuildFreeTierLimitExceededError,
-            'Error 1\nRun eas billing:subscribe starter --account test-account to upgrade to the Starter plan.'
-          );
-        });
-
-        it('does not append the block to other server-side errors', async () => {
-          const platform = Platform.ANDROID;
-          const graphQLError = getGraphQLError('Error 1', 'EAS_BUILD_FREE_TIER_DISABLED');
-          const error = new CombinedError({ graphQLErrors: [graphQLError] });
-
-          const handleBuildRequestErrorThrownError = await getErrorAsync<EasBuildFreeTierDisabledError>(
-            async () => {
-              await handleBuildRequestErrorAsync(error, platform, undefined, createExperiment('treatment'));
-            }
-          );
-
-          assertReThrownError(
-            handleBuildRequestErrorThrownError,
-            EasBuildFreeTierDisabledError,
-            'Error 1'
-          );
-        });
-      });
       describe('for free tier limit errors in the checkout experiment', () => {
         it('offers the checkout with the limit message and marks the message as printed', async () => {
           jest.mocked(maybeOfferFreeTierLimitCheckoutAsync).mockResolvedValue(true);
@@ -482,7 +347,6 @@ describe(Build.name, () => {
                 error,
                 platform,
                 accountName,
-                undefined,
                 CHECKOUT_EXPERIMENT
               );
             }
@@ -515,7 +379,6 @@ describe(Build.name, () => {
                 error,
                 platform,
                 accountName,
-                undefined,
                 CHECKOUT_EXPERIMENT
               );
             });
@@ -544,7 +407,6 @@ describe(Build.name, () => {
                 error,
                 platform,
                 accountName,
-                undefined,
                 CHECKOUT_EXPERIMENT
               );
             }
@@ -559,35 +421,6 @@ describe(Build.name, () => {
           );
         });
 
-        it('passes the agent guidance along when both experiments are present', async () => {
-          jest
-            .mocked(getAgentTelemetryContext)
-            .mockReturnValue({ id: 'claude-code', sessionId: 'session-1' });
-          const platform = Platform.ANDROID;
-          const accountName = 'test-account';
-          const graphQLError = getGraphQLError('Error 1', 'EAS_BUILD_FREE_TIER_LIMIT_EXCEEDED');
-          const error = new CombinedError({ graphQLErrors: [graphQLError] });
-
-          await getErrorAsync(async () => {
-            await handleBuildRequestErrorAsync(
-              error,
-              platform,
-              accountName,
-              createExperiment('treatment'),
-              CHECKOUT_EXPERIMENT
-            );
-          });
-
-          expect(maybeOfferFreeTierLimitCheckoutAsync).toHaveBeenCalledWith(
-            [
-              'Error 1',
-              'Run eas billing:subscribe starter --account test-account to upgrade to the Starter plan.',
-              'Fix: Human required: Android builds for this account are blocked until the Free plan resets. Upgrading costs money, so an account owner or admin decides.',
-            ].join('\n'),
-            CHECKOUT_EXPERIMENT
-          );
-        });
-
         it('does not offer the checkout for other server-side errors', async () => {
           const platform = Platform.ANDROID;
           const graphQLError = getGraphQLError('Error 1', 'EAS_BUILD_FREE_TIER_DISABLED');
@@ -599,7 +432,6 @@ describe(Build.name, () => {
                 error,
                 platform,
                 undefined,
-                undefined,
                 CHECKOUT_EXPERIMENT
               );
             }

packages/eas-cli/src/build/build.ts

@@ -34,11 +34,6 @@ import {
   getFreeTierLimitCheckoutExperiment,
   maybeOfferFreeTierLimitCheckoutAsync,
 } from './freeTierLimitCheckout';
-import {
-  FreeTierLimitAgentGuidanceExperiment,
-  getFreeTierLimitAgentGuidanceExperiment,
-  maybeAppendFreeTierLimitAgentGuidanceAsync,
-} from './freeTierLimitGuidance';
 import { transformMetadata } from './graphql';
 import { LocalBuildMode, runLocalBuildAsync } from './local';
 import {
@@ -236,7 +231,6 @@ export async function prepareBuildRequestForPlatformAsync<
           error,
           job.platform,
           ctx.accountName,
-          getFreeTierLimitAgentGuidanceExperiment(ctx),
           getFreeTierLimitCheckoutExperiment(ctx)
         );
       }
@@ -263,7 +257,6 @@ export async function handleBuildRequestErrorAsync(
   error: any,
   platform: Platform,
   accountName?: string,
-  freeTierLimitAgentGuidanceExperiment?: FreeTierLimitAgentGuidanceExperiment,
   freeTierLimitCheckoutExperiment?: FreeTierLimitCheckoutExperiment
 ): Promise<never> {
   logBuildRequestErrorDebugInfo(error);
@@ -283,11 +276,7 @@ export async function handleBuildRequestErrorAsync(
     if (!isFreeTierLimitError) {
       throw new ErrorClass(message);
     }
-    const limitMessage = await maybeAppendFreeTierLimitAgentGuidanceAsync(
-      `${message}\nRun ${formatStarterSubscribeCommand(accountName)} to upgrade to the Starter plan.`,
-      platform,
-      freeTierLimitAgentGuidanceExperiment
-    );
+    const limitMessage = `${message}\nRun ${formatStarterSubscribeCommand(accountName)} to upgrade to the Starter plan.`;
     const messageAlreadyPrinted = await maybeOfferFreeTierLimitCheckoutAsync(
       limitMessage,
       freeTierLimitCheckoutExperiment

packages/eas-cli/src/build/evaluateConfigWithEnvVarsAsync.ts

@@ -107,11 +107,7 @@ async function resolveEnvVarsAsync({
     return { ...serverEnvVars, ...buildProfile.env };
   } catch (e) {
     Log.error(`Failed to pull env variables for environment ${environment} from EAS servers`);
-    Log.error(e);
-    Log.error(
-      'This can possibly be a bug in EAS/EAS CLI. Report it here: https://github.com/expo/eas-cli/issues'
-    );
-    return { ...buildProfile.env };
+    throw e;
   }
 }
 

packages/eas-cli/src/build/freeTierLimitGuidance.ts

@@ -1,60 +0,0 @@
-import { Platform } from '@expo/eas-build-job';
-
-import { getAgentTelemetryContext } from '../analytics/agent';
-import { LazyExperimentationClient } from '../experimentation/LazyExperimentationClient';
-import { requestedPlatformDisplayNames } from '../platform';
-
-export const FREE_TIER_LIMIT_AGENT_GUIDANCE_EXPERIMENT_NAMESPACE =
-  'cli-build-free-tier-limit-agent-guidance';
-
-export type FreeTierLimitAgentGuidanceVariant = 'control' | 'treatment';
-
-export type FreeTierLimitAgentGuidanceExperiment = {
-  experimentation: LazyExperimentationClient;
-  accountId: string;
-};
-
-export function getFreeTierLimitAgentGuidanceExperiment(ctx: {
-  experimentation?: LazyExperimentationClient;
-  accountId: string;
-}): FreeTierLimitAgentGuidanceExperiment | undefined {
-  return ctx.experimentation
-    ? { experimentation: ctx.experimentation, accountId: ctx.accountId }
-    : undefined;
-}
-
-/**
- * Resolves the account's variant. Only runs driven by a coding agent are eligible. Other runs get
- * control before the client loads, so they make no config request and log no exposure.
- */
-export async function resolveFreeTierLimitAgentGuidanceVariantAsync({
-  experimentation,
-  accountId,
-}: FreeTierLimitAgentGuidanceExperiment): Promise<FreeTierLimitAgentGuidanceVariant> {
-  if (!getAgentTelemetryContext()) {
-    return 'control';
-  }
-  const client = await experimentation.getClientAsync();
-  return client
-    .getAccountNamespace(FREE_TIER_LIMIT_AGENT_GUIDANCE_EXPERIMENT_NAMESPACE, { accountId })
-    .getParam<FreeTierLimitAgentGuidanceVariant>('variant', 'control');
-}
-
-export function formatFreeTierLimitAgentGuidance(platform: Platform): string {
-  const platformName = requestedPlatformDisplayNames[platform];
-  return `Fix: Human required: ${platformName} builds for this account are blocked until the Free plan resets. Upgrading costs money, so an account owner or admin decides.`;
-}
-
-export async function maybeAppendFreeTierLimitAgentGuidanceAsync(
-  message: string,
-  platform: Platform,
-  experiment: FreeTierLimitAgentGuidanceExperiment | undefined
-): Promise<string> {
-  if (
-    !experiment ||
-    (await resolveFreeTierLimitAgentGuidanceVariantAsync(experiment)) !== 'treatment'
-  ) {
-    return message;
-  }
-  return `${message}\n${formatFreeTierLimitAgentGuidance(platform)}`;
-}

