@xenon-device-management/xenon 2.14.0 → 2.15.0

package/lib/test/unit/stream-start-pipelines.spec.js

@@ -72,6 +72,10 @@ const own_node_id_1 = require("../helpers/own-node-id");
  * cannot decode H.264 (WebCodecs exists only in a secure context, so plain
  * http://hub:4723 has none), shows MJPEG, so it says so when it starts the
  * stream (`player: 'mjpeg'`), and the server then runs MJPEG only.
+ *
+ * Only once nobody plays the H.264 capture, though. A Live devices tile, or a
+ * second tab, may still be playing it when one page falls back to MJPEG; the
+ * capture then ends when its last viewer leaves, not under them.
  */
 const UDID = 'DEV-1';
 function buildApp() {
@@ -98,10 +102,31 @@ describe('POST /control/:udid/stream/start: which capture runs', () => {
     let restoreContainer;
     let savedArgs;
     let mjpegStart;
+    let h264;
     let h264Start;
     let h264Stop;
-    let h264Running;
+    let captureKills;
+    let pushPacket;
     let row;
+    /** The real H.264 service with its capture (scrcpy) stubbed out. */
+    const h264Service = () => {
+        const svc = Object.create(AndroidH264StreamService_1.default.prototype);
+        svc.sessions = new Map();
+        svc.startPromises = new Map();
+        svc.scrcpyIncompatible = new Set();
+        svc.openCapture = (_udid, onPacket) => __awaiter(void 0, void 0, void 0, function* () {
+            pushPacket = onPacket;
+            onPacket({ type: 'config', data: Buffer.from([0]), ptsMs: 0 });
+            return { kill: () => (captureKills += 1) };
+        });
+        return svc;
+    };
+    /** Another page playing the phone's H.264 preview: what it got, and its leave. */
+    const h264Viewer = () => __awaiter(void 0, void 0, void 0, function* () {
+        const got = [];
+        const leave = (yield h264.start(UDID)).addClient((p) => got.push(p.type));
+        return { got, leave };
+    });
     const flag = (androidH264) => {
         typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs = Object.assign(Object.assign({}, savedArgs), { streaming: { androidH264 } });
     };
@@ -120,27 +145,27 @@ describe('POST /control/:udid/stream/start: which capture runs', () => {
         };
         sinon_1.default.stub(device_store_1.DeviceStoreFactory, 'getStore').returns({ findDevice: () => __awaiter(void 0, void 0, void 0, function* () { return row; }) });
         sinon_1.default.stub(deviceService, 'blockDevice').resolves();
-        h264Running = false;
+        captureKills = 0;
         mjpegStart = sinon_1.default.stub().resolves({ mjpegPort: 9100 });
-        h264Start = sinon_1.default.stub().callsFake(() => __awaiter(void 0, void 0, void 0, function* () {
-            h264Running = true;
-            return {};
-        }));
-        h264Stop = sinon_1.default.stub().callsFake(() => __awaiter(void 0, void 0, void 0, function* () {
-            h264Running = false;
-        }));
+        h264 = h264Service();
         typedi_1.Container.set(AndroidStreamService_1.default, {
             startStream: mjpegStart,
             getStreamStatus: () => undefined,
         });
         typedi_1.Container.set(IOSStreamService_1.default, { getStreamStatus: () => undefined });
-        typedi_1.Container.set(AndroidH264StreamService_1.default, {
-            start: h264Start,
-            stop: h264Stop,
-            getMultiplexer: () => (h264Running ? { clientCount: 0 } : undefined),
-        });
+        typedi_1.Container.set(AndroidH264StreamService_1.default, h264);
         typedi_1.Container.set(recording_store_1.RecordingStore, { isRecording: () => __awaiter(void 0, void 0, void 0, function* () { return false; }) });
+        // Spied after any setup start, so they count only what the route does.
