@expo/build-tools 24.0.0 → 24.1.0

package/dist/common/projectSources.js

@@ -26,9 +26,11 @@ async function prepareProjectSourcesAsync(ctx, destinationDirectory) {
     else {
         const projectArchiveResult = await (0, results_1.asyncResult)(fetchProjectArchiveSourceAsync(ctx));
         if (!projectArchiveResult.ok) {
-            ctx.logger.error({ err: projectArchiveResult.reason }, 'Failed to refresh project archive, falling back to the original one');
+            throw new eas_build_job_1.SystemError('Failed to fetch project sources. Re-run the job.', {
+                cause: projectArchiveResult.reason,
+            });
         }
-        projectArchive = projectArchiveResult.value ?? ctx.job.projectArchive;
+        projectArchive = projectArchiveResult.value;
     }
     switch (projectArchive.type) {
         case eas_build_job_1.ArchiveSourceType.R2:

package/dist/generic.js

@@ -13,6 +13,7 @@ const projectSources_1 = require("./common/projectSources");
 const customBuildContext_1 = require("./customBuildContext");
 const easFunctionGroups_1 = require("./steps/easFunctionGroups");
 const easFunctions_1 = require("./steps/easFunctions");
+const localEgress_1 = require("./steps/utils/localEgress");
 const outputs_1 = require("./utils/outputs");
 const retry_1 = require("./utils/retry");
 async function runGenericJobAsync(ctx) {
@@ -63,7 +64,16 @@ async function runGenericJobAsync(ctx) {
             throw parseError;
         }
     });
-    const runResult = await (0, results_1.asyncResult)(workflow.executeAsync());
+    const runResult = await (0, results_1.asyncResult)((async () => {
+        try {
+            await workflow.executeAsync();
+        }
+        finally {
+            // The session-owning step may never run if simulator boot/setup fails,
+            // or may time out while resource acquisition is still in flight.
+            await (0, localEgress_1.stopLocalEgressResourcesAsync)(ctx.logger);
+        }
+    })());
     await ctx.runBuildPhase(eas_build_job_1.BuildPhase.COMPLETE_JOB, async () => {
         const results = await Promise.allSettled([
             (0, outputs_1.uploadJobOutputsToWwwAsync)(globalContext, {

package/dist/steps/easFunctions.js

@@ -49,6 +49,7 @@ const startAppiumRemoteSession_1 = require("./functions/startAppiumRemoteSession
 const startCuttlefishDevice_1 = require("./functions/startCuttlefishDevice");
 const startIosSimulator_1 = require("./functions/startIosSimulator");
 const startIosSimulatorRecordings_1 = require("./functions/startIosSimulatorRecordings");
+const startLocalEgress_1 = require("./functions/startLocalEgress");
 const startWebPreviewRemoteSession_1 = require("./functions/startWebPreviewRemoteSession");
 const startServeSimMetrics_1 = require("./functions/startServeSimMetrics");
 const collectServeSimMetrics_1 = require("./functions/collectServeSimMetrics");
@@ -99,6 +100,7 @@ function getEasFunctions(ctx) {
         (0, startAndroidEmulator_1.createStartAndroidEmulatorBuildFunction)(),
         (0, startCuttlefishDevice_1.createStartCuttlefishDeviceBuildFunction)(),
         (0, startIosSimulator_1.createStartIosSimulatorBuildFunction)(),
+        (0, startLocalEgress_1.createStartLocalEgressBuildFunction)(),
         (0, startIosSimulatorRecordings_1.createStartIosSimulatorRecordingsBuildFunction)(),
         (0, finishIosSimulatorRecordings_1.createFinishIosSimulatorRecordingsBuildFunction)(),
         (0, uploadDeviceRunSessionScreenRecordings_1.createUploadDeviceRunSessionScreenRecordingsBuildFunction)(ctx),

