@expo/build-tools 24.2.0 → 24.4.0

package/dist/common/projectSources.js

@@ -19,6 +19,9 @@ const zod_1 = require("zod");
 const git_1 = require("./git");
 const turtleFetch_1 = require("../utils/turtleFetch");
 async function prepareProjectSourcesAsync(ctx, destinationDirectory) {
+    if (ctx.job.projectArchive.type === eas_build_job_1.ArchiveSourceType.NONE) {
+        return { handled: true };
+    }
     if (ctx.isLocal) {
         if (ctx.job.projectArchive.type !== eas_build_job_1.ArchiveSourceType.PATH) {
             throw new eas_build_job_1.SystemError(`Expected a PATH project source for a local build, received ${ctx.job.projectArchive.type}.`, { trackingCode: 'INVALID_LOCAL_PROJECT_SOURCE' });

package/dist/steps/easFunctions.js

@@ -52,6 +52,7 @@ const startIosSimulatorRecordings_1 = require("./functions/startIosSimulatorReco
 const startLocalEgress_1 = require("./functions/startLocalEgress");
 const startWebPreviewRemoteSession_1 = require("./functions/startWebPreviewRemoteSession");
 const startServeSimMetrics_1 = require("./functions/startServeSimMetrics");
+const startSandbox_1 = require("./functions/startSandbox");
 const collectServeSimMetrics_1 = require("./functions/collectServeSimMetrics");
 const uploadArtifact_1 = require("./functions/uploadArtifact");
 const uploadDeviceRunSessionScreenRecordings_1 = require("./functions/uploadDeviceRunSessionScreenRecordings");
@@ -106,6 +107,7 @@ function getEasFunctions(ctx) {
         (0, uploadDeviceRunSessionScreenRecordings_1.createUploadDeviceRunSessionScreenRecordingsBuildFunction)(ctx),
         (0, startWebPreviewRemoteSession_1.createStartWebPreviewRemoteSessionBuildFunction)(ctx),
         (0, startServeSimMetrics_1.createStartServeSimMetricsBuildFunction)(),
+        (0, startSandbox_1.createStartSandboxBuildFunction)(ctx),
         (0, collectServeSimMetrics_1.createCollectServeSimMetricsBuildFunction)(ctx),
         (0, installMaestro_1.createInstallMaestroBuildFunction)(),
         (0, installPods_1.createInstallPodsBuildFunction)(),

package/dist/steps/functions/startIosSimulator.js

@@ -7,6 +7,8 @@ exports.createStartIosSimulatorBuildFunction = createStartIosSimulatorBuildFunct
 const steps_1 = require("@expo/steps");
 const turtle_spawn_1 = __importDefault(require("@expo/turtle-spawn"));
 const lodash_1 = require("lodash");
+const localEgress_1 = require("../utils/localEgress");
+const localEgressGuard_1 = require("../utils/localEgressGuard");
 const IosSimulatorUtils_1 = require("../../utils/IosSimulatorUtils");
 function createStartIosSimulatorBuildFunction() {
     return new steps_1.BuildFunction({
@@ -61,9 +63,10 @@ function createStartIosSimulatorBuildFunction() {
                     env,
                 });
             }
-            const { udid } = await IosSimulatorUtils_1.IosSimulatorUtils.startAsync({
+            const udid = await bootWithLocalEgressAsync({
                 deviceIdentifier: originalDeviceIdentifier,
                 env,
+                logger,
             });
             try {
                 await IosSimulatorUtils_1.IosSimulatorUtils.disableApsdAsync({ udid, env });
@@ -97,9 +100,10 @@ function createStartIosSimulatorBuildFunction() {
                             env,
                         });
                     }
-                    const { udid: cloneUdid } = await IosSimulatorUtils_1.IosSimulatorUtils.startAsync({
+                    const cloneUdid = await bootWithLocalEgressAsync({
                         deviceIdentifier: cloneDeviceName,
                         env,
+                        logger,
                     });
                     try {
                         await IosSimulatorUtils_1.IosSimulatorUtils.disableApsdAsync({ udid: cloneUdid, env });
@@ -118,6 +122,34 @@ function createStartIosSimulatorBuildFunction() {
         },
     });
 }
+/**
+ * Boot a device with the local egress environment in place before anything
+ * inside it starts. `simctl boot` returns once the simulator's launchd is up
+ * and before it has spawned anything else, which is the only moment at which
+ * launchd environment reaches every process of the boot. The proxy variables
+ * and the guard are set in that gap; then the boot is waited for and the
+ * guard is verified in a fresh process. Nothing here applies when no local
+ * egress session is active.
+ */
+async function bootWithLocalEgressAsync({ deviceIdentifier, env, logger, }) {
+    const udid = await IosSimulatorUtils_1.IosSimulatorUtils.resolveUdidAsync({ deviceIdentifier, env });
+    // The guard and proxy variables ride the boot itself, so launchd has them
+    // before it spawns its first process.
+    const launchdEnvironment = await (0, localEgressGuard_1.resolveLocalEgressBootEnvironmentAsync)();
+    await IosSimulatorUtils_1.IosSimulatorUtils.bootAsync({
+        deviceIdentifier: udid,
+        env,
+        launchdEnvironment: launchdEnvironment ?? {},
+    });
+    // Also set them through launchctl, for a device that was already booted.
+    const guardInstalled = await (0, localEgressGuard_1.installLocalEgressGuardAsync)({ udid, env, logger });
+    await (0, localEgress_1.configureSimulatorProxyEnvironmentAsync)({ udid, env, logger });
+    await IosSimulatorUtils_1.IosSimulatorUtils.startAsync({ deviceIdentifier: udid, env });
+    if (guardInstalled) {
+        await (0, localEgressGuard_1.verifyLocalEgressGuardAsync)({ udid, env, logger });
+    }
+    return udid;
+}
 async function findMostGenericIphoneUuidAsync({ env, }) {
     const availableSimulatorDevices = await IosSimulatorUtils_1.IosSimulatorUtils.getAvailableDevicesAsync({
         env,

