@xenon-device-management/xenon 2.13.2 → 2.15.0

package/lib/src/app/openapi/platform.yaml

@@ -187,11 +187,19 @@ paths:
       operationId: getLabSettings
       summary: Read the lab's settings and AI provider
       description: |
-        The lab-wide settings stored in the database (health checks and build cleanup), merged
-        with the AI settings currently in effect. API keys are never returned: `geminiSet`,
-        `openaiSet` and `anthropicSet` say only whether one is configured. A setting never saved
-        is absent. Needs the `ADMIN` role or above, as the dashboard's settings pages do; through
-        2.12 any signed-in user could read it.
+        The lab-wide settings in effect (health checks, build cleanup and the AI self-healing
+        switch), merged with the AI settings in effect (provider, models and base URL). Each
+        setting is the value saved in the dashboard, else the plugin option or environment
+        variable the server was started with, else the default, which is also what the server
+        runs with. A model or base URL set nowhere is absent: the provider's own applies. A user
+        name, password or query value in the base URL is sent as `***`. `defaults` holds the defaults themselves, which
+        is what "restore defaults" goes back to. Only `healthCheckSchedule` can be absent: no
+        schedule is set. Through 2.13 `enableSelfHealing` was neither stored nor sent, so the
+        Settings page always showed it on.
+        API keys are never returned: `geminiSet`, `openaiSet` and `anthropicSet` say only
+        whether one is configured. Needs the `ADMIN` role or above, as the dashboard's settings
+        pages do; through 2.12 any signed-in user could read it. Through 2.13 a setting never
+        saved was absent, and `defaults` was not sent.
       tags:
         - Configuration
       responses:
@@ -202,8 +210,19 @@ paths:
               schema:
                 $ref: '#/components/schemas/PlatformSettings'
               example:
+                enableSelfHealing: true
                 healthCheckIntervalMs: 300000
                 buildCleanupDays: 30
+                buildCleanupMaxCount: 100
+                buildCleanupSchedule: 0 0 * * *
+                deleteBuildAssets: true
+                defaults:
+                  enableSelfHealing: true
+                  healthCheckIntervalMs: 300000
+                  buildCleanupDays: 30
+                  buildCleanupMaxCount: 100
+                  buildCleanupSchedule: 0 0 * * *
+                  deleteBuildAssets: true
                 aiProvider: gemini
                 aiModel: gemini-3-flash-preview
                 geminiModel: gemini-3-flash-preview
@@ -233,11 +252,34 @@ paths:
         Saves the lab-wide settings and changes the AI provider settings. Every field is
         optional; fields not sent are left as they are, and unknown fields are ignored.
 
-        - Health-check and build-cleanup fields are stored in the database.
-        - AI fields (`aiProvider`, `aiModel`, `aiBaseUrl` and the per-provider models) change the
-          running server only. They are not stored, so a restart returns to the values the
-          server was started with. API keys can't be set here; they come from the server's
-          environment.
+        - Health-check and build-cleanup fields are stored in the database. A stored value
+          replaces the plugin option the server was started with, and applies without a
+          restart: the health check within a minute, the retention values at the next cleanup
+          run, and a new `buildCleanupSchedule` at once. The cleanup fields are checked first
+          and refused with `400` when they could not work: `buildCleanupDays` and
+          `buildCleanupMaxCount` must be whole numbers of at least 1, `buildCleanupSchedule` a
+          cron expression of five or six fields, `deleteBuildAssets` true or false. Nothing is
+          saved then. Send only the fields to change: a field sent is saved as the lab's own.
+          Through 2.13 only one setting could be saved: saving a second failed with a `500`.
+        - `enableSelfHealing` (true or false; anything else is refused with `400`) is the AI
+          self-healing switch. A stored value replaces the plugin option the server was started
+          with, and applies to the next command this server runs, with no restart. A session's
+          own `xe:options.healingTiers` still limits the tiers it may use. Through 2.13 the
+          switch was accepted and ignored. The value belongs to the server it is saved on:
+          saving it on a hub changes the hub's own sessions, not those on a node's phones,
+          which the node's own setting decides.
+        - AI fields (`aiProvider`, `aiModel`, `aiBaseUrl` and the per-provider models) are stored
+          too. A stored value replaces the plugin option or environment variable the server was
+          started with, and applies to the next AI call, with no restart. An empty value removes
+          the stored one, and the server's own applies again. They are checked first and refused
+          with `400`: `aiProvider` must be `gemini`, `openai`, `anthropic` or `ollama`; a model
+          name has no spaces and at most 200 characters; `aiBaseUrl` is an http or https address
+          with no user name, password or query. Through 2.14 they changed the running server
+          only, and a restart undid them. Like the self-healing switch, they belong to the server
+          they are saved on.
+        - API keys can't be set here, and are never stored: they come from the server's
+          environment. `aiTemperature`, `aiMaxTokens` and `aiTopP`, which the AI engine page sent
+          through 2.14, were never used by any AI call and are ignored like any unknown field.
 
