fix(agent-worker): Expo Go QR now works — signed Daytona preview + EXPO_PACKAGER_PROXY_URL

The mobile QR was broken: expoUrlFromPreview derived the exp:// URL from the custom
token-gated preview proxy (preview.trycheatcode.com) and dropped the ?__cc_pt token,
so Expo Go hit the proxy with no credential -> 401. (V1 worked by using Daytona's
raw preview host directly.)

Fix (verified end-to-end against a live sandbox + Expo CLI source):
- Derive the deep link from Daytona's SIGNED preview URL for the Metro port (8081),
  whose token lives in the SUBDOMAIN (https://8081-<token>.daytonaproxy01.net) — no
  header/cookie needed, so Expo Go reaches it directly (curl-verified: HTTP 200,
  native manifest served). QR value = exps://8081-<token>.daytonaproxy01.net.
- Start Metro with EXPO_PACKAGER_PROXY_URL=<signed https url> so its manifest
  launchAsset/bundle URLs use that public host instead of 127.0.0.1 (Expo's own
  documented proxy override; V1's older SDK used the request Host so didn't need it).
- Applied on both the run path (startExpoDevServer) and the wake path (wakePreview
  re-mints a fresh 24h signed URL + re-sets EXPO_PACKAGER_PROXY_URL on relaunch).
- Deleted expoUrlFromPreview; added signedUrlToExpo (https->exps, http->exp);
  ProjectSandbox.getSignedPreviewUrl wraps the existing daytona-client method.

No tunnel/ngrok, no Daytona image change. Live mobile build produced
exps://8081-ynuywcwxudw6lprr.daytonaproxy01.net and its manifest launchAsset.url
host = the signed host (200), not 127.0.0.1. Gate green.

Author: iamjr15

apps/agent-worker/src/durable-objects/agent-run-app-builder.ts

@@ -20,12 +20,16 @@ import {
   appBuilderLayoutSource,
   appBuilderPageSource,
 } from "./app-builder-template";
+import { signedUrlToExpo } from "./project-sandbox-preview";
 
 export { restoreBestEffortSnapshot, snapshotAppBuilderWorkspace };
 
 const APP_BUILDER_DIR = "/workspace/app";
 const APP_BUILDER_PORT = 5173;
 const EXPO_METRO_PORT = 8081;
+// 24h is Daytona's max signed-preview TTL; the token rides in the subdomain so Expo Go needs no
+// header, and we re-mint on every dev-server (re)start so it never serves an expired manifest URL.
+const SIGNED_PREVIEW_TTL_SECONDS = 24 * 60 * 60;
 const DEFAULT_PREVIEW_HOSTNAME = "trycheatcode.com";
 const PreviewHostnameSchema = z.string().trim().min(1).max(255).default(DEFAULT_PREVIEW_HOSTNAME);
 
@@ -130,13 +134,12 @@ async function prepareTemplateWorkspace(
 async function startTemplatePreview(
   options: RunAppBuilderOptions & { mobile: boolean },
 ): Promise<{ previewUrl: string; expoUrl: string | null }> {
-  const { append, env, mobile, sandbox, setRunStage } = options;
+  const { append, env, logger, mobile, sandbox, setRunStage } = options;
   setRunStage("Starting the dev server.");
   const preview = mobile
-    ? await startExpoDevServer(env, sandbox)
-    : await startAppBuilderDevServer(env, sandbox);
-  const previewUrl = preview.previewUrl;
-  const expoUrl = mobile ? expoUrlFromPreview(preview.previewUrl) : null;
+    ? await startExpoDevServer(env, sandbox, logger)
+    : { ...(await startAppBuilderDevServer(env, sandbox)), expoUrl: null };
+  const { expoUrl, previewUrl } = preview;
   await append({
     type: "data-sandbox-status",
     data: { v: 1, status: "ready", previewUrl, ...(expoUrl ? { expoUrl } : {}) },
@@ -353,15 +356,6 @@ function repoImportError(message: string): APIError {
   });
 }
 
