@xenon-device-management/xenon 2.13.2 → 2.14.0

package/lib/src/app/openapi/control.yaml

@@ -1483,13 +1483,20 @@ paths:
         refused, and so is a command that fails, **with `200`** and an `error` field instead of
         `output` (the dashboard's terminal prints either).
 
-        - **Android** (`adb shell`): commands starting with `ls`, `ps`, `top`, `dumpsys battery`,
-        `dumpsys wifi`, `dumpsys power`, `whoami`, `getprop`, `pm list packages`, `ip addr`, `cat
-        /proc/meminfo`, `cat /proc/cpuinfo`, `date`, `uptime` or `netstat`.
+        A command must be one of the commands below, word for word, on one line. Where it takes
+        arguments, they are plain words: letters, digits and `._/:=@%+,-`. Anything a shell would
+        interpret (`;`, `|`, `&`, `$`, backticks, quotes, `<`, `>`) is refused.
 
-        - **iOS:** simulator commands `listapps`, `get_app_container`, `list`, `getenv` (through
-        `simctl`); go-ios commands `apps`, `info`, `syslog`, `list`, `deviceinfo`, `diagnostics`;
-        and `ls`, `ps`, `top`, `whoami`, `date`, `uptime`, `netstat`, `id`.
+        - **Android** (`adb shell`): `ls`, `ps`, `top`, `getprop`, `pm list packages`, `ip addr`,
+        `date` and `netstat`, with arguments; `dumpsys battery`, `dumpsys wifi`, `dumpsys power`,
+        `whoami`, `cat /proc/meminfo`, `cat /proc/cpuinfo` and `uptime`, without.
+
+        - **iOS simulator:** `listapps`, and `get_app_container` and `getenv` with arguments
+        (through `simctl`); `ls`, `ps`, `whoami`, `date`, `uptime` and `id` without arguments
+        (spawned in the simulator).
+
+        - **Real iPhone** (go-ios, through the phone's tunnel): `apps` with arguments and `info`
+        without. Xenon names the phone; a command may not pass `--udid`.
 
         Needs the `MEMBER` role and the `devices` scope. Refused with `409` while another user holds
         the device (their live preview or recording) or runs an Appium session on it; admins are
@@ -1639,14 +1646,14 @@ paths:
       operationId: scanDeviceScreen
       summary: Analyse the screen with OCR and AI
       description: >-
-        Screenshots the device, runs OCR over it (every word with its confidence and box) and asks
-        the configured AI provider for a qualitative read of the screen. No Appium session is
-        needed. Slow: allow tens of seconds.
+        Screenshots the device, runs OCR over it (every word with its confidence and box, in the
+        screenshot's pixels) and sends the screenshot to the configured AI provider for a short
+        description of the screen. No Appium session is needed. Slow: allow tens of seconds.
 
 
         If the analysis itself fails (an empty screenshot, OCR failing), the answer is `500` with
-        `{ status: 'error', message }`. If only the AI step fails, the answer is `200` and
-        `ai_insights` is `null`.
+        `{ status: 'error', message }`. If only the AI step fails, or no AI provider is
+        configured, the answer is `200`, `ai_insights` is `null` and `ai_insights_error` says why.
 
 
         Open to watchers. Needs the `MEMBER` role; any scope will do.
@@ -1683,10 +1690,27 @@ paths:
                               y0: 210
                               x1: 188
                               y1: 236
-                      ai_insights:
-                        summary: >-
-                          A sign-in form with email and password fields and a disabled Sign in
-                          button.
+                      ai_insights: >-
+                        A sign-in screen with empty email and password fields and a disabled Sign
+                        in button. No error or dialog is shown.
+                noProvider:
+                  summary: No AI provider configured
+                  value:
+                    status: success
+                    value:
+                      timestamp: '2026-10-04T14:05:22.118Z'
+                      ocr:
+                        text: Sign in
+                        words:
+                          - text: Sign
+                            confidence: 96.2
+                            bbox:
+                              x0: 142
+                              y0: 210
+                              x1: 188
+                              y1: 236
+                      ai_insights: null
+                      ai_insights_error: No AI provider is configured
         '400':
           description: This server has no device manager for the platform, or the udid is malformed.
           content:
@@ -1745,8 +1769,9 @@ paths:
         Runs one of Xenon's AI locator strategies against a fresh screenshot, as a test would with
         `findElement`, without an Appium session.
 
