@xenon-device-management/xenon 2.14.0 → 2.15.0

package/lib/src/services/EmailService.js

@@ -23,6 +23,7 @@ const typedi_1 = require("typedi");
 const nodemailer_1 = __importDefault(require("nodemailer"));
 const config_1 = require("../config");
 const logger_1 = __importDefault(require("../logger"));
+const passwordResetLink_1 = require("./passwordResetLink");
 let EmailService = class EmailService {
     constructor() {
         this.log = logger_1.default.scope('Email');
@@ -55,6 +56,34 @@ let EmailService = class EmailService {
             'over the account for the link lifetime. Configure XENON_SMTP_URL, or unset this and ' +
             'issue links from the dashboard Users page.');
     }
+    /**
+     * Startup notice about XENON_PUBLIC_URL, the address links Xenon hands out
+     * are built from (never the request's Host, which the asker chooses):
+     *
+     * - set but refused (not an http(s) server address): whatever the mail
+     *   setup, since it also decides each device's dashboard_link. The value is
+     *   not logged: a user name and password in it is one reason to refuse it.
+     * - unset while Xenon could send reset links: the sign-in page's "forgot
+     *   password" then sends people to an administrator, and an administrator's
+     *   reset link is handed back to them rather than emailed.
+     */
+    warnAboutPublicUrl() {
+        var _a;
+        if (((_a = config_1.config.publicUrl) === null || _a === void 0 ? void 0 : _a.trim()) && (0, passwordResetLink_1.resetLinkBase)() === null) {
+            this.warnLog('XENON_PUBLIC_URL is set but is not an http(s) server address such as ' +
+                'https://xenon.example.com or http://lab-mac:4723 (a trailing /xenon is fine; any ' +
+                'other path, a query, a fragment or a user name is not), so Xenon ignores it: it ' +
+                'emails no password-reset links, and device dashboard links are paths on this server.');
+            return;
+        }
+        if (!this.canDeliver() || (0, passwordResetLink_1.resetLinkBase)() !== null)
+            return;
+        this.warnLog("XENON_PUBLIC_URL is not set to this server's address, so Xenon sends no password-reset " +
+            'links: "Forgot password" asks people to contact an administrator, and the Users ' +
+            'page hands an administrator the link instead of emailing it. Set XENON_PUBLIC_URL to ' +
+            'the http(s) address people reach this server at, such as https://xenon.example.com ' +
+            'or http://lab-mac:4723 (a trailing /xenon is fine; any other path is not).');
+    }
     send(mail) {
         return __awaiter(this, void 0, void 0, function* () {
             const smtpUrl = config_1.config.smtpUrl;

package/lib/src/services/OrphanSweeper.js

@@ -26,6 +26,7 @@ const event_manager_1 = require("../dashboard/event-manager");
 const SessionStatus_1 = require("../types/SessionStatus");
 const device_service_1 = require("../data-service/device-service");
 const PhoneNetworkRestore_1 = require("./network/PhoneNetworkRestore");
+const sessionMemory_1 = require("../sessions/sessionMemory");
 let OrphanSweeper = class OrphanSweeper {
     constructor() {
         this.log = logger_1.default.scope('OrphanSweeper');
@@ -74,6 +75,7 @@ let OrphanSweeper = class OrphanSweeper {
                     // back before the phone is released; for a previous process's it is
                     // the ledger's, at boot (PhoneNetworkRestore).
                     yield typedi_1.Container.get(PhoneNetworkRestore_1.PhoneNetworkRestore).restoreSession(s.id, 'heartbeat timeout');
+                    (0, sessionMemory_1.forgetSessionMemory)(s.id);
                     // This session's claim only, not every row with its udid: the phone
                     // may be another session's by now (deviceClaims.ts).
                     yield (0, device_service_1.releaseSessionDevices)(s.id);

