@xenon-device-management/xenon 2.14.0 → 2.16.0

package/lib/src/services/AICommandService.js

@@ -49,12 +49,19 @@ let AICommandService = class AICommandService {
         return __awaiter(this, void 0, void 0, function* () {
             this.logger.info(`Testing AI locator: ${locator.strategy}=${locator.selector}`);
             const omniService = typedi_1.Container.get(OmniVisionService_1.OmniVisionService);
+            // A session's own route: its test may act on what it found.
+            const keep = (found) => {
+                if (driver === null || driver === void 0 ? void 0 : driver.sessionId)
+                    for (const el of found)
+                        omniService.remember(driver.sessionId, el);
+                return found;
+            };
             if (locator.strategy === '-custom:ai-text') {
-                return yield omniService.findByText(driver, locator.selector);
+                return keep(yield omniService.findByText(driver, locator.selector));
             }
             else if (locator.strategy === '-custom:ai-icon') {
                 const result = yield omniService.findByIcon(driver, locator.selector);
-                return result ? [result] : [];
+                return keep(result ? [result] : []);
             }
             throw new Error(`Unsupported AI strategy: ${locator.strategy}`);
         });

package/lib/src/services/AIService.js

@@ -45,7 +45,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AI_SERVICE = exports.AIService = void 0;
+exports.AI_SERVICE = exports.AIService = exports.FAILURE_ANALYSIS_TIMEOUT_MS = exports.AI_CALL_TIMEOUT_MS = exports.AITimeoutError = exports.AIProviderPausedError = exports.AIRateLimitedError = void 0;
 exports.parseVisualVerdict = parseVisualVerdict;
 const generative_ai_1 = require("@google/generative-ai");
 const openai_1 = __importDefault(require("openai"));
@@ -56,8 +56,88 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
 const CircuitBreaker_1 = require("./CircuitBreaker");
-/** What GeminiProvider answers, instead of throwing, when the provider is rate-limited (429). */
-const RATE_LIMITED = 'CONNECTION_OK_RATE_LIMITED';
+/**
+ * A provider refused a call for its rate limit or quota (HTTP 429), whichever
+ * provider it is. A failed call like any other: its caller gets no answer and
+ * the circuit breaker counts it (`status`). Through 2.14 Gemini's provider
+ * answered a 429 with the text 'CONNECTION_OK_RATE_LIMITED', which was saved
+ * as a failed session's AI analysis and counted by the breaker as a success.
+ */
+class AIRateLimitedError extends Error {
+    constructor(detail) {
+        super('The AI provider is rate-limited or out of quota');
+        this.name = 'AIRateLimitedError';
+        this.status = 429;
+        this.detail = detail;
+    }
+}
+exports.AIRateLimitedError = AIRateLimitedError;
+/** A provider's 429, as its SDK (`status`) or axios (`response.status`) reports it. */
+function isRateLimit(err) {
+    var _a;
+    return err instanceof AIRateLimitedError || (err === null || err === void 0 ? void 0 : err.status) === 429 || ((_a = err === null || err === void 0 ? void 0 : err.response) === null || _a === void 0 ? void 0 : _a.status) === 429;
+}
+/**
+ * The circuit breaker didn't send the call: the provider's recent calls
+ * failed. Still a CircuitOpenError, in words for testers: the Omni-Scan, Test
+ * locator and visual assertion answers show it, and "Circuit open for
+ * 'ai:gemini:<model>'; retry in 43120ms" isn't.
+ */
+class AIProviderPausedError extends CircuitBreaker_1.CircuitOpenError {
+    constructor(from) {
+        super(from.key, from.retryAfterMs);
+        this.seconds = Math.max(1, Math.ceil(from.retryAfterMs / 1000));
+        this.message = `The AI provider has been failing, so Xenon will call it again in ${this.seconds} s`;
+    }
+}
+exports.AIProviderPausedError = AIProviderPausedError;
+/** A call that outlasted its time limit; its request was cancelled. The circuit breaker counts it (`code`). */
+class AITimeoutError extends Error {
+    constructor(ms) {
+        super(`The AI provider didn't answer within ${Math.round(ms / 1000)} s`);
+        this.name = 'AITimeoutError';
+        this.code = 'ETIMEDOUT';
+    }
+}
+exports.AITimeoutError = AITimeoutError;
+/**
+ * How long an AI call may take, retries included, unless it says otherwise
+ * (failure analysis). Most are made while a test command runs: the LLM and
+ * visual healing tiers inside a failing findElement (both: 2 of these), the
+ * visual assertion and the screen description inside an execute script, an
+ * ai-icon find. The OpenAI and Anthropic SDKs otherwise wait up to 10 minutes
+ * a try, three tries, and Gemini has no limit, which held the command past
+ * the client's own timeout. Ollama's generate call already had 30 s.
+ */
+exports.AI_CALL_TIMEOUT_MS = 30000;
+/**
+ * How long a failed session's AI analysis may take, retries included. The
+ * OpenAI and Anthropic SDKs otherwise wait up to 10 minutes a try, three
+ * tries. The analysis runs after the session has ended (onSessionStopped
+ * doesn't wait for it), so this bounds the work left running, not a client's
+ * wait: an answer with a screenshot usually takes seconds.
+ */
+exports.FAILURE_ANALYSIS_TIMEOUT_MS = 120000;
+/** `call`, given a signal that cancels it after `ms`, when it fails with AITimeoutError. */
