@limrun/api 0.31.2 → 0.31.4

package/rbe-bep.mjs

@@ -8,21 +8,55 @@
  * downloads the bytes (`--remote_download_outputs`), because the URI names the
  * output's CAS identity, not its local availability. `lim xcode rbe install`
  * reads that digest and hands it to the instance, which fetches the blob from
- * its own RBE cache and installs it — no round-trip. The printed build command
- * passes `--remote_download_outputs=minimal` to skip the (unneeded) local
- * download by default; dropping it does not affect this parser.
+ * its own RBE cache and installs it — no round-trip. The generated bazelrc sets
+ * `--remote_download_outputs=minimal` to skip the (unneeded) local download by
+ * default; overriding it (e.g. `--remote_download_outputs=toplevel` on the command
+ * line) to materialize the .ipa locally does not affect this parser.
+ *
+ * A fully-cached rebuild (0 actions executed) still emits the bytestream URI and
+ * reproduces the same digest, so the auto-install watcher can rely on this parser
+ * after a no-op or revert (e.g. `git stash`) rebuild. Verified empirically.
  */
+export class RbeBepError extends Error {
+    constructor(kind, message) {
+        super(message);
+        this.name = 'RbeBepError';
+        this.kind = kind;
+    }
+    /**
+     * True when re-reading the same (completed) BEP cannot help — the build was
+     * produced with flags the instance cache can't use (local download or a
+     * non-SHA256 digest). The watcher logs these once instead of retrying.
+     */
+    get terminal() {
+        return this.kind === 'local-only' || this.kind === 'non-sha256';
+    }
+}
 /** A SHA-256 digest is exactly 64 lowercase hex chars; the instance CAS is keyed by it. */
 const SHA256_HEX = /^[0-9a-f]{64}$/;
-/** Extracts (hash, size) from a `bytestream://…/blobs/<hash>/<size>` URI. */
+/**
+ * Extracts (digestFunction, hash, size) from a Bazel/REAPI bytestream blob URI:
+ * `bytestream://…/blobs/[<digest_function>/]<hash>/<size>`. The digest-function
+ * segment is OMITTED for functions inferable from hash length (SHA-256 among
+ * them) and PRESENT otherwise — notably BLAKE3, whose 256-bit output is also 64
+ * hex chars and so cannot be told apart from SHA-256 by length. Capturing the
+ * function lets the caller reject a non-SHA256 build (e.g. Bazel 9's BLAKE3
+ * default) with the right guidance instead of misreading the URI.
+ */
 function parseBytestreamDigest(uri) {
-    // Tolerate an optional instance-name segment before /blobs/ by anchoring on
-    // the /blobs/<hash>/<size> tail rather than a fixed segment count. The hash is
-    // left length-agnostic here (validated as SHA-256 by the caller).
-    const m = uri.match(/\/blobs\/([0-9a-f]+)\/(\d+)(?:$|\/)/);
-    if (!m || m[1] === undefined || m[2] === undefined)
+    // Anchor on the /blobs/[func/]<hash>/<size> tail (tolerating an instance-name
+    // prefix). The optional function group only matches a real function segment:
+    // for the SHA-256 form (`/blobs/<hash>/<size>`) it backtracks to absent, and
+    // for `/blobs/blake3/<hash>/<size>` the non-hex 'l'/'k' force it to be captured
+    // as the function rather than the hash.
+    const m = uri.match(/\/blobs\/(?:([a-z0-9_]+)\/)?([0-9a-fA-F]+)\/(\d+)(?:$|\/)/);
+    if (!m || m[2] === undefined || m[3] === undefined)
         return null;
-    return { hash: m[1], sizeBytes: Number(m[2]) };
+    return {
+        ...(m[1] !== undefined ? { digestFunction: m[1] } : {}),
+        hash: m[2].toLowerCase(),
+        sizeBytes: Number(m[3]),
+    };
 }
 /**
  * Canonicalizes a Bazel target label to the `//pkg:name` form BEP records.
@@ -41,14 +75,8 @@ function canonicalizeLabel(label) {
     const name = pkg.split('/').pop() ?? '';
     return name ? `${pkg}:${name}` : pkg;
 }
-/**
- * Finds the `.ipa` produced for `label` in a BEP stream and returns its CAS
- * digest. Throws a descriptive Error when the target/.ipa is absent, its output
- * was materialized locally (a `file://` URI) instead of left in CAS, or it was
- * built with a non-SHA256 digest the instance cache cannot resolve.
- */
