@xenon-device-management/xenon 2.0.0 → 2.1.0

package/lib/src/plugin.js

@@ -60,9 +60,12 @@ const AICommandService_1 = require("./services/AICommandService");
 const TracingService_1 = require("./services/TracingService");
 const CommandInterceptor_1 = require("./interceptors/CommandInterceptor");
 const SessionLifecycleService_1 = require("./services/SessionLifecycleService");
+const createHandoff_1 = require("./gateway/createHandoff");
 const ServerManager_1 = require("./services/ServerManager");
 const IPluginArgs_1 = require("./interfaces/IPluginArgs");
 const NodeDevices_1 = __importDefault(require("./device-managers/NodeDevices"));
+const appiumUmbrella_1 = require("./sessions/appiumUmbrella");
+const LiveSessionOwners_1 = require("./services/device-access/LiveSessionOwners");
 const config_1 = require("./config");
 const SessionManager_1 = require("./sessions/SessionManager");
 const event_manager_1 = require("./dashboard/event-manager");
@@ -94,6 +97,7 @@ class XenonPlugin extends base_plugin_1.default {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
             const sessionId = driver.sessionId;
+            typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).forget(sessionId);
             const deviceFilter = {
                 session_id: sessionId ? sessionId : undefined,
                 udid: driver.caps && driver.caps.udid ? driver.caps.udid : undefined,
@@ -105,6 +109,10 @@ class XenonPlugin extends base_plugin_1.default {
                     hubToken: config_1.config.hubToken,
                 }).unblockDevice(deviceFilter);
             }
+            else if (sessionId) {
+                // Keyed on the session: its phone may be another session's by now.
+                yield (0, device_service_1.releaseSessionDevices)(sessionId);
+            }
             else {
                 yield (0, device_service_1.unblockDeviceMatchingFilter)(deviceFilter);
             }
@@ -168,7 +176,25 @@ class XenonPlugin extends base_plugin_1.default {
             if (caps && (!Array.isArray(caps.firstMatch) || caps.firstMatch.length === 0)) {
                 caps.firstMatch = [{}];
             }
-            return yield typedi_1.Container.get(SessionLifecycleService_1.SessionLifecycleService).createSession(next, driver, caps);
+            // The umbrella: where a node answers the hub's "does this session exist"
+            // without sending the session a command (gateway/nodeSessionStatus.ts).
+            typedi_1.Container.get(appiumUmbrella_1.AppiumUmbrella).note(driver);
+            const lifecycle = typedi_1.Container.get(SessionLifecycleService_1.SessionLifecycleService);
+            // The session gateway allocated this request's phone in front of Appium's
+            // route (gateway/sessionCreate.ts) and handed it here through the
+            // request's async context. It only ever hands over a phone this server
+            // drives: it creates a node's session itself and answers it, so Appium
+            // never has to hold a session it has no driver for.
+            const handoff = (0, createHandoff_1.currentCreateHandoff)();
+            if (handoff)
+                return yield lifecycle.completeLocalSession(handoff.take(), next, driver, caps);
+            // A create that did not come through the gateway (it could not be placed
+            // ahead of Appium's routes). A phone this server drives is still created
+            // here; one on another server is refused, since answering for Appium
+            // without calling next() is what broke its umbrella driver.
+            this.xenonLog.warn("createSession reached the plugin without the session gateway's allocation; allocating " +
+                'here. Sessions on phones other servers drive need the session gateway, and are refused.');
+            return yield lifecycle.createSession(next, driver, caps, { localOnly: true });
         });
     }
     deleteSession(next, driver, sessionId) {

package/lib/src/prisma.js

@@ -36,7 +36,8 @@ const MODEL_DELEGATES = new Set([
     'build', 'session', 'sessionLog', 'log', 'profiling', 'app', 'device',
     'pendingSession', 'cLIArgs', 'webhookConfig', 'webConfig', 'locatorEtalon',
     'lease', 'portLease', 'apiKey', 'selectorState', 'user', 'userSession',
-    'passwordResetToken', 'team', 'teamMember', 'eventLog', 'project',
+    'passwordResetToken', 'team', 'teamMember', 'eventLog', 'project', 'recording', 'bookmark',
+    'annotation',
 ]);
 /** Cache of plain-object wrappers, keyed by model name. */
 const _modelWrappers = new Map();