-        - `-custom:ai-text`: OCR; every word containing `selector` (case-insensitive, confidence
-        above 60%).
+        - `-custom:ai-text`: OCR; every place `selector` appears (case-insensitive), within a word
+        or across neighbouring words on one line, so `Sign in` matches; each match read with
+        confidence above 60%.
 
         - `-custom:ai-icon`: the configured AI provider looks for what `selector` describes; at most
         one match, a 40×40 box around the point it names.
@@ -1939,6 +1964,28 @@ paths:
         On a hub, for a node's phone, the request is forwarded to the node, which holds the phone by
         its own rules; on success the hub also marks the phone busy and held by you at once. A cloud
         provider's phone answers `501`.
+
+        One capture runs per Android device. A page that shows MJPEG (a browser that cannot decode
+        H.264, which on plain http it cannot, or a page whose H.264 player failed) sends
+        `player: mjpeg`: the server then starts the MJPEG capture, and first ends an H.264 capture
+        already running for the device, so the two never run together.
+      requestBody:
+        required: false
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                player:
+                  type: string
+                  enum:
+                    - mjpeg
+                  description: >-
+                    Set to `mjpeg` when the page shows MJPEG. Left out, or any other value, the
+                    server chooses: H.264 for an Android device when the setting is on and the
+                    device is not being recorded, MJPEG otherwise.
+            example:
+              player: mjpeg
       responses:
         '200':
           description: The preview is running. `type` says which transport to use.
@@ -2968,10 +3015,14 @@ components:
                           y1:
                             type: number
             ai_insights:
-              type: object
+              type: string
               nullable: true
-              additionalProperties: true
-              description: The AI provider's analysis; null if it was skipped or failed.
+              description: >-
+                The AI provider's description of the screen, in plain text; null when there is no
+                AI provider or its call failed.
+            ai_insights_error:
+              type: string
+              description: Why `ai_insights` is null. Present only then.
     ControlTestLocatorRequest:
       type: object
       required:

package/lib/src/app/openapi/grid.yaml

@@ -141,7 +141,8 @@ paths:
       description: |
         Sets `userBlocked` on a device, so no new session or lease is
         allocated to it. A session already running on it is not affected,
-        and neither is `busy`.
+        and neither is `busy`. The device stays blocked when it disconnects
+        and comes back, through restarts too.
 
         Send both `udid` and `host`, exactly as `GET /api/devices` shows
         them: the device is the row of that udid on that host. Without
@@ -247,7 +248,9 @@ paths:
         Replaces the device's tag list with `tags` (it doesn't append). Tags
         are free-form labels, such as `flaky` or `lab-row-3`, that a lease
         can filter on. The row is chosen by exact `udid` and `host`; a pair
-        that names no device changes nothing and still answers `200`.
+        that names no device is `404` (through 2.13 it changed nothing and
+        answered `200`). The device keeps its tags when it disconnects and
+        comes back, through restarts too.
 
         Needs role `ADMIN` and the `devices` scope.
       tags:
@@ -298,6 +301,14 @@ paths:
           $ref: '#/components/responses/Unauthorized'
         '403':
           $ref: '#/components/responses/Forbidden'
+        '404':
+          description: No device of that udid on that host.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              example:
+                error: Device not found
         '429':
           $ref: '#/components/responses/RateLimited'
   /api/device/{udid}/team:
@@ -307,10 +318,14 @@ paths:
       description: |
         Gives the device to a team, or with `teamId: null` returns it to the
         shared pool, which every member sees. A missing `teamId` counts as
-        null. Every row with this udid changes (on a hub, each node that
+        null. Every device with this udid changes (on a hub, each node that
         reports it), and allocation and live dashboard events follow the new
         team at once.
 
+        A device keeps its team when it disconnects and comes back, through
+        restarts too, and this also moves one of this udid that isn't
+        connected now: a team that one belongs to can't be deleted.
+
         Needs role `ADMIN` and the `admin` scope.
       tags:
         - Devices
@@ -336,7 +351,7 @@ paths:
                   example: clx9k2v0a0000qz8r4h7m3n2p
       responses:
         '200':
-          description: The device's team changed. `updated` is how many rows changed.
+          description: The device's team changed. `updated` is how many devices changed, connected or not.
           content:
             application/json:
               schema:
@@ -432,7 +447,10 @@ paths:
         (`reservedByUserId`), who alone, or an admin, may release or extend
         it. A device already reserved by someone else, or running an Appium
         session, is refused with `409`. The same user under the same
-        `reservedBy` may reserve it again, which restarts the clock.
+        `reservedBy` may reserve it again, which restarts the clock. The
+        reservation lasts until it ends even if the device disconnects or
+        the server restarts meanwhile; one that ended while the device was
+        away is not brought back.
 
