feat: cds v9

[haoruikun-cb]

What changed? Why?

Root cause (required for bugfixes)

UI changes

iOS Old	iOS New
old screenshot	new screenshot

Android Old	Android New
old screenshot	new screenshot

Web Old	Web New
old screenshot	new screenshot

Testing

How has it been tested?

• Unit tests
• Interaction tests
• Pseudo State tests
• Manual - Web
• Manual - Android (Emulator / Device)
• Manual - iOS (Emulator / Device)

Testing instructions

Illustrations/Icons Checklist

Required if this PR changes files under packages/illustrations/** or packages/icons/**

• verified visreg changes with Terran (include link to visreg run/approval)
• all illustration/icons names have been reviewed by Dom and/or Terran

Change management

type=routine
risk=low
impact=sev5

automerge=false

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 1 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1
CODEOWNERS	🟡 See below

🟡 CODEOWNERS

Code Owner	Status	Calculation
ui-systems-eng-team	🟡 0/1	Denominator calculation Additional CODEOWNERS Requirement Show calculation Sum 0 0 From CODEOWNERS 1 Sum 1

[github-actions]

https://percy.io/d424b72f/web/cds-mobile-visreg-03c97426/builds/48232167

In general, to fix this type of problem you should stop constructing a single shell command string with interpolated environment or path values and instead pass the command and its arguments separately (for example, using execFileSync or spawn with an argument array). This prevents the shell from re‑parsing the path value and interpreting special characters.

For this specific code, the best fix with minimal behavioral changes is:

• Replace the execSync call on line 138 that uses a backticked string with a call to spawn (already imported) or execFileSync-style usage where:
  • The command is "zip".
  • The arguments are ['-u', apk, 'assets/index.android.bundle'].
  • cwd remains patchDir, and stdio: 'inherit' is preserved.
  • We ensure the process exits successfully, otherwise we throw an error to mimic execSync’s behavior.

Because spawn is already imported at the top, we can create a small helper in this file (or inline logic) to run zip synchronously and check its exit code. Since we must not assume other project utilities beyond what we see, we’ll add a small runZipUpdate helper function within this file, just above applyBundle, which uses spawn to execute zip with an argument array and returns a promise that rejects on non‑zero exit. We then await it from applyBundle. This preserves functionality while removing the shell command construction.

No other lines need to change, and no new imports are required.

In general, the fix is to avoid building a single shell command string that includes environment- or configuration-derived paths, and instead execute the program directly with an argument array so that the shell is not invoked and the arguments are not reinterpreted. For Node.js, this means using execFileSync (or spawn/spawnSync) with a command name and an array of arguments, rather than execSync with a combined string.

Concretely in AndroidBuilder.mjs, we should:

• Import execFileSync from node:child_process.
• Replace the three execSync calls in applyBundle with execFileSync (or spawnSync) using argument arrays:
  • zip -u ${apk} assets/index.android.bundle → execFileSync('zip', ['-u', apk, 'assets/index.android.bundle'], { cwd: patchDir, stdio: 'inherit' }).
  • zipalign -f 4 ${apk} ${alignedApk} → execFileSync('zipalign', ['-f', '4', apk, alignedApk], { stdio: 'inherit' }).
  • apksigner sign --ks ${debugKeystore} --ks-pass pass:android --key-pass pass:android ${apk} → execFileSync('apksigner', ['sign', '--ks', debugKeystore, '--ks-pass', 'pass:android', '--key-pass', 'pass:android', apk], { stdio: 'inherit' }).

These changes keep the behavior identical (same commands, same working directory, same stdio handling) while ensuring environment-derived paths are passed as raw arguments rather than interpolated into a shell command string.

In general, to fix this class of problem you should avoid constructing a single shell command string with interpolated environment-derived values. Instead, call the command with its arguments specified separately so that Node bypasses the shell and passes arguments directly to the executable. For child_process.execSync, that means switching to execFileSync (or using spawn/spawnSync) with an argument array; each path (like apk and debugKeystore) then becomes a separate element in that array and is not subject to shell parsing.

For this specific code, the safest change that preserves behavior is:

• Replace the execSync invocation at lines 145–148 with a call to execFileSync('apksigner', [...args...], { stdio: 'inherit' }).
• Build the argument list as an array: ['sign', '--ks', debugKeystore, '--ks-pass', 'pass:android', '--key-pass', 'pass:android', apk].
• Import execFileSync from node:child_process alongside the existing imports so it is available.
• Leave the rest of the method unchanged; we are not altering options, flags, or logging, just how the command is invoked.

Concretely:

• In apps/test-expo/scripts/utils/AndroidBuilder.mjs, update the import on line 1 from import { execSync, spawn } from 'node:child_process'; to also import execFileSync.
• Replace the execSync call for apksigner (lines 145–148) with a corresponding execFileSync call using an argument array, keeping stdio: 'inherit' in the options.

No other regions or files need changes to fix this particular alert.