fix(ios): reject extra reset-keychain arguments and add live-tested keychain fixture

settings reset-keychain clear <extra-arg> silently dropped the extra
argument in both the CLI reader and the direct-daemon parser, so a
caller expecting per-app scoping could get a whole-simulator wipe
without any signal something was off. Reject it instead in both
places, with tests proving no settings mutation happens.

Also add a small keychain-backed "auth" fixture to the test-app's
automation lab (expo-secure-store) so the settings reset-keychain
guarantee has a real regression surface: authenticate, verify the
credential survives clear-app-state and a plain relaunch, then verify
reset-keychain actually clears it. Validated live against a disposable
iOS simulator.

Author: thymikee

examples/test-app/app.config.js

@@ -20,6 +20,7 @@ module.exports = {
     buildCacheProvider: { plugin: 'expo-build-disk-cache' },
     plugins: [
       'expo-router',
+      'expo-secure-store',
       [
         'expo-audio',
         {

examples/test-app/package.json

@@ -20,6 +20,7 @@
     "expo-linking": "56.0.14",
     "expo-modules-core": "56.0.17",
     "expo-router": "~56.2.11",
+    "expo-secure-store": "~56.0.4",
     "expo-status-bar": "~56.0.4",
     "react": "19.2.3",
     "react-dom": "19.2.3",

examples/test-app/pnpm-lock.yaml

@@ -14,10 +14,17 @@ import {
 } from 'react-native';
 import { getRecordingPermissionsAsync, requestRecordingPermissionsAsync } from 'expo-audio';
 import { requireOptionalNativeModule } from 'expo-modules-core';
+import * as SecureStore from 'expo-secure-store';
 
 import { ActionButton, ScreenTitle, SectionCard } from '../components';
 import { useAppColors, type AppColors } from '../theme';
 
+// A fixed key/value pair standing in for a real login token: this screen only
+// needs to prove keychain-backed state survives `clear-app-state` but not
+// `reset-keychain`, not to model an actual auth flow.
+const KEYCHAIN_AUTH_KEY = 'automation-keychain-auth-token';
+const KEYCHAIN_AUTH_VALUE = 'demo-auth-token';
+
 type PushBroadcastLabModule = {
   lastPushBroadcast(): string;
 };
@@ -45,6 +52,7 @@ export function AutomationLabScreen(props: {
   const [microphonePermission, setMicrophonePermission] = useState('checking');
   const [lastPushBroadcast, setLastPushBroadcast] = useState('none');
   const [sheetVisible, setSheetVisible] = useState(false);
+  const [keychainAuthStatus, setKeychainAuthStatus] = useState('checking');
   const permissionReadGeneration = useRef(0);
   const windowMode = dimensions.width > dimensions.height ? 'landscape' : 'portrait';
 
@@ -125,6 +133,26 @@ export function AutomationLabScreen(props: {
     setLastPushBroadcast(pushBroadcastLab?.lastPushBroadcast() ?? 'unavailable');
   }
 
+  useEffect(() => {
+    let mounted = true;
+    void SecureStore.getItemAsync(KEYCHAIN_AUTH_KEY)
+      .then((value) => {
+        if (mounted)
+          setKeychainAuthStatus(value === KEYCHAIN_AUTH_VALUE ? 'signed-in' : 'signed-out');
+      })
+      .catch(() => {
+        if (mounted) setKeychainAuthStatus('error');
+      });
+    return () => {
+      mounted = false;
+    };
+  }, []);
+
+  async function signInWithKeychain() {
+    await SecureStore.setItemAsync(KEYCHAIN_AUTH_KEY, KEYCHAIN_AUTH_VALUE);
+    setKeychainAuthStatus('signed-in');
+  }
+
   return (
     <ScrollView contentContainerStyle={styles.content} showsVerticalScrollIndicator={false}>
       <ScreenTitle
@@ -235,6 +263,19 @@ export function AutomationLabScreen(props: {
         />
       </SectionCard>
 
+      <SectionCard title="Keychain-backed auth">
+        <ActionButton
+          label="Sign in (write keychain)"
+          onPress={() => void signInWithKeychain()}
+          testID="automation-keychain-signin"
+        />
+        <StateRow
+          label="Auth status"
+          testID="automation-keychain-status"
+          value={keychainAuthStatus}
+        />
+      </SectionCard>
+
       <SectionCard title="Android push broadcast">
         <ActionButton
           kind="secondary"

examples/test-app/src/screens/AutomationLabScreen.tsx

@@ -205,3 +205,17 @@ test('settings grammar owns positional parsing for CLI commands', () => {
   assert.equal(resetKeychain.setting, 'reset-keychain');
   assert.equal(resetKeychain.state, 'clear');
 });
+
+test('settings reset-keychain rejects an extra app argument instead of dropping it', () => {
+  assert.throws(
+    () =>
+      readInputFromCli('settings', ['reset-keychain', 'clear', 'com.example.app'], {
+        ...BASE_FLAGS,
+        platform: 'ios',
+      }),
+    (err: any) => {
+      assert.equal(err.code, 'INVALID_ARGS');
+      return true;
+    },
+  );
+});

src/__tests__/cli-grammar.test.ts

@@ -107,7 +107,7 @@ function readSettingsOptionsFromPositionals(
     const app = state === 'clear' ? positionals[2] : state;
     return { ...base, setting, state: 'clear', app };
   }
-  if (setting === 'reset-keychain' && state === 'clear') {
+  if (setting === 'reset-keychain' && state === 'clear' && positionals.length === 2) {
     return { ...base, setting, state };
   }
   throw new AppError('INVALID_ARGS', 'Invalid settings arguments.');

src/commands/capture/settings.ts

@@ -158,6 +158,27 @@ test('settings reset-keychain dispatches without an app id or active app session
   });
 });
 
+test('settings reset-keychain rejects an extra app argument instead of dropping it', async () => {
+  const sessionStore = makeSessionStore();
+  const sessionName = 'ios-reset-keychain-extra-arg';
+  sessionStore.set(sessionName, makeSession(sessionName, iosSimulatorDevice));
+
+  const response = await handleSnapshotCommands({
+    req: snapshotRequest(sessionName, 'settings', {
+      positionals: ['reset-keychain', 'clear', 'com.example.app'],
+    }),
+    sessionName,
+    logPath: '/tmp/daemon.log',
+    sessionStore,
+  });
+
+  expect(response?.ok).toBe(false);
+  if (response?.ok === false) {
+    expect(response.error.code).toBe('INVALID_ARGS');
+  }
+  expect(fixtureSettingsMutations).toHaveLength(0);
+});
+
 test('settings usage hint documents canonical faceid states', async () => {
   const sessionStore = makeSessionStore();
   const response = await handleSnapshotCommands({

src/daemon/handlers/__tests__/snapshot-settings-handler.test.ts

@@ -64,7 +64,10 @@ export function parseSettingsArgs(
     !setting ||
     !state ||
     (setting === 'permission' && !permissionTarget) ||
-    (setting === 'location' && state === 'set' && (!req.positionals?.[2] || !req.positionals?.[3]))
+    (setting === 'location' &&
+      state === 'set' &&
+      (!req.positionals?.[2] || !req.positionals?.[3])) ||
+    (setting === 'reset-keychain' && req.positionals?.[2] !== undefined)
   ) {
     return errorResponse('INVALID_ARGS', SETTINGS_INVALID_ARGS_MESSAGE);
   }