package/dist/steps/functions/startAgentDeviceRemoteSession.js

@@ -11,6 +11,7 @@ const turtle_spawn_1 = __importDefault(require("@expo/turtle-spawn"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
+const localEgressSession_1 = require("../utils/localEgressSession");
 const sentry_1 = require("../../sentry");
 const agentDeviceArtifacts_1 = require("../utils/agentDeviceArtifacts");
 const agentDeviceEvents_1 = require("../utils/agentDeviceEvents");
@@ -48,7 +49,7 @@ function createStartAgentDeviceRemoteSessionBuildFunction(ctx) {
                 allowedValueTypeName: steps_1.BuildStepInputValueTypeName.NUMBER,
             }),
         ],
-        fn: async ({ logger, global }, { inputs, env, signal }) => {
+        fn: (0, localEgressSession_1.withLocalEgressSession)(async ({ logger, global }, { inputs, env, signal }) => {
             // Fail fast before any expensive setup if the injected env
             // vars are missing: DEVICE_RUN_SESSION_ID (to report the remote config
             // back to the API server), EAS_SIMULATOR_NGROK_TUNNEL_DOMAIN (base domain
@@ -92,13 +93,16 @@ function createStartAgentDeviceRemoteSessionBuildFunction(ctx) {
                     timeoutMs: STARTUP_TIMEOUT_MS,
                 });
                 logger.info(`Web preview URL: ${webPreview.previewUrl}`);
-                await (0, remoteDeviceRunSession_1.uploadRemoteSessionConfigAsync)({
+                await (0, localEgressSession_1.uploadRemoteSessionConfigWithLocalEgressAsync)({
+                    env,
+                    signal,
                     ctx,
                     deviceRunSessionId,
                     remoteConfig: {
                         agentDeviceRemoteSessionUrl,
                         agentDeviceRemoteSessionToken: daemonToken,
                         webPreviewUrl: webPreview.previewUrl,
+                        ...(webPreview.previewToken ? { webPreviewToken: webPreview.previewToken } : {}),
                     },
                     logger,
                 });
@@ -142,7 +146,7 @@ function createStartAgentDeviceRemoteSessionBuildFunction(ctx) {
                 }
                 await daemonProcess.stopAsync();
             }
-        },
+        }),
     });
 }
 async function stopAgentDeviceEventCollectionSafelyAsync({ eventCollection, deviceRunSessionId, logger, }) {

package/dist/steps/functions/startAppiumRemoteSession.js

@@ -14,6 +14,7 @@ const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const semver_1 = __importDefault(require("semver"));
 const zod_1 = require("zod");
+const localEgressSession_1 = require("../utils/localEgressSession");
 const AndroidEmulatorUtils_1 = require("../../utils/AndroidEmulatorUtils");
 const IosSimulatorUtils_1 = require("../../utils/IosSimulatorUtils");
 const retry_1 = require("../../utils/retry");
@@ -43,7 +44,7 @@ function createStartAppiumRemoteSessionBuildFunction(ctx) {
                 allowedValueTypeName: steps_1.BuildStepInputValueTypeName.NUMBER,
             }),
         ],
-        fn: async ({ logger, global }, { inputs, env, signal }) => {
+        fn: (0, localEgressSession_1.withLocalEgressSession)(async ({ logger, global }, { inputs, env, signal }) => {
             const deviceRunSessionId = (0, remoteDeviceRunSession_1.getDeviceRunSessionIdOrThrow)(env);
             const ngrokTunnelDomain = (0, remoteDeviceRunSession_1.getNgrokTunnelDomainOrThrow)(env);
             const ngrokAuthtoken = (0, remoteDeviceRunSession_1.getNgrokAuthtokenOrThrow)(env);
@@ -113,7 +114,9 @@ function createStartAppiumRemoteSessionBuildFunction(ctx) {
                     logger,
                     timeoutMs: APPIUM_STARTUP_TIMEOUT_MS,
                 });
-                await (0, remoteDeviceRunSession_1.uploadRemoteSessionConfigAsync)({
+                await (0, localEgressSession_1.uploadRemoteSessionConfigWithLocalEgressAsync)({
+                    env,
+                    signal,
                     ctx,
                     deviceRunSessionId,
                     remoteConfig: {
@@ -124,6 +127,7 @@ function createStartAppiumRemoteSessionBuildFunction(ctx) {
                             'appium:udid': device.udid,
                         },
                         webPreviewUrl: webPreview.previewUrl,
+                        ...(webPreview.previewToken ? { webPreviewToken: webPreview.previewToken } : {}),
                     },
                     logger,
                 });
@@ -151,7 +155,7 @@ function createStartAppiumRemoteSessionBuildFunction(ctx) {
                 await appiumProcess.stopAsync();
                 await node_fs_1.default.promises.rm(appiumHome, { recursive: true, force: true });
             }
-        },
+        }),
     });
 }
 function resolveAppium3VersionSpec(packageVersion) {