package/lib/src/services/SelectorVerificationJob.js

@@ -32,8 +32,11 @@ const selectorKeys_1 = require("./selector-health/selectorKeys");
 const log = logger_1.default.scope('SelectorVerification');
 /**
  * Threshold of distinct clean build_ids required to promote a Pending
- * SelectorState row to Resolved. "Clean" means at least one findElement
- * for the (strategy, selector) tuple ran in the build with no heal.
+ * SelectorState row to Resolved. "Clean" means the selector was found without
+ * healing in the build: a findElement of the (strategy, selector) tuple that
+ * answered an element, or a findElements that answered at least one, and no
+ * heal of it. Through 2.14 a find that failed outright counted too, so a
+ * selector that was never found again was verified as fixed.
  */
 const CLEAN_BUILDS_TO_RESOLVE = 3;
 /**
@@ -127,12 +130,20 @@ let SelectorVerificationJob = class SelectorVerificationJob {
             // that ran under a CI build (build_id IS NOT NULL); ad-hoc local runs
             // intentionally don't move verification forward.
             //
+            // A find that found the selector is one that didn't fail (`is_error`,
+            // the dashboard's record of an error answer) and didn't answer an empty
+            // list (`{"value":[]`, findElements finding nothing). The command log
+            // keeps the answer as JSON.stringify wrote it, or as the node sent it.
+            //
             // Identifier names (PascalCase tables, camelCase createdAt) match the
             // actual SQLite schema generated by Prisma — see
             // `sqlite3 prisma/dev.db ".schema SessionLog"`.
             const heals = yield this.prisma.$queryRaw `
       SELECT s."build_id" AS build_id,
-             MAX(CASE WHEN sl."is_healed" THEN 1 ELSE 0 END) AS healed
+             MAX(CASE WHEN sl."is_healed" THEN 1 ELSE 0 END) AS healed,
+             MAX(CASE WHEN NOT sl."is_healed" AND NOT sl."is_error"
+                       AND sl."response" NOT LIKE '{"value":[]%'
+                      THEN 1 ELSE 0 END) AS found
       FROM "SessionLog" sl
       INNER JOIN "Session" s ON sl."session_id" = s."id"
       WHERE sl."original_strategy" = ${row.original_strategy}
@@ -142,7 +153,7 @@ let SelectorVerificationJob = class SelectorVerificationJob {
         AND s."build_id" IS NOT NULL
       GROUP BY s."build_id"
     `;
-            const cleanBuildCount = heals.filter((r) => Number(r.healed) === 0).length;
+            const cleanBuildCount = heals.filter((r) => Number(r.healed) === 0 && Number(r.found) === 1).length;
             if (cleanBuildCount >= CLEAN_BUILDS_TO_RESOLVE) {
                 yield this.promoteToResolved(row);
             }

package/lib/src/services/ServerManager.js

@@ -79,6 +79,7 @@ const IPluginArgs_1 = require("../interfaces/IPluginArgs");
 const config_service_1 = require("../data-service/config-service");
 const PluginContext_1 = require("../PluginContext");
 const SelfHealingSwitch_1 = require("./settings/SelfHealingSwitch");
+const aiEngineSettings_1 = require("./settings/aiEngineSettings");
 const device_store_1 = require("../data-service/device-store");
 const device_utils_1 = require("../device-utils");
 const localDeviceHosts_1 = require("../device-managers/localDeviceHosts");
@@ -140,6 +141,9 @@ let ServerManager = ServerManager_1 = class ServerManager {
             // The Settings page's AI self-healing toggle, which the command interceptor
             // reads from memory at every command: load it before a command can arrive.
             yield typedi_1.Container.get(SelfHealingSwitch_1.SelfHealingSwitch).load();
+            // The AI engine page's provider, model and base URL, over the startup
+            // options applied above (what a cleared value goes back to).
+            yield typedi_1.Container.get(aiEngineSettings_1.AiEngineSettings).load();
             this.registerRoutes(expressApp, httpServer, cliArgs, pluginArgs);
             yield this.bootEmulators(pluginArgs);
             this.registerDependenciesInContainer(pluginArgs, cliArgs, nodeId);
@@ -397,6 +401,7 @@ let ServerManager = ServerManager_1 = class ServerManager {
             const { bootstrapIdentity } = yield Promise.resolve().then(() => __importStar(require('./identity/bootstrap')));
             yield bootstrapIdentity();
             typedi_1.Container.get(EmailService_1.EmailService).warnIfLogFallbackEnabled();
+            typedi_1.Container.get(EmailService_1.EmailService).warnAboutPublicUrl();
             const { startUserSessionCleanupCron } = yield Promise.resolve().then(() => __importStar(require('./identity/sessionCleanupCron')));
             startUserSessionCleanupCron();
             // Hub-issued JWT signing key (REST/MCP tokens, stream tickets) — key
@@ -445,7 +450,12 @@ let ServerManager = ServerManager_1 = class ServerManager {
         });
     }
     registerRoutes(expressApp, httpServer, cliArgs, pluginArgs) {
-        expressApp.use('/xenon', (0, app_1.createRouter)(pluginArgs));
+        expressApp.use('/xenon', (0, app_1.createRouter)(pluginArgs, {
+            address: cliArgs.address,
+            port: cliArgs.port,
+            // Appium serves HTTPS with both of these (base-driver's server()).
+            tls: !!(cliArgs.sslCertificatePath && cliArgs.sslKeyPath),
+        }));
         // The session gateway goes in front of Appium's routes: Xenon's own
         // /wd-internal calls (with the per-process secret), per-command auth
         // (XENON_REQUIRE_COMMAND_AUTH), then, on a hub, forwarding of the sessions

