@xenon-device-management/xenon 2.13.1 → 2.14.0

package/lib/src/app/openapi/platform.yaml

@@ -187,11 +187,17 @@ paths:
       operationId: getLabSettings
       summary: Read the lab's settings and AI provider
       description: |
-        The lab-wide settings stored in the database (health checks and build cleanup), merged
-        with the AI settings currently in effect. API keys are never returned: `geminiSet`,
-        `openaiSet` and `anthropicSet` say only whether one is configured. A setting never saved
-        is absent. Needs the `ADMIN` role or above, as the dashboard's settings pages do; through
-        2.12 any signed-in user could read it.
+        The lab-wide settings in effect (health checks, build cleanup and the AI self-healing
+        switch), merged with the AI settings currently in effect. Each setting is the value saved
+        in the dashboard, else the plugin option the server was started with, else the default,
+        which is also what the server runs with. `defaults` holds the defaults themselves, which
+        is what "restore defaults" goes back to. Only `healthCheckSchedule` can be absent: no
+        schedule is set. Through 2.13 `enableSelfHealing` was neither stored nor sent, so the
+        Settings page always showed it on.
+        API keys are never returned: `geminiSet`, `openaiSet` and `anthropicSet` say only
+        whether one is configured. Needs the `ADMIN` role or above, as the dashboard's settings
+        pages do; through 2.12 any signed-in user could read it. Through 2.13 a setting never
+        saved was absent, and `defaults` was not sent.
       tags:
         - Configuration
       responses:
@@ -202,8 +208,19 @@ paths:
               schema:
                 $ref: '#/components/schemas/PlatformSettings'
               example:
+                enableSelfHealing: true
                 healthCheckIntervalMs: 300000
                 buildCleanupDays: 30
+                buildCleanupMaxCount: 100
+                buildCleanupSchedule: 0 0 * * *
+                deleteBuildAssets: true
+                defaults:
+                  enableSelfHealing: true
+                  healthCheckIntervalMs: 300000
+                  buildCleanupDays: 30
+                  buildCleanupMaxCount: 100
+                  buildCleanupSchedule: 0 0 * * *
+                  deleteBuildAssets: true
                 aiProvider: gemini
                 aiModel: gemini-3-flash-preview
                 geminiModel: gemini-3-flash-preview
@@ -233,7 +250,22 @@ paths:
         Saves the lab-wide settings and changes the AI provider settings. Every field is
         optional; fields not sent are left as they are, and unknown fields are ignored.
 
-        - Health-check and build-cleanup fields are stored in the database.
+        - Health-check and build-cleanup fields are stored in the database. A stored value
+          replaces the plugin option the server was started with, and applies without a
+          restart: the health check within a minute, the retention values at the next cleanup
+          run, and a new `buildCleanupSchedule` at once. The cleanup fields are checked first
+          and refused with `400` when they could not work: `buildCleanupDays` and
+          `buildCleanupMaxCount` must be whole numbers of at least 1, `buildCleanupSchedule` a
+          cron expression of five or six fields, `deleteBuildAssets` true or false. Nothing is
+          saved then. Send only the fields to change: a field sent is saved as the lab's own.
+          Through 2.13 only one setting could be saved: saving a second failed with a `500`.
+        - `enableSelfHealing` (true or false; anything else is refused with `400`) is the AI
+          self-healing switch. A stored value replaces the plugin option the server was started
+          with, and applies to the next command this server runs, with no restart. A session's
+          own `xe:options.healingTiers` still limits the tiers it may use. Through 2.13 the
+          switch was accepted and ignored. The value belongs to the server it is saved on:
+          saving it on a hub changes the hub's own sessions, not those on a node's phones,
+          which the node's own setting decides.
         - AI fields (`aiProvider`, `aiModel`, `aiBaseUrl` and the per-provider models) change the
           running server only. They are not stored, so a restart returns to the values the
           server was started with. API keys can't be set here; they come from the server's
@@ -254,6 +286,7 @@ paths:
               healthCheckIntervalMs: 300000
               buildCleanupDays: 14
               deleteBuildAssets: true
+              enableSelfHealing: false
               aiProvider: anthropic
               anthropicModel: claude-sonnet-4-6
       responses:
@@ -265,6 +298,16 @@ paths:
                 $ref: '#/components/schemas/Success'
               example:
                 success: true
+        '400':
+          description: A build-cleanup field or the self-healing switch has a value that could not work. Nothing was saved.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              example:
+                error: invalid_setting
+                field: buildCleanupDays
+                message: buildCleanupDays must be a whole number of at least 1.
         '401':
           $ref: '#/components/responses/Unauthorized'
         '403':
@@ -279,7 +322,7 @@ paths:
                 $ref: '#/components/schemas/Error'
               example:
                 error: true
-                message: Unique constraint failed on the fields (`id`)
+                message: Can't reach database server
   /api/config/reset-metrics:
     post:
       operationId: resetDeviceHealCounts
@@ -415,21 +458,39 @@ paths:
       description: |
         Adds a webhook, active at once. When one of its `events` happens Xenon POSTs to `url`:
 