-export function parseTopLevelIpaDigest(bepJson, label) {
-    const canonical = canonicalizeLabel(label);
+/** Parses the BEP stream into events, ignoring partial/garbled lines. */
+function parseEvents(bepJson) {
     const events = [];
     for (const line of bepJson.split('\n')) {
         const trimmed = line.trim();
@@ -61,28 +89,64 @@ export function parseTopLevelIpaDigest(bepJson, label) {
             // Ignore partial/garbled lines (BEP is flushed incrementally).
         }
     }
-    // The successful TargetComplete for the requested label (matched against the
-    // canonical //pkg:name form Bazel records, so `//App` matches `//App:App`).
-    const completed = events.find((e) => e.id?.targetCompleted?.label === canonical && e.completed?.success)
-        ?.completed;
-    if (!completed) {
-        throw new Error(`No successful build of ${label} found in the build event log. ` +
-            `Build it first with --config=limrun (e.g. \`bazelisk --digest_function=sha256 build --config=limrun ${label}\`).`);
+    return events;
+}
+/**
+ * Inspects a BEP stream for build completion. The watcher reads the BEP on every
+ * change but only acts once `complete` is true (the stream is fully flushed) and
+ * `success` is true (the build did not fail). `invocationId` lets the watcher act
+ * once per build even when consecutive builds reproduce the same .ipa digest
+ * (e.g. a `git stash` revert that rebuilds to an earlier digest).
+ */
+export function inspectBuildCompletion(bepJson) {
+    let complete = false;
+    let sawFinished = false;
+    let success = false;
+    let invocationId;
+    for (const e of parseEvents(bepJson)) {
+        if (e.started?.uuid)
+            invocationId = e.started.uuid;
+        if (e.id?.buildFinished !== undefined || e.finished !== undefined) {
+            sawFinished = true;
+            // proto3 JSON omits zero-valued scalars, so a SUCCESS exit code serializes
+            // as `{name:"SUCCESS"}` with `code` omitted — checking `code === 0` would be
+            // a dead branch. Trust overallSuccess (present=true on success, omitted on
+            // failure) and fall back to the exit code's symbolic name.
+            success = e.finished?.overallSuccess === true || e.finished?.exitCode?.name === 'SUCCESS';
+        }
+        if (e.lastMessage === true)
+            complete = true;
+    }
+    return {
+        complete,
+        success: sawFinished && success,
+        ...(invocationId !== undefined ? { invocationId } : {}),
+    };
+}
+/** Indexes namedSetOfFiles events by id for transitive fileset resolution. */
+function indexNamedSets(events) {
+    const namedSets = new Map();
+    for (const e of events) {
+        const id = e.id?.namedSet?.id;
+        if (id && e.namedSetOfFiles)
+            namedSets.set(id, e.namedSetOfFiles);
     }
+    return namedSets;
+}
+/**
+ * Resolves the top-level `.ipa` CAS digest for one successful target's
+ * `completed` event, walking its default output group's filesets transitively.
+ * Throws a typed RbeBepError when no .ipa is present, it was materialized
+ * locally (`file://`), or it carries a non-SHA256 (e.g. BLAKE3) digest.
+ */
+function resolveIpaDigest(label, completed, namedSets) {
     // Default output group -> the fileSet (namedSetOfFiles) ids holding its outputs.
     const rootFileSetIds = (completed.outputGroup ?? [])
         .filter((og) => og.name === 'default' || !og.name)
         .flatMap((og) => (og.fileSets ?? []).map((fs) => fs.id))
         .filter((id) => !!id);
     if (rootFileSetIds.length === 0) {
-        throw new Error(`Build of ${label} reported no default output files.`);
-    }
-    // Index namedSetOfFiles by id and walk transitively (sets can nest).
-    const namedSets = new Map();
-    for (const e of events) {
-        const id = e.id?.namedSet?.id;
-        if (id && e.namedSetOfFiles)
-            namedSets.set(id, e.namedSetOfFiles);
+        throw new RbeBepError('no-output', `Build of ${label} reported no default output files.`);
     }
     const seen = new Set();
     const queue = [...rootFileSetIds];
