@xenon-device-management/xenon 2.0.0 → 2.2.0

package/lib/test/unit/ios-stream-port-leases.spec.js

@@ -0,0 +1,299 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const child_process_1 = __importDefault(require("child_process"));
+const events_1 = require("events");
+const fs_1 = __importDefault(require("fs"));
+const net_1 = __importDefault(require("net"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const sinon_1 = __importDefault(require("sinon"));
+const typedi_1 = require("typedi");
+const IOSStreamService_1 = __importDefault(require("../../src/device-managers/ios/IOSStreamService"));
+const AndroidStreamService_1 = __importDefault(require("../../src/device-managers/android/AndroidStreamService"));
+const singleFlight_1 = require("../../src/helpers/singleFlight");
+const PortAllocator_1 = require("../../src/services/PortAllocator");
+const ProcessRegistry_1 = require("../../src/services/ProcessRegistry");
+const device_store_1 = require("../../src/data-service/device-store");
+const InternalHttpClient_1 = require("../../src/InternalHttpClient");
+const app_service_1 = require("../../src/dashboard/services/app-service");
+const scratch_port_leases_1 = require("../helpers/scratch-port-leases");
+/**
+ * Seen on the lab (S9+ 381103b720057ece, iPhone 00008150-000E78612168C01C):
+ * the iPhone's live preview and recording showed the S9+'s screen, because
+ * both streams ended up on local port 9100.
+ *
+ *  - A retried iOS start deleted its own port leases: acquire() handed the
+ *    iPhone back its existing 8100/9100 leases, then the stale-session cleanup
+ *    released "its" ports — the same numbers — so the new stream ran on
+ *    unleased ports.
+ *  - The allocator's OS probe bound 127.0.0.1, which macOS allows beside
+ *    iproxy's IPv6 wildcard listener, so it called 9100 free and leased it to
+ *    the S9+.
+ *
+ * Processes are fakes: an "iproxy" here is a real listener on `::` at its
+ * local port, which is what the real one is (`lsof`: `IPv6 TCP *:9100`).
+ * Nothing is spawned, and the lease table is a scratch SQLite file.
+ */
+const IPHONE = 'test-iphone-00008150';
+const S9 = 'test-android-s9';
+class FakeProcess extends events_1.EventEmitter {
+    constructor(command, args, server) {
+        super();
+        this.command = command;
+        this.args = args;
+        this.server = server;
+        this.pid = undefined;
+        this.exitCode = null;
+        this.stdout = new events_1.EventEmitter();
+        this.stderr = new events_1.EventEmitter();
+    }
+    kill() {
+        var _a;
+        if (this.exitCode === null)
+            this.exitCode = 137;
+        if ((_a = this.server) === null || _a === void 0 ? void 0 : _a.listening)
+            this.server.close();
+        return true;
+    }
+}
+/** Bind synchronously, as a real iproxy has by the time its process runs. */
+function listenNow(port, host = '::') {
+    const server = net_1.default.createServer((socket) => {
+        server.emit('accepted');
+        socket.destroy();
+    });
+    server.on('error', () => undefined);
+    server.listen(port, host);
+    return server;
+}
+function iosService() {
+    // Bypass the constructor: it starts watchdog intervals.
+    const svc = Object.create(IOSStreamService_1.default.prototype);
+    svc.sessions = new Map();
+    svc.startFlight = new singleFlight_1.SingleFlight();
+    svc.recoveryCooldowns = new Map();
+    svc.RECOVERY_COOLDOWN_MS = 30000;
+    svc.STREAM_PORT_TTL_MS = 90 * 60 * 1000;
+    svc.goIOSPath = '/nonexistent/go-ios';
+    return svc;
+}
+function androidService() {
+    const svc = Object.create(AndroidStreamService_1.default.prototype);
+    svc.sessions = new Map();
+    svc.startFlight = new singleFlight_1.SingleFlight();
+    return svc;
+}
+describe('iOS stream port leases (fake processes, real sockets, scratch DB)', () => {
+    const scratch = (0, scratch_port_leases_1.useScratchPortLeases)();
+    let allocator;
+    let devices;
+    let spawned;
+    let extraServers;
+    let appiumWdaPorts;
+    let ios;
+    let android;
+    beforeEach(() => {
+        allocator = new PortAllocator_1.PortAllocator();
+        // iOS and Android share the mjpeg range, as they do on the lab.