package/lib/src/services/DeviceReconciler.js

@@ -78,8 +78,11 @@ let DeviceReconciler = DeviceReconciler_1 = class DeviceReconciler {
                 .join(', ')}`);
             for (const device of orphans) {
                 try {
-                    yield (0, device_service_1.unblockDevice)(device.udid, device.host);
-                    this.orphansFreed++;
+                    // Keyed on the session read above: if it ended meanwhile and the
+                    // phone went to another session, that one keeps it.
+                    if (yield (0, device_service_1.releaseSessionDevice)(device.udid, device.host, device.session_id)) {
+                        this.orphansFreed++;
+                    }
                 }
                 catch (err) {
                     this.logger.error(`Failed to unblock ghost device ${device.udid}: ${err.message}`);

package/lib/src/services/OrphanSweeper.js

@@ -24,6 +24,7 @@ const prisma_1 = require("../prisma");
 const logger_1 = __importDefault(require("../logger"));
 const event_manager_1 = require("../dashboard/event-manager");
 const SessionStatus_1 = require("../types/SessionStatus");
+const device_service_1 = require("../data-service/device-service");
 let OrphanSweeper = class OrphanSweeper {
     constructor() {
         this.log = logger_1.default.scope('OrphanSweeper');
@@ -60,25 +61,17 @@ let OrphanSweeper = class OrphanSweeper {
             this.log.info(`Sweeping ${stale.length} orphaned session(s)`);
             for (const s of stale) {
                 try {
-                    yield prisma_1.prisma.$transaction([
-                        prisma_1.prisma.session.update({
-                            where: { id: s.id },
-                            data: {
-                                status: 'failed',
-                                failure_reason: 'Session heartbeat timeout',
-                                endTime: new Date(),
-                            },
-                        }),
-                        prisma_1.prisma.device.updateMany({
-                            where: { udid: s.device_udid },
-                            data: {
-                                busy: false,
-                                session_id: null,
-                                owningSessionId: null,
-                                lockedAt: null,
-                            },
-                        }),
-                    ]);
+                    yield prisma_1.prisma.session.update({
+                        where: { id: s.id },
+                        data: {
+                            status: 'failed',
+                            failure_reason: 'Session heartbeat timeout',
+                            endTime: new Date(),
+                        },
+                    });
+                    // This session's claim only, not every row with its udid: the phone
+                    // may be another session's by now (deviceClaims.ts).
+                    yield (0, device_service_1.releaseSessionDevices)(s.id);
                     // Event emit stays outside the transaction (side-effect with own error boundary)
                     yield event_manager_1.DASHBORD_EVENT_MANAGER.onSessionStopped(s.id, SessionStatus_1.SessionStatus.FAILED, 'Session heartbeat timeout');
                 }