@@ -102,14 +166,20 @@ export function parseTopLevelIpaDigest(bepJson, label) {
                 continue;
             const digest = f.uri ? parseBytestreamDigest(f.uri) : null;
             if (digest) {
-                // The instance cache is keyed by SHA-256. A non-64-hex digest means the
-                // build used a different digest function (Bazel 9 defaults to BLAKE3),
-                // which the server CAS cannot resolve — surface that clearly here rather
-                // than letting it fail later as a cryptic cache miss.
-                if (!SHA256_HEX.test(digest.hash)) {
-                    throw new Error(`Built ${f.name} with a non-SHA256 digest (got ${digest.hash.length} hex chars, expected 64; ` +
-                        `likely BLAKE3 on Bazel 9). The instance cache is keyed by SHA-256 — rebuild with ` +
-                        `--digest_function=sha256, e.g. \`bazelisk --digest_function=sha256 build --config=limrun ${label}\`.`);
+                // The instance cache is keyed by SHA-256. Reject any other digest
+                // function — Bazel 9 defaults to BLAKE3, whose URI carries an explicit
+                // `blake3` function segment (and whose 64-hex hash is indistinguishable
+                // from SHA-256 by length, so the hash form alone can't catch it). Surface
+                // it here with the fix rather than letting it fail later as a cryptic
+                // server cache miss.
+                const isSha256 = digest.digestFunction === undefined ?
+                    SHA256_HEX.test(digest.hash)
+                    : digest.digestFunction === 'sha256';
+                if (!isSha256) {
+                    const got = digest.digestFunction ?? `${digest.hash.length} hex chars`;
+                    throw new RbeBepError('non-sha256', `Built ${f.name} with a non-SHA256 digest (${got}; Bazel 9 defaults to BLAKE3). The instance ` +
+                        `cache is keyed by SHA-256 — rebuild with --digest_function=sha256, e.g. ` +
+                        `\`bazelisk --digest_function=sha256 build --config=limrun ${label}\`.`);
                 }
                 return { hash: digest.hash, sizeBytes: digest.sizeBytes, ipaName: f.name };
             }
@@ -121,10 +191,29 @@ export function parseTopLevelIpaDigest(bepJson, label) {
         }
     }
     if (localOnlyIpa) {
-        throw new Error(`Found ${label}'s .ipa (${localOnlyIpa}) but it has no remote (bytestream) digest — it was ` +
+        throw new RbeBepError('local-only', `Found ${label}'s .ipa (${localOnlyIpa}) but it has no remote (bytestream) digest — it was ` +
             `built locally, not remotely executed. Ensure you built with --config=limrun so the .ipa is ` +
             `produced in the instance's cache.`);
     }
-    throw new Error(`No .ipa output found for ${label} in the build event log.`);
+    throw new RbeBepError('no-ipa', `No .ipa output found for ${label} in the build event log.`);
+}
+/**
+ * Finds the `.ipa` produced for `label` in a BEP stream and returns its CAS
+ * digest. Throws a typed RbeBepError when the target/.ipa is absent, its output
+ * was materialized locally (a `file://` URI) instead of left in CAS, or it was
+ * built with a non-SHA256 digest the instance cache cannot resolve.
+ */
+export function parseTopLevelIpaDigest(bepJson, label) {
+    const canonical = canonicalizeLabel(label);
+    const events = parseEvents(bepJson);
+    // The successful TargetComplete for the requested label (matched against the
+    // canonical //pkg:name form Bazel records, so `//App` matches `//App:App`).
+    const completed = events.find((e) => e.id?.targetCompleted?.label === canonical && e.completed?.success)
+        ?.completed;
+    if (!completed) {
+        throw new RbeBepError('no-build', `No successful build of ${label} found in the build event log. ` +
+            `Build it first with --config=limrun (e.g. \`bazelisk --digest_function=sha256 build --config=limrun ${label}\`).`);
+    }
+    return resolveIpaDigest(label, completed, indexNamedSets(events));
 }
 //# sourceMappingURL=rbe-bep.mjs.map