+        h264Start = sinon_1.default.spy(h264, 'start');
+        h264Stop = sinon_1.default.spy(h264, 'stop');
     });
+    /** An H.264 capture already running for the phone, as a tile's start leaves it. */
+    const h264AlreadyRunning = () => __awaiter(void 0, void 0, void 0, function* () {
+        h264Start.restore();
+        yield h264.start(UDID);
+        h264Start = sinon_1.default.spy(h264, 'start');
+    });
+    const h264Running = () => h264.getMultiplexer(UDID) !== undefined;
     afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
         sinon_1.default.restore();
         typedi_1.Container.get(PluginContext_1.PluginContext).pluginArgs = savedArgs;
@@ -170,20 +195,39 @@ describe('POST /control/:udid/stream/start: which capture runs', () => {
         (0, chai_1.expect)(mjpegStart.calledOnce).to.equal(true);
         (0, chai_1.expect)(h264Start.called).to.equal(false);
     }));
-    it('ends an H.264 capture already running for the phone, so the two never overlap', () => __awaiter(void 0, void 0, void 0, function* () {
+    it('ends an H.264 capture nobody is watching, so the two never overlap', () => __awaiter(void 0, void 0, void 0, function* () {
         flag(true);
-        h264Running = true;
+        yield h264AlreadyRunning();
         yield start({ player: 'mjpeg' });
         (0, chai_1.expect)(h264Stop.calledOnceWith(UDID)).to.equal(true);
+        (0, chai_1.expect)(captureKills).to.equal(1);
         (0, chai_1.expect)(mjpegStart.calledOnce).to.equal(true);
-        (0, chai_1.expect)(h264Running).to.equal(false);
+        (0, chai_1.expect)(h264Running()).to.equal(false);
     }));
     it('stops the H.264 capture before it starts the MJPEG one', () => __awaiter(void 0, void 0, void 0, function* () {
         flag(true);
-        h264Running = true;
+        yield h264AlreadyRunning();
         yield start({ player: 'mjpeg' });
         (0, chai_1.expect)(h264Stop.calledBefore(mjpegStart)).to.equal(true);
     }));
+    it('keeps the H.264 capture for another page still playing it', () => __awaiter(void 0, void 0, void 0, function* () {
+        flag(true);
+        const other = yield h264Viewer();
+        const res = yield start({ player: 'mjpeg' });
+        (0, chai_1.expect)(res.body.type).to.equal('mjpeg');
+        (0, chai_1.expect)(mjpegStart.calledOnce).to.equal(true);
+        (0, chai_1.expect)(captureKills).to.equal(0);
+        pushPacket({ type: 'key', data: Buffer.from([1]), ptsMs: 1 });
+        (0, chai_1.expect)(other.got).to.deep.equal(['config', 'key']);
+    }));
+    it('ends the H.264 capture when that last page leaves, without waiting for the idle stop', () => __awaiter(void 0, void 0, void 0, function* () {
+        flag(true);
+        const other = yield h264Viewer();
+        yield start({ player: 'mjpeg' });
+        other.leave();
+        (0, chai_1.expect)(captureKills).to.equal(1);
+        (0, chai_1.expect)(h264Running()).to.equal(false);
+    }));
     it('runs MJPEG alone, and stops nothing, when the flag is off', () => __awaiter(void 0, void 0, void 0, function* () {
         flag(false);
         const res = yield start();
@@ -207,4 +251,14 @@ describe('POST /control/:udid/stream/start: which capture runs', () => {
         (0, chai_1.expect)(mjpegStart.calledOnce).to.equal(true);
         (0, chai_1.expect)(h264Start.called).to.equal(false);
     }));
+    it('ends H.264 at once for a phone being recorded, viewers or not, as before', () => __awaiter(void 0, void 0, void 0, function* () {
+        // A recording reads the MJPEG capture, and H.264 never runs beside it
+        // (ensureMjpegForRecording stopped it when the recording began).
+        flag(true);
+        yield h264Viewer();
+        typedi_1.Container.set(recording_store_1.RecordingStore, { isRecording: () => __awaiter(void 0, void 0, void 0, function* () { return true; }) });
+        yield start();
+        (0, chai_1.expect)(captureKills).to.equal(1);
+        (0, chai_1.expect)(h264Running()).to.equal(false);
+    }));
 });

package/lib/test/unit/token-mint-limits.spec.js

@@ -0,0 +1,165 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const jose = __importStar(require("jose"));
+const typedi_1 = require("typedi");
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const JwtKeyService_1 = require("../../src/services/token/JwtKeyService");
+const auth_1 = require("../../src/app/routers/auth");
+const container_registration_1 = require("../helpers/container-registration");
+/**
+ * A token POST /auth/token mints never carries more than the credential
+ * minting it: not more scopes, and not a longer life.