+function withTimeLimit(ms, call) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const controller = new AbortController();
+        let timer;
+        const expired = new Promise((_, reject) => {
+            timer = setTimeout(() => {
+                // The time-out first, so it, not the cancelled request's error, is the answer.
+                reject(new AITimeoutError(ms));
+                controller.abort();
+            }, ms);
+        });
+        try {
+            return yield Promise.race([call(controller.signal), expired]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    });
+}
 /**
  * A provider's answer to the assertion prompt, `{ "result": true|false,
  * "reason": "..." }`, read leniently (code fences, text around the JSON,
@@ -97,7 +177,7 @@ class GeminiProvider {
         this.modelName =
             modelName && modelName.trim() !== '' ? modelName.trim() : 'gemini-3-flash-preview';
     }
-    analyze(prompt, screenshotBase64) {
+    analyze(prompt, screenshotBase64, signal) {
         return __awaiter(this, void 0, void 0, function* () {
             const parts = [prompt];
             if (screenshotBase64) {
@@ -116,17 +196,17 @@ class GeminiProvider {
             for (const version of versions) {
                 try {
                     const model = this.genAI.getGenerativeModel({ model: this.modelName }, { apiVersion: version });
-                    const result = yield model.generateContent(parts);
+                    const result = yield model.generateContent(parts, signal ? { signal } : undefined);
                     const response = yield result.response;
                     return response.text();
                 }
                 catch (err) {
                     lastError = err;
-                    // If we get a 429, the connection IS WORKING, just rate limited.
-                    if (err.message.includes('429') || err.message.includes('Quota exceeded')) {
-                        logger_1.default.info(`[Gemini] Connection verified (Rate Limited) via ${version} endpoint.`);
-                        return 'CONNECTION_OK_RATE_LIMITED';
-                    }
+                    // The other endpoint has the same quota. By status only: the message
+                    // holds the URL and the provider's text, where "429" can be a token
+                    // count or part of the model's name.
+                    if (err.status === 429)
+                        throw new AIRateLimitedError(err.message);
                     if (err.message.includes('404') ||
                         err.message.includes('not found') ||
                         err.message.includes('unsupported')) {
@@ -145,7 +225,7 @@ class OpenAIProvider {
         this.client = new openai_1.default({ apiKey, baseURL });
         this.model = model;
     }
-    analyze(prompt, screenshotBase64) {
+    analyze(prompt, screenshotBase64, signal) {
         return __awaiter(this, void 0, void 0, function* () {
             const messages = [
                 {
@@ -163,7 +243,7 @@ class OpenAIProvider {
                 model: this.model,
                 messages,
                 max_tokens: 500,
-            });
+            }, { signal });
             return response.choices[0].message.content || '';
         });
     }
@@ -173,7 +253,7 @@ class AnthropicProvider {
         this.client = new sdk_1.default({ apiKey });
         this.model = model;
     }
-    analyze(prompt, screenshotBase64) {
+    analyze(prompt, screenshotBase64, signal) {
         return __awaiter(this, void 0, void 0, function* () {
             const content = [{ type: 'text', text: prompt }];
             if (screenshotBase64) {
@@ -190,7 +270,7 @@ class AnthropicProvider {
                 model: this.model,
                 max_tokens: 500,
                 messages: [{ role: 'user', content }],
-            });
+            }, { signal });
             return response.content[0].text || '';
         });
     }
@@ -206,10 +286,11 @@ class OllamaProvider {
     checkAvailability() {
         return __awaiter(this, void 0, void 0, function* () {
             const now = Date.now();
-            // Use cached status if checked recently
-            if (this.isAvailable !== null &&
-                now - this.lastAvailabilityCheck < this.AVAILABILITY_CHECK_INTERVAL) {
-                return this.isAvailable;
+            // An answer is kept for a while; "down" is checked again at the next call
+            // (a refused local connection costs nothing), so Ollama is used as soon as
+            // it is back.
+            if (this.isAvailable && now - this.lastAvailabilityCheck < this.AVAILABILITY_CHECK_INTERVAL) {
+                return true;
             }
             try {
                 // Quick health check - Ollama has a /api/tags endpoint
@@ -225,7 +306,7 @@ class OllamaProvider {
             }
         });
     }
-    analyze(prompt, screenshotBase64) {
+    analyze(prompt, screenshotBase64, signal) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
             // Check if Ollama is available before attempting
@@ -239,7 +320,7 @@ class OllamaProvider {
                     prompt: prompt,
                     images: screenshotBase64 ? [screenshotBase64] : [],
                     stream: false,
-                }, { timeout: 30000 });
+                }, { timeout: 30000, signal });
                 return response.data.response || '';
             }
             catch (err) {
