feat(cli): import existing service account JSON in Android build init

cli/package.json

@@ -71,6 +71,7 @@
     "test:upload": "bun test/test-upload-validation.mjs",
     "test:credentials": "bun test/test-credentials.mjs",
     "test:credentials-validation": "bun test/test-credentials-validation.mjs",
+    "test:android-service-account-validation": "bun test/test-android-service-account-validation.mjs",
     "test:build-zip-filter": "bun test/test-build-zip-filter.mjs",
     "test:checksum": "bun test/test-checksum-algorithm.mjs",
     "test:build-needed": "bun test/test-build-needed.mjs",
@@ -93,7 +94,7 @@
     "test:macos-signing": "bun test/test-macos-signing.mjs",
     "test:apple-api-import-helpers": "bun test/test-apple-api-import-helpers.mjs",
     "test:manifest-path-encoding": "bun test/test-manifest-path-encoding.mjs",
-    "test": "bun run build && bun run test:version-detection:setup && bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:credentials && bun run test:credentials-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:posthog-exception && bun run test:build-platform-selection && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-app-conflict && bun run test:init-guardrails && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:version-detection && bun run test:platform-paths && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:apple-api-import-helpers && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:ai-render-markdown",
+    "test": "bun run build && bun run test:version-detection:setup && bun run test:bundle && bun run test:functional && bun run test:semver && bun run test:version-edge-cases && bun run test:regex && bun run test:upload && bun run test:credentials && bun run test:credentials-validation && bun run test:android-service-account-validation && bun run test:build-zip-filter && bun run test:checksum && bun run test:build-needed && bun run test:ci-prompts && bun run test:ci-secrets && bun run test:posthog-exception && bun run test:build-platform-selection && bun run test:onboarding-recovery && bun run test:onboarding-progress && bun run test:onboarding-run-targets && bun run test:run-device-command && bun run test:init-app-conflict && bun run test:init-guardrails && bun run test:prompt-preferences && bun run test:esm-sdk && bun run test:mcp && bun run test:version-detection && bun run test:platform-paths && bun run test:payload-split && bun run test:manifest-path-encoding && bun run test:macos-signing && bun run test:apple-api-import-helpers && bun run test:ai-log-capture && bun run test:ai-analyze-flow && bun run test:ai-render-markdown",
     "test:build-platform-selection": "bun test/test-build-platform-selection.mjs",
     "test:ai-log-capture": "bun test/test-ai-log-capture.mjs",
     "test:ai-analyze-flow": "bun test/test-ai-analyze-flow.mjs",

cli/src/build/onboarding/android/progress.ts

@@ -141,7 +141,37 @@ export function getAndroidResumeStep(progress: AndroidOnboardingProgress | null)
   if (!keystoreFullyValid(progress))
     return keystoreResumeStep(progress)
 
-  // Phase 2 — Google sign-in: marker + refresh token. We need the refresh
+  // Phase 2 — Service-account fork. Routes onto the import path or the OAuth
+  // path. Legacy progress files don't have `serviceAccountMethod` — treat
+  // those as OAuth (existing behavior) so in-flight onboardings continue
+  // along the path they started on.
+  if (progress.serviceAccountMethod === 'existing') {
+    // Phase 2a — Import existing SA JSON.
+    //
+    // `_serviceAccountKeyBase64` is set once we accept the JSON (either
+    // validation passed or the user picked "save anyway"). After that point
+    // routing is identical to the OAuth path's tail: `saving-credentials`.
+    if (progress._serviceAccountKeyBase64)
+      return 'saving-credentials'
+
+    // Package name confirmation is the first step inside the import path.
+    if (!completedSteps.androidPackageChosen)
+      return 'android-package-select'
+
+    // We have a package but no accepted SA yet. If the user already picked a
+    // file, jump back to validation; otherwise back to file selection.
+    if (progress.serviceAccountJsonPath)
+      return 'sa-json-validating'
+    return 'sa-json-existing-path'
+  }
+
+  // Backward compatibility: legacy progress files (created before the
+  // service-account fork existed) never set `serviceAccountMethod`. Per the
+  // design contract those resume into the OAuth path they were already on —
+  // we must NOT route them to the new fork screen and force them to re-pick
+  // mid-flow. Only routes through the fork explicitly set the method.
+
+  // Phase 2b — Google sign-in: marker + refresh token. We need the refresh
   // token to mint access tokens for the rest of the flow on subsequent
   // resumes; if it's missing we must re-auth.
   if (!completedSteps.googleSignInComplete || !progress._oauthRefreshToken)