+        allocator.configure({
+            mjpeg: [scratch.base, scratch.base + 9],
+            wda: [scratch.base + 50, scratch.base + 59],
+        });
+        devices = new Map([
+            [IPHONE, { udid: IPHONE, host: 'h', platform: 'ios', busy: false, session_id: null }],
+            [S9, { udid: S9, host: 'h', platform: 'android', busy: false, session_id: null }],
+        ]);
+        spawned = [];
+        extraServers = [];
+        appiumWdaPorts = new Set();
+        sinon_1.default.stub(process, 'kill');
+        const real = typedi_1.Container.get.bind(typedi_1.Container);
+        sinon_1.default.stub(typedi_1.Container, 'get').callsFake((token) => {
+            if (token === PortAllocator_1.PortAllocator)
+                return allocator;
+            if (token === ProcessRegistry_1.ProcessRegistry)
+                return { track: () => undefined };
+            return real(token);
+        });
+        sinon_1.default.stub(device_store_1.DeviceStoreFactory, 'getStore').returns({
+            findDevice: (_a) => __awaiter(void 0, [_a], void 0, function* ({ udid }) { return devices.get(udid); }),
+            updateDevice: (udid, _host, data) => __awaiter(void 0, void 0, void 0, function* () { return Object.assign(devices.get(udid), data); }),
+        });
+        sinon_1.default.stub(child_process_1.default, 'spawn').callsFake(((command, args) => {
+            let server;
+            if (command === 'iproxy') {
+                server = listenNow(Number(args[args.length - 1].split(':')[0]));
+            }
+            const proc = new FakeProcess(command, args, server);
+            spawned.push(proc);
+            return proc;
+        }));
+        sinon_1.default.stub(app_service_1.APP_SERVICE, 'getWDAApp').resolves(null);
+        sinon_1.default.stub(InternalHttpClient_1.InternalHttpClient, 'get').rejects(new Error('no WDA in tests'));
+        ios = iosService();
+        // WDA answers on a port when an Appium session forwards it, or when this
+        // service's own iproxy forwards it while its runwda is up.
+        sinon_1.default.stub(ios, 'isWDARunning').callsFake((...args) => __awaiter(void 0, void 0, void 0, function* () {
+            const port = args[0];
+            if (appiumWdaPorts.has(port))
+                return true;
+            const runwda = spawned.some((p) => p.command === ios.goIOSPath && p.exitCode === null);
+            return (runwda &&
+                spawned.some((p) => p.command === 'iproxy' && p.exitCode === null && p.args.includes(`${port}:8100`)));
+        }));
+        sinon_1.default.stub(ios, 'cleanupOrphanTunnels').resolves();
+        sinon_1.default.stub(ios, 'killStaleProcesses').resolves();
+        sinon_1.default.stub(ios, 'ensureTunnel').resolves(null);
+        sinon_1.default.stub(ios, 'detectWDABundleId').resolves('com.test.WebDriverAgentRunner.xctrunner');
+        sinon_1.default.stub(ios, 'updateWDASettings').resolves();
+        sinon_1.default.stub(ios, 'createWDASession').resolves(null);
+        android = androidService();
+        sinon_1.default.stub(android, 'resolveAdbInvocation').resolves({ adbPath: 'adb', adbHostArgs: [] });
+        sinon_1.default.stub(android, 'captureLoop').callsFake((...args) => {
+            args[1].latestFrame = Buffer.from([0xff, 0xd8]);
+        });
+    });
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        for (const p of spawned)
+            p.kill();
+        for (const s of extraServers)
+            if (s.listening)
+                s.close();
+        for (const s of android.sessions.values())
+            (_a = s.server) === null || _a === void 0 ? void 0 : _a.close();
+        sinon_1.default.restore();
+    }));
+    after(() => {
+        const runLog = path_1.default.join(os_1.default.tmpdir(), 'xenon-logs', `runwda-${IPHONE}.log`);
+        if (fs_1.default.existsSync(runLog))
+            fs_1.default.unlinkSync(runLog);
+    });
+    function leaseOf(port) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return scratch.db.portLease.findUnique({ where: { port } });
+        });
+    }
+    /** A start that fails after taking its ports: go-ios missing, say. */
+    function failedIosStart() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const goIos = sinon_1.default.stub(ios, 'isGoIOSAvailable').resolves(false);
+            let err;
+            yield ios.startStream(IPHONE).catch((e) => (err = e));
+            (0, chai_1.expect)(err === null || err === void 0 ? void 0 : err.message).to.equal('go-ios not available');
+            (0, chai_1.expect)((_a = ios.getStreamStatus(IPHONE)) === null || _a === void 0 ? void 0 : _a.status, 'the failed session stays in the map').to.equal('error');
+            goIos.restore();
+            // The retry comes after the start cooldown has run out.