@@ -257,6 +338,8 @@ class AIService {
     constructor() {
         this.provider = null;
         this.isMock = false;
+        /** The settings `provider` was set up from (initializeProvider). */
+        this.setUpFrom = null;
         this.initializeProvider();
     }
     // Key the breaker by provider + resolved model name so a misbehaving model
@@ -276,16 +359,60 @@ class AIService {
         return `ai:${provider}:${model || 'default'}`;
     }
     // Single choke point for every LLM call so circuit-breaker state is shared
-    // across analyzeFailure / visualFind / healLocator.
-    callProvider(prompt, screenshotBase64) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return CircuitBreaker_1.CIRCUIT_BREAKERS.execute(this.breakerKey(), () => this.provider.analyze(prompt, screenshotBase64));
+    // across analyzeFailure / visualFind / healLocator. A rate limit is
+    // AIRateLimitedError whichever provider sent it; a call is cancelled after
+    // `timeoutMs` (AI_CALL_TIMEOUT_MS unless given: AITimeoutError). The breaker
+    // counts both, and a call it holds back is AIProviderPausedError.
+    callProvider(prompt_1, screenshotBase64_1) {
+        return __awaiter(this, arguments, void 0, function* (prompt, screenshotBase64, opts = {}) {
+            var _a;
+            const provider = this.provider;
+            try {
+                return yield CircuitBreaker_1.CIRCUIT_BREAKERS.execute(this.breakerKey(), () => {
+                    var _a;
+                    return withTimeLimit((_a = opts.timeoutMs) !== null && _a !== void 0 ? _a : exports.AI_CALL_TIMEOUT_MS, (signal) => provider.analyze(prompt, screenshotBase64, signal));
+                });
+            }
+            catch (err) {
+                if (isRateLimit(err) && !(err instanceof AIRateLimitedError)) {
+                    throw new AIRateLimitedError((_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : String(err));
+                }
+                if (err instanceof CircuitBreaker_1.CircuitOpenError && !(err instanceof AIProviderPausedError)) {
+                    throw new AIProviderPausedError(err);
+                }
+                throw err;
+            }
         });
     }
+    /**
+     * Sets the provider up from the server's AI settings, which the AI engine
+     * page changes while the server runs (`POST /config`). Again only when they
+     * changed, so a provider's client, and Ollama's availability check, carry
+     * over from one call to the next.
+     */
     initializeProvider() {
         const providerType = config_1.config.aiProvider;
         const genericModel = config_1.config.aiModel;
         const baseUrl = config_1.config.aiBaseUrl;
+        const settings = JSON.stringify([
+            providerType,
+            genericModel,
+            baseUrl,
+            config_1.config.geminiApiKey,
+            config_1.config.openaiApiKey,
+            config_1.config.anthropicApiKey,
+            config_1.config.geminiModel,
+            config_1.config.openaiModel,
+            config_1.config.anthropicModel,
+            config_1.config.ollamaModel,
+            process.env.GEMINI_API_KEY === 'mock',
+        ]);
+        if (settings === this.setUpFrom)
+            return;
+        this.setUpFrom = settings;
+        // A provider chosen without a key is no provider, never the previous one.
+        this.provider = null;
+        this.isMock = false;
         logger_1.default.info(`[AIService] Initializing with provider: ${providerType}`);
         if (process.env.GEMINI_API_KEY === 'mock') {
             this.isMock = true;
@@ -321,7 +448,15 @@ class AIService {
             logger_1.default.error(`[AIService] Initialization error: ${err.message}`);
         }
     }
+    /**
+     * Whether a provider is set up for the settings in force now. Failure
+     * analysis and the LLM and visual healing tiers ask this first; it used to
+     * answer for the provider set up last, so choosing a configured provider on
+     * the AI engine page never turned them on, and choosing one without a key
+     * left the previous provider answering.
+     */
     isEnabled() {
+        this.initializeProvider();
         return this.provider !== null || this.isMock;
     }
     analyzeFailure(context) {
@@ -341,7 +476,9 @@ Fix: Add a pre-emptive check for the location permission dialog or use the \`aut
             try {
                 const prompt = this.constructPrompt(context);
                 const screenshotBase64 = this.getScreenshotBase64(context.screenshotPath);
-                const text = yield this.callProvider(prompt, screenshotBase64 || undefined);
+                const text = yield this.callProvider(prompt, screenshotBase64 || undefined, {
+                    timeoutMs: exports.FAILURE_ANALYSIS_TIMEOUT_MS,
+                });
                 logger_1.default.info(`[AIService] Analysis complete for ${context.sessionId}`);
                 return text;
             }
@@ -349,6 +486,12 @@ Fix: Add a pre-emptive check for the location permission dialog or use the \`aut
                 if (err instanceof CircuitBreaker_1.CircuitOpenError) {
                     logger_1.default.debug(`[AIService] Analysis skipped: ${err.message}`);
                 }
+                else if (err instanceof AIRateLimitedError) {
+                    logger_1.default.warn(`[AIService] No analysis for ${context.sessionId}: ${err.message}: ${err.detail}`);
