@xenon-device-management/xenon 2.14.0 → 2.15.0

package/lib/src/app/openapi/sessions.yaml

@@ -108,13 +108,13 @@ paths:
                   name: Checkout with saved card
                   status: failed
                   node_id: 3c9a1f20-8d4e-4b7a-a1c2-5e6f7a8b9c0d
-                  has_live_video: true
+                  has_live_video: false
                   video_recording_enabled: true
                   video_recording: 6f1c2a8e-3b4d-4e5f-9a7b-1c2d3e4f5a6b.mp4
                   startTime: '2026-10-03T14:20:11.004Z'
                   endTime: '2026-10-03T14:22:05.120Z'
                   failure_reason: 'NoSuchElementError: An element could not be located'
-                  failure_category: element_not_found
+                  failure_category: ELEMENT_NOT_FOUND
                   device_udid: emulator-5554
                   device_platform: android
                   device_version: '14'
@@ -923,7 +923,7 @@ paths:
                 type: string
               example: |
                 id,build_id,status,failure_category,failure_reason,device_platform,device_version,device_name,node_id,startTime,endTime,name
-                6f1c2a8e-3b4d-4e5f-9a7b-1c2d3e4f5a6b,9d2f4c1e-7a3b-4e8f-b6c5-2d1e0f9a8b7c,failed,element_not_found,"NoSuchElementError: An element could not be located",android,14,Pixel 7,3c9a1f20-8d4e-4b7a-a1c2-5e6f7a8b9c0d,2026-10-03T14:20:11.004Z,2026-10-03T14:22:05.120Z,Checkout with saved card
+                6f1c2a8e-3b4d-4e5f-9a7b-1c2d3e4f5a6b,9d2f4c1e-7a3b-4e8f-b6c5-2d1e0f9a8b7c,failed,ELEMENT_NOT_FOUND,"NoSuchElementError: An element could not be located",android,14,Pixel 7,3c9a1f20-8d4e-4b7a-a1c2-5e6f7a8b9c0d,2026-10-03T14:20:11.004Z,2026-10-03T14:22:05.120Z,Checkout with saved card
         '400':
           description: '`format` is neither `json` nor `csv`.'
           content:
@@ -2688,6 +2688,13 @@ components:
             failure_category:
               type: string
               nullable: true
+              description: >-
+                What kind of failure it was: `ELEMENT_NOT_FOUND`, `APP_CRASH`, `TIMEOUT`,
+                `PERMISSION_BLOCKED`, `WDA_FAILURE`, `XENON_COMMAND_FAILURE`, `SYSTEM_OVERLOAD` or
+                `UNKNOWN`, read from the failure reason and the last failed commands when the
+                session fails; or `HUB_RESTART` for a session the server's restart ended. Null for a
+                session that hasn't failed, and for a failure recorded without that analysis.
+              example: ELEMENT_NOT_FOUND
             is_profiling_available:
               type: boolean
             device_info:

package/lib/src/app/routers/apikeys.js

@@ -15,6 +15,8 @@ const typedi_1 = require("typedi");
 const ApiKeyService_1 = require("../../services/ApiKeyService");
 const scopeGuard_1 = require("../../middleware/scopeGuard");
 const roleGuard_1 = require("../../middleware/roleGuard");
+const mintedLifetime_1 = require("../../services/token/mintedLifetime");
+const KNOWN_SCOPES = ['read', 'sessions', 'devices', 'admin'];
 function apiKeysRouter() {
     const r = (0, express_1.Router)();
     r.use((0, roleGuard_1.roleGuard)('ADMIN'));
@@ -23,11 +25,16 @@ function apiKeysRouter() {
         res.json(yield svc.list());
     }));
     r.post('/', (0, scopeGuard_1.scopeGuard)(['admin']), (req, res) => __awaiter(this, void 0, void 0, function* () {
-        var _a;
+        var _a, _b;
         const { name, scopes, rateLimit, teamId, expiresAt } = req.body;
         if (!name || !Array.isArray(scopes) || scopes.length === 0) {
             return res.status(400).json({ error: 'name and scopes required' });
         }
+        // Only the scopes that exist. Any string was stored, so a typo made a key
+        // with none of the scopes its maker meant.
+        if (!scopes.every((s) => KNOWN_SCOPES.includes(s))) {
+            return res.status(400).json({ error: `scopes must be some of ${KNOWN_SCOPES.join(', ')}` });
+        }
         let expiresAtDate;
         if (expiresAt !== undefined && expiresAt !== null) {
             const d = new Date(expiresAt);
@@ -39,6 +46,11 @@ function apiKeysRouter() {
             }
             expiresAtDate = d;
         }
+        // Made with a credential that expires, a key ends no later than it.
+        const within = (0, mintedLifetime_1.keyExpiryWithin)(expiresAtDate, (_a = req.auth) === null || _a === void 0 ? void 0 : _a.credentialExpiresAt);
+        if ('error' in within)
+            return res.status(400).json({ error: within.error });
+        expiresAtDate = within.expiresAt;
         const { id, raw } = yield svc.create({
             name,
             scopes,
@@ -47,7 +59,7 @@ function apiKeysRouter() {
             userId: req.auth.userId,
             expiresAt: expiresAtDate,
         });
-        res.json({ id, key: raw, expiresAt: (_a = expiresAtDate === null || expiresAtDate === void 0 ? void 0 : expiresAtDate.toISOString()) !== null && _a !== void 0 ? _a : null });
+        res.json({ id, key: raw, expiresAt: (_b = expiresAtDate === null || expiresAtDate === void 0 ? void 0 : expiresAtDate.toISOString()) !== null && _b !== void 0 ? _b : null });
     }));
     r.delete('/:id', (0, scopeGuard_1.scopeGuard)(['admin']), (req, res) => __awaiter(this, void 0, void 0, function* () {
         yield svc.revoke(req.params.id);