packages/eas-cli/src/build/freeTierNearLimitAgentUpdatesTip.ts

@@ -0,0 +1,344 @@
+import { ExpoConfig } from '@expo/config';
+
+import { getAgentTelemetryContext } from '../analytics/agent';
+import { Analytics, AnalyticsEventProperties, BuildEvent } from '../analytics/AnalyticsManager';
+import {
+  ExpoGraphqlClient,
+  createGraphqlClient,
+} from '../commandUtils/context/contextUtils/createGraphqlClient';
+import { LazyExperimentationClient } from '../experimentation/LazyExperimentationClient';
+import {
+  AppPlatform,
+  BuildFragment,
+  BuildStatus,
+  EasServiceMetric,
+  UsageMetricType,
+} from '../graphql/generated';
+import { UserPreferenceMutation } from '../graphql/mutations/UserPreferenceMutation';
+import { AccountQuery } from '../graphql/queries/AccountQuery';
+import { UserPreferenceQuery } from '../graphql/queries/UserPreferenceQuery';
+import Log from '../log';
+import { appPlatformDisplayNames } from '../platform';
+import { isExpoUpdatesInstalled, isUsingEASUpdate } from '../project/projectUtils';
+import { LoggedInAuthenticationInfo } from '../user/SessionManager';
+import { Actor } from '../user/User';
+
+export const FREE_TIER_NEAR_LIMIT_AGENT_UPDATES_TIP_EXPERIMENT_NAMESPACE =
+  'cli-build-free-tier-near-limit-agent-updates-tip';
+
+/** The tip shows when this many builds or fewer are left on the platform. */
+export const FREE_TIER_NEAR_LIMIT_AGENT_UPDATES_TIP_BUILDS_LEFT = 5;
+
+export const EAS_UPDATE_GETTING_STARTED_URL = 'https://docs.expo.dev/eas-update/getting-started/';
+
+/** Server-side user preference key prefix. The full key is `<prefix>/<accountId>/<platform>`. */
+const USER_PREFERENCE_KEY_PREFIX = 'free-tier-near-limit-agent-updates-tip-shown';
+
+/** The tip's requests run after the build, so a stalled request must not delay the exit. */
+const REQUEST_TIMEOUT_MS = 3000;
+
+export type FreeTierNearLimitAgentUpdatesTipVariant = 'control' | 'treatment';
+
+/** The project state of one platform's build. Each build profile evaluates its own config. */
+export type FreeTierNearLimitAgentUpdatesTipPlatformProject = {
+  developmentClient: boolean;
+  projectDir: string;
+  projectId: string;
+  exp: ExpoConfig;
+  manifestHostOverride: string | null;
+};
+
+export type FreeTierNearLimitAgentUpdatesTipExperiment = {
+  experimentation: LazyExperimentationClient;
+  graphqlClient: ExpoGraphqlClient;
+  analytics: Analytics;
+  analyticsEventProperties: AnalyticsEventProperties;
+  accountId: string;
+  /** Only regular and SSO users can store user preferences. */
+  isUser: boolean;
+  runFromCI: boolean;
+  json: boolean;
+  projectByPlatform: Partial<Record<AppPlatform, FreeTierNearLimitAgentUpdatesTipPlatformProject>>;
+};
+
+export type FreeTierNearLimitAgentUpdatesTipBuildContext = {
+  experimentation?: LazyExperimentationClient;
+  authenticationInfo?: LoggedInAuthenticationInfo;
+  analytics: Analytics;
+  analyticsEventProperties: AnalyticsEventProperties;
+  accountId: string;
+  user: Actor;
+  developmentClient: boolean;
+  projectDir: string;
+  projectId: string;
+  exp: ExpoConfig;
+  easJsonCliConfig: { updateManifestHostOverride?: string } | undefined;
+  runFromCI: boolean;
+};
+
+export type FreeTierPlatformBuildUsage = {
+  used: number;
+  limit: number;
+};
+
+export type FreeTierBuildUsage = {
+  billingPeriodId: string;
+  byPlatform: Record<AppPlatform, FreeTierPlatformBuildUsage>;
+};
+
+/** All build contexts belong to one command run, so the account and the actor are shared. */
+export function getFreeTierNearLimitAgentUpdatesTipExperiment(
+  buildCtxByPlatform: Partial<Record<AppPlatform, FreeTierNearLimitAgentUpdatesTipBuildContext>>,
+  { json }: { json: boolean }
+): FreeTierNearLimitAgentUpdatesTipExperiment | undefined {
+  const ctx = Object.values(buildCtxByPlatform)[0];
+  if (!ctx?.experimentation || !ctx.authenticationInfo) {
+    return undefined;
+  }
+  const projectByPlatform: FreeTierNearLimitAgentUpdatesTipExperiment['projectByPlatform'] = {};
+  for (const [platform, platformCtx] of Object.entries(buildCtxByPlatform)) {
+    projectByPlatform[platform as AppPlatform] = {
+      developmentClient: platformCtx.developmentClient,
+      projectDir: platformCtx.projectDir,
+      projectId: platformCtx.projectId,
+      exp: platformCtx.exp,
+      manifestHostOverride: platformCtx.easJsonCliConfig?.updateManifestHostOverride ?? null,
+    };
+  }
+  return {
+    experimentation: ctx.experimentation,
+    graphqlClient: createGraphqlClient(ctx.authenticationInfo, {
+      requestTimeoutMs: REQUEST_TIMEOUT_MS,
+    }),
+    analytics: ctx.analytics,
+    analyticsEventProperties: ctx.analyticsEventProperties,
+    accountId: ctx.accountId,
+    isUser: ctx.user.__typename === 'User' || ctx.user.__typename === 'SSOUser',
+    runFromCI: ctx.runFromCI,
+    json,
+    projectByPlatform,
+  };
+}
+
+export function isProjectConfiguredForEASUpdate({
+  projectDir,
+  exp,
+  projectId,
+  manifestHostOverride,
+}: Pick<
+  FreeTierNearLimitAgentUpdatesTipPlatformProject,
+  'projectDir' | 'exp' | 'projectId' | 'manifestHostOverride'
+>): boolean {
+  return (
+    isExpoUpdatesInstalled(projectDir) && isUsingEASUpdate(exp, projectId, manifestHostOverride)
+  );
+}
+
+/**
+ * Only runs driven by a coding agent logged in as a user, outside CI and without --json are
+ * eligible. Everything else gets no tip and no usage request.
+ */
+export function isEligibleForFreeTierNearLimitAgentUpdatesTip(
+  experiment: FreeTierNearLimitAgentUpdatesTipExperiment
+): boolean {
+  return !(
+    experiment.runFromCI ||
+    experiment.json ||
+    !experiment.isUser ||
+    !getAgentTelemetryContext()
+  );
+}
+
+/**
+ * A platform is eligible when its project is not set up for Expo Update. Development builds load
+ * JavaScript from the dev server, so the tip does not apply to them.
+ */
+export function isPlatformEligibleForFreeTierNearLimitAgentUpdatesTip(
+  project: FreeTierNearLimitAgentUpdatesTipPlatformProject
+): boolean {
+  return !project.developmentClient && !isProjectConfiguredForEASUpdate(project);
+}
+
+/** True when the platform still has builds left, but no more than the tip's threshold. */
+export function isWithinFreeTierNearLimitBand({ used, limit }: FreeTierPlatformBuildUsage): boolean {
+  return limit > 0 && used < limit && limit - used <= FREE_TIER_NEAR_LIMIT_AGENT_UPDATES_TIP_BUILDS_LEFT;
+}
+
+/** Returns the Free plan build usage per platform, or null when the account is not on the Free plan. */
+export async function getFreeTierBuildUsageAsync({
+  graphqlClient,
+  accountId,
+}: Pick<FreeTierNearLimitAgentUpdatesTipExperiment, 'graphqlClient' | 'accountId'>): Promise<FreeTierBuildUsage | null> {
+  const account = await AccountQuery.getFreeTierBuildUsageAsync(graphqlClient, accountId, new Date());
+  if ((account.subscription?.name ?? 'Free') !== 'Free') {
+    return null;
+  }
+  const buildMetric = account.usageMetrics.EAS_BUILD.planMetrics.find(
+    metric =>
+      metric.serviceMetric === EasServiceMetric.Builds &&
+      metric.metricType === UsageMetricType.Build
+  );
+  const breakdown = buildMetric?.platformBreakdown;
+  if (!breakdown) {
+    return null;
+  }
+  return {
+    billingPeriodId: account.billingPeriod.id,
+    byPlatform: {
+      [AppPlatform.Android]: { used: breakdown.android.value, limit: breakdown.android.limit },
+      [AppPlatform.Ios]: { used: breakdown.ios.value, limit: breakdown.ios.limit },
+    },
+  };
+}
+
+/**
+ * The first call logs the exposure, so call it only when the tip would show. Accounts outside the
+ * rollout get the control default and no exposure.
+ */
+export async function resolveFreeTierNearLimitAgentUpdatesTipVariantAsync({
+  experimentation,
+  accountId,
+}: Pick<FreeTierNearLimitAgentUpdatesTipExperiment, 'experimentation' | 'accountId'>): Promise<FreeTierNearLimitAgentUpdatesTipVariant> {
+  const client = await experimentation.getClientAsync();
+  return client
+    .getAccountNamespace(FREE_TIER_NEAR_LIMIT_AGENT_UPDATES_TIP_EXPERIMENT_NAMESPACE, { accountId })
+    .getParam<FreeTierNearLimitAgentUpdatesTipVariant>('variant', 'control');
+}
+
+export function formatFreeTierNearLimitAgentUpdatesTip({
+  platform,
+  used,
+  limit,
+}: FreeTierPlatformBuildUsage & { platform: AppPlatform }): string {
+  const platformName = appPlatformDisplayNames[platform];
+  return [
+    `Tip: this account has used ${used} of ${limit} ${platformName} builds on the Free plan this period. This project isn't set up for Expo Update, so every change needs a new build.`,
+    'With Expo Update, JavaScript, styling and image changes reach installed builds without a new build. Setup takes effect from the next build, so it saves the most builds if done now.',
+    'Next: eas update:configure --non-interactive, then build once more.',
+    'Tell the user: this adds expo-updates and changes app.json and eas.json.',
+    `Docs: ${EAS_UPDATE_GETTING_STARTED_URL}`,
+  ].join('\n');
+}
+
+export function getFreeTierNearLimitAgentUpdatesTipPreferenceKey(
+  accountId: string,
+  platform: AppPlatform
+): string {
+  return `${USER_PREFERENCE_KEY_PREFIX}/${accountId}/${platform.toLowerCase()}`;
+}
+
+type ShownTipPreference = { billingPeriodId: string };
+
+function isShownTipPreference(value: unknown): value is ShownTipPreference {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    typeof (value as ShownTipPreference).billingPeriodId === 'string'
+  );
+}
+
+/**
+ * The tip shows at most once per user, account, platform and billing period. The marker is a
+ * user preference on the server, so it follows the user across machines and fresh agent
+ * sandboxes.
+ */
+export async function wasFreeTierNearLimitAgentUpdatesTipShownAsync(
+  graphqlClient: ExpoGraphqlClient,
+  accountId: string,
+  platform: AppPlatform,
+  billingPeriodId: string
+): Promise<boolean> {
+  const value = await UserPreferenceQuery.getValueAsync(
+    graphqlClient,
+    getFreeTierNearLimitAgentUpdatesTipPreferenceKey(accountId, platform)
+  );
+  return isShownTipPreference(value) && value.billingPeriodId === billingPeriodId;
+}
+
+export async function markFreeTierNearLimitAgentUpdatesTipShownAsync(
+  graphqlClient: ExpoGraphqlClient,
+  accountId: string,
+  platform: AppPlatform,
+  billingPeriodId: string
+): Promise<void> {
+  const value: ShownTipPreference = { billingPeriodId };
+  await UserPreferenceMutation.setAsync(
+    graphqlClient,
+    getFreeTierNearLimitAgentUpdatesTipPreferenceKey(accountId, platform),
+    value
+  );
+}
+
+/**
+ * After finished builds, suggests Expo Update to coding agents whose Free plan account is close to
+ * the platform build limit. The exposure logs only when every eligibility check passed, so both
+ * arms see the same population. The treatment arm prints the tip, logs the tip event, then
+ * writes the marker, so a failed write means at most a repeated tip. Fails open on any error.
+ */
+export async function maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync(
+  builds: (BuildFragment | null)[],
+  experiment: FreeTierNearLimitAgentUpdatesTipExperiment | undefined
+): Promise<void> {
+  if (!experiment || !isEligibleForFreeTierNearLimitAgentUpdatesTip(experiment)) {
+    return;
+  }
+  const eligiblePlatforms = new Set(
+    builds
+      .filter((build): build is BuildFragment => build?.status === BuildStatus.Finished)
+      .map(build => build.platform)
+      .filter(platform => {
+        const project = experiment.projectByPlatform[platform];
+        return project && isPlatformEligibleForFreeTierNearLimitAgentUpdatesTip(project);
+      })
+  );
+  if (eligiblePlatforms.size === 0) {
+    return;
+  }
+
+  try {
+    const usage = await getFreeTierBuildUsageAsync(experiment);
+    if (!usage) {
+      return;
+    }
+    for (const platform of eligiblePlatforms) {
+      const platformUsage = usage.byPlatform[platform];
+      if (
+        !isWithinFreeTierNearLimitBand(platformUsage) ||
+        (await wasFreeTierNearLimitAgentUpdatesTipShownAsync(
+          experiment.graphqlClient,
+          experiment.accountId,
+          platform,
+          usage.billingPeriodId
+        ))
+      ) {
+        continue;
+      }
+
+      const variant = await resolveFreeTierNearLimitAgentUpdatesTipVariantAsync(experiment);
+      if (variant !== 'treatment') {
+        continue;
+      }
+      Log.newLine();
+      Log.log(formatFreeTierNearLimitAgentUpdatesTip({ platform, ...platformUsage }));
+      experiment.analytics.logEvent(BuildEvent.FREE_TIER_NEAR_LIMIT_AGENT_UPDATES_TIP, {
+        ...experiment.analyticsEventProperties,
+        platform,
+        builds_used: platformUsage.used,
+        builds_limit: platformUsage.limit,
+      });
+      try {
+        await markFreeTierNearLimitAgentUpdatesTipShownAsync(
+          experiment.graphqlClient,
+          experiment.accountId,
+          platform,
+          usage.billingPeriodId
+        );
+      } catch (error: any) {
+        // The tip was shown. A missing marker means at most a repeated tip, so keep going.
+        Log.debug('Failed to mark the Expo Update tip as shown:', error?.message ?? error);
+      }
+    }
+  } catch (error: any) {
+    Log.debug('Failed to run the Expo Update tip check:', error?.message ?? error);
+  }
+}