package/lib/src/services/SessionLifecycleService.js

@@ -69,7 +69,6 @@ const device_utils_1 = require("../device-utils");
 const TracingService_1 = require("./TracingService");
 const PortAllocator_1 = require("./PortAllocator");
 const XenonCapabilityManager_1 = require("../XenonCapabilityManager");
-const JwtKeyService_1 = require("./token/JwtKeyService");
 const sessionIdentity_1 = require("./session/sessionIdentity");
 const leaseSessionCaps_1 = require("./lease/leaseSessionCaps");
 const sessionCredentials_1 = require("./session/sessionCredentials");
@@ -80,6 +79,7 @@ const callerTeamIds_1 = require("./device-access/callerTeamIds");
 const queueVisibility_1 = require("./device-access/queueVisibility");
 const appVisibility_1 = require("./device-access/appVisibility");
 const LiveSessionOwners_1 = require("./device-access/LiveSessionOwners");
+const sessionMemory_1 = require("../sessions/sessionMemory");
 const SessionMetricsService_1 = require("./metrics/SessionMetricsService");
 const appCapability_1 = require("./session/appCapability");
 const CircuitBreaker_1 = require("../data-service/CircuitBreaker");
@@ -100,6 +100,21 @@ const async_lock_1 = __importDefault(require("async-lock"));
 const base_driver_1 = require("@appium/base-driver");
 const PhoneNetworkRestore_1 = require("./network/PhoneNetworkRestore");
 const interceptorOptions_1 = require("./interceptor/interceptorOptions");
+/**
+ * A session token admits a session only with the `sessions` scope, as a key
+ * pair does. Tokens minted before this check carry no `scopes` claim, and
+ * POST /auth/token gave one to any credential, a read-only one included:
+ * they are refused too.
+ */
+function sessionTokenGrantsSessions(scopes) {
+    if (typeof scopes !== 'string')
+        return false;
+    const owned = scopes.split(',').map((s) => s.trim());
+    return owned.includes('sessions') || owned.includes('admin');
+}
+const SESSION_TOKEN_LACKS_SCOPE = 'session rejected: xe:options.sessionToken carries no `sessions` scope; tokens minted by ' +
+    'Xenon 2.14 or earlier carry none — mint a new one with POST /xenon/api/auth/token ' +
+    '({"audience":"xenon-mcp"}) using a credential that has the `sessions` scope.';
 /**
  * How long the hub waits for a node (or cloud provider) to create a session.
  * A create is sent once (InternalRequestConfig `retry: false`): the node may
@@ -263,6 +278,7 @@ let SessionLifecycleService = class SessionLifecycleService {
                 apiKeyId: authResult.apiKeyId,
                 userId: authResult.userId,
                 appDownload,
+                allocatedAt: Date.now(),
             };
             // The grant opens one phone, on this node. A token taken to another node
             // (an emulator's udid repeats across machines), or naming a phone this
@@ -391,7 +407,7 @@ let SessionLifecycleService = class SessionLifecycleService {
             this.logger.debug(`📱 Removing pending session with capability_id: ${allocation.pendingSessionId}`);
             yield (0, pending_sessions_service_1.removePendingSession)(allocation.pendingSessionId);
             if (this.isCreateSessionResponseInternal(session)) {
-                yield this.finalizeSession(session, device, caps, driver, remote, allocation.apiKeyId, allocation.userId);
+                yield this.finalizeSession(session, device, caps, driver, remote, allocation.apiKeyId, allocation.userId, allocation.allocatedAt);
             }
             else {
                 yield this.handleSessionFailure(session, device, remote);
@@ -505,9 +521,11 @@ let SessionLifecycleService = class SessionLifecycleService {
     // took out of `xe:options` (or its `xenon:options` alias): an access-key +
     // token pair, or a session token. Today this is best-effort: if none is
     // supplied we log a warning and let the request through to avoid breaking
-    // pre-existing test clients, unless XENON_REQUIRE_SESSION_TOKEN is on. A
-    // supplied key that is invalid / revoked / has insufficient scope is
-    // rejected. Respects the global `authDisabled` flag.
+    // pre-existing test clients, unless XENON_REQUIRE_SESSION_TOKEN is on.