         Needs the `SUPER_ADMIN` role and the `admin` scope; an `ADMIN` gets `403` with a message
         saying so (through 2.12 an `ADMIN` could). With the dashboard cookie the request must
@@ -254,6 +296,7 @@ paths:
               healthCheckIntervalMs: 300000
               buildCleanupDays: 14
               deleteBuildAssets: true
+              enableSelfHealing: false
               aiProvider: anthropic
               anthropicModel: claude-sonnet-4-6
       responses:
@@ -265,6 +308,16 @@ paths:
                 $ref: '#/components/schemas/Success'
               example:
                 success: true
+        '400':
+          description: A build-cleanup field, the self-healing switch or an AI field has a value that could not work. Nothing was saved.
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Error'
+              example:
+                error: invalid_setting
+                field: buildCleanupDays
+                message: buildCleanupDays must be a whole number of at least 1.
         '401':
           $ref: '#/components/responses/Unauthorized'
         '403':
@@ -279,7 +332,7 @@ paths:
                 $ref: '#/components/schemas/Error'
               example:
                 error: true
-                message: Unique constraint failed on the fields (`id`)
+                message: Can't reach database server
   /api/config/reset-metrics:
     post:
       operationId: resetDeviceHealCounts
@@ -415,21 +468,39 @@ paths:
       description: |
         Adds a webhook, active at once. When one of its `events` happens Xenon POSTs to `url`:
 
-        - with `payloadTemplate`: the template, with each `{{key}}` (or `{{a.b}}`) replaced from
-          the event (`eventType` plus the event's fields), sent as JSON if the result parses as
-          JSON, otherwise as `{ "text": "<result>" }`;
+        - with `payloadTemplate`: the template, with each `{{name}}` (or `{{a.b}}`, `{{list.0.b}}`)
+          replaced from the event (`eventType` plus the event's fields, below). A template that
+          is JSON as written is filled in string by string, so a value holding a quote or a line
+          break can't break it, and is sent as that JSON. Any other template is filled in as
+          text and sent as JSON if the result parses, otherwise as `{ "text": "<result>" }`. A
+          `{{name}}` the event doesn't have is left as written;
         - otherwise, `type: slack`: a Slack message with an attachment;
         - otherwise: `{ "event": "<event>", "payload": { ... } }`.
 
-        Each delivery is one POST, never retried. A template whose result isn't JSON is sent
-        once, as text. A webhook that refuses an event or can't be reached doesn't fail the
-        event: the failure is logged on the server and the other webhooks still get it. Use
-        `POST /api/webhook/test` to see whether a webhook accepts deliveries.
+        Each delivery is one POST, never retried. A webhook that refuses an event or can't be
+        reached doesn't fail the event: the failure is logged on the server and the other
+        webhooks still get it. Use `POST /api/webhook/test` to see whether a webhook accepts
+        deliveries.
 