package/lib/src/app/routers/auth.js

@@ -28,11 +28,15 @@ const JwtKeyService_1 = require("../../services/token/JwtKeyService");
 const mcpScopes_1 = require("../../services/token/mcpScopes");
 const passwordResetMode_1 = require("../../services/passwordResetMode");
 const passwordResetLink_1 = require("../../services/passwordResetLink");
+const mintedLifetime_1 = require("../../services/token/mintedLifetime");
 const SESSION_COOKIE = 'xenon_dashboard_session';
 const isSecureFromReq = (req) => req.secure || req.headers['x-forwarded-proto'] === 'https';
 const MCP_TTL_SEC = Number(process.env.XENON_MCP_TOKEN_TTL_SEC || 86400);
 const REST_TTL_SEC = 3600;
 const MINTABLE_AUDIENCES = ['xenon-rest', 'xenon-mcp'];
+function grantsScope(scopesCsv, scope) {
+    return scopesCsv.split(',').some((s) => s.trim() === scope);
+}
 function issueToken(auth, body) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c, _d;
@@ -40,7 +44,7 @@ function issueToken(auth, body) {
         if (!MINTABLE_AUDIENCES.includes(audience)) {
             throw new Error(`unsupported audience: ${audience}`);
         }
-        const expiresIn = audience === 'xenon-mcp' ? MCP_TTL_SEC : REST_TTL_SEC;
+        const expiresIn = (0, mintedLifetime_1.mintedLifetimeSec)(audience === 'xenon-mcp' ? MCP_TTL_SEC : REST_TTL_SEC, auth.credentialExpiresAt);
         const svc = typedi_1.Container.get(JwtKeyService_1.JwtKeyService);
         if (audience === 'xenon-mcp') {
             // Validate the untrusted `scopes` body field before it reaches the mapper:
@@ -66,7 +70,23 @@ function issueToken(auth, body) {
             // Session-token capability (spec §3 item 6 / R9): a sibling credential the
             // client injects as `xe:options.sessionToken` so the Appium createSession
             // interceptor can refuse tokenless direct-connect sessions when the gate is on.
-            const sessionToken = yield svc.sign({ sub: auth.userId, teamId: (_c = auth.teamId) !== null && _c !== void 0 ? _c : null }, { audience: 'xenon-session', ttlSeconds: expiresIn });
+            //
+            // It creates Appium sessions, so it comes only with a grant that includes
+            // `appium:use`, which needs the `sessions` scope. Through 2.14 every
+            // credential got one, a read-only key included. It carries the scopes a
+            // session is judged by: `sessions`, and `admin` (a lease override) only
+            // when the minting credential has it and the grant isn't narrower than
+            // it: the default grant (no scopes asked for), or a full-admin one.
+            if (!grant.granular.includes('appium:use')) {
+                return { token, expiresIn, audience, scopes: grant.granular };
+            }
+            const askedForScopes = Array.isArray(body.scopes) && body.scopes.length > 0;
+            const sessionAdmin = grantsScope(auth.scopes, 'admin') && (!askedForScopes || grant.roles.includes('admin'));
+            const sessionToken = yield svc.sign({
+                sub: auth.userId,
+                teamId: (_c = auth.teamId) !== null && _c !== void 0 ? _c : null,
+                scopes: sessionAdmin ? 'admin,sessions' : 'sessions',
+            }, { audience: 'xenon-session', ttlSeconds: expiresIn });
             return { token, expiresIn, audience, scopes: grant.granular, sessionToken };
         }
         const token = yield svc.sign({ sub: auth.userId, role: auth.role, scopes: auth.scopes, teamId: (_d = auth.teamId) !== null && _d !== void 0 ? _d : null }, { audience, ttlSeconds: expiresIn });
@@ -139,11 +159,15 @@ function authPublicRouter() {
             const emailSvc = typedi_1.Container.get(EmailService_1.EmailService);
             // No SMTP and no opt-in log fallback: nothing can reach the user, so
             // don't mint a live credential. Admins issue links from the Users page.
-            if (user && user.status === 'ACTIVE' && emailSvc.canDeliver()) {
+            // No XENON_PUBLIC_URL: nothing says where the link may point. The
+            // request's Host is the asker's to choose, and the asker may not be
+            // the account's owner, so it is never used here.
+            const base = (0, passwordResetLink_1.resetLinkBase)();
+            if (user && user.status === 'ACTIVE' && emailSvc.canDeliver() && base) {
                 const resetSvc = typedi_1.Container.get(PasswordResetService_1.PasswordResetService);
                 const { raw } = yield resetSvc.createToken(user.id);
-                const link = (0, passwordResetLink_1.buildResetLink)(req, raw);
-                yield emailSvc.send((0, passwordResetLink_1.resetEmail)(user, link));
+                const link = (0, passwordResetLink_1.buildResetLink)(base, raw);
+                yield emailSvc.send((0, passwordResetLink_1.resetEmail)(user, link, resetSvc.ttlMs()));
             }
         }
         catch (e) {

package/lib/src/app/routers/control.js

@@ -724,12 +724,20 @@ router.post('/:udid/stream/start', (req, res) => __awaiter(void 0, void 0, void
             yield typedi_1.Container.get(AndroidH264StreamService_1.default).start(udid, { source: h264Cfg.source });
         }
         else {
-            // One capture pipeline per device: an H.264 capture still running for it
-            // (a tile's, or this page's own before its player failed) ends before the
-            // screencap loop starts.
+            // One capture pipeline per device where possible.
             const h264 = typedi_1.Container.get(AndroidH264StreamService_1.default);
-            if (h264.getMultiplexer(udid))
-                yield h264.stop(udid);
+            if (recording) {
+                // A recording reads the MJPEG capture, and H.264 never runs beside it.
+                if (h264.getMultiplexer(udid))
+                    yield h264.stop(udid);
+            }
+            else {
+                // This page shows MJPEG. An H.264 capture still running for the phone
+                // (this page's own before its player failed, or a tile's) ends before
+                // the screencap loop starts if nobody watches it, else when its last
+                // viewer leaves: another tile or tab may still be playing it.
+                yield h264.endWhenUnwatched(udid);
+            }
             mjpegPort = (yield typedi_1.Container.get(AndroidStreamService_1.default).startStream(udid)).mjpegPort;
         }
         // Lazy-load the screen size if missing: tiles need it to accept taps.