+    // Credentials that don't verify — a wrong, revoked or expired key or token,
+    // or one whose user is deleted or not ACTIVE — count as none. Credentials
+    // that verify without the `sessions` scope are rejected. Respects the
+    // global `authDisabled` flag.
     //
     // Returns the caller's { apiKeyId, callerTeamIds } so allocation can filter
     // devices, and app resolution uploaded apps, by team. `apiKeyId` is null
@@ -549,23 +567,47 @@ let SessionLifecycleService = class SessionLifecycleService {
             }
             const { ApiKeyService } = yield Promise.resolve().then(() => __importStar(require('./ApiKeyService')));
             const svc = typedi_1.Container.get(ApiKeyService);
+            const { verifyKeyPairCredential, verifySessionTokenCredential, isWrongSessionToken } = yield Promise.resolve().then(() => __importStar(require('../middleware/verifyCredential')));
             // xe:options.{accessKey, token} — the only key-pair credential shape.
+            // Checked by REST's rule (verifyKeyPairCredential): a live key whose owner
+            // exists and is ACTIVE. The key alone (verifyPair) let a user set to
+            // Inactive, or deleted, keep creating sessions as themselves. The owner
+            // found here is the one lookup the session's scope and lease use.
             const pair = credentials.pair;
-            const row = pair ? yield svc.verifyPair(pair.accessKey, pair.token) : null;
+            const verifiedPair = pair ? yield verifyKeyPairCredential(pair.accessKey, pair.token) : null;
+            // The session token, verified once for both the gate and attribution, by
+            // REST's rule too: a live signature and an ACTIVE subject, looked up now.
+            let tokenCheck;
+            const verifyToken = (t) => {
+                if (!tokenCheck)
+                    tokenCheck = verifySessionTokenCredential(t);
+                return tokenCheck;
+            };
+            // Both readers below treat any failure as a token that doesn't check out:
+            // the gate refuses it as "invalid or expired", attribution ignores it. A
+            // check that could not run (the database or the signing key unavailable)
+            // is not that: it refuses the create here, as a key whose owner can't be
+            // looked up does, rather than run the session with no owner.
+            if (!verifiedPair && credentials.sessionToken) {
+                yield verifyToken(credentials.sessionToken).catch((err) => {
+                    if (!isWrongSessionToken(err))
+                        throw err;
+                });
+            }
             const { assertSessionTokenGate, sessionTokenGateEnabled } = yield Promise.resolve().then(() => __importStar(require('./sessionTokenGate')));
             try {
                 yield assertSessionTokenGate({
                     enabled: sessionTokenGateEnabled(),
-                    hasValidKeyPair: !!row,
+                    hasValidKeyPair: !!verifiedPair,
                     token: credentials.sessionToken,
-                    verify: (t) => typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(t, { audience: 'xenon-session' }),
+                    verify: verifyToken,
                 });
             }
             catch (err) {
                 this.logger.error(`❌ ${err.message}`);
                 throw new base_driver_1.errors.InvalidArgumentError(err.message);
             }
-            if (!row) {
+            if (!verifiedPair) {
                 // No key pair. An xe:options.sessionToken still identifies the caller,
                 // so read it for attribution even when the gate is off — otherwise the
                 // ownership guard fails closed on a session whose owner we actually know.
@@ -573,23 +615,36 @@ let SessionLifecycleService = class SessionLifecycleService {
                 // The token's teamId claim narrows it the way a key's team does; kept
                 // from the one verify rather than verifying again.
                 let tokenTeamId = null;
+                let tokenScopes;
+                let tokenOwner;
