builds: build history, status, logs, download and cancel across providers

CLAUDE.md

@@ -43,6 +43,9 @@ go install ./cmd/builder
 ./builder ios build --profile store --submit                          # Short for: ios release (no groups)
 ./builder ios build --profile development --distribute  # Build, then print an over-the-air install link + QR code
 ./builder ios distribute [--ipa x.ipa] [--once] [--json]  # Same for an existing IPA; --cleanup removes leftovers
+./builder builds [--provider p] [--limit N] [--status running|failed|succeeded] [--json]  # Build history
+./builder builds show|logs|download|cancel <id>  # id: build ID, provider run ID or run URL; logs --failed --follow
+./builder ios cancel --provider p --run-id X     # deprecated alias of builds cancel X --provider p
 ./builder asc apps|builds|groups|testers|users                   # App Store Connect listings (--json)
 ./builder asc groups create <name> [--external]                  # also: groups delete, groups add-build
 ./builder asc testers add <email>... --group <name>              # also: testers remove, users invite
@@ -216,6 +219,7 @@ internal/
   ipa/               # Info.plist and embedded.mobileprovision reading from .ipa archives
   otainstall/        # ios distribute: over-the-air install links (manifest, QR, GitHub draft release + gist backend)
   build/             # Build coordination (snapshot + trigger + poll + download)
+  builds/            # builds: history over GitHub/Codemagic/Bitrise (Source: list, find, show, logs, download, cancel)
   signing/           # CSR generation, .p12 assembly, and Auto (portal-free provisioning on top of asc)
   snapshot/          # Working-tree snapshot as a throwaway commit on a remote ref
   workflow/          # Workflow template (embedded)
@@ -428,6 +432,21 @@ internal/
 - **QR Rendering**: `skip2/go-qrcode` at error-correction Low, Unicode half blocks (two module rows per
   line, 2-module quiet zone), light modules as `█` so it scans on a dark terminal (`--qr-invert` for light);
   `TestQRFitsATerminal` pins a representative link at 41 modules (version 6). Printed only on a TTY or `--qr`.
+- **Build History** (`internal/builds`): the providers are the source of truth, nothing is stored. A
+  `Source` per provider normalizes runs into `Build` (status queued/running/succeeded/failed/cancelled,
+  kind `ipa`/`simulator` by workflow). GitHub lists `ios-build.yml` + `ios-share.yml` runs and takes the
+  ID off the end of `display_title` (`iOS Build <id>` or `.../ios-build/<id>`); Codemagic/Bitrise list
+  the configured build/share workflows (`ci.History`) and read `BUILD_ID`/`BUILDER_PROFILE` from the
+  variables they report back, else the `<id>.ipa` artifact name. `inputs` sends `BUILDER_PROFILE` only
+  for a profile (the runner ignores it; `BUILDER_` is reserved). GitHub runs carry no inputs, so no profile.
+- **Build Refs**: `<id>` is a build ID (8 hex, searched in recent runs; an all-digit miss falls back to a
+  run ID), a run ID, or a URL whose host also picks the provider (`ProviderFromURL`). `builds cancel`
+  with a bare Codemagic/Bitrise run ID skips the lookup and calls `build.CancelRemote` directly, which
+  keeps `ios cancel --run-id` (now a deprecated alias) exactly as before.
+- **Build Logs**: a `LogStream` prints what is new per `Read`; `--follow` loops `builds.Follow`. GitHub
+  serves a job log (`/actions/jobs/{id}/logs`, 302 to storage) only once the job ends, Codemagic per
+  step (`buildActions[].logUrl`, token only to the API host), Bitrise as chunks by position, else the
+  archived raw URL. `builds download` reuses `Coordinator.DownloadArtifact` / `build.DownloadRemote`.
 - **Signing Sets As A Library**: `signing.Setup` and `signing.EnsureSecrets`
   (internal/signing/sets.go) hold the non-interactive core of `signing setup`
   and on-demand provisioning; cmd/builder keeps the prompts, the plan and the

README.md

@@ -103,6 +103,42 @@ build cannot pick a [profile](#build-profiles) per run; it applies the profile
 named by `defaultProfile`, if there is one. The simulator build takes no
 profile at all.
 