packages/eas-cli/src/build/runBuildAndSubmit.ts

@@ -24,6 +24,10 @@ import { prepareIosBuildAsync } from './ios/build';
 import { LocalBuildMode, LocalBuildOptions } from './local';
 import { ensureLockfileExistsAsync } from './validateLockfile';
 import { ensureExpoDevClientInstalledForDevClientBuildsAsync } from './utils/devClient';
+import {
+  getFreeTierNearLimitAgentUpdatesTipExperiment,
+  maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync,
+} from './freeTierNearLimitAgentUpdatesTip';
 import { printBuildResults, printLogsUrls } from './utils/printBuildInfo';
 import { ensureRepoIsCleanAsync } from './utils/repository';
 import { Analytics } from '../analytics/AnalyticsManager';
@@ -139,6 +143,7 @@ export async function runBuildAndSubmitAsync({
 }): Promise<{
   buildIds: string[];
   buildProfiles?: ProfileData<'build'>[];
+  builds?: MaybeBuildFragment[];
 }> {
   await vcsClient.ensureRepoExistsAsync();
   await ensureRepoIsCleanAsync(vcsClient, flags.nonInteractive);
@@ -339,6 +344,10 @@ export async function runBuildAndSubmitAsync({
   if (!flags.json) {
     printBuildResults(builds);
   }
+  await maybeSuggestEASUpdateToAgentNearFreeTierLimitAsync(
+    builds,
+    getFreeTierNearLimitAgentUpdatesTipExperiment(buildCtxByPlatform, { json: flags.json })
+  );
 
   const haveAllBuildsFailedOrCanceled = builds.every(
     build =>
@@ -372,6 +381,7 @@ export async function runBuildAndSubmitAsync({
   return {
     buildIds: startedBuilds.map(({ build }) => build.id),
     buildProfiles,
+    builds,
   };
 }
 

packages/eas-cli/src/build/simulatorsLaunchHint.ts

@@ -0,0 +1,52 @@
+import { boolish } from 'getenv';
+
+import { Analytics, BuildEvent } from '../analytics/AnalyticsManager';
+import { createGraphqlClient } from '../commandUtils/context/contextUtils/createGraphqlClient';
+import { UserPreferenceMutation } from '../graphql/mutations/UserPreferenceMutation';
+import { UserPreferenceQuery } from '../graphql/queries/UserPreferenceQuery';
+import Log, { link } from '../log';
+import { LoggedInAuthenticationInfo } from '../user/SessionManager';
+import { Actor } from '../user/User';
+
+const SIMULATORS_LAUNCH_AT = new Date('2026-11-05T18:00:00Z');
+const SIMULATORS_LAUNCH_HINT_PREFERENCE_KEY = 'simulators-launch-cli-hint-seen';
+const REQUEST_TIMEOUT_MS = 3000;
+const SIMULATORS_QUICKSTART_URL =
+  'https://docs.expo.dev/preview/simulators/get-started/?utm_source=eas-cli&utm_medium=cli&utm_campaign=simulators-launch';
+
+export async function maybeShowSimulatorsLaunchHintAsync(
+  authenticationInfo: LoggedInAuthenticationInfo,
+  analytics: Analytics,
+  { actor, nonInteractive }: { actor: Actor; nonInteractive: boolean }
+): Promise<void> {
+  if (
+    nonInteractive ||
+    boolish('CI', false) ||
+    Date.now() < SIMULATORS_LAUNCH_AT.getTime() ||
+    (actor.__typename !== 'User' && actor.__typename !== 'SSOUser')
+  ) {
+    return;
+  }
+  try {
+    const graphqlClient = createGraphqlClient(authenticationInfo, {
+      requestTimeoutMs: REQUEST_TIMEOUT_MS,
+    });
+    const value = await UserPreferenceQuery.getValueAsync(
+      graphqlClient,
+      SIMULATORS_LAUNCH_HINT_PREFERENCE_KEY
+    );
+    if (value && typeof value === 'object' && 'isDismissed' in value && value.isDismissed) {
+      return;
+    }
+    Log.newLine();
+    Log.log(
+      `✨ New: run your build in Expo Simulators, cloud Android and iOS simulators for you and your agents. ${link(SIMULATORS_QUICKSTART_URL)}`
+    );
+    analytics.logEvent(BuildEvent.SIMULATORS_LAUNCH_HINT_SHOWN, {});
+    await UserPreferenceMutation.setAsync(graphqlClient, SIMULATORS_LAUNCH_HINT_PREFERENCE_KEY, {
+      isDismissed: true,
+    });
+  } catch (error) {
+    Log.debug('Failed to show the Expo Simulators hint', error);
+  }
+}

packages/eas-cli/src/commandUtils/workflow/__tests__/referencedFiles-test.ts

@@ -0,0 +1,137 @@
+import { vol } from 'memfs';
+
+import { collectReferencedWorkflowFilesAsync } from '../referencedFiles';
+
+jest.mock('fs');
+
+const projectDir = '/app';
+const workflowsDir = `${projectDir}/.eas/workflows`;
+
+function callerYaml(calls: Record<string, string>): string {
+  return [
+    'jobs:',
+    ...Object.entries(calls).flatMap(([jobKey, fileName]) => [
+      `  ${jobKey}:`,
+      `    uses: ./.eas/workflows/${fileName}`,
+    ]),
+    '',
+  ].join('\n');
+}
+
+const calleeYaml = [
+  'on:',
+  '  workflow_call: {}',
+  'jobs:',
+  '  job:',
+  '    steps:',
+  '      - run: echo hi',
+  '',
+].join('\n');
+
+async function collectAsync(
+  rootYamlConfig: string
+): Promise<{ fileName: string; yamlConfig: string }[]> {
+  return await collectReferencedWorkflowFilesAsync({
+    projectDir,
+    rootFileName: 'root.yml',
+    rootYamlConfig,
+  });
+}
+
+describe(collectReferencedWorkflowFilesAsync, () => {
+  beforeEach(() => {
+    vol.reset();
+  });
+
+  it('returns no files and reads nothing when the root has no uses jobs', async () => {
+    vol.fromJSON({ [`${workflowsDir}/unused.yml`]: 'jobs: [not: valid' });
+
+    await expect(collectAsync(calleeYaml)).resolves.toEqual([]);
+  });
+
+  it('returns no files when the root is not valid YAML', async () => {
+    await expect(collectAsync('jobs: [not: valid')).resolves.toEqual([]);
+  });
+
+  it('collects a file called from one job', async () => {
+    vol.fromJSON({ [`${workflowsDir}/build.yml`]: calleeYaml });
+
+    await expect(collectAsync(callerYaml({ ship: 'build.yml' }))).resolves.toEqual([
+      { fileName: 'build.yml', yamlConfig: calleeYaml },
+    ]);
+  });
+
+  it('collects nested calls in discovery order', async () => {
+    const releaseYaml = `on:\n  workflow_call: {}\n${callerYaml({ build: 'build.yml' })}`;
+    vol.fromJSON({
+      [`${workflowsDir}/release.yml`]: releaseYaml,
+      [`${workflowsDir}/build.yaml`]: calleeYaml,
+      [`${workflowsDir}/build.yml`]: calleeYaml,
+    });
+
+    await expect(collectAsync(callerYaml({ release: 'release.yml' }))).resolves.toEqual([
+      { fileName: 'release.yml', yamlConfig: releaseYaml },
+      { fileName: 'build.yml', yamlConfig: calleeYaml },
+    ]);
+  });
+
+  it('collects each file once and stops at cycles', async () => {
+    const aYaml = callerYaml({ b: 'b.yml' });
+    const bYaml = callerYaml({ a: 'a.yml', root: 'root.yml', c: 'c.yml' });
+    vol.fromJSON({
+      [`${workflowsDir}/a.yml`]: aYaml,
+      [`${workflowsDir}/b.yml`]: bYaml,
+      [`${workflowsDir}/c.yml`]: calleeYaml,
+    });
+
+    await expect(
+      collectAsync(callerYaml({ first: 'a.yml', second: 'c.yml', third: 'a.yml' }))
+    ).resolves.toEqual([
+      { fileName: 'a.yml', yamlConfig: aYaml },
+      { fileName: 'c.yml', yamlConfig: calleeYaml },
+      { fileName: 'b.yml', yamlConfig: bYaml },
+    ]);
+  });
+
+  it('fails when a called file does not exist', async () => {
+    await expect(collectAsync(callerYaml({ ship: 'missing.yml' }))).rejects.toThrow(
+      'Job "ship" in root.yml uses ./.eas/workflows/missing.yml, but /app/.eas/workflows/missing.yml does not exist.'
+    );
+  });
+
+  it('fails when a nested called file does not exist', async () => {
+    vol.fromJSON({ [`${workflowsDir}/release.yml`]: callerYaml({ build: 'missing.yml' }) });
+
+    await expect(collectAsync(callerYaml({ release: 'release.yml' }))).rejects.toThrow(
+      'Job "build" in release.yml uses ./.eas/workflows/missing.yml, but /app/.eas/workflows/missing.yml does not exist.'
+    );
+  });
+
+  it('fails when a called file is not valid YAML', async () => {
+    vol.fromJSON({ [`${workflowsDir}/build.yml`]: 'jobs: [not: valid' });
+
+    await expect(collectAsync(callerYaml({ ship: 'build.yml' }))).rejects.toThrow(
+      /^Job "ship" in root\.yml uses \.\/\.eas\/workflows\/build\.yml, but \/app\/\.eas\/workflows\/build\.yml is not valid YAML: /
+    );
+  });
+
+  it('skips uses values the server does not accept', async () => {
+    const rootYaml = [
+      'jobs:',
+      '  nested:',
+      '    uses: ./.eas/workflows/nested/build.yml',
+      '  interpolated:',
+      '    uses: ./.eas/workflows/${{ inputs.name }}.yml',
+      '  notString:',
+      '    uses: { path: ./.eas/workflows/build.yml }',
+      '  valid:',
+      '    uses: ./.eas/workflows/build.yml',
+      '',
+    ].join('\n');
+    vol.fromJSON({ [`${workflowsDir}/build.yml`]: calleeYaml });
+
+    await expect(collectAsync(rootYaml)).resolves.toEqual([
+      { fileName: 'build.yml', yamlConfig: calleeYaml },
+    ]);
+  });
+});