package/lib/src/app/routers/dashboard.js

@@ -59,6 +59,7 @@ const web_config_service_1 = require("../../data-service/web-config-service");
 const PluginContext_1 = require("../../PluginContext");
 const labSettings_1 = require("../../services/settings/labSettings");
 const SelfHealingSwitch_1 = require("../../services/settings/SelfHealingSwitch");
+const aiEngineSettings_1 = require("../../services/settings/aiEngineSettings");
 const typedi_1 = require("typedi");
 const scopeGuard_1 = require("../../middleware/scopeGuard");
 const roleGuard_1 = require("../../middleware/roleGuard");
@@ -1102,6 +1103,34 @@ function streamLiveSessionVideo(request, response) {
         }
     });
 }
+/**
+ * The base URL as the dashboard may see it: a user name, password or query
+ * value it carries is masked. Saving one is refused (aiEngineSettings.ts), but
+ * the server's environment can still hold one, and every admin can read this.
+ */
+function maskedBaseUrl(url) {
+    if (!url)
+        return url;
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch (_a) {
+        return url;
+    }
+    // Shown as given unless something needs masking: toString() would add a '/'.
+    if (!parsed.username && !parsed.password && !parsed.search && !parsed.hash)
+        return url;
+    if (parsed.username || parsed.password) {
+        parsed.username = '***';
+        parsed.password = '';
+    }
+    for (const name of [...new Set(parsed.searchParams.keys())]) {
+        parsed.searchParams.set(name, '***');
+    }
+    parsed.hash = '';
+    return parsed.toString();
+}
 function getGlobalConfig(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
         try {
@@ -1110,13 +1139,13 @@ function getGlobalConfig(request, response) {
             // the default. The pages show this (a saved value alone left them to guess
             // at what a setting never saved was), and `defaults` for "restore defaults".
             const effective = (0, labSettings_1.effectiveSettings)(typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs, dbConfig);
-            // Merge with Environment Config (AI Settings)
+            // The AI engine settings in effect (aiEngineSettings.ts keeps `config` at
+            // them). Never a key: only whether one is set.
             const { config } = yield Promise.resolve().then(() => __importStar(require('../../config')));
-            // Sanitize keys - return boolean existence only
             const aiConfig = {
                 aiProvider: config.aiProvider,
                 aiModel: config.aiModel,
-                aiBaseUrl: config.aiBaseUrl,
+                aiBaseUrl: maskedBaseUrl(config.aiBaseUrl),
                 geminiModel: config.geminiModel,
                 openaiModel: config.openaiModel,
                 anthropicModel: config.anthropicModel,
@@ -1136,39 +1165,25 @@ function getGlobalConfig(request, response) {
 }
 function updateGlobalConfig(request, response) {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a;
         try {
             const payload = request.body;
             // Before anything is saved: a value the cleanup job would act on, such as a
-            // retention window of 0, is refused rather than stored.
-            const problem = (0, labSettings_1.validateSettingsUpdate)(payload !== null && payload !== void 0 ? payload : {});
+            // retention window of 0, is refused rather than stored, and so is an AI
+            // provider or address that could not work, now that it outlives a restart.
+            const problem = (_a = (0, labSettings_1.validateSettingsUpdate)(payload !== null && payload !== void 0 ? payload : {})) !== null && _a !== void 0 ? _a : (0, aiEngineSettings_1.validateAiEngineUpdate)(payload !== null && payload !== void 0 ? payload : {});
             if (problem) {
                 return response
                     .status(400)
                     .json({ error: 'invalid_setting', field: problem.field, message: problem.message });
             }
-            // Handle Runtime AI Config Overrides (Memory only)
-            // Only pass defined values to avoid overwriting env vars (e.g. aiBaseUrl, ollamaModel) with undefined
-            const runtimeOverrides = {};
-            if (payload.aiProvider !== undefined)
-                runtimeOverrides.aiProvider = payload.aiProvider;
-            if (payload.aiModel !== undefined)
-                runtimeOverrides.aiModel = payload.aiModel;
-            if (payload.aiBaseUrl !== undefined)
-                runtimeOverrides.aiBaseUrl = payload.aiBaseUrl;
-            if (payload.geminiModel !== undefined)
-                runtimeOverrides.geminiModel = payload.geminiModel;
-            if (payload.openaiModel !== undefined)
-                runtimeOverrides.openaiModel = payload.openaiModel;
-            if (payload.anthropicModel !== undefined)
-                runtimeOverrides.anthropicModel = payload.anthropicModel;
-            if (payload.ollamaModel !== undefined)
-                runtimeOverrides.ollamaModel = payload.ollamaModel;
-            if (Object.keys(runtimeOverrides).length > 0) {
-                const { updateConfig } = yield Promise.resolve().then(() => __importStar(require('../../config')));
-                updateConfig(runtimeOverrides);
+            // Saved, then in force for the next AI call. Through 2.14 the AI fields
+            // changed the running server only, and a restart undid them.
+            const aiEngine = (0, aiEngineSettings_1.aiEngineUpdateOf)(payload !== null && payload !== void 0 ? payload : {});
+            yield typedi_1.Container.get(web_config_service_1.WebConfigService).setConfig(Object.assign(Object.assign({}, payload), aiEngine));
+            if (Object.keys(aiEngine).length > 0) {
+                typedi_1.Container.get(aiEngineSettings_1.AiEngineSettings).noteSaved(aiEngine);
             }
-            // Persist Web Configs to DB
-            yield typedi_1.Container.get(web_config_service_1.WebConfigService).setConfig(payload);
             // The command interceptor asks at every command and never reads the
             // database: hand it the saved value, in force from the next command.
             if (payload.enableSelfHealing !== undefined) {