package/rbe-bep.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rbe-bep.mjs","sourceRoot":"","sources":["src/rbe-bep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA0BH,2FAA2F;AAC3F,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC,6EAA6E;AAC7E,SAAS,qBAAqB,CAAC,GAAW;IACxC,4EAA4E;IAC5E,+EAA+E;IAC/E,kEAAkE;IAClE,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3D,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,0EAA0E;IAC1E,+EAA+E;IAC/E,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,KAAa;IACnE,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAa,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC;QACtG,EAAE,SAAS,CAAC;IACd,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,0BAA0B,KAAK,iCAAiC;YAC9D,uGAAuG,KAAK,MAAM,CACrH,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,MAAM,cAAc,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC;SACjD,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;SACjD,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;SACvD,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,oCAAoC,CAAC,CAAC;IACzE,CAAC;IAED,qEAAqE;IACrE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC,CAAC,eAAe;YAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;IAClC,6EAA6E;IAC7E,kFAAkF;IAClF,IAAI,YAAgC,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YAClD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3D,IAAI,MAAM,EAAE,CAAC;gBACX,wEAAwE;gBACxE,uEAAuE;gBACvE,yEAAyE;gBACzE,sDAAsD;gBACtD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CACb,SAAS,CAAC,CAAC,IAAI,kCAAkC,MAAM,CAAC,IAAI,CAAC,MAAM,2BAA2B;wBAC5F,mFAAmF;wBACnF,4FAA4F,KAAK,KAAK,CACzG,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7E,CAAC;YACD,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC;QACxB,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,SAAS,KAAK,YAAY,YAAY,sDAAsD;YAC1F,6FAA6F;YAC7F,mCAAmC,CACtC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,0BAA0B,CAAC,CAAC;AAC/E,CAAC"}
+{"version":3,"file":"rbe-bep.mjs","sourceRoot":"","sources":["src/rbe-bep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA0CH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAEpC,YAAY,IAAqB,EAAE,OAAe;QAChD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC;IAClE,CAAC;CACF;AAED,2FAA2F;AAC3F,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAC5B,GAAW;IAEX,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,gFAAgF;IAChF,wCAAwC;IACxC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACjF,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO;QACL,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QACxB,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KACxB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,0EAA0E;IAC1E,+EAA+E;IAC/E,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACvB,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAC;IAChD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACxC,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACvC,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAa,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAiBD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,YAAgC,CAAC;IACrC,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI;YAAE,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACnD,IAAI,CAAC,CAAC,EAAE,EAAE,aAAa,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClE,WAAW,GAAG,IAAI,CAAC;YACnB,2EAA2E;YAC3E,6EAA6E;YAC7E,2EAA2E;YAC3E,2DAA2D;YAC3D,OAAO,GAAG,CAAC,CAAC,QAAQ,EAAE,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI;YAAE,QAAQ,GAAG,IAAI,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,QAAQ;QACR,OAAO,EAAE,WAAW,IAAI,OAAO;QAC/B,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,cAAc,CAAC,MAAkB;IACxC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoD,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC,CAAC,eAAe;YAAE,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,KAAa,EACb,SAA6C,EAC7C,SAAgE;IAEhE,iFAAiF;IACjF,MAAM,cAAc,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC;SACjD,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;SACjD,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;SACvD,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,WAAW,CAAC,WAAW,EAAE,YAAY,KAAK,oCAAoC,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC;IAClC,6EAA6E;IAC7E,kFAAkF;IAClF,IAAI,YAAgC,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YAClD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3D,IAAI,MAAM,EAAE,CAAC;gBACX,kEAAkE;gBAClE,uEAAuE;gBACvE,wEAAwE;gBACxE,0EAA0E;gBAC1E,sEAAsE;gBACtE,qBAAqB;gBACrB,MAAM,QAAQ,GACZ,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC;oBACnC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBAC9B,CAAC,CAAC,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC;gBACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC;oBACvE,MAAM,IAAI,WAAW,CACnB,YAAY,EACZ,SAAS,CAAC,CAAC,IAAI,8BAA8B,GAAG,8CAA8C;wBAC5F,0EAA0E;wBAC1E,6DAA6D,KAAK,KAAK,CAC1E,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7E,CAAC;YACD,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC;QACxB,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,WAAW,CACnB,YAAY,EACZ,SAAS,KAAK,YAAY,YAAY,sDAAsD;YAC1F,6FAA6F;YAC7F,mCAAmC,CACtC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,4BAA4B,KAAK,0BAA0B,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,KAAa;IACnE,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAEpC,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC;QACtG,EAAE,SAAS,CAAC;IACd,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CACnB,UAAU,EACV,0BAA0B,KAAK,iCAAiC;YAC9D,uGAAuG,KAAK,MAAM,CACrH,CAAC;IACJ,CAAC;IAED,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/resources/xcode-instances-helpers.d.mts