                 const identity = yield (0, sessionIdentity_1.resolveSessionIdentity)({
                     row: null,
                     sessionToken: credentials.sessionToken,
                     verify: (t) => __awaiter(this, void 0, void 0, function* () {
-                        const payload = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(t, {
-                            audience: 'xenon-session',
-                        });
+                        const { payload, user } = yield verifyToken(t);
                         tokenTeamId = typeof (payload === null || payload === void 0 ? void 0 : payload.teamId) === 'string' ? payload.teamId : null;
+                        tokenScopes = payload === null || payload === void 0 ? void 0 : payload.scopes;
+                        tokenOwner = user;
                         return payload;
                     }),
                 });
+                // A token that names its owner may create sessions only with the
+                // `sessions` scope, as a key pair may: refused, like a key without it.
+                if (identity.userId && !sessionTokenGrantsSessions(tokenScopes)) {
+                    this.logger.error('Rejecting session: xe:options.sessionToken lacks the `sessions` scope');
+                    throw new base_driver_1.errors.InvalidArgumentError(SESSION_TOKEN_LACKS_SCOPE);
+                }
                 if (!identity.userId) {
                     this.logger.warn('Session created without valid credentials. Pass `xe:options.accessKey` + ' +
                         '`xe:options.token`, or `xe:options.sessionToken`.');
                 }
-                const leaseAccess = this.leaseAccessFor(identity.userId
-                    ? { kind: 'session-token', userId: identity.userId, teamId: tokenTeamId }
+                const leaseAccess = this.leaseAccessFor(identity.userId && tokenOwner
+                    ? {
+                        kind: 'session-token',
+                        scopes: String(tokenScopes),
+                        user: tokenOwner,
+                        teamId: tokenTeamId,
+                    }
                     : { kind: 'none' });
                 // A token's user is scoped as REST scopes them. No credentials at all
                 // stays unscoped (the back-compat path), with no lookup.
@@ -599,6 +654,7 @@ let SessionLifecycleService = class SessionLifecycleService {
                         teamId: identity.userId ? tokenTeamId : null,
                     } });
             }
+            const { row, user: owner } = verifiedPair;
             if (!svc.hasScope(row, ['sessions'])) {
                 this.logger.error('Rejecting session: credentials lack the `sessions` scope');
                 throw new base_driver_1.errors.InvalidArgumentError('credentials are invalid, revoked, or lack the `sessions` scope');
@@ -607,7 +663,7 @@ let SessionLifecycleService = class SessionLifecycleService {
             const leaseAccess = this.leaseAccessFor({
                 kind: 'api-key',
                 scopes: row.scopes,
-                userId: row.userId,
+                user: owner,
                 teamId: (_a = row.teamId) !== null && _a !== void 0 ? _a : null,
             });
             // The phones and apps this session may use: REST's rule
@@ -642,7 +698,8 @@ let SessionLifecycleService = class SessionLifecycleService {
     // How a session that names a lease is judged, looked up at most once and
     // only when asked. Who may override follows canOverrideLease; which phones
     // it can see follows REST's computeTeamIds. Both need the owner's live role,
-    // as authMiddleware reads it for every REST request.
+    // as authMiddleware reads it for every REST request: the owner the
+    // credential check looked up a moment ago, ACTIVE then.
     leaseAccessFor(credential) {
         let looked;
         return () => {
@@ -659,24 +716,24 @@ let SessionLifecycleService = class SessionLifecycleService {
             if (credential.kind === 'none') {
                 return { canOverride: (0, leaseOverride_1.canOverrideLease)({ kind: 'none' }), teamIds: undefined };
             }
+            const { user } = credential;