-        Events are `device_offline`, `session_failed`, `device_new` and
-        `selector_health_digest`. Neither `url` nor the event names are checked. Needs the
-        `ADMIN` role and the `admin` scope. With the dashboard cookie the request must come from
-        the same host.
+        What each event carries (a device event also has the device's other fields, which may
+        change; only the names listed are promised):
+
+        - `device_offline`, `device_new`: `udid`, `name`, `host`, `platform`.
+        Sent when a device stops being reported, or is first detected.
+
+        - `session_failed`: `sessionId`, `sessionName`, `failureReason`, `udid`, `deviceName`,
+        `platform`, `osVersion`, `startTime`, `endTime` (ISO 8601; unknown values are empty
+        text). Sent once per session when it ends as failed: the test marked it failed, a command
+        failed, it timed out for inactivity, its driver crashed, or its heartbeat stopped. Not
+        when the server itself shuts down, not for a session already failed when the server
+        started, and not when the dashboard is off, since the session's record is what it is
+        built from.
+
+        - `selector_health_digest`: `windowDays`, `totalHeals`, `distinctSelectors` and
+        `hotspots`, a list of `healCount`, `originalSelector` and `suggestedRewrite`.
+
+        Neither `url` nor the event names are checked. Needs the `ADMIN` role and the `admin`
+        scope. With the dashboard cookie the request must come from the same host.
       tags:
         - Webhooks
       requestBody:
@@ -536,11 +607,12 @@ paths:
       operationId: testWebhook
       summary: Send a test message to a URL
       description: |
-        Sends a sample `device_new` event (a device named `Test Device`, udid
-        `test-device-udid`, host `127.0.0.1`) to `url` the way a webhook with this `type` and
-        `payloadTemplate` gets its real events (see `POST /api/webhook`): the filled-in
-        template if there is one, else a Slack message for `type: slack` (the default), else
-        `{ "event": "device_new", "payload": { ... } }`. No stored webhook is involved.
+        Sends a sample of `event` (`device_new` unless named; a device named `Test Device`, udid
+        `test-device-udid`, host `127.0.0.1`, or for `session_failed` a failed session on it) to
+        `url` the way a webhook with this `type` and `payloadTemplate` gets its real events (see
+        `POST /api/webhook`, which lists what each event carries): the filled-in template if
+        there is one, else a Slack message for `type: slack` (the default), else
+        `{ "event": "<event>", "payload": { ... } }`. No stored webhook is involved.
 