package/dist/steps/functions/startArgentRemoteSession.js

@@ -16,6 +16,7 @@ const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const semver_1 = __importDefault(require("semver"));
 const zod_1 = require("zod");
+const localEgressSession_1 = require("../utils/localEgressSession");
 const sentry_1 = require("../../sentry");
 const processes_1 = require("../../utils/processes");
 const retry_1 = require("../../utils/retry");
@@ -63,7 +64,7 @@ function createStartArgentRemoteSessionBuildFunction(ctx) {
                 allowedValueTypeName: steps_1.BuildStepInputValueTypeName.NUMBER,
             }),
         ],
-        fn: async ({ logger, global }, { inputs, env, signal }) => {
+        fn: (0, localEgressSession_1.withLocalEgressSession)(async ({ logger, global }, { inputs, env, signal }) => {
             // Fail fast before any expensive setup if the injected env
             // vars are missing: DEVICE_RUN_SESSION_ID (to report the remote config
             // back to the API server), EAS_SIMULATOR_NGROK_TUNNEL_DOMAIN (base domain
@@ -173,13 +174,16 @@ function createStartArgentRemoteSessionBuildFunction(ctx) {
                     timeoutMs: STARTUP_TIMEOUT_MS,
                 });
                 logger.info(`Web preview URL: ${webPreview.previewUrl}`);
-                await (0, remoteDeviceRunSession_1.uploadRemoteSessionConfigAsync)({
+                await (0, localEgressSession_1.uploadRemoteSessionConfigWithLocalEgressAsync)({
+                    env,
+                    signal,
                     ctx,
                     deviceRunSessionId,
                     remoteConfig: {
                         toolsUrl: publicToolsUrl,
                         ...(toolServerToken ? { toolsAuthToken: toolServerToken } : {}),
                         webPreviewUrl: webPreview.previewUrl,
+                        ...(webPreview.previewToken ? { webPreviewToken: webPreview.previewToken } : {}),
                     },
                     logger,
                 });
@@ -216,7 +220,7 @@ function createStartArgentRemoteSessionBuildFunction(ctx) {
                 }
                 await argentServer.stopAsync();
             }
-        },
+        }),
     });
 }
 async function stopArgentEventCollectionSafelyAsync({ eventCollection, deviceRunSessionId, logger, }) {

package/dist/steps/functions/startLocalEgress.d.ts

@@ -0,0 +1,10 @@
+import { BuildFunction } from '@expo/steps';
+/**
+ * Points the device host's system HTTP(S) proxy at the EAS CLI's egress client.
+ * Must run before `eas/start_ios_simulator`: the simulator reads the system proxy
+ * at boot. Nothing else on the host changes, so requests from libraries that
+ * bypass the system proxy are not covered; the shared session monitor reports
+ * them. The shared session cleanup releases the resources started here when
+ * the session ends, with a job finalizer as a fallback.
+ */
+export declare function createStartLocalEgressBuildFunction(): BuildFunction;

