[cruzdanilo]

Before: the native e2e apps can only sign in through the injected browser wallet. The iOS simulator build has no team id and claims webcredentials:localhost, and the Android emulator has no credential provider, so neither can create or use a passkey.

After: on iOS and Android, e2e:local first signs up with a real passkey, confirmed with Maestro's biometrics (Face ID on iOS, an enrolled fingerprint on Android). It then logs out and signs back in with that passkey before the existing flows run. Both apps talk to the local stack at https://sandbox.exactly.app. The whole flow passes on both platforms in EAS run 01a15f50.

How:

• The e2e server also serves HTTPS on 443 as APP_DOMAIN, using a self-signed P-256 leaf (ported from ✅ e2e: run webauthn flow over https #1447). Both e2e jobs point sandbox.exactly.app at the runner and trust the leaf. iOS checks webcredentials through Apple's CDN and Android checks asset links through Google's API, so the deployed sandbox AASA and assetlinks.json still vouch for the apps.
• The sandbox domain also selects Panda's real sandbox key in common/pandaCertificate.ts, which the e2e server's mock can't decrypt, so card details answered 555. Both e2e jobs set EXPO_PUBLIC_PANDA_PUBLIC_KEY to the e2e key.
• One Maestro subflow, passkey.yaml, runs first on both platforms. Platform steps cover the iOS sheet buttons ("Add Passkey", "Use Passkey").
• iOS: the job adds a hosts entry and trusts the leaf with simctl keychain add-root-cert. The app builds from the e2e:production profile, with APP_DOMAIN=sandbox.exactly.app and APPLE_TEAM_ID=665NDX7LBZ as job env, since build jobs ignore job env for keys the profile sets. app.config.ts reads ios.appleTeamId from env. Release fingerprints match main on both platforms; only the iOS e2e fingerprint moves, to 041b44f2, with its own fingerprint job.
• iOS: fresh builds fail on EAS's Xcode 27.1 image until 💚 app: raise ios deployment targets #1429, as they already do on main, so the e2e reuses build 966f34d0, which matches 041b44f2. An app built with the iOS 27 SDK doesn't launch on the iOS 27 simulator ("UIScene life cycle is required", Apple TN3187), so the job runs on the macos-tahoe-26.5-xcode-26.6 image.
• Android: the job runs an API 35 emulator with -gpu swangle and uses Google's MyVault sample (android/identity-samples) as the credential provider, built from a pinned commit and cached (vault). A background step sets PIN 1111 and enrolls a fingerprint through Settings (fingerprint.yaml) while the vault apk, the build download and repack run, so enrollment adds no time to the flow. The job forwards 443 with adb reverse and bind-mounts the leaf and a hosts entry into the conscrypt store and /system/etc/hosts through nsenter. The app keeps the e2e:local build; repack bundles the sandbox domain.
• Android 15 shows a clipboard overlay over the copy-address sheet's Close button for 6s after copying; the flow dismisses it with one tap outside it.

Latency against main (run 01a15f50 vs d1c02b9): fingerprint enrollment adds nothing, since it finishes before the device prep step. The passkey sign-up and sign-in add 41s to the iOS flow and 37s to the Android flow. The Android flow is also about 16s slower across the other flows, from the API 35 emulator and the clipboard tap.

---

Generated by Claude Code

Summary by CodeRabbit

• Tests
  • Added automated passkey sign-in coverage, including account creation, biometric matching, logout, and reauthentication.
  • Added Android fingerprint enrollment and biometric authentication flows.
  • Added Android clipboard verification after copying an account address.
  • Expanded cross-platform end-to-end coverage for passkeys, fingerprints, Face ID, and local HTTPS connections.
  • Improved local Android and iOS testing against sandbox environments, including secure certificate handling and device setup.

[changeset-bot]

🦋 Changeset detected

Latest commit: d06e2cd

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 8949b15
• Latest commit, not reviewed: d06e2cd

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 801136d1-429b-4275-81ac-072235202e8f

📥 Commits

Reviewing files that changed from the base of the PR and between 091186c and 8949b15.

