Physical device runs: CODE_SIGN_STYLE stays Automatic when AGENT_DEVICE_IOS_PROVISIONING_PROFILE is set, so xcodebuild always fails

[michaelowenmeijer]

Version: agent-device 0.20.10, macOS, physical iPhone runs.

What happens

agent-device help physical-device says: "If Xcode cannot choose a profile, set AGENT_DEVICE_IOS_PROVISIONING_PROFILE to the profile name/specifier."

Following that advice makes the runner build fail every time. In dist/src/physical-device-control.js the signing overrides are:

let s=[`CODE_SIGN_STYLE=Automatic`];
if(i) s.push(`DEVELOPMENT_TEAM=${i}`);
if(a) s.push(`CODE_SIGN_IDENTITY=${a}`);
if(o) s.push(`PROVISIONING_PROFILE_SPECIFIER=${o}`);

CODE_SIGN_STYLE is always Automatic. Setting AGENT_DEVICE_IOS_PROVISIONING_PROFILE adds PROVISIONING_PROFILE_SPECIFIER next to it, and xcodebuild rejects that combination with "has conflicting provisioning settings". The help text and the code contradict each other: the documented escape hatch cannot work.

Expected

When a profile specifier is provided, switch the style to manual:

let s=[`CODE_SIGN_STYLE=${o ? "Manual" : "Automatic"}`];

cargo-mobile2, Expo, Tauri and Godot all flip to manual signing when a specifier is present, each after hitting this same xcodebuild error.

Related limitation

On a Mac without an Apple ID session in the Xcode GUI, automatic signing fails with "No Accounts", and there is no way to reach cloud signing through the tool: no env var for extra xcodebuild arguments, and no support for -authenticationKeyPath. Support for passing App Store Connect API key flags would make physical-device runs work on headless CI Macs. Happy to file that as a separate feature request if you prefer.

Our current workaround is a scoped xcodebuild shim that appends the auth flags to the runner build. It works, but the one-line style fix above would make it unnecessary for the common case.

[thymikee]

Confirmed against current source: resolveRunnerSigningBuildSettings always emits CODE_SIGN_STYLE=Automatic, then appends PROVISIONING_PROFILE_SPECIFIER when AGENT_DEVICE_IOS_PROVISIONING_PROFILE is set; the current regression test explicitly preserves that contradictory combination. The documented profile override therefore cannot perform the manual-signing escape hatch it promises.

Triaged as bug + ready-for-agent. The bounded fix should switch device runner signing to Manual only when a profile specifier is present, update the owning signing tests, and keep simulator/macOS behavior unchanged. App Store Connect API-key forwarding is a separate feature surface and should be filed separately rather than widening this bug fix.