+ *
+ * - The `sessionToken` beside a xenon-mcp token creates Appium sessions, so
+ *   it is minted only when the grant includes `appium:use` (which needs the
+ *   `sessions` scope), and carries the scopes a session is judged by. Any
+ *   credential used to get one, a read-only key included.
+ * - A token minted with a Bearer token, or an API key that expires, ends no
+ *   later than that credential. A 1-hour token used to mint a fresh 1-hour
+ *   token, for ever.
+ */
+describe('POST /auth/token mints nothing its creator does not have', () => {
+    let dir;
+    let restoreContainer;
+    beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+        restoreContainer = (0, container_registration_1.saveRegistrations)(JwtKeyService_1.JwtKeyService);
+        dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'xenon-mint-limits-'));
+        const svc = new JwtKeyService_1.JwtKeyService();
+        yield svc.init(dir);
+        typedi_1.Container.set(JwtKeyService_1.JwtKeyService, svc);
+    }));
+    afterEach(() => {
+        restoreContainer();
+        fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    const base = { kind: 'api-key', userId: 'u1', role: 'MEMBER', teamId: null, rateLimit: 300 };
+    const auth = (extra) => (Object.assign(Object.assign({}, base), extra));
+    describe('the session token', () => {
+        it('is not minted for a read-only credential', () => __awaiter(void 0, void 0, void 0, function* () {
+            const out = yield (0, auth_1.issueToken)(auth({ scopes: 'read' }), { audience: 'xenon-mcp' });
+            (0, chai_1.expect)(out.token).to.be.a('string');
+            (0, chai_1.expect)(out.sessionToken).to.equal(undefined);
+        }));
+        it('is not minted when the grant asked for leaves out appium:use', () => __awaiter(void 0, void 0, void 0, function* () {
+            const out = yield (0, auth_1.issueToken)(auth({ scopes: 'devices,sessions,read' }), {
+                audience: 'xenon-mcp',
+                scopes: ['xenon:devices:read'],
+            });
+            (0, chai_1.expect)(out.sessionToken).to.equal(undefined);
+        }));
+        it('carries `sessions`, and `admin` only when its creator has it', () => __awaiter(void 0, void 0, void 0, function* () {
+            const member = yield (0, auth_1.issueToken)(auth({ scopes: 'devices,sessions,read' }), {
+                audience: 'xenon-mcp',
+            });
+            (0, chai_1.expect)(jose.decodeJwt(String(member.sessionToken)).scopes).to.equal('sessions');
+            const dashboardAdmin = yield (0, auth_1.issueToken)(auth({ kind: 'user-session', role: 'ADMIN', scopes: 'admin,devices,sessions,read' }), { audience: 'xenon-mcp' });
+            (0, chai_1.expect)(jose.decodeJwt(String(dashboardAdmin.sessionToken)).scopes).to.equal('admin,sessions');
+        }));
+    });
+    // `admin` lets a session take over a lease someone else made. A token asked
+    // for with narrower MCP scopes doesn't get it from an admin key's breadth.