         The device is the row of `udid` on `host`, so send both exactly as
         `GET /api/devices` shows them. No such row, or a device outside the

package/lib/src/app/openapi/platform.yaml

@@ -187,11 +187,17 @@ paths:
       operationId: getLabSettings
       summary: Read the lab's settings and AI provider
       description: |
-        The lab-wide settings stored in the database (health checks and build cleanup), merged
-        with the AI settings currently in effect. API keys are never returned: `geminiSet`,
-        `openaiSet` and `anthropicSet` say only whether one is configured. A setting never saved
-        is absent. Needs the `ADMIN` role or above, as the dashboard's settings pages do; through
-        2.12 any signed-in user could read it.
+        The lab-wide settings in effect (health checks, build cleanup and the AI self-healing
+        switch), merged with the AI settings currently in effect. Each setting is the value saved
+        in the dashboard, else the plugin option the server was started with, else the default,
+        which is also what the server runs with. `defaults` holds the defaults themselves, which
+        is what "restore defaults" goes back to. Only `healthCheckSchedule` can be absent: no
+        schedule is set. Through 2.13 `enableSelfHealing` was neither stored nor sent, so the
+        Settings page always showed it on.
+        API keys are never returned: `geminiSet`, `openaiSet` and `anthropicSet` say only
+        whether one is configured. Needs the `ADMIN` role or above, as the dashboard's settings
+        pages do; through 2.12 any signed-in user could read it. Through 2.13 a setting never
+        saved was absent, and `defaults` was not sent.
       tags:
         - Configuration
       responses:
@@ -202,8 +208,19 @@ paths:
               schema:
                 $ref: '#/components/schemas/PlatformSettings'
               example:
+                enableSelfHealing: true
                 healthCheckIntervalMs: 300000
                 buildCleanupDays: 30
+                buildCleanupMaxCount: 100
+                buildCleanupSchedule: 0 0 * * *
+                deleteBuildAssets: true
+                defaults:
+                  enableSelfHealing: true
+                  healthCheckIntervalMs: 300000
+                  buildCleanupDays: 30
+                  buildCleanupMaxCount: 100
+                  buildCleanupSchedule: 0 0 * * *
+                  deleteBuildAssets: true
                 aiProvider: gemini
                 aiModel: gemini-3-flash-preview
                 geminiModel: gemini-3-flash-preview
@@ -233,7 +250,22 @@ paths:
         Saves the lab-wide settings and changes the AI provider settings. Every field is
         optional; fields not sent are left as they are, and unknown fields are ignored.
 