+                }
+                else if (err instanceof AITimeoutError) {
+                    logger_1.default.warn(`[AIService] No analysis for ${context.sessionId}: ${err.message}`);
+                }
                 else {
                     logger_1.default.error(`[AIService] Analysis failed: ${err.message}`);
                 }
@@ -429,11 +572,14 @@ Answer with JSON only, exactly: {"result": true or false, "reason": "one sentenc
                 answer = yield this.callProvider(prompt, screenshotBase64);
             }
             catch (err) {
+                if (err instanceof AIRateLimitedError || err instanceof AITimeoutError) {
+                    throw new Error(`${err.message}, ${notChecked}. Try again later.`);
+                }
+                if (err instanceof AIProviderPausedError) {
+                    throw new Error(`The AI provider has been failing, ${notChecked}. Xenon will call it again in ${err.seconds} s.`);
+                }
                 throw new Error(`The AI provider failed, ${notChecked}: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
             }
-            if (answer === RATE_LIMITED) {
-                throw new Error(`The AI provider is rate-limited, ${notChecked}. Try again later.`);
-            }
             const verdict = parseVisualVerdict(answer);
             if (!verdict) {
                 const said = answer.replace(/\s+/g, ' ').trim().slice(0, 200);
@@ -446,7 +592,9 @@ Answer with JSON only, exactly: {"result": true or false, "reason": "one sentenc
     /**
      * A short description of the screen in the screenshot, for
      * `xenon: analyzeScreen` and device control's Omni-Scan. Throws when there
-     * is no provider or the call fails, so the caller can say why there is none.
+     * is no provider or the call fails (AIRateLimitedError for a rate limit,
+     * AITimeoutError after AI_CALL_TIMEOUT_MS), so the caller can say why there
+     * is none.
      */
     describeScreen(screenshotBase64) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -458,10 +606,7 @@ You are looking at a screenshot of a mobile app, for a software tester.
 Describe the screen in a few short sentences: which screen it is, its main elements and their state (for example filled in, empty, selected or disabled), and anything unexpected, such as an error message, a system dialog, a crash or a loading indicator.
 Describe only what is visible. Answer in plain text.
         `.trim();
-            const answer = yield this.callProvider(prompt, screenshotBase64);
-            if (answer === RATE_LIMITED)
-                throw new Error('The AI provider is rate-limited');
-            return answer;
+            return this.callProvider(prompt, screenshotBase64);
         });
     }
     /**
@@ -512,9 +657,10 @@ Describe only what is visible. Answer in plain text.
     }
     testConnection(testConfig) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const providerType = testConfig.aiProvider || config_1.config.aiProvider;
             try {
                 let testProvider = null;
-                const providerType = testConfig.aiProvider || config_1.config.aiProvider;
                 const model = testConfig.aiModel || config_1.config.aiModel;
                 const baseUrl = testConfig.aiBaseUrl || config_1.config.aiBaseUrl;
                 logger_1.default.info(`[AIService] Testing connection for provider: ${providerType}`);
@@ -547,17 +693,21 @@ Describe only what is visible. Answer in plain text.
                 }
                 if (!testProvider)
                     throw new Error('Failed to initialize provider for testing');
-                // Send a minimal ping command
-                const responseText = yield testProvider.analyze('Hello. Response: OK');
-                if (responseText === 'CONNECTION_OK_RATE_LIMITED') {
-                    return {
-                        success: true,
-                        message: `Successfully connected to ${providerType}! (Note: You are currently out of quota/rate-limited, but the setup is correct)`,
-                    };
-                }
+                // Send a minimal ping command. Not through the circuit breaker (a test
+                // shouldn't pause the provider for everyone), but with the time limit.
+                const pinged = testProvider;
+                yield withTimeLimit(exports.AI_CALL_TIMEOUT_MS, (signal) => pinged.analyze('Hello. Response: OK', undefined, signal));
                 return { success: true, message: `Successfully connected to ${providerType}!` };
             }
             catch (err) {
+                // Not a success: every AI call fails the same way until it has quota again.
+                if (isRateLimit(err)) {
+                    logger_1.default.warn(`[AIService] Connection test: ${providerType} is rate-limited: ${(_a = err.detail) !== null && _a !== void 0 ? _a : err.message}`);
+                    return {
+                        success: false,
+                        message: `${providerType} answered, but it is rate-limited or out of quota. AI features won't work with it until it has quota again.`,
+                    };
+                }
                 logger_1.default.error(`[AIService] Connection test failed: ${err.message}`);
                 return { success: false, message: `Connection failed: ${err.message}` };
             }