+    describe("the session token's admin scope follows the grant", () => {
+        const adminKey = () => auth({ scopes: 'admin' });
+        const scopesOf = (t) => jose.decodeJwt(String(t)).scopes;
+        it('is left out when narrower scopes are asked for', () => __awaiter(void 0, void 0, void 0, function* () {
+            const out = yield (0, auth_1.issueToken)(adminKey(), { audience: 'xenon-mcp', scopes: ['appium:use'] });
+            (0, chai_1.expect)(scopesOf(out.sessionToken)).to.equal('sessions');
+        }));
+        it('is given for the default grant, and for a full-admin one', () => __awaiter(void 0, void 0, void 0, function* () {
+            const byDefault = yield (0, auth_1.issueToken)(adminKey(), { audience: 'xenon-mcp' });
+            (0, chai_1.expect)(scopesOf(byDefault.sessionToken)).to.equal('admin,sessions');
+            const full = yield (0, auth_1.issueToken)(adminKey(), {
+                audience: 'xenon-mcp',
+                scopes: [
+                    'appium:use',
+                    'xenon:analytics:read',
+                    'xenon:devices:lock',
+                    'xenon:devices:read',
+                    'xenon:recordings',
+                ],
+            });
+            (0, chai_1.expect)(scopesOf(full.sessionToken)).to.equal('admin,sessions');
+        }));
+    });
+    describe('its lifetime', () => {
+        const now = () => Math.floor(Date.now() / 1000);
+        for (const audience of ['xenon-rest', 'xenon-mcp']) {
+            it(`a ${audience} token ends no later than the credential that minted it`, () => __awaiter(void 0, void 0, void 0, function* () {
+                const creatorExp = now() + 600;
+                const out = yield (0, auth_1.issueToken)(auth({ kind: 'bearer', scopes: 'sessions,read', credentialExpiresAt: creatorExp * 1000 }), { audience });
+                const p = jose.decodeJwt(out.token);
+                (0, chai_1.expect)(p.exp).to.be.at.most(creatorExp);
+                (0, chai_1.expect)(out.expiresIn).to.be.at.most(600);
+                (0, chai_1.expect)(out.expiresIn).to.be.at.least(598);
+                if (out.sessionToken) {
+                    (0, chai_1.expect)(jose.decodeJwt(out.sessionToken).exp).to.be.at.most(creatorExp);
+                }
+            }));
+        }
+        it('keeps its own lifetime when the credential outlives it', () => __awaiter(void 0, void 0, void 0, function* () {
+            const out = yield (0, auth_1.issueToken)(auth({ scopes: 'sessions', credentialExpiresAt: Date.now() + 30 * 86400000 }), { audience: 'xenon-rest' });
+            (0, chai_1.expect)(out.expiresIn).to.equal(3600);
+        }));
+        it('is refused when the credential has already expired', () => __awaiter(void 0, void 0, void 0, function* () {
+            let caught;
+            try {
+                yield (0, auth_1.issueToken)(auth({ scopes: 'sessions', credentialExpiresAt: Date.now() - 1000 }), {
+                    audience: 'xenon-rest',
+                });
+            }
+            catch (err) {
+                caught = err;
+            }
+            (0, chai_1.expect)(caught === null || caught === void 0 ? void 0 : caught.message).to.match(/expired/);
+        }));
+    });
+});

package/lib/test/unit/unexpected-shutdown-reason.spec.js

@@ -0,0 +1,163 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const typedi_1 = require("typedi");
+const plugin_1 = require("../../src/plugin");
+const DeviceService = __importStar(require("../../src/data-service/device-service"));
+const device_store_1 = require("../../src/data-service/device-store");
+const SessionManager_1 = require("../../src/sessions/SessionManager");
+const SessionMetricsService_1 = require("../../src/services/metrics/SessionMetricsService");
+const PhoneNetworkRestore_1 = require("../../src/services/network/PhoneNetworkRestore");
+const SocketServer_1 = require("../../src/services/SocketServer");
+const MetricsService_1 = require("../../src/services/MetricsService");
+const NotificationService_1 = require("../../src/services/NotificationService");
+const AIService_1 = require("../../src/services/AIService");
+const shutdownReason_1 = require("../../src/services/session/shutdownReason");
+const prisma_1 = require("../../src/prisma");
+const container_registration_1 = require("../helpers/container-registration");
+const scratch_database_1 = require("../helpers/scratch-database");
+/**
+ * A session Appium ends by itself reaches `XenonPlugin.onUnexpectedShutdown`
+ * with a cause. For an idle session that is Appium's new-command timeout.
+ * The plugin threw the cause away and recorded "Driver shut down
+ * unexpectedly", which no failure pattern matches, so an idle session on this
+ * server's own phones was filed UNKNOWN and its "Why it failed" card opened
+ * the general runbook rather than the Timeout one.