+            ios.recoveryCooldowns.clear();
+        });
+    }
+    it('a start after a failed start holds leases on both of its ports', () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        yield failedIosStart();
+        sinon_1.default.stub(ios, 'isGoIOSAvailable').resolves(true);
+        const { wdaPort, mjpegPort } = yield ios.startStream(IPHONE);
+        (0, chai_1.expect)((_a = ios.getStreamStatus(IPHONE)) === null || _a === void 0 ? void 0 : _a.status).to.equal('running');
+        const wda = yield leaseOf(wdaPort);
+        const mjpeg = yield leaseOf(mjpegPort);
+        (0, chai_1.expect)(wda === null || wda === void 0 ? void 0 : wda.leasedToUdid, `wda port ${wdaPort} must stay leased to the iPhone`).to.equal(IPHONE);
+        (0, chai_1.expect)(wda === null || wda === void 0 ? void 0 : wda.purpose).to.equal('wda');
+        (0, chai_1.expect)(mjpeg === null || mjpeg === void 0 ? void 0 : mjpeg.leasedToUdid, `mjpeg port ${mjpegPort} must stay leased to the iPhone`).to.equal(IPHONE);
+        (0, chai_1.expect)(mjpeg === null || mjpeg === void 0 ? void 0 : mjpeg.purpose).to.equal('mjpeg');
+    }));
+    it('stopping a stale iOS session never deletes a lease another device holds', () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        // The S9+ has since been leased the port the stale iPhone session names.
+        const now = Date.now();
+        yield scratch.db.portLease.create({
+            data: {
+                port: scratch.base,
+                purpose: 'mjpeg',
+                leasedToUdid: S9,
+                leasedAt: now,
+                expiresAt: now + 60000,
+            },
+        });
+        ios.sessions.set(IPHONE, {
+            udid: IPHONE,
+            wdaProcess: null,
+            forwardWDAProcess: null,
+            forwardMJPEGProcess: null,
+            tunnelProcess: null,
+            wdaPort: scratch.base + 50,
+            mjpegPort: scratch.base,
+            status: 'error',
+            lastViewerAt: Date.now(),
+            viewerCount: 0,
+        });
+        yield ios.stopStream(IPHONE);
+        (0, chai_1.expect)((_a = (yield leaseOf(scratch.base))) === null || _a === void 0 ? void 0 : _a.leasedToUdid, "the S9+'s lease must survive").to.equal(S9);
+    }));
+    it("an Android stream never gets the port a retried iOS stream is using (the lab's 9100)", () => __awaiter(void 0, void 0, void 0, function* () {
+        var _a;
+        yield failedIosStart();
+        sinon_1.default.stub(ios, 'isGoIOSAvailable').resolves(true);
+        const { mjpegPort: iphonePort } = yield ios.startStream(IPHONE);
+        const iproxy = (_a = spawned.find((p) => p.command === 'iproxy' && p.args.includes(`${iphonePort}:9100`))) === null || _a === void 0 ? void 0 : _a.server;
+        if (!iproxy)
+            throw new Error('no iproxy was spawned for the iPhone mjpeg port');
+        (0, chai_1.expect)(iproxy.listening, "the iPhone's iproxy is listening").to.equal(true);
+        const { mjpegPort: s9Port } = yield android.startStream(S9);
+        (0, chai_1.expect)(s9Port, 'the S9+ must be given a different port than the iPhone').to.not.equal(iphonePort);
+        // And the symptom itself: 127.0.0.1:<iPhone port> still reaches the iPhone.
+        const reached = new Promise((resolve) => {
+            iproxy.once('accepted', () => resolve(true));
+            setTimeout(() => resolve(false), 1000);
+        });
+        net_1.default.connect(iphonePort, '127.0.0.1').on('error', () => undefined);
+        (0, chai_1.expect)(yield reached, "127.0.0.1:<iPhone port> must reach the iPhone's iproxy").to.equal(true);
+    }));
+    describe('attaching to the WDA an Appium session runs', () => {
+        it("attaches on the device's WDA port and leases it, without launching a second WDA", () => __awaiter(void 0, void 0, void 0, function* () {
+            var _a, _b;
+            const appiumPort = scratch.base + 50;
+            Object.assign(devices.get(IPHONE), {
+                busy: true,
+                session_id: '7f0c5a52-appium-session',
+                wdaLocalPort: appiumPort,
+            });
+            // The xcuitest driver's forwarder: net.Server.listen(port), i.e. `::`.
