@xenon-device-management/xenon 2.0.0 → 2.2.0

package/lib/src/services/device-access/LiveSessionOwners.js

@@ -0,0 +1,53 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LiveSessionOwners = void 0;
+const typedi_1 = require("typedi");
+/** Far more live sessions than one server runs; bounds a leak if an end is missed. */
+const MAX_LIVE_SESSIONS = 1000;
+/**
+ * The owners of the sessions this server runs, while they run.
+ *
+ * SessionOwnerResolver reads a session's owner from its Session row. A node
+ * writes none for a session the hub created (the hub keeps that record, in
+ * its own database), so the node's own ownership checks (the /control guard,
+ * the logcat WebSocket, the session listing) found no owner and, failing
+ * closed, refused the phone to everyone but admins, its owner included. The
+ * same held for any server with the dashboard off.
+ *
+ * finalizeSession records the owner of each session this server drives (on a
+ * node, the one the hub's create token named), and the session's end forgets
+ * it: deleteSession, an unexpected shutdown, or the server's own shutdown.
+ * SessionOwnerResolver asks here before the database.
+ */
+let LiveSessionOwners = class LiveSessionOwners {
+    constructor() {
+        this.owners = new Map();
+    }
+    record(sessionId, userId) {
+        if (!sessionId || !userId)
+            return;
+        this.owners.delete(sessionId);
+        if (this.owners.size >= MAX_LIVE_SESSIONS) {
+            const oldest = this.owners.keys().next().value;
+            this.owners.delete(oldest);
+        }
+        this.owners.set(sessionId, userId);
+    }
+    forget(sessionId) {
+        if (sessionId)
+            this.owners.delete(sessionId);
+    }
+    ownerOf(sessionId) {
+        return sessionId ? this.owners.get(sessionId) : undefined;
+    }
+};
+exports.LiveSessionOwners = LiveSessionOwners;
+exports.LiveSessionOwners = LiveSessionOwners = __decorate([
+    (0, typedi_1.Service)()
+], LiveSessionOwners);

package/lib/src/services/device-access/SessionOwnerResolver.js

@@ -21,6 +21,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionOwnerResolver = void 0;
 const typedi_1 = require("typedi");
 const prisma_1 = require("../../prisma");
+const LiveSessionOwners_1 = require("./LiveSessionOwners");
 /** Bound so a long-lived server cannot accumulate entries without limit. */
 const MAX_CACHE_ENTRIES = 500;
 /**
@@ -35,12 +36,18 @@ const MAX_CACHE_ENTRIES = 500;
  * given session id, so a resolved owner cannot go stale — but a *negative*
  * result can simply mean the Session row has not been written yet, and caching
  * that would deny the owner their own device for the life of the process.
+ *
+ * A live session this server drives is looked up in memory first
+ * (LiveSessionOwners): a node writes no row for a session the hub created, and
+ * a server with the dashboard off writes none at all.
  */
 let SessionOwnerResolver = class SessionOwnerResolver {
     constructor(db = prisma_1.prisma) {
         this.db = db;
         this.ownerCache = new Map();
         this.nameCache = new Map();
+        /** The owners of this server's live sessions. A field, not a constructor parameter: TypeDI. */
+        this.liveOwners = () => typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners);
     }
     ownerOf(sessionId) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -50,6 +57,11 @@ let SessionOwnerResolver = class SessionOwnerResolver {
             const cached = this.ownerCache.get(sessionId);
             if (cached)
                 return cached;
+            const live = this.liveOwners().ownerOf(sessionId);
+            if (live) {
+                this.remember(this.ownerCache, sessionId, live);
+                return live;
+            }
             const session = yield this.db.session.findUnique({
                 where: { id: sessionId },
                 select: { api_key_id: true, user_id: true },
@@ -70,6 +82,68 @@ let SessionOwnerResolver = class SessionOwnerResolver {
             return owner;
         });
     }
+    /**
+     * The owner of each of several sessions, by exactly ownerOf's rule, in one
+     * query: one `session.findMany` for the ids not already cached, plus one
+     * `apiKey.findMany` only if some of those rows predate `user_id`. Used to
+     * filter Appium's session listing, where an ownerOf per listed session would
+     * be a query per session.
+     *
+     * Every requested id is in the result, null when no owner is on record.
+     * Shares ownerOf's cache, with the same rule: only resolved owners are kept.
+     * A failed query rejects; nothing is guessed.
+     */
+    ownersOf(sessionIds) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            const ids = [...new Set(sessionIds)];
+            const resolved = new Map();
+            const missing = [];
+            for (const id of ids) {
+                const cached = id ? ((_a = this.ownerCache.get(id)) !== null && _a !== void 0 ? _a : this.liveOwners().ownerOf(id)) : undefined;
+                if (cached) {
+                    resolved.set(id, cached);
+                    this.remember(this.ownerCache, id, cached);
+                }
+                else if (id)
+                    missing.push(id);
+                else
+                    resolved.set(id, null);
+            }
+            if (missing.length > 0) {
+                const rows = yield this.db.session.findMany({
+                    where: { id: { in: missing } },
+                    select: { id: true, api_key_id: true, user_id: true },
+                });
+                const byId = new Map(rows.map((row) => [row.id, row]));
+                // Rows written before user_id existed resolve through the key, as in ownerOf.
+                const legacyKeyIds = [
+                    ...new Set(rows
+                        .filter((row) => !row.user_id && row.api_key_id)
+                        .map((row) => row.api_key_id)),
+                ];
+                const keyOwner = new Map();
+                if (legacyKeyIds.length > 0) {
+                    const keys = yield this.db.apiKey.findMany({
+                        where: { id: { in: legacyKeyIds } },
+                        select: { id: true, userId: true },
+                    });
+                    for (const key of keys)
+                        if (key.userId)
+                            keyOwner.set(key.id, key.userId);
+                }
+                for (const id of missing) {
+                    const row = byId.get(id);
+                    const owner = (_b = row === null || row === void 0 ? void 0 : row.user_id) !== null && _b !== void 0 ? _b : ((row === null || row === void 0 ? void 0 : row.api_key_id) ? ((_c = keyOwner.get(row.api_key_id)) !== null && _c !== void 0 ? _c : null) : null);
+                    resolved.set(id, owner);
+                    if (owner)
+                        this.remember(this.ownerCache, id, owner);
+                }
+            }
+            // In the order asked, so a caller filtering a list keeps its order.
+            return new Map(ids.map((id) => { var _a; return [id, (_a = resolved.get(id)) !== null && _a !== void 0 ? _a : null]; }));
+        });
+    }
     displayName(userId) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a, _b;