-export function expoUrlFromPreview(previewUrl: string): null | string {
-  const parsed = new URL(previewUrl);
-  if (parsed.hostname.endsWith(".localhost")) {
-    return null;
-  }
-  const scheme = parsed.protocol === "https:" ? "exps" : "exp";
-  return `${scheme}://${parsed.host}${parsed.pathname === "/" ? "" : parsed.pathname}`;
-}
-
 export async function warmSandbox(
   sandbox: ProjectSandboxStub,
   logger: AgentRunLogger,
@@ -409,8 +403,13 @@ function writeAppBuilderFiles(
 async function startExpoDevServer(
   env: AgentRunAppBuilderEnv,
   sandbox: ProjectSandboxStub,
-): Promise<{ previewUrl: string }> {
-  return executeStartDevServer(
+  logger: AgentRunLogger,
+): Promise<{ previewUrl: string; expoUrl: string | null }> {
+  // Mint the signed Metro URL BEFORE starting the server: Expo Go reaches the manifest via this
+  // header-free URL, and Metro must know its public host (EXPO_PACKAGER_PROXY_URL) so the manifest's
+  // launchAsset/bundle URLs point at the signed host instead of 127.0.0.1 (which Expo Go can't hit).
+  const signedUrl = await getSignedMetroUrl(sandbox, logger);
+  const preview = await executeStartDevServer(
     {
       // `--web` makes the single Metro dev server also serve the react-native-web
       // build as a real web page at `/` (iframe-renderable in the Computer panel),
@@ -431,6 +430,7 @@ async function startExpoDevServer(
       env: {
         CI: "1",
         EXPO_NO_TELEMETRY: "1",
+        ...(signedUrl ? { EXPO_PACKAGER_PROXY_URL: signedUrl } : {}),
       },
       hostname: resolvePreviewHostname(env),
       name: "app-preview",
@@ -439,6 +439,33 @@ async function startExpoDevServer(
     },
     { sandbox },
   );
+  return {
+    previewUrl: preview.previewUrl,
+    expoUrl: signedUrl ? signedUrlToExpo(signedUrl) : null,
+  };
+}
+
+// Best-effort: a Daytona-signed preview URL for the Metro port (token in the subdomain). Null when
+// the sandbox stub can't sign (older stub) or the call fails — the run still proceeds without a QR.
+async function getSignedMetroUrl(
+  sandbox: ProjectSandboxStub,
+  logger: AgentRunLogger,
+): Promise<string | null> {
+  if (!sandbox.getSignedPreviewUrl) {
+    return null;
+  }
+  try {
+    const signed = await sandbox.getSignedPreviewUrl({
+      expiresInSeconds: SIGNED_PREVIEW_TTL_SECONDS,
+      port: EXPO_METRO_PORT,
+    });
+    return signed.url;
+  } catch (error) {
+    logger.warn("expo_signed_preview_url_failed", {
+      error: error instanceof Error ? error.message : "Unknown signed preview URL error",
+    });
+    return null;
+  }
 }
 
 async function startAppBuilderDevServer(

apps/agent-worker/src/durable-objects/project-sandbox-preview.ts

@@ -57,6 +57,22 @@ export async function buildPreviewUrl(input: BuildPreviewUrlInput): Promise<Buil
   return { expiresAt: new Date(exp).toISOString(), url, token };
 }
 
+/**
+ * Turn a Daytona-signed preview URL (`https://8081-<token>.daytonaproxy01.net`) into an Expo Go
+ * deep link by swapping the scheme: `https://` → `exps://` (the daytonaproxy edge is https-only,
+ * so the secure Expo scheme is required) and `http://` → `exp://`. The token stays in the host, so
+ * Expo Go reaches the Metro manifest with no header/cookie. Keeps the full host/path/query and only
+ * trims a trailing slash (unlike the old proxy-derived helper, which dropped the token).
+ */
+export function signedUrlToExpo(url: string): string {
+  const withScheme = url.startsWith("https://")
+    ? `exps://${url.slice("https://".length)}`
+    : url.startsWith("http://")
+      ? `exp://${url.slice("http://".length)}`
+      : url;
+  return withScheme.replace(/\/+$/u, "");
+}
+
 function normalizeHostname(hostname: string): string {
   const trimmed = hostname.trim().toLowerCase();
   const withoutScheme = trimmed.includes("://") ? (trimmed.split("://")[1] ?? trimmed) : trimmed;

apps/agent-worker/src/durable-objects/project-sandbox-runtime.ts

@@ -190,6 +190,17 @@ export const ProjectWakePreviewInputSchema = z
   })
   .strict();
 
+export const ProjectSignedPreviewUrlInputSchema = z
+  .object({
+    port: z.number().int().positive().max(65_535),
+    expiresInSeconds: z
+      .number()
+      .int()
+      .positive()
+      .max(24 * 60 * 60),
+  })
+  .strict();
+
 export const ProjectCreateBackupInputSchema = z
   .object({
     dir: WorkspacePathSchema.default("/workspace"),
@@ -223,6 +234,7 @@ export type ProjectExposePortInput = z.input<typeof ProjectExposePortInputSchema
 export type ProjectCodeServerInput = z.input<typeof ProjectCodeServerInputSchema>;
 export type ProjectUnexposePortInput = z.input<typeof ProjectUnexposePortInputSchema>;
 export type ProjectWakePreviewInput = z.input<typeof ProjectWakePreviewInputSchema>;
+export type ProjectSignedPreviewUrlInput = z.input<typeof ProjectSignedPreviewUrlInputSchema>;
 