-        - Health-check and build-cleanup fields are stored in the database.
+        - Health-check and build-cleanup fields are stored in the database. A stored value
+          replaces the plugin option the server was started with, and applies without a
+          restart: the health check within a minute, the retention values at the next cleanup
+          run, and a new `buildCleanupSchedule` at once. The cleanup fields are checked first
+          and refused with `400` when they could not work: `buildCleanupDays` and
+          `buildCleanupMaxCount` must be whole numbers of at least 1, `buildCleanupSchedule` a
+          cron expression of five or six fields, `deleteBuildAssets` true or false. Nothing is
+          saved then. Send only the fields to change: a field sent is saved as the lab's own.
+          Through 2.13 only one setting could be saved: saving a second failed with a `500`.
+        - `enableSelfHealing` (true or false; anything else is refused with `400`) is the AI
+          self-healing switch. A stored value replaces the plugin option the server was started
+          with, and applies to the next command this server runs, with no restart. A session's
+          own `xe:options.healingTiers` still limits the tiers it may use. Through 2.13 the
+          switch was accepted and ignored. The value belongs to the server it is saved on:
+          saving it on a hub changes the hub's own sessions, not those on a node's phones,
+          which the node's own setting decides.
         - AI fields (`aiProvider`, `aiModel`, `aiBaseUrl` and the per-provider models) change the
           running server only. They are not stored, so a restart returns to the values the
           server was started with. API keys can't be set here; they come from the server's
@@ -254,6 +286,7 @@ paths:
               healthCheckIntervalMs: 300000
               buildCleanupDays: 14
               deleteBuildAssets: true
+              enableSelfHealing: false
               aiProvider: anthropic
               anthropicModel: claude-sonnet-4-6
       responses:
@@ -265,6 +298,16 @@ paths:
                 $ref: '#/components/schemas/Success'
               example:
                 success: true
+        '400':
+          description: A build-cleanup field or the self-healing switch has a value that could not work. Nothing was saved.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              example:
+                error: invalid_setting
+                field: buildCleanupDays
+                message: buildCleanupDays must be a whole number of at least 1.
         '401':
           $ref: '#/components/responses/Unauthorized'
         '403':
@@ -279,7 +322,7 @@ paths:
                 $ref: '#/components/schemas/Error'
               example:
                 error: true
-                message: Unique constraint failed on the fields (`id`)
+                message: Can't reach database server
   /api/config/reset-metrics:
     post:
       operationId: resetDeviceHealCounts
@@ -415,21 +458,39 @@ paths:
       description: |
         Adds a webhook, active at once. When one of its `events` happens Xenon POSTs to `url`:
 
-        - with `payloadTemplate`: the template, with each `{{key}}` (or `{{a.b}}`) replaced from
-          the event (`eventType` plus the event's fields), sent as JSON if the result parses as
-          JSON, otherwise as `{ "text": "<result>" }`;
+        - with `payloadTemplate`: the template, with each `{{name}}` (or `{{a.b}}`, `{{list.0.b}}`)
+          replaced from the event (`eventType` plus the event's fields, below). A template that
+          is JSON as written is filled in string by string, so a value holding a quote or a line
+          break can't break it, and is sent as that JSON. Any other template is filled in as
+          text and sent as JSON if the result parses, otherwise as `{ "text": "<result>" }`. A
+          `{{name}}` the event doesn't have is left as written;
         - otherwise, `type: slack`: a Slack message with an attachment;
         - otherwise: `{ "event": "<event>", "payload": { ... } }`.
 
-        Each delivery is one POST, never retried. A template whose result isn't JSON is sent
-        once, as text. A webhook that refuses an event or can't be reached doesn't fail the
-        event: the failure is logged on the server and the other webhooks still get it. Use
-        `POST /api/webhook/test` to see whether a webhook accepts deliveries.
+        Each delivery is one POST, never retried. A webhook that refuses an event or can't be
+        reached doesn't fail the event: the failure is logged on the server and the other
+        webhooks still get it. Use `POST /api/webhook/test` to see whether a webhook accepts
+        deliveries.
 
-        Events are `device_offline`, `session_failed`, `device_new` and
-        `selector_health_digest`. Neither `url` nor the event names are checked. Needs the
-        `ADMIN` role and the `admin` scope. With the dashboard cookie the request must come from
-        the same host.
+        What each event carries (a device event also has the device's other fields, which may
+        change; only the names listed are promised):
+
+        - `device_offline`, `device_new`: `udid`, `name`, `host`, `platform`.
+        Sent when a device stops being reported, or is first detected.
+
+        - `session_failed`: `sessionId`, `sessionName`, `failureReason`, `udid`, `deviceName`,
+        `platform`, `osVersion`, `startTime`, `endTime` (ISO 8601; unknown values are empty
+        text). Sent once per session when it ends as failed: the test marked it failed, a command
+        failed, it timed out for inactivity, its driver crashed, or its heartbeat stopped. Not
+        when the server itself shuts down, not for a session already failed when the server
+        started, and not when the dashboard is off, since the session's record is what it is
+        built from.
+
+        - `selector_health_digest`: `windowDays`, `totalHeals`, `distinctSelectors` and
+        `hotspots`, a list of `healCount`, `originalSelector` and `suggestedRewrite`.
+
+        Neither `url` nor the event names are checked. Needs the `ADMIN` role and the `admin`
+        scope. With the dashboard cookie the request must come from the same host.
       tags:
         - Webhooks
       requestBody:
@@ -536,11 +597,12 @@ paths:
       operationId: testWebhook
       summary: Send a test message to a URL
       description: |
-        Sends a sample `device_new` event (a device named `Test Device`, udid
-        `test-device-udid`, host `127.0.0.1`) to `url` the way a webhook with this `type` and
-        `payloadTemplate` gets its real events (see `POST /api/webhook`): the filled-in
-        template if there is one, else a Slack message for `type: slack` (the default), else
-        `{ "event": "device_new", "payload": { ... } }`. No stored webhook is involved.
+        Sends a sample of `event` (`device_new` unless named; a device named `Test Device`, udid
+        `test-device-udid`, host `127.0.0.1`, or for `session_failed` a failed session on it) to
+        `url` the way a webhook with this `type` and `payloadTemplate` gets its real events (see
+        `POST /api/webhook`, which lists what each event carries): the filled-in template if
+        there is one, else a Slack message for `type: slack` (the default), else
+        `{ "event": "<event>", "payload": { ... } }`. No stored webhook is involved.
 