package/lib/src/services/device-access/ticketActorAccess.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.makeTicketActorAuthorizer = makeTicketActorAuthorizer;
 const manualLock_1 = require("../recording/manualLock");
 const deviceAccessPolicy_1 = require("./deviceAccessPolicy");
+const deviceClaims_1 = require("../../data-service/deviceClaims");
 /**
  * Build the ownership check for a caller authenticated by a stream ticket.
  *
@@ -54,7 +55,8 @@ function makeTicketActorAuthorizer(deps) {
                 : null;
             return (0, deviceAccessPolicy_1.evaluateDeviceAccess)({
                 udid,
-                busy: !!device.busy,
+                // heldHere, as deviceAccessGuard reads it.
+                busy: (0, deviceClaims_1.heldHere)(device),
                 sessionId: device.session_id,
                 sessionOwnerUserId,
                 // The ticket's actorId is a User id — see StreamTicketService.

package/lib/src/services/lease/LeaseOrphanSweeper.js

@@ -22,10 +22,29 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LeaseOrphanSweeper = void 0;
+exports.leaseReapReason = leaseReapReason;
 const typedi_1 = require("typedi");
 const prisma_1 = require("../../prisma");
 const device_store_1 = require("../../data-service/device-store");
 const logger_1 = __importDefault(require("../../logger"));
+/**
+ * Why an active lease is over, or null while it isn't: its client missed
+ * three heartbeats, or it passed expiresAt. The second is the rule
+ * LeaseService already applies (heartbeat and extend refuse such a lease,
+ * authorizeSessionUse won't resolve it); without it here, a client that kept
+ * heartbeating held the phone for up to 3 x heartbeatSeconds past the end.
+ */
+function leaseReapReason(lease, now) {
+    var _a;
+    // The end time first: past it, heartbeats are refused, so a lease that
+    // expired has missed its heartbeats too by the next sweep.
+    if (lease.expiresAt < now)
+        return `expired at ${new Date(lease.expiresAt).toISOString()}`;
+    const thresholdMs = ((_a = lease.heartbeatSeconds) !== null && _a !== void 0 ? _a : 30) * 1000 * 3;
+    if (lease.lastHeartbeatAt + thresholdMs < now)
+        return 'missed heartbeats';
+    return null;
+}
 let LeaseOrphanSweeper = class LeaseOrphanSweeper {
     constructor(db = prisma_1.prisma, store = device_store_1.DeviceStoreFactory.getStore()) {
         this.db = db;
@@ -34,21 +53,30 @@ let LeaseOrphanSweeper = class LeaseOrphanSweeper {
     }
     sweep() {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a;
             const now = Date.now();
             const candidates = yield this.db.lease.findMany({
                 where: { status: 'active' },
-                select: { id: true, deviceUdid: true, deviceHost: true, heartbeatSeconds: true, lastHeartbeatAt: true },
+                select: {
+                    id: true,
+                    deviceUdid: true,
+                    deviceHost: true,
+                    heartbeatSeconds: true,
+                    lastHeartbeatAt: true,
+                    expiresAt: true,
+                },
             });
             for (const lease of candidates) {
-                const thresholdMs = ((_a = lease.heartbeatSeconds) !== null && _a !== void 0 ? _a : 30) * 1000 * 3;
-                if (lease.lastHeartbeatAt + thresholdMs >= now)
+                const reason = leaseReapReason(lease, now);
+                if (!reason)
                     continue;
                 try {
                     yield this.db.lease.update({ where: { id: lease.id }, data: { status: 'expired' } });