packages/eas-cli/src/commandUtils/workflow/__tests__/utils-test.ts

@@ -1,8 +1,11 @@
-import { getMockWorkflowRunWithJobsFragment } from '../../../__tests__/commands/utils';
-import { WorkflowJobStatus } from '../../../graphql/generated';
+import {
+  getMockWorkflowRunFragment,
+  getMockWorkflowRunWithJobsFragment,
+} from '../../../__tests__/commands/utils';
+import { WorkflowJobStatus, WorkflowRunStatus } from '../../../graphql/generated';
 import { groupLogLinesIntoSteps, parseLogLines } from '../../logs/parseLogs';
 import { JobLogs, RawLogLine } from '../../logs/types';
-import { formatActiveWorkflowRun, formatFailedWorkflowRun } from '../utils';
+import { formatActiveWorkflowRun, formatFailedWorkflowRun, processWorkflowRuns } from '../utils';
 
 function jobWithLogs(
   logLines: RawLogLine[],
@@ -135,3 +138,32 @@ describe(formatFailedWorkflowRun, () => {
     expect(output).toContain('line7');
   });
 });
+
+describe(processWorkflowRuns, () => {
+  test.each([WorkflowRunStatus.Success, WorkflowRunStatus.Failure, WorkflowRunStatus.Canceled])(
+    'reports finalizedAt as finishedAt for final status %s',
+    status => {
+      const [run] = processWorkflowRuns([
+        getMockWorkflowRunFragment(status, { finalizedAt: '2022-01-01T12:00:00.000Z' }),
+      ]);
+      expect(run.finishedAt).toBe('2022-01-01T12:00:00.000Z');
+    }
+  );
+
+  test('reports no finishedAt for a final run predating finalizedAt', () => {
+    const [run] = processWorkflowRuns([getMockWorkflowRunFragment(WorkflowRunStatus.Success)]);
+    expect(run.finishedAt).toBeNull();
+  });
+
+  test.each([
+    WorkflowRunStatus.New,
+    WorkflowRunStatus.Waiting,
+    WorkflowRunStatus.InProgress,
+    WorkflowRunStatus.ActionRequired,
+  ])('reports no finishedAt for non-final status %s even with a lingering finalizedAt', status => {
+    const [run] = processWorkflowRuns([
+      getMockWorkflowRunFragment(status, { finalizedAt: '2022-01-01T12:00:00.000Z' }),
+    ]);
+    expect(run.finishedAt).toBeNull();
+  });
+});

packages/eas-cli/src/commandUtils/workflow/referencedFiles.ts

@@ -0,0 +1,83 @@
+import fs from 'fs';
+import path from 'path';
+
+import { parsedYamlFromWorkflowContents } from './parse';
+import { WorkflowReferencedFileInput } from '../../graphql/generated';
+
+const WORKFLOW_CALL_USES_REGEX = /^\.\/\.eas\/workflows\/(?:(?!\$\{\{)[^/\\])+\.ya?ml$/;
+
+type WorkflowCall = { callerFileName: string; callerJobKey: string; uses: string };
+
+export async function collectReferencedWorkflowFilesAsync({
+  projectDir,
+  rootFileName,
+  rootYamlConfig,
+}: {
+  projectDir: string;
+  rootFileName: string;
+  rootYamlConfig: string;
+}): Promise<WorkflowReferencedFileInput[]> {
+  let rootYaml: unknown;
+  try {
+    rootYaml = parsedYamlFromWorkflowContents({ yamlConfig: rootYamlConfig });
+  } catch {
+    return [];
+  }
+
+  const collectedFileNames = new Set<string>([rootFileName]);
+  const referencedFiles: WorkflowReferencedFileInput[] = [];
+  const pendingCalls = getWorkflowCalls(rootFileName, rootYaml);
+  for (const call of pendingCalls) {
+    const fileName = path.posix.basename(call.uses);
+    if (collectedFileNames.has(fileName)) {
+      continue;
+    }
+    collectedFileNames.add(fileName);
+    const { yamlConfig, parsedYaml } = await readReferencedWorkflowFileAsync(
+      projectDir,
+      fileName,
+      call
+    );
+    referencedFiles.push({ fileName, yamlConfig });
+    pendingCalls.push(...getWorkflowCalls(fileName, parsedYaml));
+  }
+  return referencedFiles;
+}
+
+function getWorkflowCalls(callerFileName: string, parsedYaml: unknown): WorkflowCall[] {
+  const jobs = (parsedYaml as { jobs?: unknown } | null)?.jobs;
+  if (!jobs || typeof jobs !== 'object') {
+    return [];
+  }
+  return Object.entries(jobs).flatMap(([callerJobKey, job]) => {
+    const uses = (job as { uses?: unknown } | null)?.uses;
+    return typeof uses === 'string' && WORKFLOW_CALL_USES_REGEX.test(uses)
+      ? [{ callerFileName, callerJobKey, uses }]
+      : [];
+  });
+}
+
+async function readReferencedWorkflowFileAsync(
+  projectDir: string,
+  fileName: string,
+  { callerFileName, callerJobKey, uses }: WorkflowCall
+): Promise<{ yamlConfig: string; parsedYaml: unknown }> {
+  const filePath = path.join(projectDir, '.eas', 'workflows', fileName);
+  const describeCall = `Job "${callerJobKey}" in ${callerFileName} uses ${uses}, but ${filePath}`;
+
+  let yamlConfig: string;
+  try {
+    yamlConfig = await fs.promises.readFile(filePath, 'utf8');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      throw new Error(`${describeCall} does not exist.`);
+    }
+    throw new Error(`${describeCall} could not be read: ${(error as Error).message}`);
+  }
+
+  try {
+    return { yamlConfig, parsedYaml: parsedYamlFromWorkflowContents({ yamlConfig }) };
+  } catch (error) {
+    throw new Error(`${describeCall} is not valid YAML: ${(error as Error).message}`);
+  }
+}

packages/eas-cli/src/commandUtils/workflow/types.ts

@@ -19,7 +19,7 @@ export type WorkflowRunResult = {
   triggerType: WorkflowTriggerType;
   trigger: string | null;
   startedAt: string;
-  finishedAt: string;
+  finishedAt: string | null;
   workflowId: string;
   workflowName: string | null;
   workflowFileName: string;

packages/eas-cli/src/commandUtils/workflow/utils.ts

@@ -3,6 +3,7 @@ import * as fs from 'node:fs';
 
 import { fetchAndProcessLogsFromJobAsync, logSourceForWorkflowJob } from './logs';
 import { WorkflowJobResult, WorkflowRunResult, WorkflowTriggerType } from './types';
+import { getWorkflowRunUrl } from '../../build/utils/url';
 import {
   WorkflowJobStatus,
   WorkflowRunByIdQuery,
@@ -15,7 +16,7 @@ import { choicesFromJobLogs, stepLogTail } from '../logs/format';
 import { JobLogs } from '../logs/types';
 import { LogsWatcher } from '../logs/watcher';
 import { WorkflowRunQuery } from '../../graphql/queries/WorkflowRunQuery';
-import Log from '../../log';
+import Log, { link } from '../../log';
 import { ora, updateSpinnerText } from '../../ora';
 import { Choice } from '../../prompts';
 import formatFields from '../../utils/formatFields';
@@ -81,7 +82,7 @@ export function choiceFromWorkflowJob(job: WorkflowJobResult, index: number): Ch
 
 export function processWorkflowRuns(runs: WorkflowRunFragment[]): WorkflowRunResult[] {
   return runs.map(run => {
-    const finishedAt = run.status === WorkflowRunStatus.InProgress ? null : run.updatedAt;
+    const finishedAt = isWorkflowRunFinal(run.status) ? (run.finalizedAt ?? null) : null;
     const { triggerType, trigger } = computeTriggerInfoForWorkflowRun(run);
     return {
       id: run.id,
@@ -135,6 +136,20 @@ function isJobCompleted(status: WorkflowJobStatus): boolean {
   }
 }
 
+function isWorkflowRunFinal(status: WorkflowRunStatus): boolean {
+  switch (status) {
+    case WorkflowRunStatus.Success:
+    case WorkflowRunStatus.Failure:
+    case WorkflowRunStatus.Canceled:
+      return true;
+    case WorkflowRunStatus.New:
+    case WorkflowRunStatus.Waiting:
+    case WorkflowRunStatus.InProgress:
+    case WorkflowRunStatus.ActionRequired:
+      return false;
+  }
+}
+
 type WorkflowRunWithJobs = WorkflowRunByIdWithJobsQuery['workflowRuns']['byId'];
 
 type JobWithLogs = {
@@ -255,13 +270,12 @@ export async function showWorkflowStatusAsync(
 ): Promise<WorkflowRunByIdQuery['workflowRuns']['byId']> {
   Log.log('Waiting for workflow run to complete. You can press Ctrl+C to exit.');
 