-        - with `payloadTemplate`: the template, with each `{{key}}` (or `{{a.b}}`) replaced from
-          the event (`eventType` plus the event's fields), sent as JSON if the result parses as
-          JSON, otherwise as `{ "text": "<result>" }`;
+        - with `payloadTemplate`: the template, with each `{{name}}` (or `{{a.b}}`, `{{list.0.b}}`)
+          replaced from the event (`eventType` plus the event's fields, below). A template that
+          is JSON as written is filled in string by string, so a value holding a quote or a line
+          break can't break it, and is sent as that JSON. Any other template is filled in as
+          text and sent as JSON if the result parses, otherwise as `{ "text": "<result>" }`. A
+          `{{name}}` the event doesn't have is left as written;
         - otherwise, `type: slack`: a Slack message with an attachment;
         - otherwise: `{ "event": "<event>", "payload": { ... } }`.
 
-        Each delivery is one POST, never retried. A template whose result isn't JSON is sent
-        once, as text. A webhook that refuses an event or can't be reached doesn't fail the
-        event: the failure is logged on the server and the other webhooks still get it. Use
-        `POST /api/webhook/test` to see whether a webhook accepts deliveries.
+        Each delivery is one POST, never retried. A webhook that refuses an event or can't be
+        reached doesn't fail the event: the failure is logged on the server and the other
+        webhooks still get it. Use `POST /api/webhook/test` to see whether a webhook accepts
+        deliveries.
 
-        Events are `device_offline`, `session_failed`, `device_new` and
-        `selector_health_digest`. Neither `url` nor the event names are checked. Needs the
-        `ADMIN` role and the `admin` scope. With the dashboard cookie the request must come from
-        the same host.
+        What each event carries (a device event also has the device's other fields, which may
+        change; only the names listed are promised):
+
+        - `device_offline`, `device_new`: `udid`, `name`, `host`, `platform`.
+        Sent when a device stops being reported, or is first detected.
+
+        - `session_failed`: `sessionId`, `sessionName`, `failureReason`, `udid`, `deviceName`,
+        `platform`, `osVersion`, `startTime`, `endTime` (ISO 8601; unknown values are empty
+        text). Sent once per session when it ends as failed: the test marked it failed, a command
+        failed, it timed out for inactivity, its driver crashed, or its heartbeat stopped. Not
+        when the server itself shuts down, not for a session already failed when the server
+        started, and not when the dashboard is off, since the session's record is what it is
+        built from.
+
+        - `selector_health_digest`: `windowDays`, `totalHeals`, `distinctSelectors` and
+        `hotspots`, a list of `healCount`, `originalSelector` and `suggestedRewrite`.
+
+        Neither `url` nor the event names are checked. Needs the `ADMIN` role and the `admin`
+        scope. With the dashboard cookie the request must come from the same host.
       tags:
         - Webhooks
       requestBody:
@@ -536,11 +597,12 @@ paths:
       operationId: testWebhook
       summary: Send a test message to a URL
       description: |
-        Sends a sample `device_new` event (a device named `Test Device`, udid
-        `test-device-udid`, host `127.0.0.1`) to `url` the way a webhook with this `type` and
-        `payloadTemplate` gets its real events (see `POST /api/webhook`): the filled-in
-        template if there is one, else a Slack message for `type: slack` (the default), else
-        `{ "event": "device_new", "payload": { ... } }`. No stored webhook is involved.
+        Sends a sample of `event` (`device_new` unless named; a device named `Test Device`, udid
+        `test-device-udid`, host `127.0.0.1`, or for `session_failed` a failed session on it) to
+        `url` the way a webhook with this `type` and `payloadTemplate` gets its real events (see
+        `POST /api/webhook`, which lists what each event carries): the filled-in template if
+        there is one, else a Slack message for `type: slack` (the default), else
+        `{ "event": "<event>", "payload": { ... } }`. No stored webhook is involved.
 