                     yield this.db.portLease.deleteMany({ where: { leaseId: lease.id } });
-                    yield this.store.updateDevice(lease.deviceUdid, lease.deviceHost, { busy: false });
-                    this.logger.info(`reaped lease ${lease.id} (missed heartbeats); device ${lease.deviceUdid}@${lease.deviceHost} unblocked`);
+                    // Only the lease's lock: a session that outlived its lease keeps the
+                    // phone, and its own release frees it.
+                    const freed = yield this.store.releaseLeaseLock(lease.deviceUdid, lease.deviceHost);
+                    const device = `${lease.deviceUdid}@${lease.deviceHost}`;
+                    this.logger.info(`reaped lease ${lease.id} (${reason}); device ${device} ${freed ? 'unblocked' : 'still held (a session or a hold), left busy'}`);
                 }
                 catch (err) {
                     this.logger.warn(`failed to reap lease ${lease.id}: ${err.message}`);

package/lib/src/services/lease/LeaseService.js

@@ -279,13 +279,26 @@ let LeaseService = class LeaseService {
             return lease;
         });
     }
-    heartbeat(leaseId, token) {
+    /**
+     * The lease, as loadActiveLease, if it also hasn't passed its expiresAt.
+     * The sweeper marks leases by missed heartbeats, not by expiresAt, so a
+     * lapsed lease can still read 'active'. It is gone all the same: heartbeat
+     * must not keep it and extend must not revive it. Release still takes it,
+     * so its holder can hand the device back early.
+     */
+    loadLiveLease(leaseId, token) {
         return __awaiter(this, void 0, void 0, function* () {
             const lease = yield this.loadActiveLease(leaseId, token);
-            const now = Date.now();
-            if (lease.expiresAt < now) {
+            if (lease.expiresAt < Date.now()) {
                 throw new LeaseGone(`lease ${leaseId} expired at ${lease.expiresAt}`);
             }
+            return lease;
+        });
+    }
+    heartbeat(leaseId, token) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const lease = yield this.loadLiveLease(leaseId, token);
+            const now = Date.now();
             // Guarded by status='active' so a concurrent sweeper expiration is observed.
             const result = yield this.db.lease.updateMany({
                 where: { id: leaseId, status: 'active' },
@@ -299,7 +312,7 @@ let LeaseService = class LeaseService {
     }
     extend(leaseId, token, additionalMs) {
         return __awaiter(this, void 0, void 0, function* () {
-            const lease = yield this.loadActiveLease(leaseId, token);
+            const lease = yield this.loadLiveLease(leaseId, token);
             const now = Date.now();
             const createdAtMs = typeof lease.createdAt === 'number' ? lease.createdAt : new Date(lease.createdAt).getTime();
             const ceiling = createdAtMs + MAX_LEASE_MS;
@@ -325,7 +338,8 @@ let LeaseService = class LeaseService {
             // idempotent and safe — port rows may already be gone, device may already
             // be unlocked. We treat that as a successful release.
             yield this.db.portLease.deleteMany({ where: { leaseId } });
-            yield this.store.updateDevice(lease.deviceUdid, lease.deviceHost, { busy: false });
+            // Only the lease's lock: a session still on the phone keeps it busy.
+            yield this.store.releaseLeaseLock(lease.deviceUdid, lease.deviceHost);
             void result;
         });
     }