+  const waitingToStartPrefixText = chalk`{bold.yellow Workflow run is waiting to start:}`;
   const spinner = ora({
     stream: spinnerUsesStdErr ? process.stderr : process.stdout,
     text: '',
   }).start();
-  updateSpinnerText(spinner, {
-    prefixText: chalk`{bold.yellow Workflow run is waiting to start:}`,
-  });
+  updateSpinnerText(spinner, { prefixText: waitingToStartPrefixText });
 
   const watcher = new LogsWatcher(
     () => createRealtimeLogsClient(graphqlClient),
@@ -283,7 +297,27 @@ export async function showWorkflowStatusAsync(
 
         switch (workflowRun.status) {
           case WorkflowRunStatus.New:
+            // A queued run returns to NEW once its concurrency group frees up.
+            updateSpinnerText(spinner, { prefixText: waitingToStartPrefixText });
             break;
+          case WorkflowRunStatus.Waiting: {
+            const {
+              blockingWorkflowRun,
+              workflow: { app },
+            } = workflowRun;
+            // The blocking run is in the same app: concurrency groups are app-scoped.
+            const actionRequiredSuffix =
+              blockingWorkflowRun?.status === WorkflowRunStatus.ActionRequired
+                ? ` — it needs your action first: ${link(getWorkflowRunUrl(app.ownerAccount.name, app.slug, blockingWorkflowRun.id))}`
+                : '';
+            const reason = blockingWorkflowRun
+              ? `Waiting for ${blockingWorkflowRun.name}${actionRequiredSuffix}`
+              : 'Waiting for its concurrency group';
+            updateSpinnerText(spinner, {
+              prefixText: chalk`{bold.yellow Workflow run is queued:} ${reason}`,
+            });
+            break;
+          }
           case WorkflowRunStatus.InProgress: {
             updateSpinnerText(spinner, {
               prefixText: chalk`{bold.green Workflow run is in progress:}`,

packages/eas-cli/src/commands/build/index.ts

@@ -9,12 +9,13 @@ import path from 'path';
 
 import { LocalBuildMode } from '../../build/local';
 import { BuildFlags, runBuildAndSubmitAsync } from '../../build/runBuildAndSubmit';
+import { maybeShowSimulatorsLaunchHintAsync } from '../../build/simulatorsLaunchHint';
 import EasCommand from '../../commandUtils/EasCommand';
 import {
   EasNonInteractiveAndJsonFlags,
   resolveNonInteractiveAndJsonFlags,
 } from '../../commandUtils/flags';
-import { StatuspageServiceName } from '../../graphql/generated';
+import { BuildStatus, StatuspageServiceName } from '../../graphql/generated';
 import Log, { link } from '../../log';
 import { RequestedPlatform, selectRequestedPlatformAsync } from '../../platform';
 import { selectAsync } from '../../prompts';
@@ -176,7 +177,7 @@ export default class Build extends EasCommand {
 
     const flagsWithPlatform = await this.ensurePlatformSelectedAsync(flags);
 
-    const { buildProfiles } = await runBuildAndSubmitAsync({
+    const { buildProfiles, builds } = await runBuildAndSubmitAsync({
       graphqlClient,
       analytics,
       vcsClient,
@@ -192,6 +193,13 @@ export default class Build extends EasCommand {
       buildProfiles,
       nonInteractive: flags.nonInteractive,
     });
+
+    if (builds?.some(build => build?.status === BuildStatus.Finished)) {
+      await maybeShowSimulatorsLaunchHintAsync(authenticationInfo, analytics, {
+        actor,
+        nonInteractive: flags.nonInteractive,
+      });
+    }
   }
 
   private sanitizeFlags(

packages/eas-cli/src/commands/observe/__tests__/session.test.ts

@@ -112,6 +112,7 @@ describe(ObserveSession, () => {
       metadata: null,
       hasMoreMetricEvents: false,
       hasMoreLogEvents: false,
+      hasMoreSpans: false,
     });
     mockFetchSessionMetricCandidatesAsync.mockResolvedValue([]);
     mockFetchSessionLogCandidatesAsync.mockResolvedValue([]);

packages/eas-cli/src/commands/observe/__tests__/trace.test.ts

@@ -0,0 +1,113 @@
+import { CombinedError } from '@urql/core';
+import { GraphQLError } from 'graphql';
+
+import { ExpoGraphqlClient } from '../../../commandUtils/context/contextUtils/createGraphqlClient';
+import { getMockOclifConfig } from '../../../__tests__/commands/utils';
+import { ObserveQuery } from '../../../graphql/queries/ObserveQuery';
+import { buildObserveTraceJson, buildObserveTraceTable } from '../../../observe/formatSpans';
+import { EAS_OBSERVE_PLAN_UPGRADE_REQUIRED_ERROR_CODE } from '../../../observe/planGating';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../../utils/json';
+import ObserveTrace from '../trace';
+
+jest.mock('../../../observe/formatSpans', () => ({
+  buildObserveTraceTable: jest.fn().mockReturnValue('trace-table'),
+  buildObserveTraceJson: jest.fn().mockReturnValue({ id: 'trace-json' }),
+}));
+jest.mock('../../../graphql/queries/ObserveQuery', () => ({
+  ObserveQuery: {
+    traceByIdAsync: jest.fn(),
+  },
+}));
+jest.mock('../../../log');
+jest.mock('../../../utils/json');
+
+const mockTraceByIdAsync = jest.mocked(ObserveQuery.traceByIdAsync);
+const mockBuildObserveTraceTable = jest.mocked(buildObserveTraceTable);
+const mockBuildObserveTraceJson = jest.mocked(buildObserveTraceJson);
+const mockEnableJsonOutput = jest.mocked(enableJsonOutput);
+const mockPrintJsonOnlyOutput = jest.mocked(printJsonOnlyOutput);
+
+const TRACE_ID = '0123456789abcdef0123456789abcdef';
+const trace = { id: TRACE_ID, isTruncated: false, spans: [] } as any;
+
+describe(ObserveTrace, () => {
+  const graphqlClient = {} as any as ExpoGraphqlClient;
+  const mockConfig = getMockOclifConfig();
+  const projectId = 'test-project-id';
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockTraceByIdAsync.mockResolvedValue(trace);
+  });
+
+  function createCommand(argv: string[]): ObserveTrace {
+    const command = new ObserveTrace(argv, mockConfig);
+    // @ts-expect-error
+    jest.spyOn(command, 'getContextAsync').mockReturnValue({
+      projectId,
+      loggedIn: { graphqlClient },
+    });
+    return command;
+  }
+
+  it('requires a trace ID argument', async () => {
+    await expect(createCommand([]).runAsync()).rejects.toThrow();
+    expect(mockTraceByIdAsync).not.toHaveBeenCalled();
+  });
+
+  it('rejects a malformed trace ID before querying', async () => {
+    await expect(createCommand(['not-a-trace-id']).runAsync()).rejects.toThrow(
+      /not a valid trace ID/
+    );
+    expect(mockTraceByIdAsync).not.toHaveBeenCalled();
+  });
+
+  it('accepts an uppercase trace ID', async () => {
+    await createCommand([TRACE_ID.toUpperCase()]).runAsync();
+    expect(mockTraceByIdAsync).toHaveBeenCalledWith(graphqlClient, {
+      appId: projectId,
+      id: TRACE_ID.toUpperCase(),
+    });
+  });
+
+  it('renders the trace table by default', async () => {
+    await createCommand([TRACE_ID]).runAsync();
+
+    expect(mockTraceByIdAsync).toHaveBeenCalledWith(graphqlClient, {
+      appId: projectId,
+      id: TRACE_ID,
+    });
+    expect(mockBuildObserveTraceTable).toHaveBeenCalledWith(trace);
+    expect(mockBuildObserveTraceJson).not.toHaveBeenCalled();
+  });
+
+  it('emits JSON with --json', async () => {
+    await createCommand([TRACE_ID, '--json', '--non-interactive']).runAsync();
+
+    expect(mockEnableJsonOutput).toHaveBeenCalled();
+    expect(mockBuildObserveTraceJson).toHaveBeenCalledWith(trace);
+    expect(mockPrintJsonOnlyOutput).toHaveBeenCalledWith({ id: 'trace-json' });
+    expect(mockBuildObserveTraceTable).not.toHaveBeenCalled();
+  });
+
+  it('fails with a not-found message when the trace is unknown', async () => {
+    mockTraceByIdAsync.mockResolvedValue(null);
+    await expect(createCommand([TRACE_ID]).runAsync()).rejects.toThrow(/No trace found with ID/);
+  });
+
+  it('surfaces the plan-gate message', async () => {
+    const serverMessage =
+      'Access to this feature is not included in your current plan. ' +
+      'Upgrade your plan: https://expo.dev/accounts/acme/settings/billing';
+    mockTraceByIdAsync.mockRejectedValueOnce(
+      new CombinedError({
+        graphQLErrors: [
+          new GraphQLError(serverMessage, null, null, null, null, null, {
+            errorCode: EAS_OBSERVE_PLAN_UPGRADE_REQUIRED_ERROR_CODE,
+          }),
+        ],
+      })
+    );
+    await expect(createCommand([TRACE_ID]).runAsync()).rejects.toThrow(serverMessage);
+  });
+});