         Answers `200` when `url` accepted the delivery (a 2xx), and `502 delivery_failed`, with
         the reason, when it refused it or couldn't be reached. Needs the `ADMIN` role and the
@@ -575,6 +637,16 @@ paths:
                     The webhook's template, filled in from the sample event as a real event's
                     would be.
                   example: '{"text": "{{eventType}}: {{name}} ({{udid}})"}'
+                event:
+                  type: string
+                  default: device_new
+                  enum:
+                    - device_offline
+                    - session_failed
+                    - device_new
+                    - selector_health_digest
+                  description: Which event to send a sample of.
+                  example: session_failed
             example:
               url: https://hooks.slack.com/services/T000/B000/XXXXXXXX
               type: slack
@@ -588,13 +660,18 @@ paths:
               example:
                 success: true
         '400':
-          description: '`url` is missing or not a string.'
+          description: '`url` is missing or not a string, or `event` is not one of the four.'
           content:
             application/json:
               schema:
                 $ref: '#/components/schemas/Error'
-              example:
-                error: url is required
+              examples:
+                noUrl:
+                  value:
+                    error: url is required
+                badEvent:
+                  value:
+                    error: 'event must be one of: device_offline, session_failed, device_new, selector_health_digest'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '403':
@@ -2264,8 +2341,12 @@ components:
           example: 734120
     PlatformSettings:
       type: object
-      description: The lab's stored settings, merged with the AI settings in effect. A setting never saved is absent.
+      description: The lab's settings in effect (saved, else the startup option, else the default), merged with the AI settings in effect. Only `healthCheckSchedule` can be absent.
       properties:
+        enableSelfHealing:
+          type: boolean
+          description: Whether a failed findElement goes on to the self-healing tiers.
+          example: true
         healthCheckIntervalMs:
           type: integer
           example: 300000
@@ -2283,6 +2364,27 @@ components:
           example: 0 3 * * *
         deleteBuildAssets:
           type: boolean
+        defaults:
+          type: object
+          description: The server's own defaults for the settings above, which is what "restore defaults" goes back to.
+          properties:
+            enableSelfHealing:
+              type: boolean
+              example: true
+            healthCheckIntervalMs:
+              type: integer
+              example: 300000
+            buildCleanupDays:
+              type: integer
+              example: 30
+            buildCleanupMaxCount:
+              type: integer
+              example: 100
+            buildCleanupSchedule:
+              type: string
+              example: 0 0 * * *
+            deleteBuildAssets:
+              type: boolean
         aiProvider:
           type: string
           example: gemini
@@ -2311,6 +2413,10 @@ components:
       type: object
       description: Any subset. Unknown fields are ignored.
       properties:
+        enableSelfHealing:
+          type: boolean
+          description: The AI self-healing switch. Takes effect at the next command, with no restart.
+          example: false
         healthCheckIntervalMs:
           type: integer
           example: 300000
@@ -2448,7 +2554,9 @@ components:
           example: slack
         payloadTemplate:
           type: string
-          description: A body template with `{{key}}` placeholders, used in place of the default body.
+          description: >-
+            A body template with `{{name}}` placeholders, used in place of the default body (see
+            `POST /api/webhook` for the names each event has).
           example: '{"text":"{{eventType}} on {{udid}}"}'
     PlatformApp:
       type: object