 /** Result of waking a preview: the (possibly restarted) dev-server preview URL + liveness. */
 export interface ProjectWakePreviewResult {
@@ -231,6 +243,9 @@ export interface ProjectWakePreviewResult {
   port?: number;
   url?: string;
   expiresAt?: string;
+  // exp(s):// deep link for the Expo Go QR — only present for a mobile (Metro/8081) dev server,
+  // regenerated from a fresh signed preview URL on every wake.
+  expoUrl?: string;
 }
 
 /** Current Daytona lifecycle state for the project's sandbox (webhook/status surface). */

apps/agent-worker/src/durable-objects/project-sandbox.ts

@@ -30,7 +30,7 @@ import {
   type SandboxMeteringContext,
   setSandboxQuotaPeriod,
 } from "./project-sandbox-metering";
-import { buildPreviewUrl } from "./project-sandbox-preview";
+import { buildPreviewUrl, signedUrlToExpo } from "./project-sandbox-preview";
 import { emptyConsoleSnapshot, sliceProcessLogs } from "./project-sandbox-process-logs";
 import {
   commandToShellString,
@@ -61,6 +61,8 @@ import {
   type ProjectSandboxRuntimeState,
   type ProjectSearchFilesInput,
   ProjectSearchFilesInputSchema,
+  type ProjectSignedPreviewUrlInput,
+  ProjectSignedPreviewUrlInputSchema,
   type ProjectStartProcessInput,
   ProjectStartProcessInputSchema,
   type ProjectUnexposePortInput,
@@ -103,6 +105,12 @@ const DEFAULT_IDLE_STOP_MIN = 30;
 const AUTO_ARCHIVE_MIN = 1_440; // 1 day stopped → cold storage
 const NEVER_AUTO_DELETE = -1; // the sandbox disk is the durable store
 const APP_PREVIEW_TTL_MS = 24 * 60 * 60 * 1000;
+// Daytona's signed preview URL (token in the subdomain) TTL — 24h is Daytona's max. Regenerated on
+// every mobile dev-server (re)start so Expo Go always has an unexpired, header-free manifest URL.
+const SIGNED_PREVIEW_TTL_SECONDS = 24 * 60 * 60;
+// Expo Metro dev-server port. A dev server tracked on this port is a mobile build, so its wake path
+// re-mints a signed preview URL + EXPO_PACKAGER_PROXY_URL and returns an exp(s):// deep link.
+const EXPO_METRO_PORT = 8081;
 // Upper bound for a dev server (Expo Metro / Next) to boot when waking a stopped preview.
 const PREVIEW_WAKE_TIMEOUT_MS = 90_000;
 const CODE_SERVER_PORT = 13_340;
@@ -486,6 +494,18 @@ export class ProjectSandbox extends DurableObject<ProjectSandboxEnv> {
     };
   }
 
+  // Mint a Daytona-signed preview URL for a port. Unlike the custom token-gated proxy URL, the
+  // token lives in the subdomain, so the URL is reachable with no header/cookie — used to hand
+  // Expo Go a working manifest URL and to set the Metro dev server's EXPO_PACKAGER_PROXY_URL.
+  public async getSignedPreviewUrl(
+    input: ProjectSignedPreviewUrlInput,
+  ): Promise<{ token: string; url: string }> {
+    const parsed = ProjectSignedPreviewUrlInputSchema.parse(input);
+    const id = await this.ensureSandbox();
+    const link = await this.client().getSignedPreviewUrl(id, parsed.port, parsed.expiresInSeconds);
+    return { token: link.token, url: link.url };
+  }
+
   public async exposeCodeServer(input: ProjectCodeServerInput): Promise<{
     expiresAt: string;
     port: number;
@@ -531,9 +551,12 @@ export class ProjectSandbox extends DurableObject<ProjectSandboxEnv> {
       return { running: false, state: "started" };
     }
     const port = record.port;
+    // Mobile (Metro/8081): re-mint the header-free signed URL and thread EXPO_PACKAGER_PROXY_URL
+    // into the relaunch env so Metro emits bundle/asset URLs on that host after a restart.
+    const mobile = await this.mobileExpoProxy(id, port, record);
     let running = await this.isPortAlive(id, port);
     if (!running) {
-      await this.relaunchDevServer(id, "app-preview", record);
+      await this.relaunchDevServer(id, "app-preview", mobile?.record ?? record);
       await this.waitForPort(id, port, "/", PREVIEW_WAKE_TIMEOUT_MS).catch(() => undefined);
       running = await this.isPortAlive(id, port);
     }
@@ -550,7 +573,38 @@ export class ProjectSandbox extends DurableObject<ProjectSandboxEnv> {
       secret,
       ttlMs: APP_PREVIEW_TTL_MS,
     });
-    return { expiresAt: built.expiresAt, port, running, state: "started", url: built.url };
+    return {
+      expiresAt: built.expiresAt,
+      port,
+      running,
+      state: "started",
+      url: built.url,
+      ...(mobile?.expoUrl ? { expoUrl: mobile.expoUrl } : {}),
+    };
+  }
+
+  // For a mobile Expo dev server (Metro on 8081), mint a fresh 24h signed preview URL (token in the
+  // subdomain, so Expo Go reaches it with no header), thread EXPO_PACKAGER_PROXY_URL into the
+  // relaunch env so Metro's bundle/asset URLs use that signed host, and derive the exps:// deep
+  // link. Returns null for non-mobile ports or when signing is unavailable.
+  private async mobileExpoProxy(
+    id: string,
+    port: number,
+    record: ProcessRecord,
+  ): Promise<{ expoUrl: string; record: ProcessRecord } | null> {
+    if (port !== EXPO_METRO_PORT) {
+      return null;
+    }
+    const signed = await this.client()
+      .getSignedPreviewUrl(id, port, SIGNED_PREVIEW_TTL_SECONDS)
+      .catch(() => null);
+    if (!signed) {
+      return null;
+    }
+    return {
+      expoUrl: signedUrlToExpo(signed.url),
+      record: { ...record, env: { ...record.env, EXPO_PACKAGER_PROXY_URL: signed.url } },
+    };
   }
 