package/lib/src/services/PortAllocator.js

@@ -32,6 +32,13 @@ const DEFAULT_RANGES = {
     system: [10100, 10199],
     proxy: [11100, 11199],
 };
+/** Loopback and wildcard, in both families. See isOsFree. */
+const PROBE_HOSTS = ['127.0.0.1', '::1', '0.0.0.0', '::'];
+/**
+ * Bind errors meaning the host can't use that address at all (IPv6 disabled),
+ * not that something holds the port. Any other error still counts as in use.
+ */
+const ADDRESS_UNAVAILABLE = new Set(['EADDRNOTAVAIL', 'EAFNOSUPPORT']);
 class PortRangeExhaustedError extends Error {
     constructor(purpose) {
         super(`Port range for purpose '${purpose}' is exhausted`);
@@ -166,9 +173,43 @@ let PortAllocator = class PortAllocator {
                 .catch(() => undefined);
         });
     }
-    release(port) {
+    /**
+     * Lease a port `udid` is already serving on. acquire() would refuse it,
+     * because its OS probe sees the listener, and that listener is the device's
+     * own: iOS attaching to the WDA an Appium session forwards is the case. The
+     * lease is what keeps the port from being handed to another device once the
+     * listener closes.
+     *
+     * Returns false, and leaves the row alone, when another udid holds an
+     * unexpired lease on the port.
+     */
+    claim(purpose_1, udid_1, port_1) {
+        return __awaiter(this, arguments, void 0, function* (purpose, udid, port, opts = {}) {
+            var _a;
+            const now = Date.now();
+            const ttlMs = (_a = opts.ttlMs) !== null && _a !== void 0 ? _a : 60 * 60 * 1000;
+            const held = yield prisma_1.prisma.portLease.findUnique({ where: { port } });
+            if (held && held.leasedToUdid !== udid && held.expiresAt >= now)
+                return false;
+            const lease = { purpose, leasedToUdid: udid, leasedAt: now, expiresAt: now + ttlMs };
+            yield prisma_1.prisma.portLease.upsert({
+                where: { port },
+                create: Object.assign({ port }, lease),
+                update: lease,
+            });
+            return true;
+        });
+    }
+    /**
+     * Release `port` if `udid` holds it. A port number alone doesn't say whose
+     * lease it is: a stale session releasing "its" port used to delete whatever
+     * lease held that number by then, including another device's live one.
+     */
+    release(port, udid) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield prisma_1.prisma.portLease.delete({ where: { port } }).catch(() => undefined);
+            yield prisma_1.prisma.portLease
+                .deleteMany({ where: { port, leasedToUdid: udid } })
+                .catch(() => undefined);
         });
     }
     /**
@@ -195,23 +236,41 @@ let PortAllocator = class PortAllocator {
             yield prisma_1.prisma.portLease.deleteMany({ where: { expiresAt: { lt: Date.now() } } });
         });
     }
+    /**
+     * Whether nothing listens on `port` on any local address.
+     *
+     * One bind can't tell. On macOS a bind to 127.0.0.1 succeeds beside a
+     * wildcard listener, and the more specific socket then takes every
+     * 127.0.0.1 connection. iproxy listens on the IPv6 wildcard, so a
+     * 127.0.0.1-only probe called an iPhone's 9100 free, the S9+'s MJPEG server
+     * bound 127.0.0.1:9100 over it, and the iPhone's recording showed the S9+.
+     *
+     * Each listener shape fails at least one of these binds (checked on macOS
+     * with Node's default SO_REUSEADDR): 127.0.0.1 → 127.0.0.1, ::1 → ::1,
+     * 0.0.0.0 → 0.0.0.0, dual-stack :: → 0.0.0.0 and ::, v6-only :: → ::.
+     */
     isOsFree(port) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let probed = 0;
+            // One at a time: probes in flight together can fail on each other (a
+            // 0.0.0.0 bind fails beside a :: one).
+            for (const host of PROBE_HOSTS) {
+                const code = yield this.bindProbe(port, host);
+                if (code === null)
+                    probed++;
+                else if (!ADDRESS_UNAVAILABLE.has(code))
+                    return false;
+            }
+            return probed > 0;
+        });
+    }
+    /** Bind `host:port` and close it again. Resolves null on success, else the error code. */
+    bindProbe(port, host) {
         return new Promise((resolve) => {
             const server = net_1.default.createServer();
-            let settled = false;
-            const done = (ok) => {
-                if (settled)
-                    return;
-                settled = true;
-                server.removeAllListeners();
-                if (ok)
-                    server.close(() => resolve(true));
-                else
-                    resolve(false);
-            };
-            server.once('error', () => done(false));
-            server.once('listening', () => done(true));
-            server.listen(port, '127.0.0.1');
+            server.once('error', (err) => { var _a; return resolve((_a = err.code) !== null && _a !== void 0 ? _a : 'UNKNOWN'); });
+            server.once('listening', () => server.close(() => resolve(null)));
+            server.listen(port, host);
         });
     }
 };