         Answers `200` when `url` accepted the delivery (a 2xx), and `502 delivery_failed`, with
         the reason, when it refused it or couldn't be reached. Needs the `ADMIN` role and the
@@ -575,6 +647,16 @@ paths:
                     The webhook's template, filled in from the sample event as a real event's
                     would be.
                   example: '{"text": "{{eventType}}: {{name}} ({{udid}})"}'
+                event:
+                  type: string
+                  default: device_new
+                  enum:
+                    - device_offline
+                    - session_failed
+                    - device_new
+                    - selector_health_digest
+                  description: Which event to send a sample of.
+                  example: session_failed
             example:
               url: https://hooks.slack.com/services/T000/B000/XXXXXXXX
               type: slack
@@ -588,13 +670,18 @@ paths:
               example:
                 success: true
         '400':
-          description: '`url` is missing or not a string.'
+          description: '`url` is missing or not a string, or `event` is not one of the four.'
           content:
             application/json:
               schema:
                 $ref: '#/components/schemas/Error'
-              example:
-                error: url is required
+              examples:
+                noUrl:
+                  value:
+                    error: url is required
+                badEvent:
+                  value:
+                    error: 'event must be one of: device_offline, session_failed, device_new, selector_health_digest'
         '401':
           $ref: '#/components/responses/Unauthorized'
         '403':
@@ -2264,8 +2351,12 @@ components:
           example: 734120
     PlatformSettings:
       type: object
-      description: The lab's stored settings, merged with the AI settings in effect. A setting never saved is absent.
+      description: The lab's settings in effect (saved, else the startup option, else the default), merged with the AI settings in effect. Only `healthCheckSchedule` can be absent.
       properties:
+        enableSelfHealing:
+          type: boolean
+          description: Whether a failed findElement goes on to the self-healing tiers.
+          example: true
         healthCheckIntervalMs:
           type: integer
           example: 300000
@@ -2283,8 +2374,30 @@ components:
           example: 0 3 * * *
         deleteBuildAssets:
           type: boolean
+        defaults:
+          type: object
+          description: The server's own defaults for the settings above, which is what "restore defaults" goes back to.
+          properties:
+            enableSelfHealing:
+              type: boolean
+              example: true
+            healthCheckIntervalMs:
+              type: integer
+              example: 300000
+            buildCleanupDays:
+              type: integer
+              example: 30
+            buildCleanupMaxCount:
+              type: integer
+              example: 100
+            buildCleanupSchedule:
+              type: string
+              example: 0 0 * * *
+            deleteBuildAssets:
+              type: boolean
         aiProvider:
           type: string
+          description: The provider in effect, saved on the AI engine page, else the server's option or environment, else gemini.
           example: gemini
         aiModel:
           type: string
@@ -2311,6 +2424,10 @@ components:
       type: object
       description: Any subset. Unknown fields are ignored.
       properties:
+        enableSelfHealing:
+          type: boolean
+          description: The AI self-healing switch. Takes effect at the next command, with no restart.
+          example: false
         healthCheckIntervalMs:
           type: integer
           example: 300000
@@ -2332,30 +2449,37 @@ components:
           type: boolean
         aiProvider:
           type: string
-          description: Not stored; until the server restarts.
+          description: The provider every AI call uses. Stored; empty goes back to the server's own.
           enum:
             - gemini
             - openai
             - anthropic
             - ollama
+            - ''
         aiModel:
           type: string
-          description: Not stored; until the server restarts.
+          description: The model for a provider with no model of its own below. Stored; empty goes back to the server's own.
+          maxLength: 200
         aiBaseUrl:
           type: string
-          description: Not stored; until the server restarts.
+          description: Where OpenAI-compatible and Ollama calls go. An http or https address with no user name, password or query. Stored; empty goes back to the server's own.
+          example: http://gpu-box.lab:11434
         geminiModel:
           type: string
-          description: Not stored; until the server restarts.
+          description: Stored; empty goes back to the server's own.
+          maxLength: 200
         openaiModel:
           type: string
-          description: Not stored; until the server restarts.
+          description: Stored; empty goes back to the server's own.
+          maxLength: 200
         anthropicModel:
           type: string
-          description: Not stored; until the server restarts.
+          description: Stored; empty goes back to the server's own.
+          maxLength: 200
         ollamaModel:
           type: string
-          description: Not stored; until the server restarts.
+          description: Stored; empty goes back to the server's own.
+          maxLength: 200
     PlatformAiTestRequest:
       type: object
       description: Every field is optional and falls back to the server's current setting.
@@ -2448,7 +2572,9 @@ components:
           example: slack
         payloadTemplate:
           type: string
-          description: A body template with `{{key}}` placeholders, used in place of the default body.
+          description: >-
+            A body template with `{{name}}` placeholders, used in place of the default body (see
+            `POST /api/webhook` for the names each event has).
           example: '{"text":"{{eventType}} on {{udid}}"}'
     PlatformApp:
       type: object