package/dist/steps/functions/startLocalEgress.js

@@ -0,0 +1,156 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createStartLocalEgressBuildFunction = createStartLocalEgressBuildFunction;
+const steps_1 = require("@expo/steps");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const localEgress_1 = require("../utils/localEgress");
+const remoteDeviceRunSession_1 = require("../utils/remoteDeviceRunSession");
+/**
+ * The downloader and ngrok SDK do not accept an AbortSignal. Stop awaiting them
+ * on cancellation, while retaining handlers that dispose any eventual result.
+ */
+function awaitLocalEgressAcquisitionAsync(pending, signal, disposeAbandonedAsync, logger) {
+    return new Promise((resolve, reject) => {
+        let abandoned = false;
+        const abort = () => {
+            signal.removeEventListener('abort', abort);
+            abandoned = true;
+            reject(signal.reason);
+        };
+        signal.addEventListener('abort', abort, { once: true });
+        if (signal.aborted) {
+            abort();
+        }
+        void pending
+            .then(async (result) => {
+            signal.removeEventListener('abort', abort);
+            if (abandoned) {
+                await disposeAbandonedAsync(result);
+            }
+            else {
+                resolve(result);
+            }
+        }, async (error) => {
+            signal.removeEventListener('abort', abort);
+            if (abandoned) {
+                await disposeAbandonedAsync();
+            }
+            else {
+                reject(error);
+            }
+        })
+            .catch(err => logger.warn({ err }, 'Could not release a cancelled local egress acquisition.'));
+    });
+}
+/**
+ * Points the device host's system HTTP(S) proxy at the EAS CLI's egress client.
+ * Must run before `eas/start_ios_simulator`: the simulator reads the system proxy
+ * at boot. Nothing else on the host changes, so requests from libraries that
+ * bypass the system proxy are not covered; the shared session monitor reports
+ * them. The shared session cleanup releases the resources started here when
+ * the session ends, with a job finalizer as a fallback.
+ */
+function createStartLocalEgressBuildFunction() {
+    return new steps_1.BuildFunction({
+        namespace: 'eas',
+        id: 'start_local_egress',
+        name: 'Start local egress',
+        __metricsId: 'eas/start_local_egress',
+        supportedRuntimePlatforms: [steps_1.BuildRuntimePlatform.DARWIN],
+        fn: async ({ logger }, { env, signal }) => {
+            const ngrokTunnelDomain = (0, remoteDeviceRunSession_1.getNgrokTunnelDomainOrThrow)(env);
+            const ngrokAuthtoken = (0, remoteDeviceRunSession_1.getNgrokAuthtokenOrThrow)(env);
+            let workDir;
+            let server;
+            let tunnel;
+            let finishSetup;
+            const setupFinished = new Promise(resolve => {
+                finishSetup = resolve;
+            });
+            // Register before acquisition. Cancellation ends setup promptly; pending
+            // SDK calls retain their own late-result disposal handlers.
+            const lifetimeSignal = (0, localEgress_1.registerLocalEgressResources)(async () => {
+                await setupFinished;
+                const results = await Promise.allSettled([
+                    Promise.resolve().then(() => tunnel?.stopAsync()),
+                    Promise.resolve().then(() => server?.stopAsync()),
+                ]);
+                for (const result of results) {
+                    if (result.status === 'rejected') {
+                        logger.warn({ err: result.reason }, 'Could not stop a local egress resource.');
+                    }
+                }
+                await Promise.all([
+                    node_fs_1.default.promises.rm(localEgress_1.LOCAL_EGRESS_HANDOFF_PATH, { force: true }),
+                    workDir ? node_fs_1.default.promises.rm(workDir, { recursive: true, force: true }) : undefined,
+                ]);
+            });
+            const startupSignal = signal ? AbortSignal.any([signal, lifetimeSignal]) : lifetimeSignal;
+            try {
+                startupSignal.throwIfAborted();
+                workDir = await node_fs_1.default.promises.mkdtemp(node_path_1.default.join(node_os_1.default.tmpdir(), 'eas-local-egress-'));
+                startupSignal.throwIfAborted();
+                logger.info(`Downloading the reverse tunnel server (chisel ${localEgress_1.CHISEL_VERSION}).`);
+                const downloadDir = workDir;
+                const chiselPath = await awaitLocalEgressAcquisitionAsync((0, localEgress_1.downloadChiselAsync)({ destinationDir: downloadDir, logger }), startupSignal, async () => await node_fs_1.default.promises.rm(downloadDir, { recursive: true, force: true }), logger);
+                startupSignal.throwIfAborted();
+                const credentials = (0, localEgress_1.generateEgressCredentials)();
+                const authfilePath = node_path_1.default.join(workDir, 'authfile.json');
+                await node_fs_1.default.promises.writeFile(authfilePath, (0, localEgress_1.createChiselAuthfileContents)({ ...credentials, port: localEgress_1.LOCAL_EGRESS_PROXY_PORT }), { encoding: 'utf8', mode: 0o600 });
+                startupSignal.throwIfAborted();
+                const controlPort = await (0, remoteDeviceRunSession_1.findAvailablePortAsync)();
+                startupSignal.throwIfAborted();
+                logger.info(`Starting the reverse tunnel server on 127.0.0.1:${controlPort}.`);
+                const started = await (0, localEgress_1.startChiselServerAsync)({
+                    chiselPath,
+                    controlPort,
+                    authfilePath,
+                    env,
+                    signal: startupSignal,
+                });
+                server = started.process;
+                startupSignal.throwIfAborted();
+                tunnel = await awaitLocalEgressAcquisitionAsync((0, remoteDeviceRunSession_1.startNgrokTunnelAsync)({
+                    port: controlPort,
+                    subdomainPrefix: 'egress',
+                    baseDomain: ngrokTunnelDomain,
+                    authtoken: ngrokAuthtoken,
+                    logger,
+                }), startupSignal, async (listener) => await listener?.stopAsync(), logger);
+                startupSignal.throwIfAborted();
+                const { service } = await (0, localEgress_1.configureSystemProxyAsync)({
+                    env,
+                    logger,
+                    port: localEgress_1.LOCAL_EGRESS_PROXY_PORT,
+                    signal: startupSignal,
+                });
+                startupSignal.throwIfAborted();
+                await (0, localEgress_1.writeLocalEgressHandoffAsync)({
+                    url: tunnel.url,
+                    token: credentials.password,
+                    fingerprint: started.fingerprint,
+                    port: localEgress_1.LOCAL_EGRESS_PROXY_PORT,
+                });
+                startupSignal.throwIfAborted();
+                logger.info(`Local egress is configured on network service "${service}". HTTP(S) and WebSocket ` +
+                    'requests that honor the system proxy (WebKit, URLSession and other CFNetwork clients) ' +
+                    'fail until the EAS CLI egress client connects, then exit from that machine. Requests ' +
+                    'from libraries that bypass the system proxy are not covered and exit from this worker. ' +
+                    'Connection sampling may report these bypasses, but can miss short connections and unconnected UDP traffic.');
+            }
+            catch (error) {
+                finishSetup();
+                await (0, localEgress_1.stopLocalEgressResourcesAsync)(logger);
+                throw error;
+            }
+            finally {
+                finishSetup();
+            }
+        },
+    });
+}