package/lib/src/services/ServerManager.js

@@ -63,6 +63,7 @@ const networkAddresses_1 = require("../helpers/networkAddresses");
 const logger_1 = __importDefault(require("../logger"));
 const h264StreamWs_1 = require("../app/ws/h264StreamWs");
 const logcatWs_1 = require("../app/ws/logcatWs");
+const upgradeRouter_1 = require("../app/ws/upgradeRouter");
 const StreamTicketService_1 = require("./token/StreamTicketService");
 const AndroidH264StreamService_1 = __importDefault(require("../device-managers/android/AndroidH264StreamService"));
 const LogcatStreamService_1 = require("../device-managers/android/LogcatStreamService");
@@ -77,16 +78,16 @@ const config_service_1 = require("../data-service/config-service");
 const PluginContext_1 = require("../PluginContext");
 const device_store_1 = require("../data-service/device-store");
 const device_utils_1 = require("../device-utils");
+const localDeviceHosts_1 = require("../device-managers/localDeviceHosts");
 const app_1 = require("../app");
-const wd_command_proxy_1 = require("../proxy/wd-command-proxy");
 const registerCommandAuth_1 = require("../app/registerCommandAuth");
+const defaultGateway_1 = require("../gateway/defaultGateway");
 const appium_adb_1 = require("appium-adb");
 const ChromeDriverManager_1 = __importDefault(require("../device-managers/ChromeDriverManager"));
 const AndroidDeviceManager_1 = __importDefault(require("../device-managers/AndroidDeviceManager"));
 const IOSDeviceManager_1 = __importDefault(require("../device-managers/IOSDeviceManager"));
 const device_managers_1 = require("../device-managers");
 const pluginArgs_1 = require("../data-service/pluginArgs");
-const NodeDevices_1 = __importDefault(require("../device-managers/NodeDevices"));
 const config_1 = require("../config");
 const SocketServer_1 = require("./SocketServer");
 const SocketClient_1 = require("./SocketClient");
@@ -128,13 +129,17 @@ let ServerManager = ServerManager_1 = class ServerManager {
             }
             yield this.syncDatabaseAndAIConfig(pluginArgs);
             yield this.initializeCoreSubsystems(pluginArgs, cliArgs.port);
-            this.registerRoutes(expressApp, cliArgs, pluginArgs);
+            this.registerRoutes(expressApp, httpServer, cliArgs, pluginArgs);
             yield this.bootEmulators(pluginArgs);
             this.registerDependenciesInContainer(pluginArgs, cliArgs, nodeId);
-            yield this.setupHubOrNode(pluginArgs, cliArgs, httpServer, nodeId);
-            yield this.setupMaintenanceCrons(pluginArgs);
+            // The hosts this server files its own phones under. Every "is this phone
+            // mine?" below compares against these exactly: a node on this machine
+            // shares the IP and differs only by port.
+            const localHosts = (0, localDeviceHosts_1.localDeviceHosts)(pluginArgs, cliArgs.port);
+            yield this.setupHubOrNode(pluginArgs, cliArgs, httpServer, localHosts);
+            yield this.setupMaintenanceCrons(pluginArgs, localHosts);
             // Live H.264 preview WebSocket (Android; feature-flagged in the frontend).
-            // Only claims /stream/h264 — socket.io keeps its own upgrades. Ticket-auth'd.
+            // A route of the upgrade router: only /stream/h264 upgrades reach it. Ticket-auth'd.
             if (httpServer) {
                 (0, h264StreamWs_1.attachH264Ws)(httpServer, {
                     redeem: (ticket, udid) => typedi_1.Container.get(StreamTicketService_1.StreamTicketService).redeem(ticket, udid),
@@ -144,8 +149,8 @@ let ServerManager = ServerManager_1 = class ServerManager {
                     startStream: (udid) => typedi_1.Container.get(AndroidH264StreamService_1.default).start(udid),
                 });
                 // Continuous logcat WebSocket (Android; replaces the 3s dump-poll).
-                // Only claims /logcat — socket.io and the h264 WS keep their own
-                // upgrades. Ticket-auth'd like h264, plus an ownership check h264
+                // A route of the upgrade router: only /logcat upgrades reach it.
+                // Ticket-auth'd like h264, plus an ownership check h264
                 // doesn't need: logcat routinely carries auth tokens and PII from
                 // whatever app is under test, so it's an ownership-checked read, not
                 // an open one — see docs/superpowers/specs/2026-08-09-logcat-stream-design.md
@@ -191,7 +196,7 @@ let ServerManager = ServerManager_1 = class ServerManager {
             // Principal Cleaning: Attempt to recover remote sessions before marking as failed
             const { SessionManager } = yield Promise.resolve().then(() => __importStar(require('../sessions/SessionManager')));
