feat(server): EAS Simulator device hosts#21844

Configured EAS hosts now appear in the device hub. Opening the host's iPhone starts an EAS Simulator session, waits until it runs, and shows the simulator like any other device. Powering it off stops the session; closing the panel without powering off leaves it running until its idle limit.

Cost bounds. Sessions bill the Expo account until they stop, so a started session is always tracked or stopped:

• every session is created with the host's run and idle limits, and the host refuses to start past its session limit;
• each session is recorded by its unique name, atomically, before Expo is asked to create it; a start whose record cannot be written does not happen, and an unreadable record is an error rather than an empty one;
• a start runs in the host, so a client that disconnects while a session boots leaves it running and tracked; creating it runs uninterrupted, and the stop for a failed or interrupted start is in place before anything can interrupt it;
• the host knows every session it owns: starts in progress, tracked sessions, and sessions whose stop failed (including the stop after a failed start). They count against the limit, as does a create Expo did not answer or answered with a server error, until a sweep finds the session or Expo would have listed it by now (5 minutes), and every record a previous server left, until a sweep whose listing succeeded has looked for it. A create Expo refused frees the slot once a sweep shows Expo did not list its session anyway, and keeps its record, marked refused, for the reaper in case the refusal was misread; a restart does not count such a record. A record three hours old stops counting against the limit whatever its listing says, so an app that is gone cannot hold the host; since Expo's longest session runs 115 minutes from when it is ready, and being ready can wait on Expo's queue, the record itself stays until a listing of its app confirms the session is not running, or for a day. A session whose stop keeps failing is let go once its status says Expo ended it. Saving the host in Settings replaces its instance; one whose scope has closed neither sweeps nor writes the record, so it cannot stop its replacement's session, and closing waits for a record write already in flight so it cannot overwrite the replacement's record either. A listing sweeps before anything starts, and one sweep runs at a time. Without a credential a start says how to sign in before anything else, and a record Expo would have listed by now stops counting on the next listing even though no sweep can look. A session whose stop failed is retried by the next listing and let go once Expo reports it ended; the refusal at the cap says what is still being cleaned up. One failed status poll during a start is retried rather than ending it;
• stopping or closing the host (device support off, host changed or removed, server stopping) interrupts starts in progress, waits for them to stop their sessions, and stops tracked ones;
• recorded sessions the host does not own are found by name and stopped at start and while listing, including ones a crashed server left behind; a recorded session Expo does not list yet is kept until Expo must have ended it;
• sessions started elsewhere on the account are never touched.

EAS project. Sessions run under the host's EAS project, or the one found in the thread's project, so the MCP tool and the device.open RPC pass the thread's workspace (threadWorkspaceRoot).

Per-session endpoints. Each session has its own serve-sim preview host and agent-device daemon:

• Every EAS simulator reports the same UDID, so a running EAS device's id is its Expo session id. DeviceHostReady.upstream lets a host route proxied requests itself: the proxy sends stream, input and WebRTC signalling to the right session with that session's token, as a Bearer header or WebSocket subprotocol, and swaps the session id for the UDID serve-sim knows. The token never reaches clients.
• DeviceOperations.agentEndpoint gives per-device agent config files and the id agent-device selects the device by (the UDID). device_open checks agent access first, opens the device, then targets the opened device, whose daemon only exists once its session runs.
• Hosts that end devices themselves (endsDevices) drop sessions on devices they stop listing; local and SSH hosts keep theirs through a listing that misses a device.

Also: device host errors name the host by its label instead of its id; a host without an Expo credential is still ready, and opening a device says how to sign in; and the client opens each device per thread in its own command lane, so a long EAS start no longer holds up powering off another device, turning device support off, or another thread's start.

Device settings stay unavailable on EAS devices: they run simctl on the simulator's machine, which EAS does not expose.

Part of built-in EAS Simulator support (stack #21847). Layer 5 of 6.

Testing:

• EAS host tests, against a fake Expo API and preview host:
  • a bounded session start, the device listed by its session id, and the agent endpoint with the UDID;
  • two concurrent sessions with the same UDID told apart, listed, routed and stopped separately;
  • proxied requests rewritten with the session token and UDID, a malformed path escape answered 404, and serve-emu refused;
  • an interrupted open leaving a tracked session that closing the host stops;
  • stopping the host while a session is still starting stops it without waiting for it to be ready;
  • the periodic sweep leaving a start in progress, and its record, alone;
  • a failed stop keeping the session counted until a retry succeeds, also after a failed start (listed when it was running);
  • an unwritable record refusing the start before anything is created;
  • stopping on close, refusing past the limit, stopping only recorded sessions found by name (keeping a fresh unlisted record, forgetting an expired one), holding the slot for a create whose outcome is unknown until the clock frees it, holding it when the failed create's session is listed but its stop fails, holding it for a record a previous server left until the sweep stops its session (a fresh unlisted one until the clock frees it), holding it while the listing that would find it fails, freeing the slot of one Expo has ended by now while its listing keeps failing but keeping its record until a listing confirms (a day-old one is forgotten), letting go of a stopping session Expo ended although its stop keeps failing, keeping a refused create's record without counting it after a restart, keeping an old record whose session is listed but cannot be stopped, leaving a replacement's session alone once the host's own scope has closed (also from a listing already in flight), waiting for a record write in flight before the scope closes, stopping the session a refused create made anyway, and asking for a project before creating anything.
• Device service: sessions on a device the host stops listing are dropped only for hosts that end devices; labelled error messages.
• MCP test: the quick start targets the id agent-device knows, not T3's device id.
• Live checks against Expo: sessions started, streamed over WebRTC, driven, and stopped through this host on a Mac, following the handoff note on #21846.

Done with Claude Opus 5.5 in Claude Code, running in T3 Code.

🤖 Generated with Claude Code