             try {
-                const { UserService } = yield Promise.resolve().then(() => __importStar(require('./UserService')));
-                const found = yield typedi_1.Container.get(UserService).findById(credential.userId);
-                const user = found && found.status === 'ACTIVE' ? found : null;
-                const canOverride = (0, leaseOverride_1.canOverrideLease)(credential.kind === 'api-key'
-                    ? { kind: 'api-key', scopes: credential.scopes, user }
-                    : { kind: 'session-token', user });
-                const role = (user === null || user === void 0 ? void 0 : user.role) === 'SUPER_ADMIN' || (user === null || user === void 0 ? void 0 : user.role) === 'ADMIN' ? user.role : 'MEMBER';
+                const canOverride = (0, leaseOverride_1.canOverrideLease)({
+                    kind: credential.kind,
+                    scopes: credential.scopes,
+                    user,
+                });
+                const role = user.role === 'SUPER_ADMIN' || user.role === 'ADMIN' ? user.role : 'MEMBER';
                 const teamIds = yield (0, callerTeamIds_1.computeTeamIds)({
                     role,
-                    userId: credential.userId,
+                    userId: user.id,
                     apiKeyTeamId: credential.teamId,
                 });
                 return { canOverride, teamIds };
             }
             catch (err) {
                 // Fail closed: no override, and the shared pool only.
-                this.logger.warn(`Could not look up how user ${credential.userId} may use a lease: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
+                this.logger.warn(`Could not look up how user ${user.id} may use a lease: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
                 return { canOverride: false, teamIds: [] };
             }
         });
@@ -790,7 +847,7 @@ let SessionLifecycleService = class SessionLifecycleService {
         }
     }
     finalizeSession(session_1, device_1, caps_1, driver_1, isRemote_1) {
-        return __awaiter(this, arguments, void 0, function* (session, device, caps, driver, isRemote, apiKeyId = null, userId = null) {
+        return __awaiter(this, arguments, void 0, function* (session, device, caps, driver, isRemote, apiKeyId = null, userId = null, allocatedAt) {
             var _a;
             const sessionId = session.value[0];
             const sessionResponse = session.value[1];
@@ -826,6 +883,7 @@ let SessionLifecycleService = class SessionLifecycleService {
             const sessionInstance = this.createSessionInstance(sessionId, freshDevice, sessionResponse, xenonCapabilities, driver, webDriverUrl);
             sessionInstance.apiKeyId = apiKeyId;
             sessionInstance.userId = userId;
+            sessionInstance.allocatedAt = allocatedAt;
             // A session this server drives: its owner is known while it runs, row or
             // not (a node writes none for the hub's sessions; LiveSessionOwners).
             if (sessionInstance instanceof LocalSession_1.LocalSession) {
@@ -1148,6 +1206,7 @@ let SessionLifecycleService = class SessionLifecycleService {
             finally {
                 if (sessionId) {
                     typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).forget(sessionId);
+                    (0, sessionMemory_1.forgetSessionMemory)(sessionId);
                     // Before the lock's "still in memory?" check, which a dashboard-off
                     // node fails. On a node this ends the figures it holds for its hub;
                     // on a hub it collects a node session's last ones. Idempotent.
@@ -1263,6 +1322,7 @@ let SessionLifecycleService = class SessionLifecycleService {
                 }
                 SessionManager_1.SESSION_MANAGER.removeSession(sessionId);
                 typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).forget(sessionId);
+                (0, sessionMemory_1.forgetSessionMemory)(sessionId);
                 yield typedi_1.Container.get(SessionMetricsService_1.SessionMetricsService).stop(sessionId);
             }));
         });