package/lib/src/services/session/nodeCreateCaps.js

@@ -0,0 +1,55 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.capsForNode = capsForNode;
+const lodash_1 = __importDefault(require("lodash"));
+const sessionCredentials_1 = require("./sessionCredentials");
+const xenonOptions_1 = require("./xenonOptions");
+/**
+ * The capabilities a hub sends the node whose phone it allocated.
+ *
+ * Each instance has its own database, and the hub has already done what
+ * needs its database: it checked the credentials, applied the team rule and
+ * resolved the lease to a phone. The node gets a request that stands on its
+ * own, whatever the node's auth settings: that one phone, and nothing the
+ * node can't act on.
+ *
+ * - No credentials. createSession took them out of `caps` first thing; they
+ *   are removed here again so no copy that leaves the hub can carry one. The
+ *   node gets the hub's create token instead (hubSessionToken.ts).
+ * - No lease id. The lease lives in the hub's database; a node that looked it
+ *   up in its own would refuse the session.
+ * - The phone, pinned: `appium:udid` in alwaysMatch, and no `appium:udid` or
+ *   `appium:udids` anywhere else. A lease-bound allocation does not write the
+ *   udid into the caps, and a `udids` list would let the node pick another
+ *   phone than the one the hub holds.
+ *
+ * `caps` is not modified: the hub keeps its own copy for its records.
+ */
+const NOT_FOR_THE_NODE = ['leaseId', ...sessionCredentials_1.SECRET_OPTION_FIELDS];
+const DEVICE_PICKERS = ['appium:udid', 'appium:udids'];
+function capsForNode(caps, udid) {
+    const alwaysMatch = (0, xenonOptions_1.isOptionsObject)(caps === null || caps === void 0 ? void 0 : caps.alwaysMatch)
+        ? lodash_1.default.cloneDeep(caps.alwaysMatch)
+        : {};
+    const firstMatch = Array.isArray(caps === null || caps === void 0 ? void 0 : caps.firstMatch) && caps.firstMatch.length > 0
+        ? caps.firstMatch.map((entry) => ((0, xenonOptions_1.isOptionsObject)(entry) ? lodash_1.default.cloneDeep(entry) : entry))
+        : [{}];
+    for (const bucket of [alwaysMatch, ...firstMatch]) {
+        if (!(0, xenonOptions_1.isOptionsObject)(bucket))
+            continue;
+        for (const key of DEVICE_PICKERS)
+            delete bucket[key];
+        for (const namespace of xenonOptions_1.OPTION_NAMESPACES) {
+            const options = bucket[namespace];
+            if (!(0, xenonOptions_1.isOptionsObject)(options))
+                continue;
+            for (const field of NOT_FOR_THE_NODE)
+                delete options[field];
+        }
+    }
+    alwaysMatch['appium:udid'] = udid;
+    return Object.assign(Object.assign({}, caps), { alwaysMatch, firstMatch });
+}