package/lib/src/app/openapi/sessions.yaml

@@ -108,13 +108,13 @@ paths:
                   name: Checkout with saved card
                   status: failed
                   node_id: 3c9a1f20-8d4e-4b7a-a1c2-5e6f7a8b9c0d
-                  has_live_video: true
+                  has_live_video: false
                   video_recording_enabled: true
                   video_recording: 6f1c2a8e-3b4d-4e5f-9a7b-1c2d3e4f5a6b.mp4
                   startTime: '2026-10-03T14:20:11.004Z'
                   endTime: '2026-10-03T14:22:05.120Z'
                   failure_reason: 'NoSuchElementError: An element could not be located'
-                  failure_category: element_not_found
+                  failure_category: ELEMENT_NOT_FOUND
                   device_udid: emulator-5554
                   device_platform: android
                   device_version: '14'
@@ -923,7 +923,7 @@ paths:
                 type: string
               example: |
                 id,build_id,status,failure_category,failure_reason,device_platform,device_version,device_name,node_id,startTime,endTime,name
-                6f1c2a8e-3b4d-4e5f-9a7b-1c2d3e4f5a6b,9d2f4c1e-7a3b-4e8f-b6c5-2d1e0f9a8b7c,failed,element_not_found,"NoSuchElementError: An element could not be located",android,14,Pixel 7,3c9a1f20-8d4e-4b7a-a1c2-5e6f7a8b9c0d,2026-10-03T14:20:11.004Z,2026-10-03T14:22:05.120Z,Checkout with saved card
+                6f1c2a8e-3b4d-4e5f-9a7b-1c2d3e4f5a6b,9d2f4c1e-7a3b-4e8f-b6c5-2d1e0f9a8b7c,failed,ELEMENT_NOT_FOUND,"NoSuchElementError: An element could not be located",android,14,Pixel 7,3c9a1f20-8d4e-4b7a-a1c2-5e6f7a8b9c0d,2026-10-03T14:20:11.004Z,2026-10-03T14:22:05.120Z,Checkout with saved card
         '400':
           description: '`format` is neither `json` nor `csv`.'
           content:
@@ -2688,6 +2688,13 @@ components:
             failure_category:
               type: string
               nullable: true
+              description: >-
+                What kind of failure it was: `ELEMENT_NOT_FOUND`, `APP_CRASH`, `TIMEOUT`,
+                `PERMISSION_BLOCKED`, `WDA_FAILURE`, `XENON_COMMAND_FAILURE`, `SYSTEM_OVERLOAD` or
+                `UNKNOWN`, read from the failure reason and the last failed commands when the
+                session fails; or `HUB_RESTART` for a session the server's restart ended. Null for a
+                session that hasn't failed, and for a failure recorded without that analysis.
+              example: ELEMENT_NOT_FOUND
             is_profiling_available:
               type: boolean
             device_info:

package/lib/src/app/routers/apikeys.js

@@ -15,6 +15,8 @@ const typedi_1 = require("typedi");
 const ApiKeyService_1 = require("../../services/ApiKeyService");
 const scopeGuard_1 = require("../../middleware/scopeGuard");
 const roleGuard_1 = require("../../middleware/roleGuard");
+const mintedLifetime_1 = require("../../services/token/mintedLifetime");
+const KNOWN_SCOPES = ['read', 'sessions', 'devices', 'admin'];
 function apiKeysRouter() {
     const r = (0, express_1.Router)();
     r.use((0, roleGuard_1.roleGuard)('ADMIN'));
@@ -23,11 +25,16 @@ function apiKeysRouter() {
         res.json(yield svc.list());
     }));
     r.post('/', (0, scopeGuard_1.scopeGuard)(['admin']), (req, res) => __awaiter(this, void 0, void 0, function* () {
-        var _a;
+        var _a, _b;
         const { name, scopes, rateLimit, teamId, expiresAt } = req.body;
         if (!name || !Array.isArray(scopes) || scopes.length === 0) {
             return res.status(400).json({ error: 'name and scopes required' });
         }
+        // Only the scopes that exist. Any string was stored, so a typo made a key
+        // with none of the scopes its maker meant.
+        if (!scopes.every((s) => KNOWN_SCOPES.includes(s))) {
+            return res.status(400).json({ error: `scopes must be some of ${KNOWN_SCOPES.join(', ')}` });
+        }
         let expiresAtDate;
         if (expiresAt !== undefined && expiresAt !== null) {
             const d = new Date(expiresAt);
@@ -39,6 +46,11 @@ function apiKeysRouter() {
             }
             expiresAtDate = d;
         }
+        // Made with a credential that expires, a key ends no later than it.
+        const within = (0, mintedLifetime_1.keyExpiryWithin)(expiresAtDate, (_a = req.auth) === null || _a === void 0 ? void 0 : _a.credentialExpiresAt);
+        if ('error' in within)
+            return res.status(400).json({ error: within.error });
+        expiresAtDate = within.expiresAt;
         const { id, raw } = yield svc.create({
             name,
             scopes,
@@ -47,7 +59,7 @@ function apiKeysRouter() {
             userId: req.auth.userId,
             expiresAt: expiresAtDate,
         });
-        res.json({ id, key: raw, expiresAt: (_a = expiresAtDate === null || expiresAtDate === void 0 ? void 0 : expiresAtDate.toISOString()) !== null && _a !== void 0 ? _a : null });
+        res.json({ id, key: raw, expiresAt: (_b = expiresAtDate === null || expiresAtDate === void 0 ? void 0 : expiresAtDate.toISOString()) !== null && _b !== void 0 ? _b : null });
     }));
     r.delete('/:id', (0, scopeGuard_1.scopeGuard)(['admin']), (req, res) => __awaiter(this, void 0, void 0, function* () {
         yield svc.revoke(req.params.id);

