fix(ios): harden beta release prep

apps/ios/fastlane/Fastfile

@@ -143,6 +143,11 @@ def resolve_beta_build_number(api_key:, version:)
   next_build.to_s
 end
 
+def beta_build_number_needs_asc_auth?
+  explicit = ENV["IOS_BETA_BUILD_NUMBER"]
+  !env_present?(explicit)
+end
+
 def prepare_beta_release!(version:, build_number:)
   script_path = File.join(repo_root, "scripts", "ios-beta-prepare.sh")
   UI.message("Preparing iOS beta release #{version} (build #{build_number}).")
@@ -235,8 +240,10 @@ platform :ios do
     api_key
   end
 
-  private_lane :prepare_beta_context do
-    api_key = asc_api_key
+  private_lane :prepare_beta_context do |options|
+    require_api_key = options[:require_api_key] == true
+    needs_api_key = require_api_key || beta_build_number_needs_asc_auth?
+    api_key = needs_api_key ? asc_api_key : nil
     version = read_root_package_version
     build_number = resolve_beta_build_number(api_key: api_key, version: version)
     beta_xcconfig = prepare_beta_release!(version: version, build_number: build_number)
@@ -252,7 +259,7 @@ platform :ios do
 
   desc "Build a beta archive locally without uploading"
   lane :beta_archive do
-    context = prepare_beta_context
+    context = prepare_beta_context(require_api_key: false)
     build = build_beta_release(context)
     UI.success("Built iOS beta archive: version=#{build[:version]} short=#{build[:short_version]} build=#{build[:build_number]}")
     build
@@ -262,7 +269,7 @@ platform :ios do
 
   desc "Build + upload a beta to TestFlight"
   lane :beta do
-    context = prepare_beta_context
+    context = prepare_beta_context(require_api_key: true)
     build = build_beta_release(context)
 
     upload_to_testflight(

scripts/ios-beta-prepare.sh

@@ -15,6 +15,7 @@ EOF
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 IOS_DIR="${ROOT_DIR}/apps/ios"
+BUILD_DIR="${IOS_DIR}/build"
 BETA_XCCONFIG="${IOS_DIR}/build/BetaRelease.xcconfig"
 TEAM_HELPER="${ROOT_DIR}/scripts/ios-team-id.sh"
 VERSION_HELPER="${ROOT_DIR}/scripts/ios-write-version-xcconfig.sh"
@@ -23,6 +24,29 @@ BUILD_NUMBER=""
 TEAM_ID="${IOS_DEVELOPMENT_TEAM:-}"
 PACKAGE_VERSION="$(cd "${ROOT_DIR}" && node -p "require('./package.json').version" 2>/dev/null || true)"
 
+prepare_build_dir() {
+  if [[ -L "${BUILD_DIR}" ]]; then
+    echo "Refusing to use symlinked build directory: ${BUILD_DIR}" >&2
+    exit 1
+  fi
+
+  mkdir -p "${BUILD_DIR}"
+}
+
+write_generated_file() {
+  local output_path="$1"
+  local tmp_file=""
+
+  if [[ -e "${output_path}" && -L "${output_path}" ]]; then
+    echo "Refusing to overwrite symlinked file: ${output_path}" >&2
+    exit 1
+  fi
+
+  tmp_file="$(mktemp "${output_path}.XXXXXX")"
+  cat >"${tmp_file}"
+  mv -f "${tmp_file}" "${output_path}"
+}
+
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --)
@@ -58,13 +82,18 @@ if [[ -z "${TEAM_ID}" ]]; then
   TEAM_ID="$(IOS_ALLOW_KEYCHAIN_TEAM_FALLBACK=1 bash "${TEAM_HELPER}")"
 fi
 
-mkdir -p "${IOS_DIR}/build"
+if [[ -z "${TEAM_ID}" ]]; then
+  echo "Could not resolve Apple Team ID. Set IOS_DEVELOPMENT_TEAM or sign into Xcode." >&2
+  exit 1
+fi
+
+prepare_build_dir
 
 (
   bash "${VERSION_HELPER}" --build-number "${BUILD_NUMBER}"
 )
 
-cat >"${BETA_XCCONFIG}" <<EOF
+write_generated_file "${BETA_XCCONFIG}" <<EOF
 // Auto-generated by scripts/ios-beta-prepare.sh.
 // Local beta-release override; do not commit.
 OPENCLAW_CODE_SIGN_STYLE = Automatic

scripts/ios-write-version-xcconfig.sh

@@ -15,10 +15,34 @@ EOF
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 IOS_DIR="${ROOT_DIR}/apps/ios"
+BUILD_DIR="${IOS_DIR}/build"
 VERSION_XCCONFIG="${IOS_DIR}/build/Version.xcconfig"
 PACKAGE_VERSION="$(cd "${ROOT_DIR}" && node -p "require('./package.json').version" 2>/dev/null || true)"
 BUILD_NUMBER=""
 
+prepare_build_dir() {
+  if [[ -L "${BUILD_DIR}" ]]; then
+    echo "Refusing to use symlinked build directory: ${BUILD_DIR}" >&2
+    exit 1
+  fi
+
+  mkdir -p "${BUILD_DIR}"
+}
+
+write_generated_file() {
+  local output_path="$1"
+  local tmp_file=""
+
+  if [[ -e "${output_path}" && -L "${output_path}" ]]; then
+    echo "Refusing to overwrite symlinked file: ${output_path}" >&2
+    exit 1
+  fi
+
+  tmp_file="$(mktemp "${output_path}.XXXXXX")"
+  cat >"${tmp_file}"
+  mv -f "${tmp_file}" "${output_path}"
+}
+
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --)
@@ -62,9 +86,9 @@ if [[ ! "${BUILD_NUMBER}" =~ ^[0-9]+$ ]]; then
   exit 1
 fi
 
-mkdir -p "${IOS_DIR}/build"
+prepare_build_dir
 
-cat >"${VERSION_XCCONFIG}" <<EOF
+write_generated_file "${VERSION_XCCONFIG}" <<EOF
 // Auto-generated by scripts/ios-write-version-xcconfig.sh.
 // Local version override; do not commit.
 OPENCLAW_GATEWAY_VERSION = ${PACKAGE_VERSION}