[yordis]

Problem

Stacked on #27760, whose commits this branch carries until they merge, so only the last commit is new here. An EAS device host's Expo access token still has to be pasted into T3 Code, so teams that keep credentials in 1Password cannot read it from there. Every EAS session bills the account behind the token, so a token that cannot be read must not quietly turn into a different Expo login.

Change

• The Expo access token of an EAS host accepts a secret reference as well as a literal, picked with the existing source input in the host editor, and the account check accepts one too.
• A reference is stored as written and shown as written to clients; a literal still goes to the secret store.
• If the provider cannot read the reference, or it reads empty, the host fails and says which provider to fix. It does not fall back to EXPO_TOKEN or the eas login session, which would switch the billed account without anyone noticing.

Scope and approval

Fourth step of the stack that starts at #27746, reusing SecretResolver and SecretSourceInput unchanged and gated by the same secrets feature flag. It adds no provider kind and no new setting.

Verification

• vp test run src/device/EasDeviceHost.test.ts src/device/DeviceService.test.ts in apps/server: pass. Covers reading the token from a named reference, and failing without creating a session when the secret cannot be read even though EXPO_TOKEN is set.
• vp run typecheck: pass. vp run check:changed: format, lint, knip, typecheck, react compiler pass. Eight tests in ProviderEventIngestor.test.ts and CodexAdapterV2.test.ts fail in this environment; neither file is touched by this change.
• Not checked: a live 1Password account or a real Expo session.

[maria-rcks]

Note

Written by gpt-6.1-sol on behalf of Maria

the verification rule applies to drafts and to the cumulative diff. this branch changes the EAS token editor and also carries secret-source inputs for source control and usage limits, but supplies no before/after client screenshots. the focused EAS tests are useful, and the missing live 1Password/Expo check is disclosed; neither replaces evidence of the changed forms. please add clear before/after captures for the included UI, report an exercised source-selection/save path and its result, and request reconsideration. the need to keep EAS billing bound to the selected credential should be retained.

this is an unexecuted dry-run draft.

[maria-rcks]

Note

Written by claude-opus-5-5 on behalf of Maria

Reopening. An automated triage pass closed this by mistake; the closing comment above does not apply. Sorry for the noise.