package/dist/steps/functions/startLocalEgress.d.ts

@@ -2,9 +2,10 @@ import { BuildFunction } from '@expo/steps';
 /**
  * Points the device host's system HTTP(S) proxy at the EAS CLI's egress client.
  * Must run before `eas/start_ios_simulator`: the simulator reads the system proxy
- * at boot. Nothing else on the host changes, so requests from libraries that
- * bypass the system proxy are not covered; the shared session monitor reports
- * them. The shared session cleanup releases the resources started here when
+ * at boot. Once a simulator boots, `eas/start_ios_simulator` also sets proxy
+ * environment variables inside it for clients that read them (gRPC, libcurl)
+ * and installs the local egress guard, which refuses connections that ignore
+ * both. The shared session cleanup releases the resources started here when
  * the session ends, with a job finalizer as a fallback.
  */
 export declare function createStartLocalEgressBuildFunction(): BuildFunction;

package/dist/steps/functions/startLocalEgress.js

@@ -9,6 +9,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const localEgress_1 = require("../utils/localEgress");
+const localEgressGuard_1 = require("../utils/localEgressGuard");
 const remoteDeviceRunSession_1 = require("../utils/remoteDeviceRunSession");
 /**
  * The downloader and ngrok SDK do not accept an AbortSignal. Stop awaiting them
@@ -50,9 +51,10 @@ function awaitLocalEgressAcquisitionAsync(pending, signal, disposeAbandonedAsync
 /**
  * Points the device host's system HTTP(S) proxy at the EAS CLI's egress client.
  * Must run before `eas/start_ios_simulator`: the simulator reads the system proxy
- * at boot. Nothing else on the host changes, so requests from libraries that
- * bypass the system proxy are not covered; the shared session monitor reports
- * them. The shared session cleanup releases the resources started here when
+ * at boot. Once a simulator boots, `eas/start_ios_simulator` also sets proxy
+ * environment variables inside it for clients that read them (gRPC, libcurl)
+ * and installs the local egress guard, which refuses connections that ignore
+ * both. The shared session cleanup releases the resources started here when
  * the session ends, with a job finalizer as a fallback.
  */
 function createStartLocalEgressBuildFunction() {
@@ -77,6 +79,7 @@ function createStartLocalEgressBuildFunction() {
             const lifetimeSignal = (0, localEgress_1.registerLocalEgressResources)(async () => {
                 await setupFinished;
                 const results = await Promise.allSettled([
+                    Promise.resolve().then(() => (0, localEgressGuard_1.stopLocalEgressGuardRelaysAsync)(logger)),
                     Promise.resolve().then(() => tunnel?.stopAsync()),
                     Promise.resolve().then(() => server?.stopAsync()),
                 ]);
@@ -139,9 +142,10 @@ function createStartLocalEgressBuildFunction() {
                 startupSignal.throwIfAborted();
                 logger.info(`Local egress is configured on network service "${service}". HTTP(S) and WebSocket ` +
                     'requests that honor the system proxy (WebKit, URLSession and other CFNetwork clients) ' +
-                    'fail until the EAS CLI egress client connects, then exit from that machine. Requests ' +
-                    'from libraries that bypass the system proxy are not covered and exit from this worker. ' +
-                    'Connection sampling may report these bypasses, but can miss short connections and unconnected UDP traffic.');
+                    'fail until the EAS CLI egress client connects, then exit from that machine. Once the ' +
+                    'Simulator boots, proxy environment variables are set inside it for clients that read ' +
+                    'them (gRPC, libcurl), and the local egress guard is installed so that connections which ' +
+                    'ignore both are refused in the process that makes them and reported here.');
             }
             catch (error) {
                 finishSetup();