package/lib/src/app/routers/control.js

@@ -88,6 +88,8 @@ const streamLeave_1 = require("./streamLeave");
 const SessionOwnerResolver_1 = require("../../services/device-access/SessionOwnerResolver");
 const actor_1 = require("../../services/device-access/actor");
 const deviceAccessPolicy_1 = require("../../services/device-access/deviceAccessPolicy");
+const leaseHold_1 = require("../../services/device-access/leaseHold");
+const activeLeases_1 = require("../../services/lease/activeLeases");
 /**
  * The answer for an unknown udid, and for another team's phone (see
  * deviceTeamGuard): the same JSON on every route. Most routes used to send
@@ -623,7 +625,7 @@ const MJPEG_PROXY_CACHE = new Map();
  * Start stream endpoint - Initiates WDA and MJPEG streaming for iOS devices
  */
 router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b, _c, _d;
+    var _a, _b, _c, _d, _e, _f;
     const { udid } = req.params;
     // Someone is about to watch: a page that just left (a reload, or another tab
     // closing) must not stop the stream this page is starting.
@@ -654,6 +656,18 @@ router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void
             return res.status(503).json((0, deviceAccessPolicy_1.ownershipUnavailableBody)());
         }
     }
+    // Busy with nothing in session_id is a lease's lock: is it the caller's?
+    let leaseHolder = false;
+    if (device.busy && !device.session_id && !actor.isAdmin) {
+        try {
+            const held = yield (0, leaseHold_1.leaseHoldFor)({ udid, host: device.host }, (u, h) => (0, activeLeases_1.activeLeaseOn)(u, h), (id) => ownerResolver.leaseHolderOf(id));
+            leaseHolder = (0, deviceAccessPolicy_1.isLeaseHolder)(held, actorUserId, actor.apiKeyId);
+        }
+        catch (e) {
+            logger_1.default.error(`stream/start: lease lookup failed for ${udid}: ${(_b = e === null || e === void 0 ? void 0 : e.message) !== null && _b !== void 0 ? _b : e}`);
+            return res.status(503).json((0, deviceAccessPolicy_1.ownershipUnavailableBody)());
+        }
+    }
     const conflict = (0, streamStartConflict_1.decideStreamStartConflict)({
         udid,
         busy: !!device.busy,
@@ -663,6 +677,7 @@ router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void
         actorUserId,
         actorApiKeyId: actor.apiKeyId,
         isAdmin: actor.isAdmin,
+        leaseHolder,
     });
     if (conflict.action === 'deny') {
         // holderName lookup is cosmetic — a failure here must still deny (never
@@ -673,7 +688,7 @@ router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void
                 holderName = yield ownerResolver.displayName(conflict.holderId);
             }
             catch (e) {
-                logger_1.default.warn(`stream/start: holder name lookup failed for ${conflict.holderId}: ${(_b = e === null || e === void 0 ? void 0 : e.message) !== null && _b !== void 0 ? _b : e}`);
+                logger_1.default.warn(`stream/start: holder name lookup failed for ${conflict.holderId}: ${(_c = e === null || e === void 0 ? void 0 : e.message) !== null && _c !== void 0 ? _c : e}`);
             }
         }
         logger_1.default.warn(`Manual Control refused for ${udid}: ${conflict.code} (holder=${conflict.holderId || 'unknown'})`);
@@ -685,16 +700,20 @@ router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void
             yield (0, device_service_1.unblockDevice)(udid, device.host);
         }
         catch (e) {
-            logger_1.default.warn(`Failed to clear orphaned lock on ${udid}: ${(_c = e === null || e === void 0 ? void 0 : e.message) !== null && _c !== void 0 ? _c : e}`);
+            logger_1.default.warn(`Failed to clear orphaned lock on ${udid}: ${(_d = e === null || e === void 0 ? void 0 : e.message) !== null && _d !== void 0 ? _d : e}`);
         }
     }
     try {
-        const h264Cfg = (0, androidH264Config_1.resolveAndroidH264)((_d = typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs.streaming) === null || _d === void 0 ? void 0 : _d.androidH264);
+        const h264Cfg = (0, androidH264Config_1.resolveAndroidH264)((_e = typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs.streaming) === null || _e === void 0 ? void 0 : _e.androidH264);
         const flagOn = h264Cfg.enabled;
         // A recording device keeps MJPEG preview so we never run screenrecord and
         // the recording's screencap pipeline against the same device at once.
         const recording = yield typedi_1.Container.get(recording_store_1.RecordingStore).isRecording(udid);
-        const streamType = (0, streamType_1.resolveStreamType)(device.platform, flagOn, recording);
+        // A page that shows MJPEG says so (`player: 'mjpeg'`): device control, a
+        // browser with no WebCodecs, or a page whose H.264 player just failed.
+        // Anything else is the server's choice.
+        const clientShowsMjpeg = ((_f = req.body) === null || _f === void 0 ? void 0 : _f.player) === 'mjpeg';
+        const streamType = (0, streamType_1.resolveStreamType)(device.platform, flagOn, recording, !clientShowsMjpeg);
         let mjpegPort;
         if (device.platform === 'ios' || device.platform === 'tvos') {
             mjpegPort = (yield typedi_1.Container.get(IOSStreamService_1.default).startStream(udid)).mjpegPort;
@@ -705,6 +724,12 @@ router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void
             yield typedi_1.Container.get(AndroidH264StreamService_1.default).start(udid, { source: h264Cfg.source });
         }
         else {
+            // One capture pipeline per device: an H.264 capture still running for it
+            // (a tile's, or this page's own before its player failed) ends before the
+            // screencap loop starts.
+            const h264 = typedi_1.Container.get(AndroidH264StreamService_1.default);
+            if (h264.getMultiplexer(udid))
+                yield h264.stop(udid);
             mjpegPort = (yield typedi_1.Container.get(AndroidStreamService_1.default).startStream(udid)).mjpegPort;
         }
         // Lazy-load the screen size if missing: tiles need it to accept taps.