+ */
+// What @appium/base-driver 10.2 passes when a session sits idle too long.
+const IDLE = "New Command Timeout of 60 seconds expired. Try customizing the timeout using the 'newCommandTimeout' desired capability";
+describe('the reason of a session Appium ends by itself', () => {
+    it("is Appium's cause: its new-command timeout", () => {
+        (0, chai_1.expect)((0, shutdownReason_1.unexpectedShutdownReason)(new Error(IDLE))).to.equal(IDLE);
+    });
+    it("is a driver's own account of giving up, which still reads as one", () => {
+        (0, chai_1.expect)((0, shutdownReason_1.unexpectedShutdownReason)(new Error('The driver was unexpectedly shut down!'))).to.equal('The driver was unexpectedly shut down!');
+    });
+    it('is the old fixed reason when there is no cause to tell', () => {
+        for (const cause of [undefined, null, new Error(''), new Error('   '), {}, 42]) {
+            (0, chai_1.expect)((0, shutdownReason_1.unexpectedShutdownReason)(cause), String(cause)).to.equal(shutdownReason_1.UNEXPECTED_SHUTDOWN_REASON);
+        }
+        // The umbrella's placeholder when a driver gives none.
+        (0, chai_1.expect)((0, shutdownReason_1.unexpectedShutdownReason)(new Error('Unknown error'))).to.equal(shutdownReason_1.UNEXPECTED_SHUTDOWN_REASON);
+    });
+    it('is the message alone, never a stack', () => {
+        const err = new Error(IDLE);
+        (0, chai_1.expect)((0, shutdownReason_1.unexpectedShutdownReason)(err)).not.to.contain('    at ');
+    });
+});
+describe('a session Appium ends for being idle, on a hub that records sessions', function () {
+    this.timeout(30000);
+    const scratch = (0, scratch_database_1.useScratchDatabase)();
+    let restoreRegs;
+    let wasHub;
+    const plugin = {
+        pluginArgs: { enableDashboard: true },
+        xenonLog: { withSession: () => ({ info() { } }) },
+    };
+    const seed = (id) => scratch.db.session.create({
+        data: {
+            id,
+            status: 'running',
+            desired_capabilities: '{}',
+            session_capabilities: '{}',
+            node_id: 'n-1',
+            has_live_video: false,
+            device_udid: 'R5CT',
+            device_platform: 'android',
+            device_version: '14',
+        },
+    });
+    const shutDown = (id, cause) => plugin_1.XenonPlugin.prototype.onUnexpectedShutdown.call(plugin, { sessionId: id, caps: { udid: 'R5CT' } }, cause);
+    beforeEach(() => __awaiter(this, void 0, void 0, function* () {
+        restoreRegs = (0, container_registration_1.saveRegistrations)(PhoneNetworkRestore_1.PhoneNetworkRestore, SessionMetricsService_1.SessionMetricsService, SocketServer_1.SocketServer, MetricsService_1.MetricsService, NotificationService_1.NotificationService);
+        typedi_1.Container.set(PhoneNetworkRestore_1.PhoneNetworkRestore, { restoreSession: sinon_1.default.stub().resolves() });
+        typedi_1.Container.set(SessionMetricsService_1.SessionMetricsService, { stop: sinon_1.default.stub().resolves() });
+        typedi_1.Container.set(SocketServer_1.SocketServer, {
+            emitToDashboard: sinon_1.default.stub(),
+            emitToDashboardForDevices: sinon_1.default.stub().resolves(),
+            hasScopedDashboard: sinon_1.default.stub().returns(false),
+        });
+        typedi_1.Container.set(MetricsService_1.MetricsService, {
+            incrementSessionSuccess: sinon_1.default.stub(),