package/lib/src/services/ApiKeyService.js

@@ -23,6 +23,7 @@ const typedi_1 = require("typedi");
 const crypto_1 = __importDefault(require("crypto"));
 const prisma_1 = require("../prisma");
 const logger_1 = __importDefault(require("../logger"));
+const identityChanges_1 = require("./identity/identityChanges");
 let ApiKeyService = class ApiKeyService {
     constructor() {
         this.log = logger_1.default.scope('ApiKey');
@@ -38,8 +39,13 @@ let ApiKeyService = class ApiKeyService {
     generateRaw() {
         return crypto_1.default.randomBytes(32).toString('hex');
     }
-    verify(raw) {
-        return __awaiter(this, void 0, void 0, function* () {
+    /**
+     * The live key for `raw`. A use of it is recorded (`lastUsedAt`);
+     * `touch: false` only looks, for a check that isn't a use (a socket's
+     * re-check). Likewise verifyPair.
+     */
+    verify(raw_1) {
+        return __awaiter(this, arguments, void 0, function* (raw, { touch = true } = {}) {
             if (!raw)
                 return null;
             const row = yield prisma_1.prisma.apiKey.findUnique({ where: { keyHash: this.hash(raw) } });
@@ -47,6 +53,8 @@ let ApiKeyService = class ApiKeyService {
                 return null;
             if (row.expiresAt && row.expiresAt.getTime() <= Date.now())
                 return null;
+            if (!touch)
+                return row;
             prisma_1.prisma.apiKey
                 .update({ where: { id: row.id }, data: { lastUsedAt: new Date() } })
                 .catch(() => undefined);
@@ -77,8 +85,8 @@ let ApiKeyService = class ApiKeyService {
             return { id: row.id, raw };
         });
     }
-    verifyPair(accessKey, token) {
-        return __awaiter(this, void 0, void 0, function* () {
+    verifyPair(accessKey_1, token_1) {
+        return __awaiter(this, arguments, void 0, function* (accessKey, token, { touch = true } = {}) {
             if (!accessKey || !token)
                 return null;
             const user = yield prisma_1.prisma.user.findUnique({ where: { accessKey } });
@@ -91,6 +99,8 @@ let ApiKeyService = class ApiKeyService {
                 return null;
             if (row.expiresAt && row.expiresAt.getTime() <= Date.now())
                 return null;
+            if (!touch)
+                return row;
             prisma_1.prisma.apiKey
                 .update({ where: { id: row.id }, data: { lastUsedAt: new Date() } })
                 .catch(() => undefined);
@@ -99,7 +109,8 @@ let ApiKeyService = class ApiKeyService {
     }
     revoke(id) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield prisma_1.prisma.apiKey.update({ where: { id }, data: { revokedAt: new Date() } });
+            const row = yield prisma_1.prisma.apiKey.update({ where: { id }, data: { revokedAt: new Date() } });
+            yield (0, identityChanges_1.identityChanged)(row.userId);
         });
     }
     list() {