   // Current Daytona lifecycle state without forcing a start — the status surface for the

apps/agent-worker/src/index.ts

@@ -58,7 +58,6 @@ import {
   withRunLocation,
 } from "./agent-routing";
 import { AgentRun } from "./durable-objects/agent-run";
-import { expoUrlFromPreview } from "./durable-objects/agent-run-app-builder";
 import { ProjectSandbox } from "./durable-objects/project-sandbox";
 import { formatAgentRouteError } from "./error-handling";
 import {
@@ -618,10 +617,10 @@ agentApp.post("/v1/threads/:threadId/sandbox/preview/wake", async (c) => {
   const sandbox = project
     ? await sandboxForProject(c.env, userId, project.id)
     : await sandboxForThread(c.env, userId, threadId);
+  // wakePreview re-mints the signed Metro URL for a mobile dev server and returns the exp(s)://
+  // deep link directly (expoUrl) — the web/local paths leave it undefined.
   const result = await sandbox.wakePreview({ hostname: resolvePreviewHostname(c.env) });
-  // exp:// deep link only makes sense for the Expo Metro port (8081); null for web/local.
-  const expoUrl = result.url && result.port === 8081 ? expoUrlFromPreview(result.url) : null;
-  return c.json(SandboxPreviewWakeSchema.parse({ ...result, ...(expoUrl ? { expoUrl } : {}) }));
+  return c.json(SandboxPreviewWakeSchema.parse(result));
 });
 
 // Current sandbox lifecycle state for the preview panel (polled while the panel is open so the

packages/tools-code/src/index.ts

@@ -125,6 +125,8 @@ export type {
   SandboxSearchFilesInput,
   SandboxSearchFilesResult,
   SandboxSearchMatch,
+  SandboxSignedPreviewUrlInput,
+  SandboxSignedPreviewUrlResult,
   SandboxStartProcessInput,
   SandboxStatus,
   SandboxTerminalInput,

packages/tools-code/src/runtime.ts

@@ -169,6 +169,21 @@ export interface SandboxUnexposePortInput {
   port: number;
 }
 
+export interface SandboxSignedPreviewUrlInput {
+  port: number;
+  expiresInSeconds: number;
+}
+
+/**
+ * A Daytona-signed preview URL whose access token is encoded in the subdomain
+ * (`https://<port>-<token>.daytonaproxy01.net`), so it needs no header/cookie — the form
+ * Expo Go can reach for exp(s):// deep links and `EXPO_PACKAGER_PROXY_URL`.
+ */
+export interface SandboxSignedPreviewUrlResult {
+  url: string;
+  token: string;
+}
+
 export interface SandboxBackupHandle {
   id: string;
   dir: string;
@@ -197,6 +212,7 @@ export interface SandboxLike {
   ensureReady?(): Promise<SandboxStatus>;
   exec?(input: SandboxExecInput): Promise<SandboxExecResult>;
   exposePort?(input: SandboxExposePortInput): Promise<SandboxExposePortResult>;
+  getSignedPreviewUrl?(input: SandboxSignedPreviewUrlInput): Promise<SandboxSignedPreviewUrlResult>;
   killAllProcesses?(): Promise<number>;
   killProcess?(input: SandboxKillProcessInput): Promise<SandboxKillProcessResult>;
   listFiles?(input: SandboxListFilesInput): Promise<SandboxListFilesResult>;