package/lib/src/services/session/sessionCredentials.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SECRET_OPTION_FIELDS = void 0;
 exports.takeSessionCredentials = takeSessionCredentials;
-exports.capsWithCredentials = capsWithCredentials;
 const XenonCapabilityManager_1 = require("../../XenonCapabilityManager");
 const xenonOptions_1 = require("./xenonOptions");
 /**
@@ -15,7 +14,8 @@ const xenonOptions_1 = require("./xenonOptions");
  * them out of the capabilities, in place, before anything else reads them:
  * the pending-session row, device allocation, the driver, the Session row,
  * the dashboard and the logs. Every other option, the lease id included,
- * stays: a lease id is not a secret.
+ * stays: a lease id is not a secret. They never leave the server they were
+ * sent to.
  */
 exports.SECRET_OPTION_FIELDS = ['accessKey', 'token', 'sessionToken', 'leaseToken'];
 function buckets(caps) {
@@ -27,8 +27,11 @@ function buckets(caps) {
  * Read the session's credentials, then remove every secret field from both
  * namespaces in alwaysMatch and every firstMatch entry, in place: Appium hands
  * this same object to the driver. The namespaces themselves are kept, emptied
- * if need be, so a peer node's copy can put the credentials back where they
- * came from (see capsWithCredentials).
+ * if need be, with the options that are not secrets.
+ *
+ * Nothing puts the credentials back. A hub forwarding a create to a node
+ * sends the hub's own create token instead (gateway/hubSessionToken.ts): each
+ * instance has its own database, so the node could not check them anyway.
  */
 function takeSessionCredentials(caps) {
     var _a;
@@ -48,58 +51,3 @@ function takeSessionCredentials(caps) {
     }
     return credentials;
 }
-/** The secret fields to put back, from what was read. */
-function secretFields(credentials) {
-    const fields = {};
-    if (credentials.pair) {
-        fields.accessKey = credentials.pair.accessKey;
-        fields.token = credentials.pair.token;
-    }
-    if (credentials.sessionToken)
-        fields.sessionToken = credentials.sessionToken;
-    if (credentials.leaseToken)
-        fields.leaseToken = credentials.leaseToken;
-    return fields;
-}
-/**
- * Where the winning namespace lives in the merged view: the bucket (the one
- * that holds it, alwaysMatch first) and the namespace itself.
- */
-function home(caps) {
-    const always = caps === null || caps === void 0 ? void 0 : caps.alwaysMatch;
-    const first = Array.isArray(caps === null || caps === void 0 ? void 0 : caps.firstMatch) ? caps.firstMatch[0] : undefined;
-    for (const namespace of xenonOptions_1.OPTION_NAMESPACES) {
-        for (const bucket of [always, first]) {
-            if (!(0, xenonOptions_1.isOptionsObject)(bucket) || !Object.prototype.hasOwnProperty.call(bucket, namespace)) {
-                continue;
-            }
-            // alwaysMatch holding the key hides firstMatch's, as in the merged view.
-            if ((0, xenonOptions_1.isOptionsObject)(bucket[namespace]))
-                return { bucket, namespace };
-            break;
-        }
-    }
-    return undefined;
-}
-/**
- * A copy of `caps` with the credentials put back, for a peer Xenon node. The
- * node re-runs createSession: it authenticates and attributes the session,
- * enforces XENON_REQUIRE_SESSION_TOKEN and checks the lease itself, so it
- * needs exactly what this hub read. It takes them out again before its own
- * driver sees them. They go into the namespace that wins, so the node reads
- * the same values. `caps` is not modified. Never hand this to a cloud
- * provider: it is not a Xenon node.
- */
-function capsWithCredentials(caps, credentials) {
-    var _a;
-    const fields = secretFields(credentials);
-    const target = home(caps);
-    if (Object.keys(fields).length === 0 || !target)
-        return caps;
-    const { bucket, namespace } = target;
-    const withCredentials = Object.assign(Object.assign({}, bucket), { [namespace]: Object.assign(Object.assign({}, bucket[namespace]), fields) });
-    if (bucket === caps.alwaysMatch)
-        return Object.assign(Object.assign({}, caps), { alwaysMatch: withCredentials });
-    const [, ...rest] = (_a = caps.firstMatch) !== null && _a !== void 0 ? _a : [];
-    return Object.assign(Object.assign({}, caps), { firstMatch: [withCredentials, ...rest] });
-}

package/lib/src/sessions/CloudSession.js

@@ -19,6 +19,18 @@ class CloudSession extends RemoteSession_1.RemoteSession {
     getType() {
         return SessionType_1.default.CLOUD;
     }
+    /** A cloud provider is not a Xenon node: it never gets the hub's session token. */
+    callOptions() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return {};
+        });
+    }
+    /** A cloud provider has no Xenon session-status route: the WebDriver probe it is. */
+    askNodeForSession() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return null;
+        });
+    }
     getScreenShot() {
         return __awaiter(this, void 0, void 0, function* () {
             return '';