             const sessionManager = typedi_1.Container.get(SessionManager);
-            const recoveredCount = yield sessionManager.recoverActiveSessions(nodeId, plugin_1.XenonPlugin.nodeBasePath);
+            const recoveredCount = yield sessionManager.recoverActiveSessions(nodeId, plugin_1.XenonPlugin.nodeBasePath, (host) => (0, localDeviceHosts_1.isLocalDeviceHost)(localHosts, host));
             const recoveredSessionIds = sessionManager.getAllSessions().map((s) => s.getId());
             if (recoveredCount > 0) {
                 logger_1.default.info(`🔄 Successfully recovered ${recoveredCount} remote sessions`);
@@ -232,9 +237,9 @@ let ServerManager = ServerManager_1 = class ServerManager {
             const { cleanupZombieSessions } = yield Promise.resolve().then(() => __importStar(require('../dashboard/services/session-service')));
             yield cleanupZombieSessions(recoveredSessionIds);
             // Initial device discovery poll to start managers and trackers
-            yield (0, device_utils_1.updateDeviceList)(pluginArgs.bindHostOrIp, pluginArgs.hub, pluginArgs.tlsRejectUnauthorized);
+            yield (0, device_utils_1.updateDeviceList)(localHosts, pluginArgs.hub, pluginArgs.tlsRejectUnauthorized);
             // remove stale devices
-            yield (0, device_utils_1.removeStaleDevices)(pluginArgs.bindHostOrIp, pluginArgs.tlsRejectUnauthorized);
+            yield (0, device_utils_1.removeStaleDevices)(localHosts, pluginArgs.tlsRejectUnauthorized);
             this.logger.info(`🚀 Xenon will be served at http://${pluginArgs.bindHostOrIp}:${cliArgs.port}/xenon with id ${nodeId}`);
             this.logger.info('You can provide the following URLs to access Xenon:');
             for (const url of (0, networkAddresses_1.listReachableBaseUrls)(cliArgs.port)) {
@@ -314,7 +319,8 @@ let ServerManager = ServerManager_1 = class ServerManager {
             yield (0, device_utils_1.initializeStorage)();
             const { runMigrations } = yield Promise.resolve().then(() => __importStar(require('../scripts/run-migrations')));
             yield runMigrations();
-            yield device_store_1.DeviceStoreFactory.getStore().clearStorage();
+            // A hub keeps its nodes' phones: the sessions on them outlive its restart.
+            yield device_store_1.DeviceStoreFactory.getStore().clearStorage((0, localDeviceHosts_1.devicesClearedAtBoot)(pluginArgs, (0, localDeviceHosts_1.localDeviceHosts)(pluginArgs, port)));
             const { bootstrapIdentity } = yield Promise.resolve().then(() => __importStar(require('./identity/bootstrap')));
             yield bootstrapIdentity();
             typedi_1.Container.get(EmailService_1.EmailService).warnIfLogFallbackEnabled();
@@ -345,15 +351,33 @@ let ServerManager = ServerManager_1 = class ServerManager {
             typedi_1.Container.set(ARTIFACT_STORE, new FsArtifactStore(config_1.config.recordingsAssetsPath));
         });
     }
-    registerRoutes(expressApp, cliArgs, pluginArgs) {
+    registerRoutes(expressApp, httpServer, cliArgs, pluginArgs) {
         expressApp.use('/xenon', (0, app_1.createRouter)(pluginArgs));
-        // Per-command auth (XENON_REQUIRE_COMMAND_AUTH) goes in front of Appium's
-        // routes, and is placed before the proxy middleware so that, where the
-        // proxy is also spliced ahead of the routes, a hub checks a command before
-        // forwarding it to a node. Throws when the setting is on and it cannot be
-        // placed, rather than serve session commands unchecked.
-        (0, registerCommandAuth_1.registerCommandAuth)(expressApp, cliArgs);
-        (0, wd_command_proxy_1.registerProxyMiddlware)(expressApp, cliArgs);
+        // The session gateway goes in front of Appium's routes: Xenon's own
+        // /wd-internal calls (with the per-process secret), per-command auth
+        // (XENON_REQUIRE_COMMAND_AUTH), then, on a hub, forwarding of the sessions
+        // nodes run, so a hub checks a command before forwarding it and Appium's
+        // umbrella never sees a remote session. A node accepts the hub's session
+        // token in place of the client's credentials. With it go the filter on
+        // Appium's session listing and the guard on session WebSockets (BiDi,
+        // driver /ws/session/...), which upgrade outside the routes. One set of
+        // deps, so all three share a credential cache. Each throws when the
+        // setting is on and it cannot be installed, rather than serve sessions
+        // unchecked.
+        const commandAuth = (0, registerCommandAuth_1.commandAuthDeps)();
+        (0, registerCommandAuth_1.registerSessionGateway)(expressApp, cliArgs, commandAuth, (0, defaultGateway_1.gatewayOptionsFor)(pluginArgs, cliArgs, () => typedi_1.Container.get(PluginContext_1.PluginContext).nodeId));