+            extraServers.push(listenNow(appiumPort));
+            appiumWdaPorts.add(appiumPort);
+            const goIos = sinon_1.default.stub(ios, 'isGoIOSAvailable').resolves(true);
+            const { wdaPort, mjpegPort } = yield ios.startStream(IPHONE);
+            (0, chai_1.expect)(wdaPort).to.equal(appiumPort);
+            (0, chai_1.expect)(goIos.called, 'must not start a WDA of its own').to.equal(false);
+            (0, chai_1.expect)(spawned.some((p) => p.command === ios.goIOSPath)).to.equal(false);
+            (0, chai_1.expect)((_a = (yield leaseOf(appiumPort))) === null || _a === void 0 ? void 0 : _a.leasedToUdid).to.equal(IPHONE);
+            (0, chai_1.expect)((_b = (yield leaseOf(mjpegPort))) === null || _b === void 0 ? void 0 : _b.leasedToUdid).to.equal(IPHONE);
+        }));
+        it('does not attach to a WDA on that port when no Appium session holds the device', () => __awaiter(void 0, void 0, void 0, function* () {
+            // WDA's /status carries no udid, so an answer on a port the Device row
+            // names proves nothing on its own: two rows can carry the same stale
+            // port, and the answer may be another phone's.
+            const strayPort = scratch.base + 50;
+            Object.assign(devices.get(IPHONE), { wdaLocalPort: strayPort });
+            extraServers.push(listenNow(strayPort));
+            appiumWdaPorts.add(strayPort);
+            sinon_1.default.stub(ios, 'isGoIOSAvailable').resolves(true);
+            const { wdaPort } = yield ios.startStream(IPHONE);
+            (0, chai_1.expect)(wdaPort).to.not.equal(strayPort);
+            (0, chai_1.expect)(spawned.some((p) => p.command === ios.goIOSPath), 'starts its own WDA').to.equal(true);
+        }));
+    });
+});

package/lib/test/unit/ios-wda-status-identity.spec.js

@@ -0,0 +1,84 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const http_1 = __importDefault(require("http"));
+const IOSStreamService_1 = __importDefault(require("../../src/device-managers/ios/IOSStreamService"));
+/**
+ * isWDARunning took a udid and compared it with `value.ios.udid` from WDA's
+ * /status, which WDA never sends. The check could never refuse anything.
+ *
+ * What WDA does send (WebDriverAgent, FBSessionCommands.m handleGetStatus):
+ * ready, message, state, os {name, version, sdkVersion,
+ * testmanagerdVersion}, ios {ip} (plus simulatorVersion on a simulator),
+ * build and device (the form factor). /wda/device/info
+ * (FBCustomCommands.m) has a `uuid`, but that is identifierForVendor, not
+ * the phone's UDID. No endpoint names the phone.
+ *
+ * The fake WDA below listens on an OS-assigned port on 127.0.0.1.
+ */
+const REAL_WDA_STATUS = {
+    value: {
+        ready: true,
+        message: 'WebDriverAgent is ready to accept commands',
+        state: 'success',
+        os: { name: 'iOS', version: '26.7', sdkVersion: '26.0', testmanagerdVersion: 65535 },
+        ios: { ip: '192.168.0.23' },
+        build: {
+            time: 'Jul 14 2026 08:53:17',
+            productBundleIdentifier: 'com.facebook.WebDriverAgentRunner',
+            version: '11.4.1',
+        },
+        device: 'iphone',
+    },
+    sessionId: null,
+};
+describe('isWDARunning: WDA names no device', () => {
+    let server;
+    let port;
+    let requests;
+    let answers;
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        requests = 0;
+        answers = [];
+        server = http_1.default.createServer((req, res) => {
+            var _a;
+            requests++;
+            const status = (_a = answers.shift()) !== null && _a !== void 0 ? _a : 200;
+            res.writeHead(status, { 'content-type': 'application/json' });
+            res.end(JSON.stringify(status === 200 ? REAL_WDA_STATUS : { value: { error: 'busy' } }));
+        });
+        yield new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+        port = server.address().port;
+    }));
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        yield new Promise((resolve) => server.close(() => resolve()));
+    }));
+    function service() {
+        // Bypass the constructor: it starts watchdog intervals.