package/dist/steps/functions/startSandbox.d.ts

@@ -0,0 +1,4 @@
+import { BuildFunction } from '@expo/steps';
+import { CustomBuildContext } from '../../customBuildContext';
+export declare function createStartSandboxBuildFunction(ctx: CustomBuildContext): BuildFunction;
+export declare function markSandboxReadyAsync(ctx: CustomBuildContext, sandboxId: string, signal?: AbortSignal): Promise<void>;

package/dist/steps/functions/startSandbox.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createStartSandboxBuildFunction = createStartSandboxBuildFunction;
+exports.markSandboxReadyAsync = markSandboxReadyAsync;
+const eas_build_job_1 = require("@expo/eas-build-job");
+const steps_1 = require("@expo/steps");
+const gql_tada_1 = require("gql.tada");
+const logPhase_1 = require("../../utils/logPhase");
+const sandboxDaemon_1 = require("../utils/sandboxDaemon");
+const MARK_SANDBOX_READY_MUTATION = (0, gql_tada_1.graphql)(`
+  mutation MarkSandboxReady($sandboxId: ID!) {
+    sandbox {
+      markSandboxReady(sandboxId: $sandboxId) {
+        id
+      }
+    }
+  }
+`);
+const RECONNECT_DELAY_MS = 1_000;
+const AWAIT_SANDBOX_STEP_NAME = 'Await sandbox completion';
+function createStartSandboxBuildFunction(ctx) {
+    return new steps_1.BuildFunction({
+        namespace: 'eas',
+        id: 'start_sandbox',
+        name: 'Start sandbox daemon',
+        __metricsId: 'eas/start_sandbox',
+        inputProviders: [
+            steps_1.BuildStepInput.createProvider({
+                id: 'sandbox_id',
+                required: true,
+                allowedValueTypeName: steps_1.BuildStepInputValueTypeName.STRING,
+            }),
+        ],
+        fn: async (stepCtx, { inputs, signal }) => {
+            const sandboxToken = ctx.env.__EAS_SANDBOX_MCP_TOKEN;
+            if (!sandboxToken) {
+                throw new eas_build_job_1.SystemError('__EAS_SANDBOX_MCP_TOKEN is required to start the sandbox daemon.');
+            }
+            const mcpServerUrl = ctx.mcpServerUrl;
+            if (!mcpServerUrl) {
+                throw new eas_build_job_1.SystemError('MCP server URL is required to start the sandbox daemon.');
+            }
+            const sandboxId = String(inputs.sandbox_id.value);
+            const daemon = await (0, sandboxDaemon_1.startSandboxDaemonAsync)({
+                credential: sandboxToken,
+                serverUrl: mcpServerUrl,
+                reconnectDelayMs: RECONNECT_DELAY_MS,
+                logger: stepCtx.logger,
+                signal,
+            });
+            try {
+                await daemon.ready;
+                signal?.throwIfAborted();
+                await markSandboxReadyAsync(ctx, sandboxId, signal);
+                signal?.throwIfAborted();
+                stepCtx.logger.info('Sandbox daemon started.');
+                await (0, logPhase_1.withLogPhaseAsync)(stepCtx.logger, AWAIT_SANDBOX_STEP_NAME, async () => {
+                    await waitForCancellationAsync(signal);
+                });
+            }
+            finally {
+                await daemon.stopAsync();
+            }
+        },
+    });
+}
+async function markSandboxReadyAsync(ctx, sandboxId, signal) {
+    signal?.throwIfAborted();
+    const result = await ctx.graphqlClient
+        .mutation(MARK_SANDBOX_READY_MUTATION, { sandboxId }, signal
+        ? {
+            fetch: (input, init) => fetch(input, {
+                ...init,
+                signal: init?.signal ? AbortSignal.any([signal, init.signal]) : signal,
+            }),
+        }
+        : undefined)
+        .toPromise();
+    signal?.throwIfAborted();
+    if (result.error) {
+        throw new eas_build_job_1.SystemError(`Failed to mark sandbox ${sandboxId} as ready.`, {
+            cause: result.error,
+        });
+    }
+}
+async function waitForCancellationAsync(signal) {
+    if (signal?.aborted) {
+        return;
+    }
+    await new Promise(resolve => {
+        signal?.addEventListener('abort', () => resolve(), { once: true });
+    });
+}

