feat(ios): support explicit iOS simulator keychain reset (#2345)

* feat(ios): support explicit iOS simulator keychain reset

`settings clear-app-state` never touched keychain-backed credentials
(e.g. Firebase auth), so a customer's fresh-install reset via the CLI
left an app signed in when their in-app reset button did not (#2282).

simctl exposes no per-app keychain reset, only a whole-simulator one
(`simctl keychain <device> reset`), so this ships as a separate,
explicit `settings reset-keychain clear` command rather than folding
it into `clear-app-state` — callers opt in knowing the scope is the
whole simulator, not just the app under test.

Split the pre-existing `apps.test.ts` and `snapshot-handler.test.ts`
suites along the `app-settings.ts`/`snapshot-settings.ts` modules they
actually mirror, since both were already over the test-file-size
tripwire and could not grow further.

* fix(ios): reject extra reset-keychain arguments and add live-tested keychain fixture

settings reset-keychain clear <extra-arg> silently dropped the extra
argument in both the CLI reader and the direct-daemon parser, so a
caller expecting per-app scoping could get a whole-simulator wipe
without any signal something was off. Reject it instead in both
places, with tests proving no settings mutation happens.

Also add a small keychain-backed "auth" fixture to the test-app's
automation lab (expo-secure-store) so the settings reset-keychain
guarantee has a real regression surface: authenticate, verify the
credential survives clear-app-state and a plain relaunch, then verify
reset-keychain actually clears it. Validated live against a disposable
iOS simulator.

* fix(ci): stop a bare gradle.properties append from corrupting the last line

expo prebuild's generated android/gradle.properties has no trailing
newline, so `echo "org.gradle.jvmargs=-Xmx4g" >> gradle.properties`
appended directly onto its last line instead of a new one, producing
expo.inlineModules.watchedDirectories=[]org.gradle.jvmargs=-Xmx4g.
Gradle's JSON.parse of that property then fails at configure time,
before any real compilation runs -- the exact "Process 'command
'node'' finished with non-zero exit value 1" failure this branch hit
on Android Release and the Smoke Tests fixture-app fallback build.

This was a dormant bug: the Android build-cache job only runs on a
fingerprint miss, and no PR had changed the test-app's native
dependencies in a while. Adding expo-secure-store (#2282's keychain
fixture) was enough to trigger it. Reproduced locally against a clean
install with the exact CI script, confirmed the corrupted property,
and confirmed the printf-based fix builds cleanly (870/870 tasks).

Author: thymikee

.github/actions/setup-fixture-app/action.yml

@@ -172,7 +172,10 @@ runs:
       run: |
         set -euo pipefail
         pnpm --dir examples/test-app exec expo prebuild --platform android --no-install
-        echo "org.gradle.jvmargs=-Xmx4g" >> examples/test-app/android/gradle.properties
+        # expo prebuild's generated gradle.properties has no trailing newline, so a bare
+        # `echo >>` corrupts its last line (e.g. `expo.inlineModules.watchedDirectories=[]org.gradle.jvmargs=...`),
+        # which fails Gradle's JSON.parse of that property at configure time. Lead with a newline.
+        printf '\n%s\n' 'org.gradle.jvmargs=-Xmx4g' >> examples/test-app/android/gradle.properties
         (
           cd examples/test-app/android
           ./gradlew :app:assembleRelease

.github/workflows/test-app-build-cache.yml

@@ -188,7 +188,10 @@ jobs:
         run: |
           set -euo pipefail
           pnpm --dir examples/test-app exec expo prebuild --platform android --no-install
-          echo "org.gradle.jvmargs=-Xmx4g" >> examples/test-app/android/gradle.properties
+          # expo prebuild's generated gradle.properties has no trailing newline, so a bare
+          # `echo >>` corrupts its last line (e.g. `expo.inlineModules.watchedDirectories=[]org.gradle.jvmargs=...`),
+          # which fails Gradle's JSON.parse of that property at configure time. Lead with a newline.
+          printf '\n%s\n' 'org.gradle.jvmargs=-Xmx4g' >> examples/test-app/android/gradle.properties
           (
             cd examples/test-app/android
             ./gradlew :app:assembleRelease

examples/test-app/app.config.js

@@ -20,6 +20,7 @@ module.exports = {
     buildCacheProvider: { plugin: 'expo-build-disk-cache' },
     plugins: [
       'expo-router',
+      'expo-secure-store',
       [
         'expo-audio',
         {

examples/test-app/package.json

@@ -20,6 +20,7 @@
     "expo-linking": "56.0.14",
     "expo-modules-core": "56.0.17",
     "expo-router": "~56.2.11",
+    "expo-secure-store": "~56.0.4",
     "expo-status-bar": "~56.0.4",
     "react": "19.2.3",
     "react-dom": "19.2.3",

examples/test-app/pnpm-lock.yaml

@@ -14,10 +14,17 @@ import {
 } from 'react-native';
 import { getRecordingPermissionsAsync, requestRecordingPermissionsAsync } from 'expo-audio';
 import { requireOptionalNativeModule } from 'expo-modules-core';
+import * as SecureStore from 'expo-secure-store';
 
 import { ActionButton, ScreenTitle, SectionCard } from '../components';
 import { useAppColors, type AppColors } from '../theme';
 