+        (0, registerCommandAuth_1.registerSessionUpgradeGuard)(httpServer, expressApp, cliArgs, commandAuth);
+        // One owner per WebSocket upgrade (upgradeRouter.ts): Xenon's H.264,
+        // logcat and socket.io paths go to Xenon, everything else to Appium behind
+        // the session guard. Installed after the guard, so the guard never sees
+        // Xenon's sockets, and before socket.io and the H.264 / logcat sockets
+        // attach to it below. Without it, which side got an upgrade depended on
+        // the Node version, and each version broke one side.
+        if (httpServer) {
+            const router = (0, upgradeRouter_1.upgradeRouterFor)(httpServer);
+            this.logger.info("WebSocket upgrades: Xenon's own paths go to Xenon; every other path goes to " +
+                `${router.describeAppiumPath()}.`);
+        }
     }
     bootEmulators(pluginArgs) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -384,22 +408,18 @@ let ServerManager = ServerManager_1 = class ServerManager {
         }
         (0, pluginArgs_1.addCLIArgs)(cliArgs);
     }
-    setupHubOrNode(pluginArgs, cliArgs, httpServer, nodeId) {
+    setupHubOrNode(pluginArgs, cliArgs, httpServer, localHosts) {
         return __awaiter(this, void 0, void 0, function* () {
             const hubArgument = pluginArgs.hub;
             if (hubArgument !== undefined) {
                 this.logger.info(`📡 I'm a node and my hub is ${hubArgument}`);
-                yield (0, device_utils_1.setupCronUpdateDeviceList)(pluginArgs.bindHostOrIp, hubArgument, pluginArgs.sendNodeDevicesToHubIntervalMs, pluginArgs.tlsRejectUnauthorized);
+                yield (0, device_utils_1.setupCronUpdateDeviceList)(localHosts, hubArgument, pluginArgs.sendNodeDevicesToHubIntervalMs, pluginArgs.tlsRejectUnauthorized);
                 // Handle graceful shutdown
                 ['SIGINT', 'SIGTERM'].forEach((signal) => {
                     process.once(signal, () => __awaiter(this, void 0, void 0, function* () {
                         logger_1.default.info(`Received ${signal}, unregistering node from hub...`);
                         try {
-                            yield new NodeDevices_1.default(hubArgument, {
-                                tlsRejectUnauthorized: pluginArgs.tlsRejectUnauthorized,
-                                hubAccessKey: config_1.config.hubAccessKey,
-                                hubToken: config_1.config.hubToken,
-                            }).unRegisterNode(pluginArgs.bindHostOrIp);
+                            yield (0, device_utils_1.unregisterNodeFromHub)(hubArgument, localHosts, pluginArgs.tlsRejectUnauthorized, typedi_1.Container.get(PluginContext_1.PluginContext).nodeId);
                         }
                         catch (err) {
                             logger_1.default.error(`Error during node unregistration: ${err}`);
@@ -417,7 +437,7 @@ let ServerManager = ServerManager_1 = class ServerManager {
                 // Principal discovery: Background poll to prune stale/offline devices on the Hub itself
                 (() => __awaiter(this, void 0, void 0, function* () {
                     const { setupCronLocalDiscovery } = yield Promise.resolve().then(() => __importStar(require('../device-utils')));
-                    yield setupCronLocalDiscovery(pluginArgs.bindHostOrIp, pluginArgs.sendNodeDevicesToHubIntervalMs);
+                    yield setupCronLocalDiscovery(localHosts, pluginArgs.sendNodeDevicesToHubIntervalMs);
                 }))();
                 const socketServer = typedi_1.Container.get(SocketServer_1.SocketServer);
                 socketServer.initialize(httpServer);
@@ -426,12 +446,12 @@ let ServerManager = ServerManager_1 = class ServerManager {
             }
         });
     }
-    setupMaintenanceCrons(pluginArgs) {
+    setupMaintenanceCrons(pluginArgs, localHosts) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
             if (!((_a = pluginArgs.cloud) === null || _a === void 0 ? void 0 : _a.cloudName)) {
                 // 1. Check for stale nodes
-                yield (0, device_utils_1.setupCronCheckStaleDevices)(pluginArgs.checkStaleDevicesIntervalMs, pluginArgs.bindHostOrIp, pluginArgs.tlsRejectUnauthorized);
+                yield (0, device_utils_1.setupCronCheckStaleDevices)(pluginArgs.checkStaleDevicesIntervalMs, localHosts, pluginArgs.tlsRejectUnauthorized);
                 // 2. Release blocked devices
                 yield (0, device_utils_1.setupCronReleaseBlockedDevices)(pluginArgs.checkBlockedDevicesIntervalMs, pluginArgs.newCommandTimeoutSec);
                 // 3. Clean up pending sessions