package/dist/steps/utils/localEgress.d.ts

@@ -1,5 +1,6 @@
 import { bunyan } from '@expo/logger';
 import { BuildStepEnv } from '@expo/steps';
+import { type IosSimulatorUuid } from '../../utils/IosSimulatorUtils';
 import { type DetachedProcessHandle } from './remoteDeviceRunSession';
 /**
  * Local egress provides an HTTP(S) proxy through the machine running the EAS CLI.
@@ -101,6 +102,29 @@ export declare function configureSystemProxyAsync({ env, logger, port, signal, }
 }): Promise<{
     service: string;
 }>;
+export declare const LOCAL_EGRESS_NO_PROXY = "localhost,127.0.0.1,::1";
+/**
+ * Proxy environment for processes inside the simulator. CFNetwork ignores these
+ * variables and follows the system proxy, but clients with their own network
+ * stack that read them (gRPC and therefore Firestore, libcurl, Go) then send
+ * HTTP CONNECT requests to the same loopback port. Loopback is excluded so the
+ * ports forwarded for `--egress-allow` behave the same on both paths. Lowercase
+ * and uppercase forms are both set because clients differ in which they read.
+ */
+export declare function buildLocalEgressSimulatorEnvironment(port: number): Record<string, string>;
+/**
+ * Set the local egress proxy environment in a booted simulator when a local
+ * egress session is active. Returns false when local egress is not configured
+ * or the environment could not be set. Failure is a warning, not an error: the
+ * session still works, but clients that read these variables then exit from
+ * this worker instead of the egress client, which the warning spells out.
+ */
+export declare function configureSimulatorProxyEnvironmentAsync({ udid, env, logger, handoffPath, }: {
+    udid: IosSimulatorUuid;
+    env: NodeJS.ProcessEnv;
+    logger: bunyan;
+    handoffPath?: string;
+}): Promise<boolean>;
 export declare function writeLocalEgressHandoffAsync(handoff: LocalEgressHandoff, handoffPath?: string): Promise<void>;
 export declare function readLocalEgressHandoffAsync(handoffPath?: string): Promise<LocalEgressHandoff | null>;
 /** remoteConfig fields the CLI needs to start the egress client. */