package/lib/src/services/SocketServer.js

@@ -33,9 +33,14 @@ const SocketEvents_1 = require("../enums/SocketEvents");
 const callerTeamIds_1 = require("./device-access/callerTeamIds");
 const DeviceTeamResolver_1 = require("./device-access/DeviceTeamResolver");
 const upgradeRouter_1 = require("../app/ws/upgradeRouter");
+const sessionCommandSummary_1 = require("../dashboard/sessionCommandSummary");
 /** socket.io's default path, which the dashboard and nodes connect to. */
 const SOCKET_IO_PATH = '/socket.io';
 const SESSION_COOKIE = 'xenon_dashboard_session';
+const EVENT_LOG_KEEPS = new Map([
+    [SocketEvents_1.SocketEvents.INTERCEPTOR_REQUEST, null],
+    [SocketEvents_1.SocketEvents.SESSION_COMMAND, sessionCommandSummary_1.sessionCommandSummary],
+]);
 function readCookie(cookieHeader, name) {
     if (!cookieHeader)
         return undefined;
@@ -242,12 +247,23 @@ let SocketServer = SocketServer_1 = class SocketServer {
         if (this.io) {
             this.io.to('dashboard').emit(event, data);
         }
-        typedi_1.Container.get(EventLogService_1.EventLogService).appendSafe({ type: event, payload: data });
+        this.logEvent(event, data);
+    }
+    /** Once per event, unscoped: whole, or what EVENT_LOG_KEEPS keeps of it. */
+    logEvent(event, data) {
+        const keep = EVENT_LOG_KEEPS.get(event);
+        if (keep === null)
+            return;
+        typedi_1.Container.get(EventLogService_1.EventLogService).appendSafe({
+            type: event,
+            payload: keep ? keep(data) : data,
+        });
     }
     /**
      * A dashboard event about one or more phones: each dashboard socket gets it
      * only if its caller can see the phone ({@link DeviceEventScope}), by the
-     * same team rule as REST. The event log records it once, unscoped.
+     * same team rule as REST. The event log records it once, unscoped, as
+     * EVENT_LOG_KEEPS says.
      *
      * Each phone's events are delivered through one chain, in the order they
      * were emitted, whatever their scope shape: one that waits on a team lookup
@@ -262,7 +278,7 @@ let SocketServer = SocketServer_1 = class SocketServer {
      */
     emitToDashboardForDevices(event, data, scope) {
         var _a, _b;
-        typedi_1.Container.get(EventLogService_1.EventLogService).appendSafe({ type: event, payload: data });
+        this.logEvent(event, data);
         const udids = 'udids' in scope ? scope.udids : [(_a = scope.udid) !== null && _a !== void 0 ? _a : ''];
         if (!this.hasScopedDashboard() && udids.every((udid) => !this.deliveries.has(udid))) {
             this.noteRow(scope);

package/lib/src/services/bug-report/video-slice.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sliceVideo = sliceVideo;
 const child_process_1 = require("child_process");
+const ffmpegPath_1 = require("../../helpers/ffmpegPath");
 const logger_1 = __importDefault(require("../../logger"));
 function sliceVideo(inputPath, startSec, endSec, outPath, spawnFn = child_process_1.spawn) {
     return new Promise((resolve) => {
@@ -16,7 +17,9 @@ function sliceVideo(inputPath, startSec, endSec, outPath, spawnFn = child_proces
             '-c', 'copy',
             outPath,
         ];
-        const proc = spawnFn('ffmpeg', args);
+        // Xenon's own ffmpeg, as everywhere else: a bare name isn't found by a
+        // server the Mac app started, and finds a system ffmpeg first otherwise.
+        const proc = spawnFn((0, ffmpegPath_1.resolveFfmpegPath)(), args);
         let stderr = '';
         if (proc.stderr) {
             proc.stderr.on('data', (chunk) => {

package/lib/src/services/device-access/leaseOverride.js

@@ -2,18 +2,20 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.canOverrideLease = canOverrideLease;
 function canOverrideLease(credential) {
-    var _a, _b;
     switch (credential.kind) {
         case 'auth-disabled':
             return true;
-        case 'api-key': {
+        case 'api-key':
+        case 'session-token': {
             if (!credential.user)
                 return false;
             const scopes = new Set(credential.scopes.split(',').map((s) => s.trim()));
-            return scopes.has('admin') || credential.user.role === 'SUPER_ADMIN';
+            const { role } = credential.user;
+            if (credential.kind === 'session-token') {
+                return role === 'SUPER_ADMIN' || (role === 'ADMIN' && scopes.has('admin'));
+            }
+            return scopes.has('admin') || role === 'SUPER_ADMIN';
         }
-        case 'session-token':
-            return ((_a = credential.user) === null || _a === void 0 ? void 0 : _a.role) === 'SUPER_ADMIN' || ((_b = credential.user) === null || _b === void 0 ? void 0 : _b.role) === 'ADMIN';
         default:
             return false;
     }