+## Build history
+
+The provider stays the source of truth: `builder builds` reads the runs Builder
+started there and shows them in one shape, whether they ran on GitHub Actions,
+Codemagic or Bitrise. Nothing is stored locally.
+
+```bash
+builder builds                          # Newest 20 builds on the default provider
+builder builds --status failed --limit 50 --json
+builder builds --provider codemagic     # Another provider's builds
+builder builds show 1a2b3c4d            # Jobs and steps, failed step and its errors, artifacts and expiry
+builder builds logs 1a2b3c4d --failed   # Only the failed jobs (GitHub) or steps (Codemagic)
+builder builds logs 1a2b3c4d --follow   # Keep printing until the build ends
+builder builds download 1a2b3c4d        # The IPA into ./dist/ (-o to change), e.g. after Ctrl-C on ios build
+builder builds cancel 1a2b3c4d
+```
+
+`<id>` is the 8-character build ID `ios build` prints, a provider run ID, or a
+run URL; a URL also picks its provider, so `--provider` is only needed for bare
+run IDs on a non-default provider. The listing covers IPA builds (`ios build`,
+kind `ipa`) and simulator sessions (`ios share`, kind `simulator`):
+
+- **GitHub**: runs of `ios-build.yml` and `ios-share.yml`; the build ID comes
+  from the run name (`iOS Build <id>`, or the tag for tag-triggered runs). Job
+  logs exist once a job has ended, so `--follow` prints step names while a job
+  runs and its log when it ends. Artifacts expire after 7 days. GitHub does not
+  report workflow inputs, so the profile column stays empty.
+- **Codemagic / Bitrise**: builds of the configured `build_workflow` and
+  `share_workflow`; the build ID and profile come from the variables Builder sent
+  (`BUILD_ID`, `BUILDER_PROFILE`), else from the IPA's name. Codemagic serves logs
+  per step; Bitrise serves one build log, so `--failed` prints all of a failed
+  build's log.
+
+`builder ios cancel --provider <name> --run-id <id>` still works and now means
+`builder builds cancel <id> --provider <name>`.
+
 ## Additional macOS Providers
 
 GitHub Actions remains the default, so existing commands continue to work. Add
@@ -215,6 +251,13 @@ builder ios build --unsigned  # Build without code signing (if signing is config
 builder ios build --provider codemagic  # Build on another provider (also: bitrise)
 builder ios build --profile production  # Build with a profile from builder.json
 
+# Build history (GitHub, Codemagic and Bitrise)
+builder builds                # Recent builds: ID, kind, profile, status, started, duration, run
+builder builds show <id>      # Jobs, steps, failure, artifacts (<id>: build ID, run ID or run URL)
+builder builds logs <id> --follow  # Logs until the build ends (--failed: failed jobs/steps only)
+builder builds download <id>  # The IPA into ./dist/
+builder builds cancel <id>    # Cancel a running build
+
 # Simulator (free, needs a MOBAI_API_KEY secret)
 builder ios share             # Try the build on a simulator in the MobAI app
 builder ios share --duration 1h  # Keep it available longer while unused
@@ -273,7 +316,7 @@ builder asc users             # Team members and whether they can test internall
 builder asc users invite dev@example.com --role DEVELOPER --first Dee --last Vee
 ```
 
-Every `release`/`upload`/`submit`/`distribute`/`asc` command takes `--json` for
+Every `release`/`upload`/`submit`/`distribute`/`asc` command, and `builds`/`builds show`, takes `--json` for
 machine-readable output and never prompts, so agents and CI jobs can drive them.
 
 ## Configuration