package/dist/steps/utils/localEgress.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CHISEL_VERSION = exports.LOCAL_EGRESS_HANDOFF_PATH = exports.LOCAL_EGRESS_USERNAME = exports.LOCAL_EGRESS_PROXY_PORT = exports.LOCAL_EGRESS_PROXY_HOST = void 0;
+exports.LOCAL_EGRESS_NO_PROXY = exports.CHISEL_VERSION = exports.LOCAL_EGRESS_HANDOFF_PATH = exports.LOCAL_EGRESS_USERNAME = exports.LOCAL_EGRESS_PROXY_PORT = exports.LOCAL_EGRESS_PROXY_HOST = void 0;
 exports.getChiselAssetName = getChiselAssetName;
 exports.getChiselDownloadUrl = getChiselDownloadUrl;
 exports.downloadChiselAsync = downloadChiselAsync;
@@ -16,6 +16,8 @@ exports.parseNetworkServiceNameForDevice = parseNetworkServiceNameForDevice;
 exports.resolveActiveNetworkServiceNameAsync = resolveActiveNetworkServiceNameAsync;
 exports.buildNetworksetupProxyArgs = buildNetworksetupProxyArgs;
 exports.configureSystemProxyAsync = configureSystemProxyAsync;
+exports.buildLocalEgressSimulatorEnvironment = buildLocalEgressSimulatorEnvironment;
+exports.configureSimulatorProxyEnvironmentAsync = configureSimulatorProxyEnvironmentAsync;
 exports.writeLocalEgressHandoffAsync = writeLocalEgressHandoffAsync;
 exports.readLocalEgressHandoffAsync = readLocalEgressHandoffAsync;
 exports.buildEgressRemoteConfigFields = buildEgressRemoteConfigFields;
@@ -37,6 +39,7 @@ const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const promises_1 = require("node:stream/promises");
 const node_zlib_1 = __importDefault(require("node:zlib"));
+const IosSimulatorUtils_1 = require("../../utils/IosSimulatorUtils");
 const retry_1 = require("../../utils/retry");
 const remoteDeviceRunSession_1 = require("./remoteDeviceRunSession");
 /**
@@ -253,6 +256,61 @@ async function configureSystemProxyAsync({ env, logger, port, signal, }) {
     logger.info(`System proxy for "${service}" set to ${exports.LOCAL_EGRESS_PROXY_HOST}:${port}.`);
     return { service };
 }
+exports.LOCAL_EGRESS_NO_PROXY = 'localhost,127.0.0.1,::1';
+/**
+ * Proxy environment for processes inside the simulator. CFNetwork ignores these
+ * variables and follows the system proxy, but clients with their own network
+ * stack that read them (gRPC and therefore Firestore, libcurl, Go) then send
+ * HTTP CONNECT requests to the same loopback port. Loopback is excluded so the
+ * ports forwarded for `--egress-allow` behave the same on both paths. Lowercase
+ * and uppercase forms are both set because clients differ in which they read.
+ */
+function buildLocalEgressSimulatorEnvironment(port) {
+    const proxyUrl = `http://${exports.LOCAL_EGRESS_PROXY_HOST}:${port}`;
+    return {
+        http_proxy: proxyUrl,
+        https_proxy: proxyUrl,
+        HTTP_PROXY: proxyUrl,
+        HTTPS_PROXY: proxyUrl,
+        grpc_proxy: proxyUrl,
+        no_proxy: exports.LOCAL_EGRESS_NO_PROXY,
+        NO_PROXY: exports.LOCAL_EGRESS_NO_PROXY,
+    };
+}
+/**
+ * Set the local egress proxy environment in a booted simulator when a local
+ * egress session is active. Returns false when local egress is not configured
+ * or the environment could not be set. Failure is a warning, not an error: the
+ * session still works, but clients that read these variables then exit from
+ * this worker instead of the egress client, which the warning spells out.
+ */
+async function configureSimulatorProxyEnvironmentAsync({ udid, env, logger, handoffPath = exports.LOCAL_EGRESS_HANDOFF_PATH, }) {
+    let handoff;
+    try {
+        handoff = await readLocalEgressHandoffAsync(handoffPath);
+    }
+    catch (err) {
+        logger.warn({ err }, 'Local egress: could not read the local egress handoff, so proxy environment variables were ' +
+            'not set in the Simulator. Clients that read http_proxy/https_proxy (for example gRPC and ' +
+            'libcurl) will bypass local egress and exit from this worker.');
+        return false;
+    }
+    if (!handoff) {
+        return false;
+    }
+    const variables = buildLocalEgressSimulatorEnvironment(handoff.port);
+    try {
+        await IosSimulatorUtils_1.IosSimulatorUtils.setLaunchdEnvironmentAsync({ udid, env, variables });
+    }
+    catch (err) {
+        logger.warn({ err }, 'Local egress: could not set proxy environment variables in the Simulator. Clients that read ' +
+            'http_proxy/https_proxy (for example gRPC and libcurl) will bypass local egress and exit from ' +
+            'this worker. CFNetwork clients (WebKit, URLSession) still follow the system proxy.');
+        return false;
+    }
+    logger.info(`Local egress: proxy environment variables set in the Simulator (${Object.keys(variables).join(', ')}), so clients that read them, such as gRPC and libcurl, also exit from the egress client.`);
+    return true;
+}
 async function writeLocalEgressHandoffAsync(handoff, handoffPath = exports.LOCAL_EGRESS_HANDOFF_PATH) {
     await node_fs_1.default.promises.writeFile(handoffPath, JSON.stringify(handoff), {
         encoding: 'utf8',