package/lib/src/services/EmailService.js

@@ -23,6 +23,7 @@ const typedi_1 = require("typedi");
 const nodemailer_1 = __importDefault(require("nodemailer"));
 const config_1 = require("../config");
 const logger_1 = __importDefault(require("../logger"));
+const passwordResetLink_1 = require("./passwordResetLink");
 let EmailService = class EmailService {
     constructor() {
         this.log = logger_1.default.scope('Email');
@@ -55,6 +56,34 @@ let EmailService = class EmailService {
             'over the account for the link lifetime. Configure XENON_SMTP_URL, or unset this and ' +
             'issue links from the dashboard Users page.');
     }
+    /**
+     * Startup notice about XENON_PUBLIC_URL, the address links Xenon hands out
+     * are built from (never the request's Host, which the asker chooses):
+     *
+     * - set but refused (not an http(s) server address): whatever the mail
+     *   setup, since it also decides each device's dashboard_link. The value is
+     *   not logged: a user name and password in it is one reason to refuse it.
+     * - unset while Xenon could send reset links: the sign-in page's "forgot
+     *   password" then sends people to an administrator, and an administrator's
+     *   reset link is handed back to them rather than emailed.
+     */
+    warnAboutPublicUrl() {
+        var _a;
+        if (((_a = config_1.config.publicUrl) === null || _a === void 0 ? void 0 : _a.trim()) && (0, passwordResetLink_1.resetLinkBase)() === null) {
+            this.warnLog('XENON_PUBLIC_URL is set but is not an http(s) server address such as ' +
+                'https://xenon.example.com or http://lab-mac:4723 (a trailing /xenon is fine; any ' +
+                'other path, a query, a fragment or a user name is not), so Xenon ignores it: it ' +
+                'emails no password-reset links, and device dashboard links are paths on this server.');
+            return;
+        }
+        if (!this.canDeliver() || (0, passwordResetLink_1.resetLinkBase)() !== null)
+            return;
+        this.warnLog("XENON_PUBLIC_URL is not set to this server's address, so Xenon sends no password-reset " +
+            'links: "Forgot password" asks people to contact an administrator, and the Users ' +
+            'page hands an administrator the link instead of emailing it. Set XENON_PUBLIC_URL to ' +
+            'the http(s) address people reach this server at, such as https://xenon.example.com ' +
+            'or http://lab-mac:4723 (a trailing /xenon is fine; any other path is not).');
+    }
     send(mail) {
         return __awaiter(this, void 0, void 0, function* () {
             const smtpUrl = config_1.config.smtpUrl;