+        return Object.create(IOSStreamService_1.default.prototype);
+    }
+    it("answers ready from WDA's real /status, which carries no udid", () => __awaiter(void 0, void 0, void 0, function* () {
+        (0, chai_1.expect)(yield service().isWDARunning(port)).to.equal(true);
+        (0, chai_1.expect)(JSON.stringify(REAL_WDA_STATUS)).to.not.match(/udid/i);
+    }));
+    it('takes the retry budget as its second argument: 0 means one attempt', () => __awaiter(void 0, void 0, void 0, function* () {
+        // A transient 5xx is retried; with no retries asked for it is the answer.
+        answers = [503, 200];
+        const up = yield service().isWDARunning(port, 0);
+        (0, chai_1.expect)(requests, 'one attempt').to.equal(1);
+        (0, chai_1.expect)(up).to.equal(false);
+    }));
+});

package/lib/test/unit/is-xenon-running.spec.js

@@ -0,0 +1,69 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const http_1 = __importDefault(require("http"));
+const helpers_1 = require("../../src/helpers");
+/**
+ * A hub asks whether each node is alive, and a node whether its hub is, with
+ * isXenonRunning. With auth on, every /xenon/api route but /health needs a
+ * login, and neither side logs in for this probe: a probe of a login-only
+ * route called a running server dead, so the hub pruned its node's phones and
+ * the node never registered with its hub.
+ */
+describe('isXenonRunning', () => {
+    let server;
+    let base;
+    const hits = [];
+    /** Answers the way a Xenon server with auth on does. */
+    function authEnabledXenon(req, res) {
+        hits.push(String(req.url));
+        if (req.url === '/xenon/api/health') {
+            res.writeHead(200, { 'content-type': 'application/json' });
+            res.end(JSON.stringify({ ok: true }));
+            return;
+        }
+        res.writeHead(401, { 'content-type': 'application/json' });
+        res.end(JSON.stringify({ error: 'unauthenticated' }));
+    }
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        hits.length = 0;
+        server = http_1.default.createServer(authEnabledXenon);
+        yield new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+        base = `http://127.0.0.1:${server.address().port}`;
+    }));
+    afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        yield new Promise((resolve) => server.close(() => resolve()));
+    }));
+    it('calls a server with auth on running', () => __awaiter(void 0, void 0, void 0, function* () {
+        (0, chai_1.expect)(yield (0, helpers_1.isXenonRunning)(base)).to.equal(true);
+        (0, chai_1.expect)(hits).to.deep.equal(['/xenon/api/health']);
+    }));
+    it('calls a server that is not listening not running', () => __awaiter(void 0, void 0, void 0, function* () {
+        // A port that was free a moment ago: bound, read, then closed again.
+        const gone = http_1.default.createServer();
+        yield new Promise((resolve) => gone.listen(0, '127.0.0.1', resolve));
+        const port = gone.address().port;
+        yield new Promise((resolve) => gone.close(() => resolve()));
+        (0, chai_1.expect)(yield (0, helpers_1.isXenonRunning)(`http://127.0.0.1:${port}`)).to.equal(false);
+    }));
+    it('calls a server whose health route fails not running', () => __awaiter(void 0, void 0, void 0, function* () {
+        server.removeAllListeners('request');
+        server.on('request', (_req, res) => {
+            res.writeHead(503);
+            res.end();
+        });
+        (0, chai_1.expect)(yield (0, helpers_1.isXenonRunning)(base)).to.equal(false);
+    }));
+});

package/lib/test/unit/lease/LeaseOrphanSweeper.spec.js

@@ -62,7 +62,7 @@ describe('LeaseOrphanSweeper', () => {
             },
             portLease: { deleteMany: sinon_1.default.stub().resolves({ count: 0 }) },
         };
-        storeStub = { updateDevice: sinon_1.default.stub().resolves() };
+        storeStub = { releaseLeaseLock: sinon_1.default.stub().resolves(true) };
         const { LeaseOrphanSweeper } = yield Promise.resolve().then(() => __importStar(require('../../../src/services/lease/LeaseOrphanSweeper')));
         sweeper = new LeaseOrphanSweeper(prismaStub, storeStub);
     }));