package/dist/steps/utils/localEgressGuard.d.ts

@@ -0,0 +1,179 @@
+import { type bunyan } from '@expo/logger';
+import { type IosSimulatorUuid } from '../../utils/IosSimulatorUtils';
+/**
+ * Worker side of the local egress guard: a dylib injected into every process
+ * the simulator launches, which refuses connections that do not go to
+ * loopback (where the proxy and the `--egress-allow` forwards live) and
+ * records one event per destination per process. This module installs it
+ * through the simulator's launchd environment and relays its events into the
+ * session log. See resources/egress-guard/README.md.
+ */
+export declare const EGRESS_GUARD_LIBRARY_FILE = "egress-guard.dylib";
+export declare const EGRESS_GUARD_CHECK_FILE = "egress-guard-check";
+export declare const EGRESS_GUARD_LOG_ENV = "EAS_EGRESS_GUARD_LOG";
+export declare const EGRESS_GUARD_MODE_ENV = "EAS_EGRESS_GUARD_MODE";
+export declare const LOCAL_EGRESS_GUARD_LOG_PATH: string;
+export type EgressGuardMode = 'block' | 'log';
+export declare function buildGuardLaunchdEnvironment({ libraryPath, logPath, mode, }: {
+    libraryPath: string;
+    logPath: string;
+    mode: EgressGuardMode;
+}): Record<string, string>;
+export type GuardEvent = {
+    process: string;
+    pid: number;
+    function: string;
+    action: 'blocked' | 'logged';
+    peer: string;
+    /** Image names above the interposer, innermost first. */
+    callers: string[];
+};
+/** One tab-separated line written by the guard; see policy.h for the format. */
+export declare function parseGuardLogLine(line: string): GuardEvent | null;
+/** The packaged library, next to the compiled package like record-sim. */
+export declare function resolveEgressGuardLibraryAsync(binDir?: string): Promise<string | null>;
+/** The packaged self-check binary, built alongside the library. */
+export declare function resolveEgressGuardCheckAsync(binDir?: string): Promise<string | null>;
+/**
+ * Turns guard events into session log lines: one line the first time a
+ * process reaches a destination through a given call, counts after that, and
+ * a summary at the end.
+ */
+export declare class GuardEventRelay {
+    private readonly limit;
+    private readonly seen;
+    private readonly peers;
+    private readonly processes;
+    private blocked;
+    private logged;
+    private suppressed;
+    private logger;
+    constructor(logger: bunyan, limit?: number);
+    /**
+     * Log through a different step's logger from now on. Refusals happen for
+     * the life of the session, so they belong to the step that runs the
+     * session, not the one that booted the simulator minutes earlier.
+     */
+    setLogger(logger: bunyan): void;
+    handle(event: GuardEvent): void;
+    summary(): {
+        blocked: number;
+        logged: number;
+        distinct: number;
+        suppressed: number;
+    };
+    logSummary(): void;
+}
+/**
+ * Polls a file the simulator processes append to and delivers whole lines.
+ * Tolerates the file not existing yet, partial trailing lines, and truncation.
+ */
+export declare class GuardLogTailer {
+    private readonly path;
+    private readonly onLine;
+    private readonly intervalMs;
+    private offset;
+    private partial;
+    private timer;
+    private reading;
+    constructor({ path: filePath, onLine, intervalMs, }: {
+        path: string;
+        onLine: (line: string) => void;
+        intervalMs?: number;
+    });
+    start(): void;
+    stopAsync(): Promise<void>;
+    private readAsync;
+}
+/**
+ * The environment the simulator's launchd must have from its first process:
+ * the guard and the proxy variables. Pass it to `IosSimulatorUtils.bootAsync`,
+ * which hands it to launchd before anything is spawned; `launchctl setenv`
+ * after boot only reaches later processes. Returns null when no local egress
+ * session is active. Throws when the guard library is not packaged, since a
+ * local egress session without it would silently leak.
+ */
+export declare function resolveLocalEgressBootEnvironmentAsync({ handoffPath, libraryPath, logPath, mode, }?: {
+    handoffPath?: string;