package/lib/src/app/routers/grid.js

@@ -89,10 +89,12 @@ function getDevices(request, response) {
             const [enriched] = yield (0, device_service_1.enrichDevicesWithTeamNames)([match]);
             return response.json(enriched);
         }
-        /* dashboard-plugin-url is the base url for opening the appium-dashboard-plugin
-         * This value will be attached to all express request via middleware
+        /* dashboard-plugin-url is where this server reaches the appium-dashboard-plugin,
+         * and dashboard-plugin-link the base of the link people open; both from
+         * configuration, never from the request (app/dashboardPluginLink.ts).
          */
         const dashboardPluginUrl = request['dashboard-plugin-url'];
+        const dashboardPluginLink = request['dashboard-plugin-link'];
         if (dashboardPluginUrl) {
             const response = yield InternalHttpClient_1.InternalHttpClient.get(`${dashboardPluginUrl}/api/sessions?start_time=${SERVER_UP_TIME}`);
             const sessions = ((_a = response === null || response === void 0 ? void 0 : response.result) === null || _a === void 0 ? void 0 : _a.rows) || [];
@@ -105,7 +107,7 @@ function getDevices(request, response) {
             });
             devices = devices.map((d) => {
                 var _a;
-                d.dashboard_link = `${dashboardPluginUrl}?device_udid=${d.udid}&start_time=${SERVER_UP_TIME}`;
+                d.dashboard_link = `${dashboardPluginLink}?device_udid=${d.udid}&start_time=${SERVER_UP_TIME}`;
                 d.total_session_count = ((_a = deviceSessionMap[d.udid]) === null || _a === void 0 ? void 0 : _a.length) || 0;
                 return d;
             });