⛔ Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 4

• .eas/workflows/local.yaml
• server/package.json
• server/test/e2e.ts
• server/vitest.config.mts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Walkthrough

The local E2E setup serves non-localhost domains over HTTPS. Android and iOS workflows use sandbox settings and configure certificate trust. Maestro coverage adds passkey and biometric flows.

Changes

Local E2E coverage

Layer / File(s)	Summary
HTTPS E2E server setup .changeset/secure-otters-serve.md, server/package.json, server/vitest.config.mts, server/test/e2e.ts	The E2E configuration sets the application domain and stack. For non-localhost domains, the test generates a self-signed certificate and serves the app over HTTPS. Teardown closes the conditional server.
Android workflow and Maestro coverage .eas/workflows/local.yaml, .maestro/package.json, .maestro/flows/local.yaml, .maestro/subflows/*	The Android workflow provisions an Android 35 emulator, enrolls fingerprints, installs the app and MyVault, configures HTTPS trust, and uploads WebAuthn coverage. Maestro adds passkey, biometric, fingerprint, and clipboard steps.
iOS build and simulator setup app.config.ts, .eas/workflows/local.yaml	The iOS workflow uses the configured Apple team ID and sandbox settings, builds with the e2e:production profile, maps the sandbox domain to localhost, trusts its TLS certificate, and uploads WebAuthn coverage.

Priority: ⚪ Pending latest changes

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Other

Suggested reviewers: aguxez, mainqueg

Sequence Diagram(s)

sequenceDiagram
  participant EASWorkflow
  participant AndroidEmulator
  participant SandboxServer
  participant Maestro
  EASWorkflow->>AndroidEmulator: Provision emulator and prepare fingerprint
  EASWorkflow->>SandboxServer: Retrieve TLS certificate
  EASWorkflow->>AndroidEmulator: Install app, MyVault, and trusted certificate
  Maestro->>AndroidEmulator: Run passkey and biometric flows

Loading

Merge Risk: 🟡 Moderate · up to 8949b

A second local passkey run can fail if the previous signed-in session persists. Reset app state before account creation to make the flow reliably repeatable. Android E2E coverage remains configured.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the main change: adding end-to-end sign-up and sign-in coverage with native passkeys.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 74bed3dc-3fc0-4251-9271-7d72e53351be

📥 Commits

Reviewing files that changed from the base of the PR and between 4d1f843 and a2f161d.

⛔ Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 9

• .changeset/secure-otters-serve.md
• .eas/workflows/local.yaml
• .maestro/flows/local.yaml
• .maestro/subflows/matchBiometrics.yaml
• .maestro/subflows/passkey.yaml
• app.config.ts
• server/package.json
• server/test/e2e.ts
• server/vitest.config.mts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T23:54:02.987138Z	d06e2cd	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4a771d5229

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cruzdanilo]

eas android_e2e is red from main, not from this pr:

• repay.yaml amount 13: 9e85526's tap fixed by ⏪️ e2e: revert repay amount tap on android #1509 (79395c4); credit passes on 1a4b292.
• assertHome.yaml tapOn: View all (onboarding): scrollTo stopped with "Latest activity" at the bottom edge, behind the floating tab bar fixed by ✅ e2e: lift latest activity above tab bar #1510 (8fa4453).

[edit: both fixed in main. eas run 01a1603f-6465 on a585237 (main 17260bf) passed ios_e2e and android_e2e.]

---

Generated by Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6ec866250a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cruzdanilo]

test is red from the clock, not from this pr: @exactly/server:generate:broadcasts fails in server/test/anvil.ts on forge script test/mocks/BobExecute.s.sol with Disagreement(). its skip(10 minutes) pushes the repay past the 00:00 utc maturity, so any setup started between 23:50 and 00:00 fails. main 88a8dc5 failed the same step at 23:50:47 (run 39695704004), this run at 23:54:32. main 88a8dc5's own test job fails the same step; main c9ce4f3 was green. a fix to the seeding is in progress; i re-run test after 00:00.

---

Generated by Claude Code