[build-tools] Forward network capture through local egress

[gwdp]

Why

Keep captured iOS Simulator traffic flowing through the local egress proxy.

How

Pass the existing handoff's loopback address to serve-sim's --network-capture-proxy. Explicit overrides, including none, win; Android skips this handoff. Redact authenticated proxy URLs from process logs. This layer follows all four startup migrations so capture and the egress guard are composed at boot.

Test Plan

• CI pending.
• Codex ran the host and launch-argument suites on this layer (147 tests), plus TypeScript, changed-file lint and formatting.

Earlier integration validation

Earlier local launch E2E used Universe-generated steps through build-tools download/install/start to serve-sim on a real iOS Simulator, checking one app start, launch arguments and the deep link. Combined capture/egress also passed on Tart. Those runs used loopback cloud adapters and pinned local builds/devices; they are earlier-head evidence, not hosted EAS/API-to-worker acceptance or a new run on this extracted head.

Authorship and LLM use

Gabe wrote the initial session implementation, directed the AI-assisted iterations and approved this smaller split. Codex extracted the capture forwarding and restacked it after the startup migrations, then ran the checks above. Claude and Devin reviewed the earlier combined work; human review of this extracted diff is pending.

[gwdp]

Codex contribution: extracted the local-egress capture handoff from #4544 under Gabe’s approved split. The production change is 12 lines; it uses the existing handoff port, preserves explicit overrides and Android isolation, and redacts authenticated proxy URLs. All 38 host tests, build-tools typecheck, changed-file lint and formatting passed. No new device run is claimed for this extracted head; human review is pending.

— Codex

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.16%. Comparing base (875a7e9) to head (810a391).

Additional details and impacted files

@@                        Coverage Diff                        @@
##           gwdp/serve-sim-appium-startup    #4598      +/-   ##
=================================================================
+ Coverage                          74.16%   74.16%   +0.01%     
=================================================================
  Files                               1016     1016              
  Lines                              49778    49784       +6     
  Branches                           10780    10785       +5     
=================================================================
+ Hits                               36912    36918       +6     
  Misses                             11874    11874              
  Partials                             992      992              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

✅ Thank you for adding the changelog entry!

[gwdp]

I restacked the capture proxy forwarding after all four iOS startup migrations. Gabe directed the implementation and split. Two Claude Opus reviews checked the reordered layer boundaries; no introduced production defect was found. Focused tests and type checks passed for each layer, and the combined focused run passed 387 tests. The unchanged log-recorder timing tests flaked under full-suite load and passed isolated reruns. Current-head CI and hosted acceptance are separate and remain pending.

— Codex