package/lib/src/app/routers/profile.js

@@ -17,6 +17,7 @@ const ApiKeyService_1 = require("../../services/ApiKeyService");
 const UserService_1 = require("../../services/UserService");
 const prisma_1 = require("../../prisma");
 const profileIdentity_1 = require("./profileIdentity");
+const mintedLifetime_1 = require("../../services/token/mintedLifetime");
 const ROLE_SCOPES = {
     SUPER_ADMIN: ['admin'],
     ADMIN: ['devices', 'sessions', 'read'],
@@ -79,10 +80,23 @@ function profileRouter() {
             return res.status(404).json({ error: 'user not found' });
         return res.json({ accessKey: user.accessKey });
     }));
+    // Rotating the access key ends every key pair its owner has, whatever their
+    // scopes, so it takes the person themselves (a dashboard sign-in) or a
+    // credential with the admin scope. Through 2.14 any credential could, a
+    // read-only token included, and cut off every one of its owner's clients.
     r.post('/access-key/rotate', (req, res) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const auth = requireAuth(req, res);
         if (!auth)
             return;
+        const credentialScopes = String((_a = auth.scopes) !== null && _a !== void 0 ? _a : '')
+            .split(',')
+            .map((s) => s.trim());
+        if (auth.kind !== 'user-session' && !credentialScopes.includes('admin')) {
+            return res.status(403).json({
+                error: 'rotating the access key needs a dashboard sign-in or a credential with the admin scope',
+            });
+        }
         const userId = yield effectiveUserId(auth.userId);
         if (!userId)
             return res.status(404).json({ error: 'user not found' });
@@ -132,6 +146,13 @@ function profileRouter() {
             }
             expiresAtDate = d;
         }
+        // A token made with a credential that expires (a Bearer token, an API key
+        // with an expiry) ends no later than it. Through 2.14 a 1-hour Bearer
+        // token could make itself a key that never expired.
+        const within = (0, mintedLifetime_1.keyExpiryWithin)(expiresAtDate, auth.credentialExpiresAt);
+        if ('error' in within)
+            return res.status(400).json({ error: within.error });
+        expiresAtDate = within.expiresAt;
         const allowed = (_a = ROLE_SCOPES[auth.role]) !== null && _a !== void 0 ? _a : ROLE_SCOPES.MEMBER;
         if (scopes !== undefined && (!Array.isArray(scopes) || !scopes.every(isScope))) {
             return res.status(400).json({ error: `scopes must be some of ${KNOWN_SCOPES.join(', ')}` });

package/lib/src/app/routers/users.js

@@ -141,8 +141,11 @@ function usersRouter() {
         });
     }));
     // Admin-issued password reset. Replaces relaying a link out of the server
-    // log: with SMTP the link is emailed to the user as before; without it the
-    // link is returned once, to the admin who asked, and never logged.
+    // log: with SMTP and XENON_PUBLIC_URL the link is emailed to the user;
+    // otherwise it is returned once, to the admin who asked, and never logged.
+    // An emailed link points at XENON_PUBLIC_URL only, never the request's
+    // Host: the admin's request could name any host, and the user would get a
+    // genuine Xenon email sending their token there.
     r.post('/:id/reset-link', (req, res) => __awaiter(this, void 0, void 0, function* () {
         const auth = getAuth(req);
         const targetId = req.params.id;
@@ -168,10 +171,11 @@ function usersRouter() {
         const resetSvc = typedi_1.Container.get(PasswordResetService_1.PasswordResetService);
         const emailSvc = typedi_1.Container.get(EmailService_1.EmailService);
         const { raw } = yield resetSvc.createToken(target.id);
-        const link = (0, passwordResetLink_1.buildResetLink)(req, raw);
+        const publicBase = (0, passwordResetLink_1.resetLinkBase)();
         const expiresAt = new Date(Date.now() + resetSvc.ttlMs()).toISOString();
-        if (emailSvc.hasSmtp()) {
-            yield emailSvc.send((0, passwordResetLink_1.resetEmail)(target, link));
+        if (emailSvc.hasSmtp() && publicBase) {
+            const link = (0, passwordResetLink_1.buildResetLink)(publicBase, raw);
+            yield emailSvc.send((0, passwordResetLink_1.resetEmail)(target, link, resetSvc.ttlMs()));
             auditLog.info(`${auth.userId} emailed a password-reset link to user ${target.id}`);
             return res.json({ emailed: true, expiresAt });
         }
@@ -179,6 +183,7 @@ function usersRouter() {
         auditLog.warn(`${auth.userId} issued a password-reset link for user ${target.id} (returned to the admin)`);
         // The body is a credential: keep it out of browser and proxy caches.
         res.set('Cache-Control', 'no-store');
+        const link = (0, passwordResetLink_1.buildResetLink)(publicBase !== null && publicBase !== void 0 ? publicBase : (0, passwordResetLink_1.requestBase)(req), raw);
         return res.json({ emailed: false, link, expiresAt });
     }));
     r.delete('/:id', (req, res) => __awaiter(this, void 0, void 0, function* () {

package/lib/src/app/swagger.js

@@ -75,6 +75,8 @@ Appium's WebDriver API (\`POST /session\` and the session's commands, under Appi
 - \`accessKey\` and \`token\`;
 - \`sessionToken\`, minted by \`POST /api/auth/token\`.
 