package/lib/src/app/routers/dashboard.js

@@ -56,6 +56,9 @@ const prisma_1 = require("../../prisma");
 const SessionManager_1 = require("../../sessions/SessionManager");
 const UniversalMjpegProxy_1 = require("../../helpers/UniversalMjpegProxy");
 const web_config_service_1 = require("../../data-service/web-config-service");
+const PluginContext_1 = require("../../PluginContext");
+const labSettings_1 = require("../../services/settings/labSettings");
+const SelfHealingSwitch_1 = require("../../services/settings/SelfHealingSwitch");
 const typedi_1 = require("typedi");
 const scopeGuard_1 = require("../../middleware/scopeGuard");
 const roleGuard_1 = require("../../middleware/roleGuard");
@@ -1103,6 +1106,10 @@ function getGlobalConfig(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         try {
             const dbConfig = yield typedi_1.Container.get(web_config_service_1.WebConfigService).getConfig();
+            // What the server runs with: a saved value, else the startup option, else
+            // the default. The pages show this (a saved value alone left them to guess
+            // at what a setting never saved was), and `defaults` for "restore defaults".
+            const effective = (0, labSettings_1.effectiveSettings)(typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs, dbConfig);
             // Merge with Environment Config (AI Settings)
             const { config } = yield Promise.resolve().then(() => __importStar(require('../../config')));
             // Sanitize keys - return boolean existence only
@@ -1118,7 +1125,9 @@ function getGlobalConfig(request, response) {
                 openaiSet: !!config.openaiApiKey,
                 anthropicSet: !!config.anthropicApiKey,
             };
-            return response.status(200).json(Object.assign(Object.assign({}, dbConfig), aiConfig));
+            return response
+                .status(200)
+                .json(Object.assign(Object.assign(Object.assign(Object.assign({}, dbConfig), effective), { defaults: (0, labSettings_1.settingsDefaults)() }), aiConfig));
         }
         catch (err) {
             return response.status(500).json({ error: true, message: err.message });
@@ -1129,6 +1138,14 @@ function updateGlobalConfig(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         try {
             const payload = request.body;
+            // Before anything is saved: a value the cleanup job would act on, such as a
+            // retention window of 0, is refused rather than stored.
+            const problem = (0, labSettings_1.validateSettingsUpdate)(payload !== null && payload !== void 0 ? payload : {});
+            if (problem) {
+                return response
+                    .status(400)
+                    .json({ error: 'invalid_setting', field: problem.field, message: problem.message });
+            }
             // Handle Runtime AI Config Overrides (Memory only)
             // Only pass defined values to avoid overwriting env vars (e.g. aiBaseUrl, ollamaModel) with undefined
             const runtimeOverrides = {};
@@ -1152,6 +1169,17 @@ function updateGlobalConfig(request, response) {
             }
             // Persist Web Configs to DB
             yield typedi_1.Container.get(web_config_service_1.WebConfigService).setConfig(payload);
+            // The command interceptor asks at every command and never reads the
+            // database: hand it the saved value, in force from the next command.
+            if (payload.enableSelfHealing !== undefined) {
+                typedi_1.Container.get(SelfHealingSwitch_1.SelfHealingSwitch).set(payload.enableSelfHealing);
+            }
+            // The retention values are read at each cleanup run, so they apply by
+            // themselves. A schedule is a timer: replace it now, not at the next restart.
+            if (payload.buildCleanupSchedule !== undefined) {
+                const { rescheduleCleanupBuilds } = yield Promise.resolve().then(() => __importStar(require('../../device-utils')));
+                yield rescheduleCleanupBuilds(typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs);
+            }
             return response.status(200).json({ success: true });
         }
         catch (err) {