@@ -76,7 +76,7 @@ describe('LeaseOrphanSweeper', () => {
         (0, chai_1.expect)(prismaStub.lease.update.firstCall.args[0].where.id).to.equal('lse_1');
         (0, chai_1.expect)(prismaStub.lease.update.firstCall.args[0].data.status).to.equal('expired');
         (0, chai_1.expect)(prismaStub.portLease.deleteMany.calledWith({ where: { leaseId: 'lse_1' } })).to.equal(true);
-        (0, chai_1.expect)(storeStub.updateDevice.calledWith('u1', 'h1', { busy: false })).to.equal(true);
+        (0, chai_1.expect)(storeStub.releaseLeaseLock.calledOnceWith('u1', 'h1')).to.equal(true);
     }));
     it('no-op when no stale leases', () => __awaiter(void 0, void 0, void 0, function* () {
         prismaStub.lease.findMany.resolves([]);

package/lib/test/unit/lease/LeaseService.spec.js

@@ -72,6 +72,7 @@ describe('LeaseService', () => {
                 udid: 'u1', host: 'h1', platform: 'android', sdk: '14', name: 'Pixel 7', teamId: null,
             }),
             updateDevice: sinon_1.default.stub().resolves(),
+            releaseLeaseLock: sinon_1.default.stub().resolves(true),
             getDevices: sinon_1.default.stub().resolves([]),
         };
         portClientStub = {
@@ -222,6 +223,30 @@ describe('LeaseService', () => {
         (0, chai_1.expect)(out.expiresAt).to.be.at.least(Date.now() + 50000);
         (0, chai_1.expect)(prismaStub.lease.updateMany.firstCall.args[0].where.status).to.equal('active');
     }));
+    // The sweeper marks a lease by missed heartbeats, not by expiresAt, so a
+    // lease can be past expiresAt and still 'active'. Heartbeat already
+    // refuses it; extend must too, or it hands the holder the lease back.
+    for (const op of ['heartbeat', 'extend']) {
+        it(`${op} refuses a lease past its expiresAt that the sweeper hasn't marked, and writes nothing`, () => __awaiter(void 0, void 0, void 0, function* () {
+            const { hashToken } = yield Promise.resolve().then(() => __importStar(require('../../../src/services/lease/leaseToken')));
+            const { LeaseGone } = yield Promise.resolve().then(() => __importStar(require('../../../src/services/lease/LeaseService')));
+            const tok = 'd'.repeat(64);
+            const expiresAt = Date.now() - 1000;
+            prismaStub.lease.findUnique.resolves({
+                id: 'lse_test',
+                tokenHash: hashToken(tok),
+                status: 'active',
+                expiresAt,
+                createdAt: new Date(Date.now() - 60000),
+            });
+            const call = op === 'extend' ? svc.extend('lse_test', tok, 60000) : svc.heartbeat('lse_test', tok);
+            let thrown = null;
+            yield call.catch((e) => (thrown = e));
+            (0, chai_1.expect)(thrown).to.be.instanceOf(LeaseGone);
+            (0, chai_1.expect)(thrown.message).to.equal(`lease lse_test expired at ${expiresAt}`);
+            (0, chai_1.expect)(prismaStub.lease.updateMany.called).to.equal(false);
+        }));
+    }
     it('release sets status=released and cascades PortLease delete', () => __awaiter(void 0, void 0, void 0, function* () {
         const { hashToken } = yield Promise.resolve().then(() => __importStar(require('../../../src/services/lease/leaseToken')));
         const tok = 'c'.repeat(64);
@@ -233,7 +258,9 @@ describe('LeaseService', () => {
         (0, chai_1.expect)(prismaStub.lease.updateMany.firstCall.args[0].data.status).to.equal('released');
         (0, chai_1.expect)(prismaStub.lease.updateMany.firstCall.args[0].where.status).to.equal('active');
         (0, chai_1.expect)(prismaStub.portLease.deleteMany.firstCall.args[0].where.leaseId).to.equal('lse_test');
-        (0, chai_1.expect)(storeStub.updateDevice.calledWith('u1', 'h1', { busy: false })).to.equal(true);
+        // Only the lease's lock (a session on the phone keeps it busy).
+        (0, chai_1.expect)(storeStub.releaseLeaseLock.calledWith('u1', 'h1')).to.equal(true);
+        (0, chai_1.expect)(storeStub.updateDevice.called).to.equal(false);
     }));
     it('rejects operations with mismatched token', () => __awaiter(void 0, void 0, void 0, function* () {
         const { hashToken } = yield Promise.resolve().then(() => __importStar(require('../../../src/services/lease/leaseToken')));