+// A fixed key/value pair standing in for a real login token: this screen only
+// needs to prove keychain-backed state survives `clear-app-state` but not
+// `reset-keychain`, not to model an actual auth flow.
+const KEYCHAIN_AUTH_KEY = 'automation-keychain-auth-token';
+const KEYCHAIN_AUTH_VALUE = 'demo-auth-token';
+
 type PushBroadcastLabModule = {
   lastPushBroadcast(): string;
 };
@@ -45,6 +52,7 @@ export function AutomationLabScreen(props: {
   const [microphonePermission, setMicrophonePermission] = useState('checking');
   const [lastPushBroadcast, setLastPushBroadcast] = useState('none');
   const [sheetVisible, setSheetVisible] = useState(false);
+  const [keychainAuthStatus, setKeychainAuthStatus] = useState('checking');
   const permissionReadGeneration = useRef(0);
   const windowMode = dimensions.width > dimensions.height ? 'landscape' : 'portrait';
 
@@ -125,6 +133,26 @@ export function AutomationLabScreen(props: {
     setLastPushBroadcast(pushBroadcastLab?.lastPushBroadcast() ?? 'unavailable');
   }
 
+  useEffect(() => {
+    let mounted = true;
+    void SecureStore.getItemAsync(KEYCHAIN_AUTH_KEY)
+      .then((value) => {
+        if (mounted)
+          setKeychainAuthStatus(value === KEYCHAIN_AUTH_VALUE ? 'signed-in' : 'signed-out');
+      })
+      .catch(() => {
+        if (mounted) setKeychainAuthStatus('error');
+      });
+    return () => {
+      mounted = false;
+    };
+  }, []);
+
+  async function signInWithKeychain() {
+    await SecureStore.setItemAsync(KEYCHAIN_AUTH_KEY, KEYCHAIN_AUTH_VALUE);
+    setKeychainAuthStatus('signed-in');
+  }
+
   return (
     <ScrollView contentContainerStyle={styles.content} showsVerticalScrollIndicator={false}>
       <ScreenTitle
@@ -235,6 +263,19 @@ export function AutomationLabScreen(props: {
         />
       </SectionCard>
 
+      <SectionCard title="Keychain-backed auth">
+        <ActionButton
+          label="Sign in (write keychain)"
+          onPress={() => void signInWithKeychain()}
+          testID="automation-keychain-signin"
+        />
+        <StateRow
+          label="Auth status"
+          testID="automation-keychain-status"
+          value={keychainAuthStatus}
+        />
+      </SectionCard>
+
       <SectionCard title="Android push broadcast">
         <ActionButton
           kind="secondary"

examples/test-app/src/screens/AutomationLabScreen.tsx

@@ -26,6 +26,10 @@ export type SettingsUpdateOptions =
       state: 'clear';
       app?: string;
     })
+  | (DeviceCommandBaseOptions & {
+      setting: 'reset-keychain';
+      state: 'clear';
+    })
   | (DeviceCommandBaseOptions & {
       setting: 'wifi' | 'airplane' | 'location';
       state: 'on' | 'off';

packages/contracts/src/client-settings.ts

@@ -45,6 +45,7 @@ const SETTINGS_FACEID_USAGE = 'faceid <match|nonmatch|enroll|unenroll>';
 const SETTINGS_TOUCHID_USAGE = 'touchid <match|nonmatch|enroll|unenroll>';
 const SETTINGS_FINGERPRINT_USAGE = 'fingerprint <match|nonmatch>';
 const SETTINGS_CLEAR_APP_STATE_USAGE = 'clear-app-state [app-id]';
+const SETTINGS_RESET_KEYCHAIN_USAGE = 'reset-keychain clear';
 const SETTINGS_PERMISSION_USAGE =
   'permission <grant|deny|reset> <camera|microphone|photos|contacts|contacts-limited|notifications|calendar|location|location-always|media-library|motion|reminders|siri> [full|limited]';
 const SETTINGS_MACOS_PERMISSION_USAGE =
@@ -60,11 +61,12 @@ export const SETTINGS_USAGE_OVERRIDE = [
   `settings ${SETTINGS_TOUCHID_USAGE}`,
   `settings ${SETTINGS_FINGERPRINT_USAGE}`,
   `settings ${SETTINGS_CLEAR_APP_STATE_USAGE}`,
+  `settings ${SETTINGS_RESET_KEYCHAIN_USAGE}`,
   `settings ${SETTINGS_PERMISSION_USAGE}`,
   `settings ${SETTINGS_MACOS_PERMISSION_USAGE}`,
 ].join(' | ');
 
-export const SETTINGS_INVALID_ARGS_MESSAGE = `settings requires ${SETTINGS_WIFI_USAGE}, ${SETTINGS_LOCATION_SET_USAGE}, ${SETTINGS_ANIMATIONS_USAGE}, ${SETTINGS_APPEARANCE_USAGE}, ${SETTINGS_FACEID_USAGE}, ${SETTINGS_TOUCHID_USAGE}, ${SETTINGS_FINGERPRINT_USAGE}, ${SETTINGS_CLEAR_APP_STATE_USAGE}, ${SETTINGS_PERMISSION_USAGE}, or ${SETTINGS_MACOS_PERMISSION_USAGE}`;
+export const SETTINGS_INVALID_ARGS_MESSAGE = `settings requires ${SETTINGS_WIFI_USAGE}, ${SETTINGS_LOCATION_SET_USAGE}, ${SETTINGS_ANIMATIONS_USAGE}, ${SETTINGS_APPEARANCE_USAGE}, ${SETTINGS_FACEID_USAGE}, ${SETTINGS_TOUCHID_USAGE}, ${SETTINGS_FINGERPRINT_USAGE}, ${SETTINGS_CLEAR_APP_STATE_USAGE}, ${SETTINGS_RESET_KEYCHAIN_USAGE}, ${SETTINGS_PERMISSION_USAGE}, or ${SETTINGS_MACOS_PERMISSION_USAGE}`;
 
 export function isMacOsSettingSupported(setting: string): boolean {
   const normalized = setting.trim().toLowerCase();