package/lib/src/app/routers/grid.js

@@ -402,10 +402,33 @@ function updateTags(request, response) {
         if (!udid || !host || !Array.isArray(tags)) {
             return response.status(400).json({ error: 'Missing udid, host, or tags array' });
         }
+        // The tags are saved for the phone (deviceSettings.ts): only for one that
+        // is here. Through 2.13 any udid and host answered 200 and wrote nothing.
+        if (!(yield device_store_1.DeviceStoreFactory.getStore().findDevice({ udid, host }))) {
+            return response.status(404).json({ error: 'Device not found' });
+        }
         yield (0, device_service_1.updateDeviceTags)(udid, host, tags);
         response.status(200).json({ success: true });
     });
 }
+/**
+ * Every phone of this udid that this server knows: those connected now, and
+ * those whose settings are saved while they are away (deviceSettings.ts), so
+ * a phone that is not connected can still be moved, and its team deleted.
+ */
+function phonesOfUdid(udid) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const store = device_store_1.DeviceStoreFactory.getStore();
+        const phones = new Map();
+        for (const phone of [
+            ...(yield store.findDevices({ udid })),
+            ...(yield store.findSavedPhones(udid)),
+        ]) {
+            phones.set(`${phone.udid}\u0000${phone.host}`, { udid: phone.udid, host: phone.host });
+        }
+        return [...phones.values()];
+    });
+}
 function assignDeviceToTeam(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         const { udid } = request.params;
@@ -415,20 +438,19 @@ function assignDeviceToTeam(request, response) {
             if (!team)
                 return response.status(404).json({ error: 'team not found' });
         }
-        const result = yield prisma_1.prisma.device.updateMany({
-            where: { udid },
-            data: { teamId: teamId || null },
-        });
-        if (result.count === 0)
+        const phones = yield phonesOfUdid(udid);
+        if (phones.length === 0)
             return response.status(404).json({ error: 'device not found' });
-        // Refresh in-memory store so subsequent allocation sees the change immediately.
-        const rows = yield prisma_1.prisma.device.findMany({ where: { udid } });
-        for (const row of rows) {
-            yield store.updateDevice(row.udid, row.host, { teamId: row.teamId });
+        // Through the store, which saves the team for the phone as it writes the
+        // row: a phone keeps it when it disconnects and comes back.
+        for (const phone of phones) {
+            yield device_store_1.DeviceStoreFactory.getStore().updateDevice(phone.udid, phone.host, {
+                teamId: teamId || null,
+            });
         }
         // The live dashboard events follow the new team now, not after the cache's TTL.
         typedi_1.Container.get(DeviceTeamResolver_1.DeviceTeamResolver).note(udid, teamId || null);
-        response.json({ ok: true, updated: result.count });
+        response.json({ ok: true, updated: phones.length });
     });
 }
 /**

package/lib/src/app/routers/streamStartConflict.js

@@ -21,6 +21,9 @@ function decideStreamStartConflict(i) {
     var _a, _b;
     if (!i.busy)
         return PROCEED;
+    // Busy only by the caller's own lease: their phone to preview.
+    if (i.leaseHolder && !i.sessionId)
+        return PROCEED;
     if ((0, manualLock_1.isManualLock)(i.sessionId)) {
         // Orphan: lock persisted but nothing is serving (server restart, crashed
         // stop, H.264 stop that skipped unlock). Any caller may reclaim it.