packages/eas-cli/src/commands/observe/__tests__/traces.test.ts

@@ -0,0 +1,260 @@
+import { CombinedError } from '@urql/core';
+import { GraphQLError } from 'graphql';
+
+import { ExpoGraphqlClient } from '../../../commandUtils/context/contextUtils/createGraphqlClient';
+import { getMockOclifConfig } from '../../../__tests__/commands/utils';
+import {
+  AppObservePlatform,
+  AppObserveSpanKind,
+  AppObserveSpanStatusCode,
+} from '../../../graphql/generated';
+import { ObserveQuery } from '../../../graphql/queries/ObserveQuery';
+import { fetchObserveSpansAsync } from '../../../observe/fetchSpans';
+import {
+  buildObserveSpanNamesJson,
+  buildObserveSpanNamesTable,
+  buildObserveSpansJson,
+  buildObserveSpansTable,
+} from '../../../observe/formatSpans';
+import { EAS_OBSERVE_PLAN_UPGRADE_REQUIRED_ERROR_CODE } from '../../../observe/planGating';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../../utils/json';
+import ObserveTraces from '../traces';
+
+jest.mock('../../../observe/fetchSpans');
+jest.mock('../../../observe/formatSpans', () => ({
+  buildObserveSpansTable: jest.fn().mockReturnValue('spans-table'),
+  buildObserveSpansJson: jest.fn().mockReturnValue({ spans: [] }),
+  buildObserveSpanNamesTable: jest.fn().mockReturnValue('names-table'),
+  buildObserveSpanNamesJson: jest.fn().mockReturnValue({ names: [], isTruncated: false }),
+}));
+jest.mock('../../../graphql/queries/ObserveQuery', () => ({
+  ObserveQuery: {
+    spanNamesAsync: jest.fn(),
+  },
+}));
+jest.mock('../../../log');
+jest.mock('../../../utils/json');
+
+const mockFetchObserveSpansAsync = jest.mocked(fetchObserveSpansAsync);
+const mockSpanNamesAsync = jest.mocked(ObserveQuery.spanNamesAsync);
+const mockBuildObserveSpansTable = jest.mocked(buildObserveSpansTable);
+const mockBuildObserveSpansJson = jest.mocked(buildObserveSpansJson);
+const mockBuildObserveSpanNamesTable = jest.mocked(buildObserveSpanNamesTable);
+const mockBuildObserveSpanNamesJson = jest.mocked(buildObserveSpanNamesJson);
+const mockEnableJsonOutput = jest.mocked(enableJsonOutput);
+const mockPrintJsonOnlyOutput = jest.mocked(printJsonOnlyOutput);
+
+describe(ObserveTraces, () => {
+  const graphqlClient = {} as any as ExpoGraphqlClient;
+  const mockConfig = getMockOclifConfig();
+  const projectId = 'test-project-id';
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockFetchObserveSpansAsync.mockResolvedValue({
+      spans: [],
+      pageInfo: { hasNextPage: false, hasPreviousPage: false },
+    });
+    mockSpanNamesAsync.mockResolvedValue({ names: [], isTruncated: false });
+  });
+
+  function createCommand(argv: string[]): ObserveTraces {
+    const command = new ObserveTraces(argv, mockConfig);
+    // @ts-expect-error
+    jest.spyOn(command, 'getContextAsync').mockReturnValue({
+      projectId,
+      loggedIn: { graphqlClient },
+    });
+    return command;
+  }
+
+  function planGateError(): CombinedError {
+    const serverMessage =
+      'Access to this feature is not included in your current plan. ' +
+      'Upgrade your plan: https://expo.dev/accounts/acme/settings/billing';
+    return new CombinedError({
+      graphQLErrors: [
+        new GraphQLError(serverMessage, null, null, null, null, null, {
+          errorCode: EAS_OBSERVE_PLAN_UPGRADE_REQUIRED_ERROR_CODE,
+        }),
+      ],
+    });
+  }
+
+  it('shows the span names summary when no span filter is given', async () => {
+    const command = createCommand(['--days', '7', '--platform', 'ios', '--environment', 'prod']);
+    await command.runAsync();
+
+    expect(mockSpanNamesAsync).toHaveBeenCalledTimes(1);
+    const variables = mockSpanNamesAsync.mock.calls[0][1];
+    expect(variables.appId).toBe(projectId);
+    expect(variables.input.platforms).toEqual([AppObservePlatform.Ios]);
+    expect(variables.input.environment).toBe('prod');
+    expect(variables.input.startTime).toBeDefined();
+    expect(variables.input.endTime).toBeDefined();
+    expect(mockFetchObserveSpansAsync).not.toHaveBeenCalled();
+    expect(mockBuildObserveSpanNamesTable).toHaveBeenCalled();
+    expect(mockBuildObserveSpansTable).not.toHaveBeenCalled();
+  });
+
+  it('passes release filters to the summary', async () => {
+    const command = createCommand([
+      '--app-version',
+      '1.2.0',
+      '--build-number',
+      '42',
+      '--update-id',
+      'update-1',
+    ]);
+    await command.runAsync();
+
+    const { input } = mockSpanNamesAsync.mock.calls[0][1];
+    expect(input.appVersion).toBe('1.2.0');
+    expect(input.appBuildNumber).toBe('42');
+    expect(input.appUpdateId).toBe('update-1');
+  });
+
+  it('emits the summary as JSON with --json', async () => {
+    const command = createCommand(['--json', '--non-interactive']);
+    await command.runAsync();
+
+    expect(mockEnableJsonOutput).toHaveBeenCalled();
+    expect(mockBuildObserveSpanNamesJson).toHaveBeenCalled();
+    expect(mockPrintJsonOnlyOutput).toHaveBeenCalled();
+    expect(mockBuildObserveSpanNamesTable).not.toHaveBeenCalled();
+  });
+
+  it('lists spans with --all-spans', async () => {
+    const command = createCommand(['--all-spans']);
+    await command.runAsync();
+
+    expect(mockSpanNamesAsync).not.toHaveBeenCalled();
+    expect(mockFetchObserveSpansAsync).toHaveBeenCalledTimes(1);
+    expect(mockBuildObserveSpansTable).toHaveBeenCalled();
+  });
+
+  it('lists spans when paging with --after', async () => {
+    const command = createCommand(['--after', 'cursor-1']);
+    await command.runAsync();
+
+    expect(mockSpanNamesAsync).not.toHaveBeenCalled();
+    expect(mockFetchObserveSpansAsync.mock.calls[0][2].after).toBe('cursor-1');
+  });
+
+  it.each([
+    ['--name', 'GET'],
+    ['--kind', 'client'],
+    ['--status', 'error'],
+    ['--host', 'api.example.com'],
+    ['--http-status', '500'],
+    ['--min-duration', '100'],
+    ['--session-id', 'session-1'],
+  ])('lists spans when %s is given', async (flag, value) => {
+    const command = createCommand([flag, value]);
+    await command.runAsync();
+
+    expect(mockSpanNamesAsync).not.toHaveBeenCalled();
+    expect(mockFetchObserveSpansAsync).toHaveBeenCalledTimes(1);
+  });
+
+  it('lists spans with --root-only', async () => {
+    const command = createCommand(['--root-only']);
+    await command.runAsync();
+
+    expect(mockSpanNamesAsync).not.toHaveBeenCalled();
+    expect(mockFetchObserveSpansAsync.mock.calls[0][2].rootOnly).toBe(true);
+  });
+
+  it('maps every span filter flag to the fetch options', async () => {
+    const command = createCommand([
+      '--name',
+      'GET',
+      '--name',
+      'POST',
+      '--kind',
+      'client',
+      '--status',
+      'error',
+      '--status',
+      'unset',
+      '--host',
+      'api.example.com',
+      '--http-status',
+      '500',
+      '--http-status',
+      '502',
+      '--min-duration',
+      '250',
+      '--root-only',
+      '--session-id',
+      'session-1',
+      '--platform',
+      'android',
+      '--app-version',
+      '1.2.0',
+      '--build-number',
+      '42',
+      '--update-id',
+      'update-1',
+      '--environment',
+      'prod',
+      '--limit',
+      '50',
+    ]);
+    await command.runAsync();
+
+    const options = mockFetchObserveSpansAsync.mock.calls[0][2];
+    expect(options).toEqual(
+      expect.objectContaining({
+        limit: 50,
+        names: ['GET', 'POST'],
+        kinds: [AppObserveSpanKind.Client],
+        statusCodes: [AppObserveSpanStatusCode.Error, AppObserveSpanStatusCode.Unset],
+        hosts: ['api.example.com'],
+        httpStatusCodes: [500, 502],
+        minDurationMs: 250,
+        rootOnly: true,
+        sessionId: 'session-1',
+        platforms: [AppObservePlatform.Android],
+        appVersion: '1.2.0',
+        buildNumber: '42',
+        updateId: 'update-1',
+        environment: 'prod',
+      })
+    );
+  });
+
+  it('defaults the span list limit to 20 and caps it at 100', async () => {
+    await createCommand(['--all-spans']).runAsync();
+    expect(mockFetchObserveSpansAsync.mock.calls[0][2].limit).toBe(20);
+
+    await expect(createCommand(['--all-spans', '--limit', '101']).runAsync()).rejects.toThrow();
+  });
+
+  it('rejects an unknown --kind or --status value', async () => {
+    await expect(createCommand(['--kind', 'bogus']).runAsync()).rejects.toThrow();
+    await expect(createCommand(['--status', 'bogus']).runAsync()).rejects.toThrow();
+  });
+
+  it('emits the span list as JSON with --json', async () => {
+    const command = createCommand(['--all-spans', '--json', '--non-interactive']);
+    await command.runAsync();
+
+    expect(mockEnableJsonOutput).toHaveBeenCalled();
+    expect(mockBuildObserveSpansJson).toHaveBeenCalled();
+    expect(mockPrintJsonOnlyOutput).toHaveBeenCalled();
+    expect(mockBuildObserveSpansTable).not.toHaveBeenCalled();
+  });
+
+  it('surfaces the plan-gate message when a session filter is not available on the plan', async () => {
+    mockFetchObserveSpansAsync.mockRejectedValueOnce(planGateError());
+    const command = createCommand(['--session-id', 'session-1']);
+    await expect(command.runAsync()).rejects.toThrow(/not included in your current plan/);
+  });
+
+  it('surfaces the plan-gate message from the summary query', async () => {
+    mockSpanNamesAsync.mockRejectedValueOnce(planGateError());
+    const command = createCommand([]);
+    await expect(command.runAsync()).rejects.toThrow(/not included in your current plan/);
+  });
+});

packages/eas-cli/src/commands/observe/session.ts

@@ -45,7 +45,7 @@ const PICKER_CANDIDATE_LIMIT = 25;
 
 export default class ObserveSession extends EasCommand {
   static override description =
-    'display the timeline of metric and log events for a specific session';
+    'display the timeline of metric, log, and request trace span events for a specific session';
 
   static override args = {
     sessionId: Args.string({
@@ -129,7 +129,7 @@ export default class ObserveSession extends EasCommand {
       });
     }
 
-    const { entries, metadata, hasMoreMetricEvents, hasMoreLogEvents } =
+    const { entries, metadata, hasMoreMetricEvents, hasMoreLogEvents, hasMoreSpans } =
       await withObservePlanGateHandlingAsync(() =>
         fetchObserveSessionEventsAsync(graphqlClient, projectId, {
           sessionId,
@@ -144,7 +144,8 @@ export default class ObserveSession extends EasCommand {
           sessionId,
           metadata,
           hasMoreMetricEvents,
-          hasMoreLogEvents
+          hasMoreLogEvents,
+          hasMoreSpans
         )
       );
     } else {
@@ -154,6 +155,7 @@ export default class ObserveSession extends EasCommand {
           metadata,
           hasMoreMetricEvents,
           hasMoreLogEvents,
+          hasMoreSpans,
         })
       );
     }

packages/eas-cli/src/commands/observe/trace.ts

@@ -0,0 +1,80 @@
+import { Args } from '@oclif/core';
+
+import EasCommand from '../../commandUtils/EasCommand';
+import { EasCommandError } from '../../commandUtils/errors';
+import {
+  EasNonInteractiveAndJsonFlags,
+  EasProjectIdFlag,
+  resolveNonInteractiveAndJsonFlags,
+} from '../../commandUtils/flags';
+import { ObserveQuery } from '../../graphql/queries/ObserveQuery';
+import Log from '../../log';
+import { buildObserveTraceJson, buildObserveTraceTable } from '../../observe/formatSpans';
+import { withObservePlanGateHandlingAsync } from '../../observe/planGating';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
+
+// A trace ID is the 32-character hex string of the OTLP JSON encoding.
+const TRACE_ID_REGEX = /^[0-9a-f]{32}$/i;
+
+export default class ObserveTrace extends EasCommand {
+  static override description =
+    'display every span of a single request trace by its trace ID, oldest first, with child spans indented under their parent. Trace IDs are shown by `eas observe:traces`. In `--json` output a span with no `parentSpanId` is a root span, and a span with no `http` object is not an HTTP request';
+
+  static override args = {
+    traceId: Args.string({
+      description: 'ID of the trace to display',
+      required: true,
+    }),
+  };
+
+  static override flags = {
+    ...EasProjectIdFlag,
+    ...EasNonInteractiveAndJsonFlags,
+  };
+
+  static override contextDefinition = {
+    ...this.ContextOptions.ProjectId,
+    ...this.ContextOptions.LoggedIn,
+  };
+
+  async runAsync(): Promise<void> {
+    const { flags, args } = await this.parse(ObserveTrace);
+    const { json, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
+
+    const traceId = args.traceId;
+    if (!TRACE_ID_REGEX.test(traceId)) {
+      throw new EasCommandError(
+        `"${traceId}" is not a valid trace ID. A trace ID is 32 hexadecimal characters; copy it from the Trace ID column of \`eas observe:traces\`.`
+      );
+    }
+
+    const {
+      projectId,
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(ObserveTrace, {
+      nonInteractive,
+      projectIdOverride: flags['project-id'],
+    });
+
+    if (json) {
+      enableJsonOutput();
+    }
+
+    const trace = await withObservePlanGateHandlingAsync(() =>
+      ObserveQuery.traceByIdAsync(graphqlClient, { appId: projectId, id: traceId })
+    );
+
+    if (!trace) {
+      throw new EasCommandError(
+        `No trace found with ID "${traceId}". Trace IDs come from \`eas observe:traces\`, and traces age out of retention.`
+      );
+    }
+
+    if (json) {
+      printJsonOnlyOutput(buildObserveTraceJson(trace));
+    } else {
+      Log.addNewLineIfNone();
+      Log.log(buildObserveTraceTable(trace));
+    }
+  }
+}