@@ -178,9 +178,9 @@ export type XcodeClient = {
     xcodebuild: (settings?: XcodeProjectConfig, options?: XcodeBuildOptions) => ExecChildProcess;
     /**
      * Attach a simulator to this xcode instance.
-     * After attaching, the latest xcodebuild build (if any) is installed on the
-     * simulator. RBE builds are not auto-installed on attach — install them
-     * explicitly with `installRbeBuildFromBep` while a simulator is attached.
+     * After attaching, the latest installable build is installed on the simulator:
+     * the latest xcodebuild build or the latest RBE build (whichever is newer),
+     * unless that build's exact digest is already on the simulator.
      */
     attachSimulator: (simulator: IosInstance | {
         apiUrl: string;

package/resources/xcode-instances-helpers.d.ts

@@ -178,9 +178,9 @@ export type XcodeClient = {
     xcodebuild: (settings?: XcodeProjectConfig, options?: XcodeBuildOptions) => ExecChildProcess;
     /**
      * Attach a simulator to this xcode instance.
-     * After attaching, the latest xcodebuild build (if any) is installed on the
-     * simulator. RBE builds are not auto-installed on attach — install them
-     * explicitly with `installRbeBuildFromBep` while a simulator is attached.
+     * After attaching, the latest installable build is installed on the simulator:
+     * the latest xcodebuild build or the latest RBE build (whichever is newer),
+     * unless that build's exact digest is already on the simulator.
      */
     attachSimulator: (simulator: IosInstance | {
         apiUrl: string;

package/src/client.ts

@@ -739,11 +739,19 @@ export class Limrun {
     return () => controller.abort();
   }
 
-  private buildBody({ options: { body, headers: rawHeaders } }: { options: FinalRequestOptions }): {
+  private buildBody({ options }: { options: FinalRequestOptions }): {
     bodyHeaders: HeadersLike;
     body: BodyInit | undefined;
   } {
+    const { body, headers: rawHeaders } = options;
     if (!body) {
+      // A resource method always passes a `body` key when its operation defines a
+      // request body, even if the caller omitted an optional body param. Keep the
+      // content-type for those, and only elide it for operations with no body at
+      // all (e.g. GET/DELETE).
+      if (body == null && 'body' in options) {
+        return this.#encoder({ body, headers: buildHeaders([rawHeaders]) });
+      }
       return { bodyHeaders: undefined, body: undefined };
     }
     const headers = buildHeaders([rawHeaders]);

package/src/index.ts

@@ -10,7 +10,7 @@ export * from './instance-client';
 export * as Ios from './ios-client';
 export { startHttpProxy, type HttpProxy, type StartHttpProxyOptions } from './http-proxy';
 export { buildSettingKeyPattern, parseBuildSettingEntries, validateBuildSettings } from './build-settings';
-export { parseTopLevelIpaDigest, type BepIpaDigest } from './rbe-bep';
+export { parseTopLevelIpaDigest, inspectBuildCompletion, RbeBepError, type BepIpaDigest } from './rbe-bep';
 export {
   exec,
   type ExecRequest,

package/src/ios-shim.ts

@@ -13,7 +13,6 @@ const FORWARDED_SIMCTL_COMMANDS = new Set([
   'privacy',
   'location',
   'status_bar',
-  'spawn',
 ]);
 
 export type IosXcrunShimServer = {

package/src/rbe-bep.ts

@@ -8,9 +8,14 @@
  * downloads the bytes (`--remote_download_outputs`), because the URI names the
  * output's CAS identity, not its local availability. `lim xcode rbe install`
  * reads that digest and hands it to the instance, which fetches the blob from
- * its own RBE cache and installs it — no round-trip. The printed build command
- * passes `--remote_download_outputs=minimal` to skip the (unneeded) local
- * download by default; dropping it does not affect this parser.
+ * its own RBE cache and installs it — no round-trip. The generated bazelrc sets
+ * `--remote_download_outputs=minimal` to skip the (unneeded) local download by
+ * default; overriding it (e.g. `--remote_download_outputs=toplevel` on the command
+ * line) to materialize the .ipa locally does not affect this parser.
+ *
+ * A fully-cached rebuild (0 actions executed) still emits the bytestream URI and
+ * reproduces the same digest, so the auto-install watcher can rely on this parser
+ * after a no-op or revert (e.g. `git stash`) rebuild. Verified empirically.
  */
 
 export type BepIpaDigest = {
@@ -26,7 +31,12 @@ type BepEvent = {
   id?: {
     targetCompleted?: { label?: string };
     namedSet?: { id?: string };
+    buildFinished?: unknown;
   };
+  started?: { uuid?: string };
+  finished?: { overallSuccess?: boolean; exitCode?: { name?: string; code?: number } };
+  /** Bazel sets this on the final BEP event once the stream is fully flushed. */
+  lastMessage?: boolean;
   completed?: {
     success?: boolean;
     outputGroup?: Array<{ name?: string; fileSets?: Array<{ id?: string }> }>;
@@ -37,17 +47,62 @@ type BepEvent = {
   };
 };
 