package/lib/src/services/healing/FuzzyXmlHealingProvider.js

@@ -20,6 +20,9 @@ const xpath_1 = require("xpath");
 const typedi_1 = require("typedi");
 const logger_1 = __importDefault(require("../../logger"));
 const HealedLocatorGenerator_1 = require("./HealedLocatorGenerator");
+const fingerprintIdentity_1 = require("./fingerprintIdentity");
+/** What an element says in words, for telling it apart once its identifier differs. */
+const TEXTS = ['text', 'label', 'content-desc'];
 class FuzzyXmlHealingProvider {
     constructor(etalonService) {
         this.etalonService = etalonService;
@@ -41,6 +44,12 @@ class FuzzyXmlHealingProvider {
                 if (this.etalonService) {
                     etalon = yield this.etalonService.getSignature(context.selector);
                 }
+                // A fingerprint with only a rect and a type (every learnt one through
+                // 2.14) would heal to whatever element of that type is at that spot.
+                if (etalon && !(0, fingerprintIdentity_1.hasIdentity)(etalon.attributes)) {
+                    this.logger.info('The baseline signature says nothing about which element it is; matching without it.');
+                    etalon = null;
+                }
                 const keywords = this.extractKeywords(context.selector);
                 if (keywords.length === 0 && !etalon)
                     return null;
@@ -135,6 +144,9 @@ class FuzzyXmlHealingProvider {
             if (etalonTag !== nodeTag && etalonTag !== 'xcuielementtypeany' && etalonTag !== 'unknown') {
                 return 0; // Immediate rejection — wrong element type
             }
+            // Position can't heal to an element whose identifier says it's another one.
+            if (this.contradictsIdentifier(node, etalon))
+                return 0;
             // Tag matches perfectly
             totalWeight += 1.0;
             totalScore += 1.0;
@@ -260,6 +272,45 @@ class FuzzyXmlHealingProvider {
         }
         return finalScore;
     }
+    /**
+     * Whether `node` is, by its identifier, another element than the
+     * fingerprint's: the fingerprint has an identifier (an Android resource-id,
+     * compared without its package, or an iOS accessibility identifier), `node`
+     * has another one (sameIdentifier), and no text of it (text, label,
+     * content-desc) reads the same as the fingerprint's (sameText). Its
+     * position then counts for nothing.
+     *
+     * A renamed id that kept its text or description still heals, and so does
+     * a renamed text that kept its id. An element without an identifier, where
+     * the fingerprint has one, is judged by its text alone: an Android element
+     * with no resource-id, or an iOS one, whose name is then its label. Only
+     * where neither has one does position decide, as through 2.14.
+     * What this stops is the button that took the old one's place: "Cancel
+     * order" (cancel) where "Pay now" (pay) was, "Log out" where "Log in" was.
+     */
+    contradictsIdentifier(node, etalon) {
+        const identifier = (0, fingerprintIdentity_1.stableIdentifierOf)(etalon.attributes);
+        if (!identifier)
+            return false;
+        // Another identifier, or none where the fingerprint has one, and the
+        // text decides. iOS gives an element without one its label as name.
+        const theirs = this.getAttrValue(node, identifier.attribute);
+        if ((0, fingerprintIdentity_1.meaningful)(theirs)) {
+            const [mine, other] = identifier.attribute === 'resource-id'
+                ? [(0, fingerprintIdentity_1.resourceIdName)(identifier.value), (0, fingerprintIdentity_1.resourceIdName)(theirs)]
+                : [identifier.value, theirs];
+            if ((0, fingerprintIdentity_1.sameIdentifier)(mine, other))
+                return false;
+        }
+        const texts = TEXTS.map((name) => etalon.attributes[name]).filter(fingerprintIdentity_1.meaningful);
+        if (texts.length === 0)
+            return true;
+        const nodeTexts = [
+            node.textContent,
+            ...TEXTS.map((name) => this.getAttrValue(node, name)),
+        ].filter(fingerprintIdentity_1.meaningful);
+        return !nodeTexts.some((t) => texts.some((w) => (0, fingerprintIdentity_1.sameText)(t, w)));
+    }
     getAttrValue(node, name) {
         if (typeof node.getAttribute === 'function') {
             const val = node.getAttribute(name);

package/lib/src/services/healing/HealEtalonService.js

@@ -37,7 +37,9 @@ let HealEtalonService = class HealEtalonService {
         return __awaiter(this, void 0, void 0, function* () {
             try {
                 const attributes = {};
-                // Extract identifying attributes
+                // Extract identifying attributes. Not `value`: on a text field it is
+                // what the test typed, an email or a name, which says nothing about
+                // which field it is.
                 const nodeAttrs = node.attributes || [];
                 const anchorNames = [
                     'content-desc',
@@ -48,7 +50,6 @@ let HealEtalonService = class HealEtalonService {
                     'hint',
                     'label',
                     'accessibility-id',
-                    'value',
                     'x',
                     'y',
                     'width',