package/lib/src/app/routers/auth.js

@@ -28,11 +28,15 @@ const JwtKeyService_1 = require("../../services/token/JwtKeyService");
 const mcpScopes_1 = require("../../services/token/mcpScopes");
 const passwordResetMode_1 = require("../../services/passwordResetMode");
 const passwordResetLink_1 = require("../../services/passwordResetLink");
+const mintedLifetime_1 = require("../../services/token/mintedLifetime");
 const SESSION_COOKIE = 'xenon_dashboard_session';
 const isSecureFromReq = (req) => req.secure || req.headers['x-forwarded-proto'] === 'https';
 const MCP_TTL_SEC = Number(process.env.XENON_MCP_TOKEN_TTL_SEC || 86400);
 const REST_TTL_SEC = 3600;
 const MINTABLE_AUDIENCES = ['xenon-rest', 'xenon-mcp'];
+function grantsScope(scopesCsv, scope) {
+    return scopesCsv.split(',').some((s) => s.trim() === scope);
+}
 function issueToken(auth, body) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c, _d;
@@ -40,7 +44,7 @@ function issueToken(auth, body) {
         if (!MINTABLE_AUDIENCES.includes(audience)) {
             throw new Error(`unsupported audience: ${audience}`);
         }
-        const expiresIn = audience === 'xenon-mcp' ? MCP_TTL_SEC : REST_TTL_SEC;
+        const expiresIn = (0, mintedLifetime_1.mintedLifetimeSec)(audience === 'xenon-mcp' ? MCP_TTL_SEC : REST_TTL_SEC, auth.credentialExpiresAt);
         const svc = typedi_1.Container.get(JwtKeyService_1.JwtKeyService);
         if (audience === 'xenon-mcp') {
             // Validate the untrusted `scopes` body field before it reaches the mapper:
@@ -66,7 +70,23 @@ function issueToken(auth, body) {
             // Session-token capability (spec §3 item 6 / R9): a sibling credential the
             // client injects as `xe:options.sessionToken` so the Appium createSession
             // interceptor can refuse tokenless direct-connect sessions when the gate is on.
-            const sessionToken = yield svc.sign({ sub: auth.userId, teamId: (_c = auth.teamId) !== null && _c !== void 0 ? _c : null }, { audience: 'xenon-session', ttlSeconds: expiresIn });
+            //
+            // It creates Appium sessions, so it comes only with a grant that includes
+            // `appium:use`, which needs the `sessions` scope. Through 2.14 every
+            // credential got one, a read-only key included. It carries the scopes a
+            // session is judged by: `sessions`, and `admin` (a lease override) only
+            // when the minting credential has it and the grant isn't narrower than
+            // it: the default grant (no scopes asked for), or a full-admin one.
+            if (!grant.granular.includes('appium:use')) {
+                return { token, expiresIn, audience, scopes: grant.granular };
+            }
+            const askedForScopes = Array.isArray(body.scopes) && body.scopes.length > 0;
+            const sessionAdmin = grantsScope(auth.scopes, 'admin') && (!askedForScopes || grant.roles.includes('admin'));
+            const sessionToken = yield svc.sign({
+                sub: auth.userId,
+                teamId: (_c = auth.teamId) !== null && _c !== void 0 ? _c : null,
+                scopes: sessionAdmin ? 'admin,sessions' : 'sessions',
+            }, { audience: 'xenon-session', ttlSeconds: expiresIn });
             return { token, expiresIn, audience, scopes: grant.granular, sessionToken };
         }
         const token = yield svc.sign({ sub: auth.userId, role: auth.role, scopes: auth.scopes, teamId: (_d = auth.teamId) !== null && _d !== void 0 ? _d : null }, { audience, ttlSeconds: expiresIn });
@@ -139,11 +159,15 @@ function authPublicRouter() {
             const emailSvc = typedi_1.Container.get(EmailService_1.EmailService);
             // No SMTP and no opt-in log fallback: nothing can reach the user, so
             // don't mint a live credential. Admins issue links from the Users page.
-            if (user && user.status === 'ACTIVE' && emailSvc.canDeliver()) {
+            // No XENON_PUBLIC_URL: nothing says where the link may point. The
+            // request's Host is the asker's to choose, and the asker may not be
+            // the account's owner, so it is never used here.
+            const base = (0, passwordResetLink_1.resetLinkBase)();
+            if (user && user.status === 'ACTIVE' && emailSvc.canDeliver() && base) {
                 const resetSvc = typedi_1.Container.get(PasswordResetService_1.PasswordResetService);
                 const { raw } = yield resetSvc.createToken(user.id);
-                const link = (0, passwordResetLink_1.buildResetLink)(req, raw);
-                yield emailSvc.send((0, passwordResetLink_1.resetEmail)(user, link));
+                const link = (0, passwordResetLink_1.buildResetLink)(base, raw);
+                yield emailSvc.send((0, passwordResetLink_1.resetEmail)(user, link, resetSvc.ttlMs()));
             }
         }
         catch (e) {