+            incrementSessionFailure: sinon_1.default.stub(),
+        });
+        typedi_1.Container.set(NotificationService_1.NotificationService, { notifySessionFailed: sinon_1.default.stub().resolves() });
+        sinon_1.default.stub(DeviceService, 'releaseSessionDevices').resolves();
+        sinon_1.default
+            .stub(device_store_1.DeviceStoreFactory, 'getStore')
+            .returns({ getDevices: () => __awaiter(this, void 0, void 0, function* () { return []; }), findDevices: () => __awaiter(this, void 0, void 0, function* () { return []; }) });
+        sinon_1.default.stub(SessionManager_1.SESSION_MANAGER, 'getSession').returns(undefined);
+        sinon_1.default.stub(AIService_1.AI_SERVICE, 'isEnabled').returns(false);
+        wasHub = plugin_1.XenonPlugin.IS_HUB;
+        plugin_1.XenonPlugin.IS_HUB = true;
+        yield scratch.db.session.deleteMany({});
+    }));
+    afterEach(() => {
+        plugin_1.XenonPlugin.IS_HUB = wasHub;
+        sinon_1.default.restore();
+        restoreRegs();
+    });
+    it("is failed with Appium's reason and filed TIMEOUT", () => __awaiter(this, void 0, void 0, function* () {
+        yield seed('s-idle');
+        yield shutDown('s-idle', new Error(IDLE));
+        const row = yield prisma_1.prisma.session.findUnique({ where: { id: 's-idle' } });
+        (0, chai_1.expect)(row === null || row === void 0 ? void 0 : row.status).to.equal('failed');
+        (0, chai_1.expect)(row === null || row === void 0 ? void 0 : row.failure_reason).to.equal(IDLE);
+        (0, chai_1.expect)(row === null || row === void 0 ? void 0 : row.failure_category).to.equal('TIMEOUT');
+    }));
+    it('keeps the old reason, filed UNKNOWN, when Appium gives no cause', () => __awaiter(this, void 0, void 0, function* () {
+        yield seed('s-crash');
+        yield shutDown('s-crash', undefined);
+        const row = yield prisma_1.prisma.session.findUnique({ where: { id: 's-crash' } });
+        (0, chai_1.expect)(row === null || row === void 0 ? void 0 : row.status).to.equal('failed');
+        (0, chai_1.expect)(row === null || row === void 0 ? void 0 : row.failure_reason).to.equal(shutdownReason_1.UNEXPECTED_SHUTDOWN_REASON);
+        (0, chai_1.expect)(row === null || row === void 0 ? void 0 : row.failure_category).to.equal('UNKNOWN');
+    }));
+});

package/lib/test/unit/verify-credential.spec.js

@@ -24,6 +24,7 @@ const UserService_1 = require("../../src/services/UserService");
 const ApiKeyService_1 = require("../../src/services/ApiKeyService");
 const verifyCredential_1 = require("../../src/middleware/verifyCredential");
 const container_registration_1 = require("../helpers/container-registration");
+const commandCaller_1 = require("../../src/middleware/commandCaller");
 /**
  * The credential checks authMiddleware applies to the header pair and to a
  * Bearer JWT, pulled out so the WebDriver per-command check verifies exactly
@@ -80,6 +81,38 @@ describe('verifyCredential', () => {
             const token = yield keys.sign({ sub: 'u1' }, { audience: 'xenon-rest', ttlSeconds: 60 });
             (0, chai_1.expect)(yield (0, verifyCredential_1.verifyBearerCredential)(token)).to.equal(null);
         }));
+        // A token's scopes are fixed when it is minted, for up to a day. An
+        // admin demoted to member since keeps no `admin` from it: REST
+        // (resolveActor, scopeGuard) and per-command auth's override read these.