package/lib/src/app/routers/streamType.js

@@ -9,10 +9,15 @@ exports.resolveStreamType = resolveStreamType;
  * MJPEG path so the recording pipeline (which reads the MJPEG server) is
  * unaffected (spec phase-1 rule). iOS/tvOS always use MJPEG (WDA emits it
  * directly).
+ *
+ * `clientCanPlayH264` is false when the page that starts the stream shows
+ * MJPEG: device control, or a browser without WebCodecs (exposed only on
+ * https and localhost). Starting an H.264 capture for it would run a second
+ * capture beside the screencap loop its `<img>` starts.
  */
-function resolveStreamType(platform, flagOn, recording) {
+function resolveStreamType(platform, flagOn, recording, clientCanPlayH264 = true) {
     const isAndroid = platform === 'android' || platform === 'androidtv' || platform === 'android-tv';
-    if (!isAndroid || !flagOn || recording)
+    if (!isAndroid || !flagOn || recording || !clientCanPlayH264)
         return 'mjpeg';
     return 'h264';
 }

package/lib/src/app/routers/webhook.js

@@ -14,6 +14,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = require("express");
 const NotificationService_1 = require("../../services/NotificationService");
+const webhookEvents_1 = require("../../services/webhookEvents");
 const typedi_1 = require("typedi");
 const logger_1 = __importDefault(require("../../logger"));
 const scopeGuard_1 = require("../../middleware/scopeGuard");
@@ -63,17 +64,20 @@ function deleteConfig(req, res) {
         }
     });
 }
-// Sends a sample event the way the webhook's real events go out (its type
-// and template), and says whether it was delivered.
+// Sends a sample of an event the way the webhook's real events go out (its
+// type and template), and says whether it was delivered.
 function testWebhook(req, res) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b;
-        const { url, type, payloadTemplate } = (_a = req.body) !== null && _a !== void 0 ? _a : {};
+        const { url, type, payloadTemplate, event } = (_a = req.body) !== null && _a !== void 0 ? _a : {};
         if (!url || typeof url !== 'string') {
             return res.status(400).json({ error: 'url is required' });
         }
+        if (event !== undefined && !(0, webhookEvents_1.isEventType)(event)) {
+            return res.status(400).json({ error: `event must be one of: ${webhookEvents_1.EVENT_TYPES.join(', ')}` });
+        }
         try {
-            yield typedi_1.Container.get(NotificationService_1.NotificationService).sendTest(url, type || 'slack', payloadTemplate);
+            yield typedi_1.Container.get(NotificationService_1.NotificationService).sendTest(url, type || 'slack', payloadTemplate, event);
             res.json({ success: true });
         }
         catch (err) {