packages/eas-cli/src/commands/observe/traces.ts

@@ -0,0 +1,203 @@
+import { Flags } from '@oclif/core';
+
+import EasCommand from '../../commandUtils/EasCommand';
+import {
+  EasNonInteractiveAndJsonFlags,
+  EasProjectIdFlag,
+  resolveNonInteractiveAndJsonFlags,
+} from '../../commandUtils/flags';
+import { getLimitFlagWithCustomValues } from '../../commandUtils/pagination';
+import { ObserveQuery } from '../../graphql/queries/ObserveQuery';
+import Log from '../../log';
+import { fetchObserveSpansAsync } from '../../observe/fetchSpans';
+import {
+  ObserveAfterFlag,
+  ObserveAppVersionFlag,
+  ObserveBuildNumberFlag,
+  ObserveEnvironmentFlag,
+  ObservePlatformFlag,
+  ObserveTimeRangeFlags,
+  ObserveUpdateIdFlag,
+} from '../../observe/flags';
+import {
+  buildObserveSpanNamesJson,
+  buildObserveSpanNamesTable,
+  buildObserveSpansJson,
+  buildObserveSpansTable,
+} from '../../observe/formatSpans';
+import { withObservePlanGateHandlingAsync } from '../../observe/planGating';
+import { observePlatformsFromFlag } from '../../observe/platforms';
+import {
+  allowedSpanKindFlagValues,
+  allowedSpanStatusFlagValues,
+  spanKindsFromFlag,
+  spanStatusCodesFromFlag,
+} from '../../observe/spanFilters';
+import { resolveTimeRange } from '../../observe/startAndEndTime';
+import { enableJsonOutput, printJsonOnlyOutput } from '../../utils/json';
+
+const DEFAULT_SPANS_LIMIT = 20;
+
+export default class ObserveTraces extends EasCommand {
+  static override description =
+    'display request trace spans recorded by the app, newest first. With no span filters, a summary of span names and kinds with counts is returned. Pass --all-spans or a span filter (--name, --kind, --status, --host, --http-status, --min-duration, --root-only, --session-id) to list individual spans';
+
+  static override flags = {
+    ...ObservePlatformFlag,
+    ...ObserveAfterFlag,
+    limit: getLimitFlagWithCustomValues({
+      defaultTo: DEFAULT_SPANS_LIMIT,
+      limit: 100,
+    }),
+    ...ObserveTimeRangeFlags,
+    ...ObserveAppVersionFlag,
+    ...ObserveBuildNumberFlag,
+    ...ObserveUpdateIdFlag,
+    ...ObserveEnvironmentFlag,
+    'session-id': Flags.string({
+      description: 'Filter by session ID',
+    }),
+    name: Flags.string({
+      description: 'Filter by span name, such as GET or POST (can be specified multiple times)',
+      multiple: true,
+    }),
+    kind: Flags.option({
+      description: 'Filter by span kind (can be specified multiple times)',
+      multiple: true,
+      options: allowedSpanKindFlagValues,
+    })(),
+    status: Flags.option({
+      description: 'Filter by span status (can be specified multiple times)',
+      multiple: true,
+      options: allowedSpanStatusFlagValues,
+    })(),
+    host: Flags.string({
+      description: 'Filter by request host (can be specified multiple times)',
+      multiple: true,
+    }),
+    'http-status': Flags.integer({
+      description: 'Filter by HTTP response status code (can be specified multiple times)',
+      multiple: true,
+    }),
+    'min-duration': Flags.integer({
+      description: 'Only spans that took at least this many milliseconds',
+      min: 0,
+    }),
+    'root-only': Flags.boolean({
+      description: 'Only root spans (spans with no parent)',
+      default: false,
+    }),
+    'all-spans': Flags.boolean({
+      description:
+        'List individual spans instead of the summary of span names + counts, even with no span filter',
+      default: false,
+    }),
+    ...EasProjectIdFlag,
+    ...EasNonInteractiveAndJsonFlags,
+  };
+
+  static override contextDefinition = {
+    ...this.ContextOptions.ProjectId,
+    ...this.ContextOptions.LoggedIn,
+  };
+
+  async runAsync(): Promise<void> {
+    const { flags } = await this.parse(ObserveTraces);
+    const { json, nonInteractive } = resolveNonInteractiveAndJsonFlags(flags);
+
+    const {
+      projectId,
+      loggedIn: { graphqlClient },
+    } = await this.getContextAsync(ObserveTraces, {
+      nonInteractive,
+      projectIdOverride: flags['project-id'],
+    });
+
+    if (json) {
+      enableJsonOutput();
+    }
+
+    const { daysBack, startTime, endTime } = resolveTimeRange(flags);
+    const platforms = observePlatformsFromFlag(flags.platform);
+
+    const hasSpanFilter =
+      flags['session-id'] !== undefined ||
+      (flags.name?.length ?? 0) > 0 ||
+      (flags.kind?.length ?? 0) > 0 ||
+      (flags.status?.length ?? 0) > 0 ||
+      (flags.host?.length ?? 0) > 0 ||
+      (flags['http-status']?.length ?? 0) > 0 ||
+      flags['min-duration'] !== undefined ||
+      flags['root-only'];
+
+    // The names summary has no span-level filters and no pagination, so any of
+    // those (or --all-spans) means the caller wants the span list.
+    if (!hasSpanFilter && !flags['all-spans'] && !flags.after) {
+      const { names, isTruncated } = await withObservePlanGateHandlingAsync(() =>
+        ObserveQuery.spanNamesAsync(graphqlClient, {
+          appId: projectId,
+          input: {
+            startTime,
+            endTime,
+            ...(platforms?.length && { platforms }),
+            ...(flags.environment && { environment: flags.environment }),
+            ...(flags['app-version'] && { appVersion: flags['app-version'] }),
+            ...(flags['build-number'] && { appBuildNumber: flags['build-number'] }),
+            ...(flags['update-id'] && { appUpdateId: flags['update-id'] }),
+          },
+        })
+      );
+
+      if (json) {
+        printJsonOnlyOutput(buildObserveSpanNamesJson(names, isTruncated));
+      } else {
+        Log.addNewLineIfNone();
+        Log.log(
+          buildObserveSpanNamesTable(names, {
+            daysBack,
+            startTime,
+            endTime,
+            isTruncated,
+          })
+        );
+      }
+      return;
+    }
+
+    const { spans, pageInfo } = await withObservePlanGateHandlingAsync(() =>
+      fetchObserveSpansAsync(graphqlClient, projectId, {
+        limit: flags.limit ?? DEFAULT_SPANS_LIMIT,
+        ...(flags.after && { after: flags.after }),
+        startTime,
+        endTime,
+        platforms,
+        appVersion: flags['app-version'],
+        buildNumber: flags['build-number'],
+        updateId: flags['update-id'],
+        environment: flags.environment,
+        sessionId: flags['session-id'],
+        names: flags.name,
+        kinds: spanKindsFromFlag(flags.kind),
+        statusCodes: spanStatusCodesFromFlag(flags.status),
+        hosts: flags.host,
+        httpStatusCodes: flags['http-status'],
+        minDurationMs: flags['min-duration'],
+        rootOnly: flags['root-only'],
+      })
+    );
+
+    if (json) {
+      printJsonOnlyOutput(buildObserveSpansJson(spans, pageInfo));
+    } else {
+      Log.addNewLineIfNone();
+      Log.log(
+        buildObserveSpansTable(spans, pageInfo, {
+          daysBack,
+          startTime,
+          endTime,
+          sessionId: flags['session-id'],
+        })
+      );
+    }
+  }
+}