package/dist/steps/functions/startWebPreviewRemoteSession.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createStartWebPreviewRemoteSessionBuildFunction = createStartWebPreviewRemoteSessionBuildFunction;
 const steps_1 = require("@expo/steps");
+const localEgressSession_1 = require("../utils/localEgressSession");
 const remoteDeviceRunSession_1 = require("../utils/remoteDeviceRunSession");
 const STARTUP_TIMEOUT_MS = 60_000;
 function createStartWebPreviewRemoteSessionBuildFunction(ctx) {
@@ -22,7 +23,7 @@ function createStartWebPreviewRemoteSessionBuildFunction(ctx) {
                 allowedValueTypeName: steps_1.BuildStepInputValueTypeName.NUMBER,
             }),
         ],
-        fn: async ({ logger, global }, { inputs, env, signal }) => {
+        fn: (0, localEgressSession_1.withLocalEgressSession)(async ({ logger, global }, { inputs, env, signal }) => {
             const deviceRunSessionId = (0, remoteDeviceRunSession_1.getDeviceRunSessionIdOrThrow)(env);
             const ngrokTunnelDomain = (0, remoteDeviceRunSession_1.getNgrokTunnelDomainOrThrow)(env);
             const maxDurationSeconds = inputs.max_duration_seconds?.value;
@@ -42,10 +43,15 @@ function createStartWebPreviewRemoteSessionBuildFunction(ctx) {
             });
             logger.info(`Preview URL: ${webPreview.previewUrl}`);
             try {
-                await (0, remoteDeviceRunSession_1.uploadRemoteSessionConfigAsync)({
+                await (0, localEgressSession_1.uploadRemoteSessionConfigWithLocalEgressAsync)({
+                    env,
+                    signal,
                     ctx,
                     deviceRunSessionId,
-                    remoteConfig: { previewUrl: webPreview.previewUrl },
+                    remoteConfig: {
+                        previewUrl: webPreview.previewUrl,
+                        ...(webPreview.previewToken ? { previewToken: webPreview.previewToken } : {}),
+                    },
                     logger,
                 });
                 await (0, remoteDeviceRunSession_1.waitForDeviceRunSessionStoppedAsync)({
@@ -59,6 +65,6 @@ function createStartWebPreviewRemoteSessionBuildFunction(ctx) {
             finally {
                 await webPreview.stopAsync();
             }
-        },
+        }),
     });
 }