package/lib/src/sessions/LocalSession.js

@@ -49,6 +49,7 @@ exports.LocalSession = void 0;
 const AndroidDeviceManager_1 = __importDefault(require("../device-managers/AndroidDeviceManager"));
 const logger_1 = __importDefault(require("../logger"));
 const SessionType_1 = __importDefault(require("../enums/SessionType"));
+const XenonSession_1 = require("./XenonSession");
 const RemoteSession_1 = require("./RemoteSession");
 const typedi_1 = require("typedi");
 const device_managers_1 = require("../device-managers");
@@ -56,27 +57,57 @@ const XenonCapabilityManager_1 = require("../XenonCapabilityManager");
 const VideoPipelineService_1 = require("../services/VideoPipelineService");
 const AndroidStreamService_1 = __importDefault(require("../device-managers/android/AndroidStreamService"));
 const IOSStreamService_1 = __importDefault(require("../device-managers/ios/IOSStreamService"));
-function constructBasePath(path) {
-    if (!path || path == '') {
-        return '/wd-internal';
-    }
-    if (!path.startsWith('/')) {
-        path = `/${path}`;
-    }
-    if (path.endsWith('/')) {
-        path = path.substr(0, path.length - 2);
-    }
-    return `${path}/wd-internal`;
-}
+const internalCall_1 = require("../gateway/internalCall");
 class LocalSession extends RemoteSession_1.RemoteSession {
     constructor(options) {
         const { address, port, basePath } = options.driver.opts || options.driver;
-        super(Object.assign(Object.assign({}, options), { baseUrl: `http://${address}:${port}${constructBasePath(basePath)}` }));
+        // The inherited HTTP calls loop back to this server's own
+        // `<basePath>/wd-internal`, which the session gateway accepts only with
+        // this process's secret (gateway/internalCall.ts).
+        super(Object.assign(Object.assign({}, options), { baseUrl: (0, internalCall_1.internalCallBaseUrl)(address, port, basePath) }));
         this.driver = options.driver;
-        // Store the proper Appium base URL for video recording commands.
-        // Principal Intelligence: Map 0.0.0.0 to 127.0.0.1 for internal loopack safety.
-        const safeAddress = address === '0.0.0.0' ? '127.0.0.1' : address;
-        this.appiumBaseUrl = `http://${safeAddress}:${port}${basePath || ''}`;
+    }
+    /**
+     * A loopback call carries the per-process secret, and never goes through an
+     * HTTP proxy from the environment, which would receive the secret.
+     */
+    callOptions() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return { headers: (0, internalCall_1.internalCallHeaders)(), proxy: false };
+        });
+    }
+    /**
+     * Whether Appium still has this session, asked of the in-process driver.
+     *
+     * Not an HTTP probe: any command sent to the session, `timeouts` included,
+     * restarts the driver's new-command timeout and Xenon's own idle clock, so a
+     * heartbeat every 30 s would keep a session its client abandoned (and its
+     * phone) alive for ever. The umbrella drops a session from its map when it
+     * is deleted, times out, or its driver shuts down unexpectedly.
+     */
+    checkHealth() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (!this.sessionId) {
+                return {
+                    isHealthy: false,
+                    errorType: XenonSession_1.HealthErrorType.NONE,
+                    message: 'No session ID assigned',
+                };
+            }
+            const umbrella = this.driver;
+            const exists = typeof (umbrella === null || umbrella === void 0 ? void 0 : umbrella.sessionExists) === 'function'
+                ? !!umbrella.sessionExists(this.sessionId)
+                : !!((_a = umbrella === null || umbrella === void 0 ? void 0 : umbrella.sessions) === null || _a === void 0 ? void 0 : _a[this.sessionId]);
+            if (exists)
+                return { isHealthy: true, errorType: XenonSession_1.HealthErrorType.NONE };
+            return {
+                isHealthy: false,
+                errorType: XenonSession_1.HealthErrorType.SESSION_NOT_FOUND,
+                message: 'Appium no longer has this session',
+                statusCode: 404,
+            };
+        });
     }
     /**
      * A local session's driver is in this process, so ask it directly instead of
@@ -280,7 +311,7 @@ class LocalSession extends RemoteSession_1.RemoteSession {
     isVideoRecordingInProgress() {
         return typedi_1.Container.get(VideoPipelineService_1.VideoPipelineService).isRecording(this.sessionId);
     }
-    // Override to use proper Appium URL for video commands
+    // The in-process pipeline or driver first; the loopback call last.
     stopVideoRecording(driver) {
         const _super = Object.create(null, {
             stopVideoRecording: { get: () => super.stopVideoRecording }
@@ -313,14 +344,9 @@ class LocalSession extends RemoteSession_1.RemoteSession {
             catch (err) {
                 logger_1.default.warn(`[LocalSession] Direct stopRecordingScreen failed: ${err.message}. Falling back to HTTP.`);
             }
-            const originalBaseUrl = this.baseUrl;
-            this.baseUrl = this.appiumBaseUrl;
-            try {
-                return yield _super.stopVideoRecording.call(this);
-            }
-            finally {
-                this.baseUrl = originalBaseUrl;
-            }
+            // Over HTTP to this server's own /wd-internal, with the secret: the public
+            // session path would need the owner's credentials under per-command auth.
+            return yield _super.stopVideoRecording.call(this);
         });
     }
     getLiveVideoUrl() {