+/**
+ * Why a BEP could not yield an .ipa digest for a label.
+ *
+ * `terminal` failures will not resolve by re-reading the same completed BEP
+ * (the build used the wrong flags); `no-build` / `no-output` / `no-ipa` are
+ * transient while the build is still flushing and become terminal only once
+ * the build is confirmed complete. The watcher uses this to decide whether to
+ * retry the read or to log-once and give up.
+ */
+export type RbeBepErrorKind = 'no-build' | 'no-output' | 'no-ipa' | 'local-only' | 'non-sha256';
+
+export class RbeBepError extends Error {
+  readonly kind: RbeBepErrorKind;
+  constructor(kind: RbeBepErrorKind, message: string) {
+    super(message);
+    this.name = 'RbeBepError';
+    this.kind = kind;
+  }
+
+  /**
+   * True when re-reading the same (completed) BEP cannot help — the build was
+   * produced with flags the instance cache can't use (local download or a
+   * non-SHA256 digest). The watcher logs these once instead of retrying.
+   */
+  get terminal(): boolean {
+    return this.kind === 'local-only' || this.kind === 'non-sha256';
+  }
+}
+
 /** A SHA-256 digest is exactly 64 lowercase hex chars; the instance CAS is keyed by it. */
 const SHA256_HEX = /^[0-9a-f]{64}$/;
 
-/** Extracts (hash, size) from a `bytestream://…/blobs/<hash>/<size>` URI. */
-function parseBytestreamDigest(uri: string): { hash: string; sizeBytes: number } | null {
-  // Tolerate an optional instance-name segment before /blobs/ by anchoring on
-  // the /blobs/<hash>/<size> tail rather than a fixed segment count. The hash is
-  // left length-agnostic here (validated as SHA-256 by the caller).
-  const m = uri.match(/\/blobs\/([0-9a-f]+)\/(\d+)(?:$|\/)/);
-  if (!m || m[1] === undefined || m[2] === undefined) return null;
-  return { hash: m[1], sizeBytes: Number(m[2]) };
+/**
+ * Extracts (digestFunction, hash, size) from a Bazel/REAPI bytestream blob URI:
+ * `bytestream://…/blobs/[<digest_function>/]<hash>/<size>`. The digest-function
+ * segment is OMITTED for functions inferable from hash length (SHA-256 among
+ * them) and PRESENT otherwise — notably BLAKE3, whose 256-bit output is also 64
+ * hex chars and so cannot be told apart from SHA-256 by length. Capturing the
+ * function lets the caller reject a non-SHA256 build (e.g. Bazel 9's BLAKE3
+ * default) with the right guidance instead of misreading the URI.
+ */
+function parseBytestreamDigest(
+  uri: string,
+): { digestFunction?: string; hash: string; sizeBytes: number } | null {
+  // Anchor on the /blobs/[func/]<hash>/<size> tail (tolerating an instance-name
+  // prefix). The optional function group only matches a real function segment:
+  // for the SHA-256 form (`/blobs/<hash>/<size>`) it backtracks to absent, and
+  // for `/blobs/blake3/<hash>/<size>` the non-hex 'l'/'k' force it to be captured
+  // as the function rather than the hash.
+  const m = uri.match(/\/blobs\/(?:([a-z0-9_]+)\/)?([0-9a-fA-F]+)\/(\d+)(?:$|\/)/);
+  if (!m || m[2] === undefined || m[3] === undefined) return null;
+  return {
+    ...(m[1] !== undefined ? { digestFunction: m[1] } : {}),
+    hash: m[2].toLowerCase(),
+    sizeBytes: Number(m[3]),
+  };
 }
 
 /**
@@ -66,14 +121,8 @@ function canonicalizeLabel(label: string): string {
   return name ? `${pkg}:${name}` : pkg;
 }
 
-/**
- * Finds the `.ipa` produced for `label` in a BEP stream and returns its CAS
- * digest. Throws a descriptive Error when the target/.ipa is absent, its output
- * was materialized locally (a `file://` URI) instead of left in CAS, or it was
- * built with a non-SHA256 digest the instance cache cannot resolve.
- */
-export function parseTopLevelIpaDigest(bepJson: string, label: string): BepIpaDigest {
-  const canonical = canonicalizeLabel(label);
+/** Parses the BEP stream into events, ignoring partial/garbled lines. */
+function parseEvents(bepJson: string): BepEvent[] {
   const events: BepEvent[] = [];
   for (const line of bepJson.split('\n')) {
     const trimmed = line.trim();
@@ -84,32 +133,83 @@ export function parseTopLevelIpaDigest(bepJson: string, label: string): BepIpaDi
       // Ignore partial/garbled lines (BEP is flushed incrementally).
     }
   }
+  return events;
+}
 