package/lib/src/app/routers/control.js

@@ -625,7 +625,7 @@ const MJPEG_PROXY_CACHE = new Map();
  * Start stream endpoint - Initiates WDA and MJPEG streaming for iOS devices
  */
 router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void 0, function* () {
-    var _a, _b, _c, _d, _e;
+    var _a, _b, _c, _d, _e, _f;
     const { udid } = req.params;
     // Someone is about to watch: a page that just left (a reload, or another tab
     // closing) must not stop the stream this page is starting.
@@ -709,7 +709,11 @@ router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void
         // A recording device keeps MJPEG preview so we never run screenrecord and
         // the recording's screencap pipeline against the same device at once.
         const recording = yield typedi_1.Container.get(recording_store_1.RecordingStore).isRecording(udid);
-        const streamType = (0, streamType_1.resolveStreamType)(device.platform, flagOn, recording);
+        // A page that shows MJPEG says so (`player: 'mjpeg'`): device control, a
+        // browser with no WebCodecs, or a page whose H.264 player just failed.
+        // Anything else is the server's choice.
+        const clientShowsMjpeg = ((_f = req.body) === null || _f === void 0 ? void 0 : _f.player) === 'mjpeg';
+        const streamType = (0, streamType_1.resolveStreamType)(device.platform, flagOn, recording, !clientShowsMjpeg);
         let mjpegPort;
         if (device.platform === 'ios' || device.platform === 'tvos') {
             mjpegPort = (yield typedi_1.Container.get(IOSStreamService_1.default).startStream(udid)).mjpegPort;
@@ -720,6 +724,20 @@ router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void
             yield typedi_1.Container.get(AndroidH264StreamService_1.default).start(udid, { source: h264Cfg.source });
         }
         else {
+            // One capture pipeline per device where possible.
+            const h264 = typedi_1.Container.get(AndroidH264StreamService_1.default);
+            if (recording) {
+                // A recording reads the MJPEG capture, and H.264 never runs beside it.
+                if (h264.getMultiplexer(udid))
+                    yield h264.stop(udid);
+            }
+            else {
+                // This page shows MJPEG. An H.264 capture still running for the phone
+                // (this page's own before its player failed, or a tile's) ends before
+                // the screencap loop starts if nobody watches it, else when its last
+                // viewer leaves: another tile or tab may still be playing it.
+                yield h264.endWhenUnwatched(udid);
+            }
             mjpegPort = (yield typedi_1.Container.get(AndroidStreamService_1.default).startStream(udid)).mjpegPort;
         }
         // Lazy-load the screen size if missing: tiles need it to accept taps.