packages/eas-cli/src/commands/workflow/__tests__/run-referenced-files.test.ts

@@ -0,0 +1,168 @@
+import spawnAsync from '@expo/spawn-async';
+import { Config } from '@oclif/core';
+
+import { collectReferencedWorkflowFilesAsync } from '../../../commandUtils/workflow/referencedFiles';
+import { fileExistsAsync, maybeReadStdinAsync } from '../../../commandUtils/workflow/utils';
+import { WorkflowRevisionMutation } from '../../../graphql/mutations/WorkflowRevisionMutation';
+import { WorkflowRunMutation } from '../../../graphql/mutations/WorkflowRunMutation';
+import { getOwnerAccountForProjectIdAsync } from '../../../project/projectUtils';
+import { uploadAccountScopedFileAsync } from '../../../project/uploadAccountScopedFileAsync';
+import { uploadAccountScopedProjectSourceAsync } from '../../../project/uploadAccountScopedProjectSourceAsync';
+import { WorkflowFile } from '../../../utils/workflowFile';
+import WorkflowRun from '../run';
+
+jest.mock('@expo/spawn-async', () => ({ __esModule: true, default: jest.fn() }));
+jest.mock('../../../commandUtils/workflow/referencedFiles');
+jest.mock('../../../graphql/mutations/WorkflowRevisionMutation');
+jest.mock('../../../graphql/mutations/WorkflowRunMutation');
+jest.mock('../../../project/projectUtils');
+jest.mock('../../../project/uploadAccountScopedFileAsync');
+jest.mock('../../../project/uploadAccountScopedProjectSourceAsync');
+jest.mock('../../../utils/workflowFile');
+jest.mock('../../../commandUtils/workflow/utils', () => ({
+  ...jest.requireActual('../../../commandUtils/workflow/utils'),
+  fileExistsAsync: jest.fn(),
+  maybeReadStdinAsync: jest.fn(),
+}));
+jest.mock('../../../log', () => ({
+  __esModule: true,
+  default: {
+    log: jest.fn(),
+    newLine: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    debug: jest.fn(),
+  },
+  link: jest.fn((url: string) => url),
+}));
+
+const mockSpawn = jest.mocked(spawnAsync);
+const mockCollectReferencedFiles = jest.mocked(collectReferencedWorkflowFilesAsync);
+const mockValidate = jest.mocked(WorkflowRevisionMutation.validateWorkflowYamlConfigAsync);
+const mockGetOrCreateRevision = jest.mocked(
+  WorkflowRevisionMutation.getOrCreateWorkflowRevisionFromGitRefAsync
+);
+const mockCreateFromGitRef = jest.mocked(WorkflowRunMutation.createWorkflowRunFromGitRefAsync);
+const mockCreateRun = jest.mocked(WorkflowRunMutation.createWorkflowRunAsync);
+const mockGetOwner = jest.mocked(getOwnerAccountForProjectIdAsync);
+const mockUploadProject = jest.mocked(uploadAccountScopedProjectSourceAsync);
+const mockUploadFile = jest.mocked(uploadAccountScopedFileAsync);
+const mockReadWorkflow = jest.mocked(WorkflowFile.readWorkflowFileContentsAsync);
+const mockFileExists = jest.mocked(fileExistsAsync);
+const mockReadStdin = jest.mocked(maybeReadStdinAsync);
+
+const rootYamlConfig = 'jobs:\n  ship:\n    uses: ./.eas/workflows/build.yml\n';
+const referencedFiles = [{ fileName: 'build.yml', yamlConfig: 'on:\n  workflow_call: {}\n' }];
+
+describe('WorkflowRun referenced workflow files', () => {
+  let mockConfig: Config;
+  let exitSpy: jest.SpyInstance;
+
+  beforeAll(async () => {
+    mockConfig = new Config({ root: __dirname });
+    mockConfig.runHook = async () => ({ failures: [], successes: [] });
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    exitSpy = jest.spyOn(process, 'exit').mockImplementation(((code?: number) => {
+      throw new Error(`process.exit:${code ?? 0}`);
+    }) as never);
+    mockReadStdin.mockResolvedValue(null);
+    mockGetOwner.mockResolvedValue({ id: 'acct-1', name: 'testuser' } as never);
+    mockValidate.mockResolvedValue(undefined as never);
+    mockReadWorkflow.mockResolvedValue({
+      filePath: '/test/project/.eas/workflows/test.yml',
+      yamlConfig: rootYamlConfig,
+    } as never);
+    mockCollectReferencedFiles.mockResolvedValue(referencedFiles);
+    mockFileExists.mockResolvedValue(false);
+    mockUploadProject.mockResolvedValue({ projectArchiveBucketKey: 'archive-key' } as never);
+    mockUploadFile.mockResolvedValue({ fileBucketKey: 'file-key' } as never);
+    mockCreateRun.mockResolvedValue({ id: 'run-1' } as never);
+    mockCreateFromGitRef.mockResolvedValue({ id: 'run-git-1' } as never);
+    mockSpawn.mockResolvedValue({ output: ['abc123\n'] } as never);
+    mockGetOrCreateRevision.mockResolvedValue({ id: 'rev-1', yamlConfig: rootYamlConfig } as never);
+  });
+
+  afterEach(() => {
+    exitSpy.mockRestore();
+  });
+
+  function createCommand(flags: { ref?: string }): WorkflowRun {
+    const command = new WorkflowRun(['.eas/workflows/test.yml'], mockConfig);
+    // @ts-expect-error getContextAsync/parse are protected
+    jest.spyOn(command, 'getContextAsync').mockResolvedValue({
+      getDynamicPrivateProjectConfigAsync: async () => ({
+        projectId: 'app-1',
+        exp: { slug: 'testapp' },
+      }),
+      loggedIn: { graphqlClient: {} },
+      vcsClient: { getRootPathAsync: async () => '/test/project' },
+      projectDir: '/test/project',
+    });
+    // @ts-expect-error parse is protected on the oclif base
+    jest.spyOn(command, 'parse').mockResolvedValue({
+      flags: {
+        json: false,
+        wait: false,
+        'non-interactive': true,
+        input: undefined,
+        ref: flags.ref,
+        ssh: false,
+        'ssh-idle-timeout': undefined,
+      },
+      args: { file: '.eas/workflows/test.yml' },
+    });
+    return command;
+  }
+
+  it('sends the collected files to validation and to the run creation', async () => {
+    await expect(createCommand({}).runAsync()).rejects.toThrow('process.exit:0');
+
+    expect(mockCollectReferencedFiles).toHaveBeenCalledWith({
+      projectDir: '/test/project',
+      rootFileName: 'test.yml',
+      rootYamlConfig,
+    });
+    expect(mockValidate).toHaveBeenCalledWith(
+      {},
+      { appId: 'app-1', yamlConfig: rootYamlConfig, referencedFiles }
+    );
+    expect(mockCreateRun).toHaveBeenCalledWith(
+      {},
+      expect.objectContaining({
+        workflowRevisionInput: {
+          fileName: 'test.yml',
+          yamlConfig: rootYamlConfig,
+          referencedFiles,
+        },
+      })
+    );
+  });
+
+  it('fails before validation and upload when the collector throws', async () => {
+    mockCollectReferencedFiles.mockRejectedValue(new Error('build.yml does not exist.'));
+
+    await expect(createCommand({}).runAsync()).rejects.toThrow('build.yml does not exist.');
+
+    expect(mockValidate).not.toHaveBeenCalled();
+    expect(mockUploadProject).not.toHaveBeenCalled();
+    expect(mockCreateRun).not.toHaveBeenCalled();
+  });
+
+  it('does not collect local files when --ref is set', async () => {
+    await expect(createCommand({ ref: 'main' }).runAsync()).rejects.toThrow('process.exit:0');
+
+    expect(mockCollectReferencedFiles).not.toHaveBeenCalled();
+    expect(mockValidate).toHaveBeenCalledWith(
+      {},
+      { appId: 'app-1', yamlConfig: rootYamlConfig, referencedFiles: undefined }
+    );
+    expect(mockCreateFromGitRef).toHaveBeenCalledWith(
+      {},
+      expect.objectContaining({ workflowRevisionId: 'rev-1', gitRef: 'abc123' })
+    );
+    expect(mockCreateRun).not.toHaveBeenCalled();
+  });
+});

packages/eas-cli/src/commands/workflow/cancel.ts

@@ -9,7 +9,7 @@ import { promptAsync } from '../../prompts';
 
 export default class WorkflowRunCancel extends EasCommand {
   static override description =
-    'cancel one or more workflow runs. If no workflow run IDs are provided, you will be prompted to select IN_PROGRESS runs to cancel';
+    'cancel one or more workflow runs. If no workflow run IDs are provided, you will be prompted to select in-progress or queued runs to cancel';
 
   static override strict = false;
 
@@ -22,21 +22,10 @@ export default class WorkflowRunCancel extends EasCommand {
   };
 
   async runAsync(): Promise<void> {
-    const { argv } = await this.parse(WorkflowRunCancel);
-    let nonInteractive = false;
-    const workflowRunIds: Set<string> = new Set();
-
-    // Custom parsing of argv
-    const tokens = [...argv] as string[];
-    while (tokens.length > 0) {
-      const token = tokens.shift();
-      if (token === '--non-interactive') {
-        nonInteractive = true;
-        continue;
-      } else if (token) {
-        workflowRunIds.add(token);
-      }
-    }
+    const { argv, flags } = await this.parse(WorkflowRunCancel);
+    // oclif removes declared flags such as --non-interactive from argv.
+    const nonInteractive = flags['non-interactive'];
+    const workflowRunIds = new Set(argv as string[]);
 
     const {
       projectId,
@@ -49,14 +38,13 @@ export default class WorkflowRunCancel extends EasCommand {
       if (nonInteractive) {
         throw new Error('Must supply workflow run IDs as arguments when in non-interactive mode');
       }
-      // Run the workflow run list query and select runs to cancel
-      const queryResult = await AppQuery.byIdWorkflowRunsFilteredByStatusAsync(
-        graphqlClient,
-        projectId,
-        WorkflowRunStatus.InProgress,
-        50
+      const pickerStatuses = [WorkflowRunStatus.InProgress, WorkflowRunStatus.Waiting];
+      const runsByStatus = await Promise.all(
+        pickerStatuses.map(status =>
+          AppQuery.byIdWorkflowRunsFilteredByStatusAsync(graphqlClient, projectId, status, 50)
+        )
       );
-      const runs = processWorkflowRuns(queryResult);
+      const runs = processWorkflowRuns(runsByStatus.flat());
       if (runs.length === 0) {
         Log.warn('No workflow runs to cancel');
         return;
@@ -64,7 +52,7 @@ export default class WorkflowRunCancel extends EasCommand {
       const answers = await promptAsync({
         type: 'multiselect',
         name: 'selectedRuns',
-        message: 'Select IN_PROGRESS workflow runs to cancel',
+        message: 'Select workflow runs to cancel',
         choices: runs.map(run => choiceFromWorkflowRun(run)),
       });
       answers.selectedRuns.forEach((id: string) => {

packages/eas-cli/src/commands/workflow/run.ts

@@ -57,6 +57,7 @@ import {
   parseJsonInputs,
   parseWorkflowInputsFromYaml,
 } from '../../commandUtils/workflow/inputs';
+import { collectReferencedWorkflowFilesAsync } from '../../commandUtils/workflow/referencedFiles';
 import {
   fileExistsAsync,
   maybeReadStdinAsync,
@@ -65,6 +66,7 @@ import {
 } from '../../commandUtils/workflow/utils';
 import {
   WorkflowProjectSourceType,
+  WorkflowReferencedFileInput,
   WorkflowRevision,
   WorkflowRunStatus,
 } from '../../graphql/generated';
@@ -179,6 +181,7 @@ export default class WorkflowRun extends EasCommand {
     let workflowRunId: string;
     let workflowRevisionId: string | undefined;
     let gitRef: string | undefined;
+    let referencedFiles: WorkflowReferencedFileInput[] | undefined;
 
     if (flags.ref) {
       // Run from git ref
@@ -230,6 +233,11 @@ export default class WorkflowRun extends EasCommand {
 
         throw err;
       }
+      referencedFiles = await collectReferencedWorkflowFilesAsync({
+        projectDir,
+        rootFileName: path.basename(args.file),
+        rootYamlConfig: yamlConfig,
+      });
     }
 
     // Validate workflow YAML
@@ -237,6 +245,7 @@ export default class WorkflowRun extends EasCommand {
       await WorkflowRevisionMutation.validateWorkflowYamlConfigAsync(graphqlClient, {
         appId: projectId,
         yamlConfig,
+        referencedFiles,
       });
     } catch (error) {
       if (error instanceof CombinedError) {
@@ -362,6 +371,7 @@ export default class WorkflowRun extends EasCommand {
           workflowRevisionInput: {
             fileName: path.basename(args.file),
             yamlConfig,
+            referencedFiles,
           },
           workflowRunInput: {
             inputs,

packages/eas-cli/src/commands/workflow/runs.ts

@@ -84,7 +84,7 @@ export default class WorkflowRunList extends EasCommand {
           { label: 'Workflow', value: run.workflowFileName },
           { label: 'Status', value: run.status },
           { label: 'Started At', value: run.startedAt },
-          { label: 'Finished At', value: run.finishedAt },
+          { label: 'Finished At', value: run.finishedAt ?? 'null' },
           { label: 'Trigger Type', value: run.triggerType },
           { label: 'Trigger', value: run.trigger ?? 'null' },
           { label: 'Git Commit Message', value: run.gitCommitMessage ?? 'null' },