         Answers `200` when `url` accepted the delivery (a 2xx), and `502 delivery_failed`, with
         the reason, when it refused it or couldn't be reached. Needs the `ADMIN` role and the
@@ -575,6 +637,16 @@ paths:
                     The webhook's template, filled in from the sample event as a real event's
                     would be.
                   example: '{"text": "{{eventType}}: {{name}} ({{udid}})"}'
+                event:
+                  type: string
+                  default: device_new
+                  enum:
+                    - device_offline
+                    - session_failed
+                    - device_new
+                    - selector_health_digest
+                  description: Which event to send a sample of.
+                  example: session_failed
             example:
               url: https://hooks.slack.com/services/T000/B000/XXXXXXXX
               type: slack
@@ -588,13 +660,18 @@ paths:
               example:
                 success: true
         '400':
-          description: '`url` is missing or not a string.'
+          description: '`url` is missing or not a string, or `event` is not one of the four.'
           content:
             application/json:
               schema:
                 $ref: '#/components/schemas/Error'
-              example:
-                error: url is required
+              examples:
+                noUrl:
+                  value:
+                    error: url is required
+                badEvent:
+                  value:
+                    error: 'event must be one of: device_offline, session_failed, device_new, selector_health_digest'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '403':
@@ -2264,8 +2341,12 @@ components:
           example: 734120
     PlatformSettings:
       type: object
-      description: The lab's stored settings, merged with the AI settings in effect. A setting never saved is absent.
+      description: The lab's settings in effect (saved, else the startup option, else the default), merged with the AI settings in effect. Only `healthCheckSchedule` can be absent.
       properties:
+        enableSelfHealing:
+          type: boolean
+          description: Whether a failed findElement goes on to the self-healing tiers.
+          example: true
         healthCheckIntervalMs:
           type: integer
           example: 300000
@@ -2283,6 +2364,27 @@ components:
           example: 0 3 * * *
         deleteBuildAssets:
           type: boolean
+        defaults:
+          type: object
+          description: The server's own defaults for the settings above, which is what "restore defaults" goes back to.
+          properties:
+            enableSelfHealing:
+              type: boolean
+              example: true
+            healthCheckIntervalMs:
+              type: integer
+              example: 300000
+            buildCleanupDays:
+              type: integer
+              example: 30
+            buildCleanupMaxCount:
+              type: integer
+              example: 100
+            buildCleanupSchedule:
+              type: string
+              example: 0 0 * * *
+            deleteBuildAssets:
+              type: boolean
         aiProvider:
           type: string
           example: gemini
@@ -2311,6 +2413,10 @@ components:
       type: object
       description: Any subset. Unknown fields are ignored.
       properties:
+        enableSelfHealing:
+          type: boolean
+          description: The AI self-healing switch. Takes effect at the next command, with no restart.
+          example: false
         healthCheckIntervalMs:
           type: integer
           example: 300000
@@ -2448,7 +2554,9 @@ components:
           example: slack
         payloadTemplate:
           type: string
-          description: A body template with `{{key}}` placeholders, used in place of the default body.
+          description: >-
+            A body template with `{{name}}` placeholders, used in place of the default body (see
+            `POST /api/webhook` for the names each event has).
           example: '{"text":"{{eventType}} on {{udid}}"}'
     PlatformApp:
       type: object