+        describe("the scopes, by the user's role now", () => {
+            const mint = (scopes, audience = 'xenon-rest') => keys.sign({ sub: 'u1', scopes }, { audience, ttlSeconds: 60 });
+            const withRole = (role) => typedi_1.Container.get(UserService_1.UserService).findById.resolves(Object.assign(Object.assign({}, active), { role }));
+            it('drops admin from the token of a user who is now a member', () => __awaiter(void 0, void 0, void 0, function* () {
+                withRole('MEMBER');
+                for (const audience of ['xenon-rest', 'xenon-mcp']) {
+                    const out = yield (0, verifyCredential_1.verifyBearerCredential)(yield mint('admin,devices,sessions,read', audience));
+                    (0, chai_1.expect)(out === null || out === void 0 ? void 0 : out.payload.scopes, audience).to.equal('devices,sessions,read');
+                }
+            }));
+            it('keeps admin for an ADMIN or SUPER_ADMIN', () => __awaiter(void 0, void 0, void 0, function* () {
+                for (const role of ['ADMIN', 'SUPER_ADMIN']) {
+                    withRole(role);
+                    const out = yield (0, verifyCredential_1.verifyBearerCredential)(yield mint('admin,sessions'));
+                    (0, chai_1.expect)(out === null || out === void 0 ? void 0 : out.payload.scopes, role).to.equal('admin,sessions');
+                }
+            }));
+            it('gives a demoted admin no override in per-command auth', () => __awaiter(void 0, void 0, void 0, function* () {
+                withRole('MEMBER');
+                const verdict = yield new commandCaller_1.CommandCallerVerifier().verify({
+                    kind: 'bearer',
+                    token: yield mint('admin,sessions'),
+                });
+                (0, chai_1.expect)(verdict).to.deep.equal({
+                    valid: true,
+                    caller: { userId: 'u1', overrideAdmin: false },
+                });
+            }));
+        });
         it('throws when the signing key is not available, rather than calling the token invalid', () => __awaiter(void 0, void 0, void 0, function* () {
             typedi_1.Container.set(JwtKeyService_1.JwtKeyService, new JwtKeyService_1.JwtKeyService()); // never initialised
             const token = yield keys.sign({ sub: 'u1' }, { audience: 'xenon-rest', ttlSeconds: 60 });

package/lib/test/unit/vision-assertion.spec.js

@@ -94,10 +94,11 @@ describe('xenon: assertVisualState', () => {
         (0, chai_1.expect)(err.message).to.match(/429 quota exceeded/);
     }));
     it('fails when the provider is rate-limited', () => __awaiter(void 0, void 0, void 0, function* () {
-        // Gemini's provider answers this instead of throwing on a 429.
-        withProvider('CONNECTION_OK_RATE_LIMITED');
+        // Any provider's 429 (ai-rate-limit.spec.ts).
+        withProvider(new AIService_1.AIRateLimitedError('429 Too Many Requests'));
         const err = yield failureOf(service.assertState(driver, 'The cart is empty'));
         (0, chai_1.expect)(err.message).to.match(/rate-limited/i);
+        (0, chai_1.expect)(err.message).to.match(/not checked/);
     }));
     it('fails without asking when there is no condition', () => __awaiter(void 0, void 0, void 0, function* () {
         const call = withProvider('{"result": true, "reason": "ok"}');

package/lib/test/unit/web-config-service.spec.js

@@ -58,6 +58,25 @@ describe('WebConfigService', () => {
         yield service().setConfig({ enableSelfHealing: true });
         (0, chai_1.expect)(yield service().getConfig()).to.deep.equal({ enableSelfHealing: true });
     }));
+    it("keeps the AI engine page's provider, models and base URL, an empty one included", () => __awaiter(void 0, void 0, void 0, function* () {
+        yield service().setConfig({
+            aiProvider: 'ollama',
+            ollamaModel: 'llava',
+            aiBaseUrl: 'http://gpu-box.lab:11434',
+            geminiModel: '',
+        });
+        (0, chai_1.expect)(yield service().getConfig()).to.deep.equal({
+            aiProvider: 'ollama',
+            ollamaModel: 'llava',
+            aiBaseUrl: 'http://gpu-box.lab:11434',
+            geminiModel: '',
+        });
+    }));
+    it('never saves an API key, whatever it is sent', () => __awaiter(void 0, void 0, void 0, function* () {
+        yield service().setConfig({ aiProvider: 'gemini', geminiApiKey: 'secret' });
+        const rows = yield scratch.db.webConfig.findMany();
+        (0, chai_1.expect)(rows.map((row) => row.name)).to.deep.equal(['aiProvider']);
+    }));
     it('changes a setting saved before', () => __awaiter(void 0, void 0, void 0, function* () {
         yield service().setConfig({ buildCleanupDays: 7, buildCleanupMaxCount: 5 });
         yield service().setConfig({ buildCleanupDays: 14 });