package/dist/steps/utils/localEgress.d.ts

@@ -0,0 +1,152 @@
+import { bunyan } from '@expo/logger';
+import { BuildStepEnv } from '@expo/steps';
+import { type DetachedProcessHandle } from './remoteDeviceRunSession';
+/**
+ * Local egress provides an HTTP(S) proxy through the machine running the EAS CLI.
+ * Requests that use this proxy exit through that machine's network.
+ *
+ * Worker side: a chisel server in reverse mode listens on loopback and is exposed
+ * through the session's ngrok domain. When the CLI's egress client connects, chisel
+ * opens LOCAL_EGRESS_PROXY_PORT on this host and forwards every connection to the
+ * HTTP proxy the CLI runs. The macOS system proxy points at that port. Until the
+ * client connects, nothing listens on the port and proxied requests fail.
+ *
+ * Contract: HTTP(S) and WebSocket requests that honor the system proxy (WebKit,
+ * URLSession and other CFNetwork clients) exit from the egress client's network
+ * and fail while the client is disconnected. Requests from libraries that bypass
+ * the system proxy are not covered and exit from this host. Nothing here enforces
+ * routing; the session monitor reports such direct connections instead.
+ */
+export declare const LOCAL_EGRESS_PROXY_HOST = "127.0.0.1";
+export declare const LOCAL_EGRESS_PROXY_PORT = 8899;
+export declare const LOCAL_EGRESS_USERNAME = "eas";
+export declare const LOCAL_EGRESS_HANDOFF_PATH: string;
+export declare const CHISEL_VERSION = "1.12.0";
+export type LocalEgressHandoff = {
+    /** Public URL of the reverse tunnel server, reachable through ngrok. */
+    url: string;
+    /** Secret the client presents to the tunnel server, paired with LOCAL_EGRESS_USERNAME. */
+    token: string;
+    /** Fingerprint of the tunnel server key, for the client to pin. */
+    fingerprint: string;
+    /** Loopback port on this host that the client must serve. */
+    port: number;
+};
+export declare function getChiselAssetName({ platform, arch, }: {
+    platform: NodeJS.Platform;
+    arch: string;
+}): string;
+export declare function getChiselDownloadUrl(assetName: string): string;
+export declare function downloadChiselAsync({ destinationDir, logger, platform, arch, }: {
+    destinationDir: string;
+    logger: bunyan;
+    platform?: NodeJS.Platform;
+    arch?: string;
+}): Promise<string>;
+export declare function generateEgressCredentials(): {
+    user: string;
+    password: string;
+};
+/**
+ * chisel authfile: one user, allowed to open reverse remotes on loopback only.
+ * The proxy port carries proxied requests. Any unprivileged loopback port may be
+ * forwarded too: the EAS CLI opens one per `--egress-allow localhost:<port>`
+ * entry so `127.0.0.1:<port>` inside the simulator reaches that port on the
+ * developer's machine, like `adb reverse`. iOS never sends loopback-literal
+ * requests to the system proxy, so the proxy alone cannot serve them.
+ * Reverse remotes are matched as `R:<interface>:<port>`.
+ */
+export declare function createChiselAuthfileContents({ user, password, port, }: {
+    user: string;
+    password: string;
+    port: number;
+}): string;
+export declare function parseChiselFingerprint(output: string): string | null;
+export declare function startChiselServerAsync({ chiselPath, controlPort, authfilePath, env, signal, }: {
+    chiselPath: string;
+    controlPort: number;
+    authfilePath: string;
+    env: BuildStepEnv;
+    signal?: AbortSignal;
+}): Promise<{
+    process: DetachedProcessHandle;
+    fingerprint: string;
+}>;
+export declare function parseDefaultRouteInterface(routeOutput: string): string | null;
+/**