-  // The successful TargetComplete for the requested label (matched against the
-  // canonical //pkg:name form Bazel records, so `//App` matches `//App:App`).
-  const completed = events.find((e) => e.id?.targetCompleted?.label === canonical && e.completed?.success)
-    ?.completed;
-  if (!completed) {
-    throw new Error(
-      `No successful build of ${label} found in the build event log. ` +
-        `Build it first with --config=limrun (e.g. \`bazelisk --digest_function=sha256 build --config=limrun ${label}\`).`,
-    );
+export type BepCompletion = {
+  /**
+   * True once Bazel has flushed the terminal event (`lastMessage`), so every
+   * earlier event — including the .ipa's namedSetOfFiles — is durably on disk.
+   * Gate the digest read on this, NOT on the presence of `buildFinished`:
+   * `buildFinished` is followed by `buildToolLogs` and `buildMetrics`
+   * (the `lastMessage` carrier), so it is not the last line.
+   */
+  complete: boolean;
+  /** Whether the build itself succeeded (overallSuccess / exit code 0). */
+  success: boolean;
+  /** Bazel's invocation UUID — distinguishes one build from the next. */
+  invocationId?: string;
+};
+
+/**
+ * Inspects a BEP stream for build completion. The watcher reads the BEP on every
+ * change but only acts once `complete` is true (the stream is fully flushed) and
+ * `success` is true (the build did not fail). `invocationId` lets the watcher act
+ * once per build even when consecutive builds reproduce the same .ipa digest
+ * (e.g. a `git stash` revert that rebuilds to an earlier digest).
+ */
+export function inspectBuildCompletion(bepJson: string): BepCompletion {
+  let complete = false;
+  let sawFinished = false;
+  let success = false;
+  let invocationId: string | undefined;
+  for (const e of parseEvents(bepJson)) {
+    if (e.started?.uuid) invocationId = e.started.uuid;
+    if (e.id?.buildFinished !== undefined || e.finished !== undefined) {
+      sawFinished = true;
+      // proto3 JSON omits zero-valued scalars, so a SUCCESS exit code serializes
+      // as `{name:"SUCCESS"}` with `code` omitted — checking `code === 0` would be
+      // a dead branch. Trust overallSuccess (present=true on success, omitted on
+      // failure) and fall back to the exit code's symbolic name.
+      success = e.finished?.overallSuccess === true || e.finished?.exitCode?.name === 'SUCCESS';
+    }
+    if (e.lastMessage === true) complete = true;
   }
+  return {
+    complete,
+    success: sawFinished && success,
+    ...(invocationId !== undefined ? { invocationId } : {}),
+  };
+}
 
+/** Indexes namedSetOfFiles events by id for transitive fileset resolution. */
+function indexNamedSets(events: BepEvent[]): Map<string, NonNullable<BepEvent['namedSetOfFiles']>> {
+  const namedSets = new Map<string, NonNullable<BepEvent['namedSetOfFiles']>>();
+  for (const e of events) {
+    const id = e.id?.namedSet?.id;
+    if (id && e.namedSetOfFiles) namedSets.set(id, e.namedSetOfFiles);
+  }
+  return namedSets;
+}
+
+/**
+ * Resolves the top-level `.ipa` CAS digest for one successful target's
+ * `completed` event, walking its default output group's filesets transitively.
+ * Throws a typed RbeBepError when no .ipa is present, it was materialized
+ * locally (`file://`), or it carries a non-SHA256 (e.g. BLAKE3) digest.
+ */
+function resolveIpaDigest(
+  label: string,
+  completed: NonNullable<BepEvent['completed']>,
+  namedSets: Map<string, NonNullable<BepEvent['namedSetOfFiles']>>,
+): BepIpaDigest {
   // Default output group -> the fileSet (namedSetOfFiles) ids holding its outputs.
   const rootFileSetIds = (completed.outputGroup ?? [])
     .filter((og) => og.name === 'default' || !og.name)
     .flatMap((og) => (og.fileSets ?? []).map((fs) => fs.id))
     .filter((id): id is string => !!id);
   if (rootFileSetIds.length === 0) {
-    throw new Error(`Build of ${label} reported no default output files.`);
-  }
-
-  // Index namedSetOfFiles by id and walk transitively (sets can nest).
-  const namedSets = new Map<string, NonNullable<BepEvent['namedSetOfFiles']>>();
-  for (const e of events) {
-    const id = e.id?.namedSet?.id;
-    if (id && e.namedSetOfFiles) namedSets.set(id, e.namedSetOfFiles);
+    throw new RbeBepError('no-output', `Build of ${label} reported no default output files.`);
   }
 