+    /** Explicit library path, `null` for "not available"; resolved from the package when omitted. */
+    libraryPath?: string | null;
+    logPath?: string;
+    mode?: EgressGuardMode;
+}): Promise<Record<string, string> | null>;
+/**
+ * Install the guard into a simulator when a local egress session is active,
+ * and start relaying its events into the session log. Returns false when
+ * there is no local egress session. Throws when the library is not packaged
+ * or launchd could not be configured: a local egress session without the
+ * guard would silently leak, so it must not start. Only an unwritable event
+ * log is a warning, since refusals still happen and only reporting is lost.
+ *
+ * Call this as soon as `simctl boot` returns: launchd is up and nothing else
+ * has started, so every process the boot spawns inherits the guard. Verify
+ * with `verifyLocalEgressGuardAsync` once boot completes.
+ */
+export declare function installLocalEgressGuardAsync({ udid, env, logger, handoffPath, libraryPath, logPath, mode, tailIntervalMs, }: {
+    udid: IosSimulatorUuid;
+    env: NodeJS.ProcessEnv;
+    logger: bunyan;
+    handoffPath?: string;
+    /** Explicit library path, `null` for "not available"; resolved from the package when omitted. */
+    libraryPath?: string | null;
+    logPath?: string;
+    mode?: EgressGuardMode;
+    tailIntervalMs?: number;
+}): Promise<boolean>;
+export type GuardCoverage = {
+    /** Simulator processes with the guard library mapped. */
+    covered: string[];
+    /** Simulator processes without it: started before the guard was installed. */
+    uncovered: string[];
+    /** Pids behind `uncovered`, for comparing samples. */
+    uncoveredPids: number[];
+};
+/**
+ * Which simulator processes have the guard library mapped, from
+ * `ps -axo pid=,ppid=,comm=` and `lsof -nP -a -p <pids> -d txt -F pn` output.
+ * A process is covered when any of its mapped images is the guard library.
+ */
+export declare function parseGuardCoverage(psOutput: string, lsofOutput: string): GuardCoverage;
+/**
+ * A process caught between fork and exec has nothing mapped yet and looks
+ * uncovered for an instant. Two samples a moment apart separate those from
+ * processes that really run without the guard: only pids uncovered in both
+ * count, reported with the later sample's names.
+ */
+export declare function mergeGuardCoverageSamples(first: GuardCoverage, second: GuardCoverage): GuardCoverage;
+/**
+ * Measure and log guard coverage across the simulator's processes. Observation
+ * only: the uncovered set is whatever started before the guard was installed,
+ * which is nothing when installation runs right after `simctl boot`.
+ */
+export declare function reportLocalEgressGuardCoverageAsync({ env, logger, sampleIntervalMs, }: {
+    env: NodeJS.ProcessEnv;
+    logger: bunyan;
+    sampleIntervalMs?: number;
+}): Promise<GuardCoverage | null>;
+/**
+ * Run the packaged self-check inside the simulator: it must find the guard
+ * loaded in a fresh process and see it behave as `mode` says. Throws when the
+ * check binary is missing or the check fails, which fails the session.
+ */
+export declare function verifyLocalEgressGuardAsync({ udid, env, logger, mode, checkPath, }: {
+    udid: IosSimulatorUuid;
+    env: NodeJS.ProcessEnv;
+    logger: bunyan;
+    mode?: EgressGuardMode;
+    /** Explicit check binary path, `null` for "not available"; resolved from the package when omitted. */
+    checkPath?: string | null;
+}): Promise<void>;
+/**
+ * Attribute guard events to the step that runs the session from now on. The
+ * relay starts under the simulator boot step's logger; once the session step
+ * takes over, its lines should appear under that step in the job log, next
+ * to the rest of the session's output, rather than under a step that already
+ * finished.
+ */
+export declare function rebindLocalEgressGuardRelays(logger: bunyan): void;
+/** Stop relaying and write each relay's summary; called from the session cleanup. */
+export declare function stopLocalEgressGuardRelaysAsync(logger: bunyan): Promise<void>;