+Either names the session's owner only while that user exists and is active, and a session token needs the \`sessions\` scope, as a key does. A key or token that doesn't check out counts as none: with \`XENON_REQUIRE_SESSION_TOKEN\` the session is refused, without it the session runs with no owner.
+
 A leased device also takes \`leaseId\` and \`leaseToken\`, which the lease's \`appiumCapabilities\` already carry. Xenon removes these credentials before the driver or any stored record sees them.
 
 ## Live streams

package/lib/src/app/ws/h264StreamWs.js

@@ -12,6 +12,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.STREAM_ENDED = void 0;
 exports.encodeWsFrame = encodeWsFrame;
 exports.parseH264WsPath = parseH264WsPath;
 exports.attachH264Ws = attachH264Ws;
@@ -29,6 +30,12 @@ const nodeSocketRelay_1 = require("./nodeSocketRelay");
  * so it is not put on the wire).
  */
 const TYPE_CODE = { config: 0, key: 1, delta: 2 };
+/**
+ * The close code for a stream whose capture stopped under its viewer, as the
+ * logcat socket uses it for an upstream that died. The player then shows MJPEG
+ * without asking stream/start: there is no H.264 capture left to end.
+ */
+exports.STREAM_ENDED = 1012;
 function encodeWsFrame(p) {
     return Buffer.concat([Buffer.from([TYPE_CODE[p.type]]), p.data]);
 }
@@ -139,7 +146,9 @@ function attachH264Ws(server, deps) {
                 if (p.type === 'delta' && ws.bufferedAmount > maxBuffered)
                     return;
                 ws.send(encodeWsFrame(p));
-            });
+            }, 
+            // The capture stopped under this viewer (a recording, a stream/stop).
+            () => ws.close(exports.STREAM_ENDED, 'stream ended'));
             logger_1.default.info(`[${parsed.udid}] H.264 WS client connected`);
         }));
     }

package/lib/src/config.js

@@ -87,6 +87,7 @@ exports.config = {
     userSessionTtlMs: Number(process.env.XENON_USER_SESSION_TTL_MS) || 24 * 60 * 60 * 1000,
     smtpUrl: process.env.XENON_SMTP_URL,
     smtpFrom: process.env.XENON_SMTP_FROM,
+    publicUrl: process.env.XENON_PUBLIC_URL,
     resetTokenTtlMs: Number(process.env.XENON_RESET_TOKEN_TTL_MS) || 60 * 60 * 1000,
     // Opt-in since 1.20.7: it writes the raw reset link (a credential) to the
     // server log. Without SMTP, admins issue links from the Users page instead.

package/lib/src/dashboard/commands.js

@@ -59,10 +59,10 @@ const xenonScripts_1 = require("../interceptors/xenonScripts");
  *
  * Each answers `{ recorded: true }` when it wrote, or `{ recorded: false,
  * message }` saying why nothing was written: no record of the session on this
- * server (its dashboard is off, or it is a node, which keeps none for the
- * hub's sessions), an argument it can't use, or a failed write. None of them
- * fails the test's command. They are bookkeeping, and a test shouldn't die
- * because the server it ran on keeps no dashboard. Through 2.13.2
+ * server (it runs without `enableDashboard`, or it is a node, which keeps
+ * none for the hub's sessions), an argument it can't use, or a failed write.
+ * None of them fails the test's command. They are bookkeeping, and a test
+ * shouldn't die because the server it ran on records no sessions. Through 2.13.2
  * setSessionName, setSessionStatus and debug failed the command there
  * (Prisma's P2025, a foreign-key error), and addTag and captureEvidence
  * answered `null` as if they had worked.
@@ -132,7 +132,7 @@ class DashboardCommands {
                 });
                 if (!row) {
                     answer = notRecorded(`This server keeps no record of session ${sessionId}, so nothing was saved. ` +
-                        'Sessions are recorded on a hub with its dashboard turned on.');
+                        'Sessions are recorded by a server started with enableDashboard, never by a node.');
                 }
                 else {
                     switch (command) {