+ * `networksetup -listnetworkserviceorder` prints each service as two lines:
+ * "(1) Wi-Fi" followed by "(Hardware Port: Wi-Fi, Device: en0)". Return the
+ * service name whose device matches.
+ */
+export declare function parseNetworkServiceNameForDevice(listOutput: string, device: string): string | null;
+export declare function resolveActiveNetworkServiceNameAsync({ env, }: {
+    env: BuildStepEnv;
+}): Promise<string>;
+export declare function buildNetworksetupProxyArgs({ service, host, port, }: {
+    service: string;
+    host: string;
+    port: number;
+}): string[][];
+/**
+ * Point the macOS system HTTP and HTTPS proxy at the loopback egress port. The
+ * simulator reads these settings when it boots, so this must run before
+ * `start_ios_simulator`. Existing bypass and automatic proxy settings are left
+ * unchanged. Requests that bypass this proxy can leave from this host's address.
+ */
+export declare function configureSystemProxyAsync({ env, logger, port, signal, }: {
+    env: BuildStepEnv;
+    logger: bunyan;
+    port: number;
+    signal?: AbortSignal;
+}): Promise<{
+    service: string;
+}>;
+export declare function writeLocalEgressHandoffAsync(handoff: LocalEgressHandoff, handoffPath?: string): Promise<void>;
+export declare function readLocalEgressHandoffAsync(handoffPath?: string): Promise<LocalEgressHandoff | null>;
+/** remoteConfig fields the CLI needs to start the egress client. */
+export declare function buildEgressRemoteConfigFields(handoff: LocalEgressHandoff | null): Record<string, string | number>;
+export declare function registerLocalEgressResources(stopAsync: () => Promise<void>): AbortSignal;
+export declare function stopLocalEgressResourcesAsync(logger: bunyan): Promise<void>;
+export declare function isPortListeningAsync({ host, port, timeoutMs, }: {
+    host: string;
+    port: number;
+    timeoutMs?: number;
+}): Promise<boolean>;
+export declare function parseExitIpResponse(body: string): string;
+export declare function fetchExitIpThroughProxyAsync({ port, env, }: {
+    port: number;
+    env: BuildStepEnv;
+}): Promise<string>;
+/**
+ * Processes inside the simulator run on the host as descendants of launchd_sim,
+ * so `ps -axo pid=,ppid=,comm=` ancestry identifies them. Returns every
+ * descendant pid; launchd_sim itself opens no network connections.
+ */
+export declare function collectSimulatorProcessIds(psOutput: string): number[];
+export type DirectSimulatorConnection = {
+    pid: number;
+    command: string;
+    protocol: string;
+    /** Remote peer as lsof prints it, e.g. `93.184.216.34:443` or `[2606::1]:443`. */
+    remote: string;
+};
+/**
+ * Parse `lsof -nP -i -F pcPnT` output. Returns the TCP and UDP connections that
+ * simulator processes hold to peers outside loopback. Those did not go through
+ * the proxy on 127.0.0.1, so they exit from this host instead of the egress
+ * client. Listening sockets, unconnected UDP sockets and connections to
+ * loopback (the proxy itself) are ignored.
+ */
+export declare function parseDirectSimulatorConnections(lsofOutput: string, simulatorPids: ReadonlySet<number>): DirectSimulatorConnection[];
+/**
+ * Log proxy listener availability, the exit IP observed by a worker request
+ * through it, and simulator connections that bypassed the proxy. Neither check
+ * verifies that proxied simulator requests reach the egress client. Never
+ * rejects: it runs in the background for the whole session.
+ */
+export declare function monitorLocalEgressAsync({ port, env, logger, signal, }: {
+    port: number;
+    env: BuildStepEnv;
+    logger: bunyan;
+    signal: AbortSignal;
+}): Promise<void>;