package/lib/src/app/routers/control.js

@@ -625,7 +625,7 @@ const MJPEG_PROXY_CACHE = new Map();
  * Start stream endpoint - Initiates WDA and MJPEG streaming for iOS devices
  */
 router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b, _c, _d, _e;
+    var _a, _b, _c, _d, _e, _f;
     const { udid } = req.params;
     // Someone is about to watch: a page that just left (a reload, or another tab
     // closing) must not stop the stream this page is starting.
@@ -709,7 +709,11 @@ router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void
         // A recording device keeps MJPEG preview so we never run screenrecord and
         // the recording's screencap pipeline against the same device at once.
         const recording = yield typedi_1.Container.get(recording_store_1.RecordingStore).isRecording(udid);
-        const streamType = (0, streamType_1.resolveStreamType)(device.platform, flagOn, recording);
+        // A page that shows MJPEG says so (`player: 'mjpeg'`): device control, a
+        // browser with no WebCodecs, or a page whose H.264 player just failed.
+        // Anything else is the server's choice.
+        const clientShowsMjpeg = ((_f = req.body) === null || _f === void 0 ? void 0 : _f.player) === 'mjpeg';
+        const streamType = (0, streamType_1.resolveStreamType)(device.platform, flagOn, recording, !clientShowsMjpeg);
         let mjpegPort;
         if (device.platform === 'ios' || device.platform === 'tvos') {
             mjpegPort = (yield typedi_1.Container.get(IOSStreamService_1.default).startStream(udid)).mjpegPort;
@@ -720,6 +724,12 @@ router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void
             yield typedi_1.Container.get(AndroidH264StreamService_1.default).start(udid, { source: h264Cfg.source });
         }
         else {
+            // One capture pipeline per device: an H.264 capture still running for it
+            // (a tile's, or this page's own before its player failed) ends before the
+            // screencap loop starts.
+            const h264 = typedi_1.Container.get(AndroidH264StreamService_1.default);
+            if (h264.getMultiplexer(udid))
+                yield h264.stop(udid);
             mjpegPort = (yield typedi_1.Container.get(AndroidStreamService_1.default).startStream(udid)).mjpegPort;
         }
         // Lazy-load the screen size if missing: tiles need it to accept taps.

package/lib/src/app/routers/dashboard.js

@@ -56,6 +56,9 @@ const prisma_1 = require("../../prisma");
 const SessionManager_1 = require("../../sessions/SessionManager");
 const UniversalMjpegProxy_1 = require("../../helpers/UniversalMjpegProxy");
 const web_config_service_1 = require("../../data-service/web-config-service");
+const PluginContext_1 = require("../../PluginContext");
+const labSettings_1 = require("../../services/settings/labSettings");
+const SelfHealingSwitch_1 = require("../../services/settings/SelfHealingSwitch");
 const typedi_1 = require("typedi");
 const scopeGuard_1 = require("../../middleware/scopeGuard");
 const roleGuard_1 = require("../../middleware/roleGuard");
@@ -1103,6 +1106,10 @@ function getGlobalConfig(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         try {
             const dbConfig = yield typedi_1.Container.get(web_config_service_1.WebConfigService).getConfig();
+            // What the server runs with: a saved value, else the startup option, else
+            // the default. The pages show this (a saved value alone left them to guess
+            // at what a setting never saved was), and `defaults` for "restore defaults".
+            const effective = (0, labSettings_1.effectiveSettings)(typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs, dbConfig);
             // Merge with Environment Config (AI Settings)
             const { config } = yield Promise.resolve().then(() => __importStar(require('../../config')));
             // Sanitize keys - return boolean existence only
@@ -1118,7 +1125,9 @@ function getGlobalConfig(request, response) {
                 openaiSet: !!config.openaiApiKey,
                 anthropicSet: !!config.anthropicApiKey,
             };
-            return response.status(200).json(Object.assign(Object.assign({}, dbConfig), aiConfig));
+            return response
+                .status(200)
+                .json(Object.assign(Object.assign(Object.assign(Object.assign({}, dbConfig), effective), { defaults: (0, labSettings_1.settingsDefaults)() }), aiConfig));
         }
         catch (err) {
             return response.status(500).json({ error: true, message: err.message });
@@ -1129,6 +1138,14 @@ function updateGlobalConfig(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         try {
             const payload = request.body;
+            // Before anything is saved: a value the cleanup job would act on, such as a
+            // retention window of 0, is refused rather than stored.
+            const problem = (0, labSettings_1.validateSettingsUpdate)(payload !== null && payload !== void 0 ? payload : {});
+            if (problem) {
+                return response
+                    .status(400)
+                    .json({ error: 'invalid_setting', field: problem.field, message: problem.message });
+            }
             // Handle Runtime AI Config Overrides (Memory only)
             // Only pass defined values to avoid overwriting env vars (e.g. aiBaseUrl, ollamaModel) with undefined
             const runtimeOverrides = {};
@@ -1152,6 +1169,17 @@ function updateGlobalConfig(request, response) {
             }
             // Persist Web Configs to DB
             yield typedi_1.Container.get(web_config_service_1.WebConfigService).setConfig(payload);
+            // The command interceptor asks at every command and never reads the
+            // database: hand it the saved value, in force from the next command.
+            if (payload.enableSelfHealing !== undefined) {
+                typedi_1.Container.get(SelfHealingSwitch_1.SelfHealingSwitch).set(payload.enableSelfHealing);
+            }
+            // The retention values are read at each cleanup run, so they apply by
+            // themselves. A schedule is a timer: replace it now, not at the next restart.
+            if (payload.buildCleanupSchedule !== undefined) {
+                const { rescheduleCleanupBuilds } = yield Promise.resolve().then(() => __importStar(require('../../device-utils')));
+                yield rescheduleCleanupBuilds(typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs);
+            }
             return response.status(200).json({ success: true });
         }
         catch (err) {