package/lib/src/config.js

@@ -32,14 +32,20 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
-var _a;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.config = void 0;
+exports.config = exports.DEFAULT_MAX_CONCURRENT_RECORDINGS = void 0;
 exports.updateConfig = updateConfig;
 exports.resolveAuthDisabled = resolveAuthDisabled;
+exports.resolveMaxConcurrentRecordings = resolveMaxConcurrentRecordings;
+exports.resolveRecordingsAssetsPath = resolveRecordingsAssetsPath;
+exports.recordingConfigFrom = recordingConfigFrom;
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const basePath = path.join(os.homedir(), '.cache', 'xenon');
+/** Where free-form recordings go unless the option or the environment says otherwise. */
+const DEFAULT_RECORDINGS_ASSETS_PATH = path.join(basePath, 'assets', 'sessions', 'recordings');
+/** The server-wide cap on simultaneous free-form recordings, unless set. */
+exports.DEFAULT_MAX_CONCURRENT_RECORDINGS = 4;
 exports.config = {
     cacheDir: basePath,
     databaseProvider: process.env.XENON_DB_PROVIDER || 'sqlite',
@@ -87,9 +93,8 @@ exports.config = {
     passwordResetLogFallback: process.env.XENON_PASSWORD_RESET_LOG_FALLBACK === 'true',
     resetRateLimitAttempts: Number(process.env.XENON_RESET_RATE_LIMIT_ATTEMPTS) || 3,
     resetRateLimitWindowMs: Number(process.env.XENON_RESET_RATE_LIMIT_WINDOW_MS) || 15 * 60 * 1000,
-    recordingsAssetsPath: process.env.XENON_RECORDINGS_ASSETS_PATH ||
-        path.join(basePath, 'assets', 'sessions', 'recordings'),
-    maxConcurrentRecordings: Number((_a = process.env.XENON_MAX_CONCURRENT_RECORDINGS) !== null && _a !== void 0 ? _a : 4),
+    recordingsAssetsPath: resolveRecordingsAssetsPath(undefined, process.env.XENON_RECORDINGS_ASSETS_PATH),
+    maxConcurrentRecordings: resolveMaxConcurrentRecordings(undefined, process.env.XENON_MAX_CONCURRENT_RECORDINGS),
 };
 function updateConfig(newConfig) {
     Object.assign(exports.config, newConfig);
@@ -113,3 +118,43 @@ function updateConfig(newConfig) {
 function resolveAuthDisabled(pluginArgValue, envDisabled) {
     return pluginArgValue === true || envDisabled === true;
 }
+function wholeNumberAtLeastOne(value) {
+    return typeof value === 'number' && Number.isInteger(value) && value >= 1 ? value : undefined;
+}
+function nonBlankString(value) {
+    return typeof value === 'string' && value.trim() !== '' ? value.trim() : undefined;
+}
+/**
+ * The cap on simultaneous free-form recordings: the `maxConcurrentRecordings`
+ * plugin option when it is set, else XENON_MAX_CONCURRENT_RECORDINGS, else 4.
+ * Both options are `schema.json` options Appium accepts, but only the variable
+ * was ever read. A value that is not a whole number of at least 1 is ignored,
+ * so the next source answers: the variable used to be taken as `Number(env)`,
+ * and `many` made that NaN, which no recording count exceeds (no cap at all).
+ * Pure, so the precedence is testable without booting a server.
+ */
+function resolveMaxConcurrentRecordings(optionValue, envValue) {
+    var _a, _b;
+    const fromEnv = (envValue === null || envValue === void 0 ? void 0 : envValue.trim()) ? Number(envValue) : undefined;
+    return ((_b = (_a = wholeNumberAtLeastOne(optionValue)) !== null && _a !== void 0 ? _a : wholeNumberAtLeastOne(fromEnv)) !== null && _b !== void 0 ? _b : exports.DEFAULT_MAX_CONCURRENT_RECORDINGS);
+}
+/**
+ * Where free-form recordings are stored: the `recordingsAssetsPath` plugin
+ * option when it is set, else XENON_RECORDINGS_ASSETS_PATH, else
+ * `~/.cache/xenon/assets/sessions/recordings`. A blank value counts as unset.
+ */
+function resolveRecordingsAssetsPath(optionValue, envValue) {
+    var _a, _b;
+    return (_b = (_a = nonBlankString(optionValue)) !== null && _a !== void 0 ? _a : nonBlankString(envValue)) !== null && _b !== void 0 ? _b : DEFAULT_RECORDINGS_ASSETS_PATH;
+}
+/**
+ * The part of `config` the recording plugin options set, from the options the
+ * server started with and the environment as it is now. Applied at boot,
+ * before the artifact store and the concurrency gate read them.
+ */
+function recordingConfigFrom(pluginArgs, env = process.env) {
+    return {
+        maxConcurrentRecordings: resolveMaxConcurrentRecordings(pluginArgs.maxConcurrentRecordings, env.XENON_MAX_CONCURRENT_RECORDINGS),
+        recordingsAssetsPath: resolveRecordingsAssetsPath(pluginArgs.recordingsAssetsPath, env.XENON_RECORDINGS_ASSETS_PATH),
+    };
+}