   const seen = new Set<string>();
@@ -127,15 +227,23 @@ export function parseTopLevelIpaDigest(bepJson: string, label: string): BepIpaDi
       if (!f.name || !f.name.endsWith('.ipa')) continue;
       const digest = f.uri ? parseBytestreamDigest(f.uri) : null;
       if (digest) {
-        // The instance cache is keyed by SHA-256. A non-64-hex digest means the
-        // build used a different digest function (Bazel 9 defaults to BLAKE3),
-        // which the server CAS cannot resolve — surface that clearly here rather
-        // than letting it fail later as a cryptic cache miss.
-        if (!SHA256_HEX.test(digest.hash)) {
-          throw new Error(
-            `Built ${f.name} with a non-SHA256 digest (got ${digest.hash.length} hex chars, expected 64; ` +
-              `likely BLAKE3 on Bazel 9). The instance cache is keyed by SHA-256 — rebuild with ` +
-              `--digest_function=sha256, e.g. \`bazelisk --digest_function=sha256 build --config=limrun ${label}\`.`,
+        // The instance cache is keyed by SHA-256. Reject any other digest
+        // function — Bazel 9 defaults to BLAKE3, whose URI carries an explicit
+        // `blake3` function segment (and whose 64-hex hash is indistinguishable
+        // from SHA-256 by length, so the hash form alone can't catch it). Surface
+        // it here with the fix rather than letting it fail later as a cryptic
+        // server cache miss.
+        const isSha256 =
+          digest.digestFunction === undefined ?
+            SHA256_HEX.test(digest.hash)
+          : digest.digestFunction === 'sha256';
+        if (!isSha256) {
+          const got = digest.digestFunction ?? `${digest.hash.length} hex chars`;
+          throw new RbeBepError(
+            'non-sha256',
+            `Built ${f.name} with a non-SHA256 digest (${got}; Bazel 9 defaults to BLAKE3). The instance ` +
+              `cache is keyed by SHA-256 — rebuild with --digest_function=sha256, e.g. ` +
+              `\`bazelisk --digest_function=sha256 build --config=limrun ${label}\`.`,
           );
         }
         return { hash: digest.hash, sizeBytes: digest.sizeBytes, ipaName: f.name };
@@ -148,11 +256,37 @@ export function parseTopLevelIpaDigest(bepJson: string, label: string): BepIpaDi
   }
 
   if (localOnlyIpa) {
-    throw new Error(
+    throw new RbeBepError(
+      'local-only',
       `Found ${label}'s .ipa (${localOnlyIpa}) but it has no remote (bytestream) digest — it was ` +
         `built locally, not remotely executed. Ensure you built with --config=limrun so the .ipa is ` +
         `produced in the instance's cache.`,
     );
   }
-  throw new Error(`No .ipa output found for ${label} in the build event log.`);
+  throw new RbeBepError('no-ipa', `No .ipa output found for ${label} in the build event log.`);
+}
+
+/**
+ * Finds the `.ipa` produced for `label` in a BEP stream and returns its CAS
+ * digest. Throws a typed RbeBepError when the target/.ipa is absent, its output
+ * was materialized locally (a `file://` URI) instead of left in CAS, or it was
+ * built with a non-SHA256 digest the instance cache cannot resolve.
+ */
+export function parseTopLevelIpaDigest(bepJson: string, label: string): BepIpaDigest {
+  const canonical = canonicalizeLabel(label);
+  const events = parseEvents(bepJson);
+
+  // The successful TargetComplete for the requested label (matched against the
+  // canonical //pkg:name form Bazel records, so `//App` matches `//App:App`).
+  const completed = events.find((e) => e.id?.targetCompleted?.label === canonical && e.completed?.success)
+    ?.completed;
+  if (!completed) {
+    throw new RbeBepError(
+      'no-build',
+      `No successful build of ${label} found in the build event log. ` +
+        `Build it first with --config=limrun (e.g. \`bazelisk --digest_function=sha256 build --config=limrun ${label}\`).`,
+    );
+  }
+
+  return resolveIpaDigest(label, completed, indexNamedSets(events));
 }

package/src/resources/xcode-instances-helpers.ts

@@ -220,9 +220,9 @@ export type XcodeClient = {
 
   /**
    * Attach a simulator to this xcode instance.
-   * After attaching, the latest xcodebuild build (if any) is installed on the
-   * simulator. RBE builds are not auto-installed on attach — install them
-   * explicitly with `installRbeBuildFromBep` while a simulator is attached.
+   * After attaching, the latest installable build is installed on the simulator:
+   * the latest xcodebuild build or the latest RBE build (whichever is newer),
+   * unless that build's exact digest is already on the simulator.
    */
   attachSimulator: (
     simulator: IosInstance | { apiUrl: string; token: string },

package/src/version.ts

@@ -1 +1 @@
-export const VERSION = '0.31.2'; // x-release-please-version
+export const VERSION = '0.31.4'; // x-release-please-version