package/lib/src/app/routers/grid.js

@@ -402,10 +402,33 @@ function updateTags(request, response) {
         if (!udid || !host || !Array.isArray(tags)) {
             return response.status(400).json({ error: 'Missing udid, host, or tags array' });
         }
+        // The tags are saved for the phone (deviceSettings.ts): only for one that
+        // is here. Through 2.13 any udid and host answered 200 and wrote nothing.
+        if (!(yield device_store_1.DeviceStoreFactory.getStore().findDevice({ udid, host }))) {
+            return response.status(404).json({ error: 'Device not found' });
+        }
         yield (0, device_service_1.updateDeviceTags)(udid, host, tags);
         response.status(200).json({ success: true });
     });
 }
+/**
+ * Every phone of this udid that this server knows: those connected now, and
+ * those whose settings are saved while they are away (deviceSettings.ts), so
+ * a phone that is not connected can still be moved, and its team deleted.
+ */
+function phonesOfUdid(udid) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const store = device_store_1.DeviceStoreFactory.getStore();
+        const phones = new Map();
+        for (const phone of [
+            ...(yield store.findDevices({ udid })),
+            ...(yield store.findSavedPhones(udid)),
+        ]) {
+            phones.set(`${phone.udid}\u0000${phone.host}`, { udid: phone.udid, host: phone.host });
+        }
+        return [...phones.values()];
+    });
+}
 function assignDeviceToTeam(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         const { udid } = request.params;
@@ -415,20 +438,19 @@ function assignDeviceToTeam(request, response) {
             if (!team)
                 return response.status(404).json({ error: 'team not found' });
         }
-        const result = yield prisma_1.prisma.device.updateMany({
-            where: { udid },
-            data: { teamId: teamId || null },
-        });
-        if (result.count === 0)
+        const phones = yield phonesOfUdid(udid);
+        if (phones.length === 0)
             return response.status(404).json({ error: 'device not found' });
-        // Refresh in-memory store so subsequent allocation sees the change immediately.
-        const rows = yield prisma_1.prisma.device.findMany({ where: { udid } });
-        for (const row of rows) {
-            yield store.updateDevice(row.udid, row.host, { teamId: row.teamId });
+        // Through the store, which saves the team for the phone as it writes the
+        // row: a phone keeps it when it disconnects and comes back.
+        for (const phone of phones) {
+            yield device_store_1.DeviceStoreFactory.getStore().updateDevice(phone.udid, phone.host, {
+                teamId: teamId || null,
+            });
         }
         // The live dashboard events follow the new team now, not after the cache's TTL.
         typedi_1.Container.get(DeviceTeamResolver_1.DeviceTeamResolver).note(udid, teamId || null);
-        response.json({ ok: true, updated: result.count });
+        response.json({ ok: true, updated: phones.length });
     });
 }
 /**