package/lib/src/services/InterceptorService.js

@@ -240,7 +240,11 @@ let InterceptorService = class InterceptorService {
             throw new Error(`Interceptor not active for session ${sessionId}`);
         return state;
     }
-    /** `udid` is the session's phone: the dashboard events reach only the teams that see it. */
+    /**
+     * `udid` is the session's phone. The dashboard events reach only admins who
+     * see it: a captured request's headers and bodies can carry the app's
+     * sign-in tokens, and REST's /interceptor routes are admin-only too.
+     */
     emit(evt, udid) {
         for (const l of this.listeners) {
             try {
@@ -255,7 +259,7 @@ let InterceptorService = class InterceptorService {
     broadcast(evt, udid) {
         try {
             const socket = typedi_1.Container.get(SocketServer_1.SocketServer);
-            const scope = { udid };
+            const scope = { udid, adminOnly: true };
             if (evt.type === 'request') {
                 void socket.emitToDashboardForDevices(SocketEvents_1.SocketEvents.INTERCEPTOR_REQUEST, evt.payload, scope);
             }

package/lib/src/services/OrphanSweeper.js

@@ -26,6 +26,8 @@ const event_manager_1 = require("../dashboard/event-manager");
 const SessionStatus_1 = require("../types/SessionStatus");
 const device_service_1 = require("../data-service/device-service");
 const PhoneNetworkRestore_1 = require("./network/PhoneNetworkRestore");
+const TracingService_1 = require("./TracingService");
+const sessionMemory_1 = require("../sessions/sessionMemory");
 let OrphanSweeper = class OrphanSweeper {
     constructor() {
         this.log = logger_1.default.scope('OrphanSweeper');
@@ -74,6 +76,12 @@ let OrphanSweeper = class OrphanSweeper {
                     // back before the phone is released; for a previous process's it is
                     // the ledger's, at boot (PhoneNetworkRestore).
                     yield typedi_1.Container.get(PhoneNetworkRestore_1.PhoneNetworkRestore).restoreSession(s.id, 'heartbeat timeout');
+                    (0, sessionMemory_1.forgetSessionMemory)(s.id);
+                    // A previous process's session has no span here; this one's ends.
+                    typedi_1.Container.get(TracingService_1.TracingService).endSessionSpan(s.id, {
+                        failed: true,
+                        reason: 'Session heartbeat timeout',
+                    });
                     // This session's claim only, not every row with its udid: the phone
                     // may be another session's by now (deviceClaims.ts).
                     yield (0, device_service_1.releaseSessionDevices)(s.id);

package/lib/src/services/SelectorStateService.js

@@ -51,6 +51,10 @@ function whereTuple(strategy, selector) {
         },
     };
 }
+/** Just the selector a change is about, for the socket server's scoped emit. */
+function selectorOf(tuple) {
+    return { strategy: tuple.strategy, selector: tuple.selector };
+}
 /** The SelectorEvent row for one change. */
 function selectorEventData(tuple, action, userId, reason) {
     return {
@@ -140,7 +144,7 @@ let SelectorStateService = class SelectorStateService {
                 return upserted;
             }));
             scopedLog.info(`markFixed: ${ctx.strategy}=${ctx.selector} → pending (api_key=${ctx.apiKeyId})`);
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_FIXED, serialize(row));
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_FIXED, serialize(row), selectorOf(ctx));
             return row;
         });
     }
@@ -174,7 +178,7 @@ let SelectorStateService = class SelectorStateService {
                 return upserted;
             }));
             scopedLog.info(`mute: ${ctx.strategy}=${ctx.selector} → muted (api_key=${ctx.apiKeyId})`);
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_MUTED, serialize(row));
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_MUTED, serialize(row), selectorOf(ctx));
             return row;
         });
     }
@@ -231,13 +235,13 @@ let SelectorStateService = class SelectorStateService {
             scopedLog.info(`unmute: ${ctx.strategy}=${ctx.selector} → ${result ? 'active' : 'deleted'} (api_key=${ctx.apiKeyId})`);
             // Emit the post-state. When the row was deleted, surface the prior tuple
             // so the dashboard can drop it from the muted list.
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_UNMUTED, result
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_UNMUTED, result
                 ? serialize(result)
                 : {
                     original_strategy: ctx.strategy,
                     original_selector: ctx.selector,
                     status: 'deleted',
-                });
+                }, selectorOf(ctx));
             return result;
         });
     }
@@ -279,13 +283,13 @@ let SelectorStateService = class SelectorStateService {
                 return row;
             }));
             scopedLog.info(`cancelVerification: ${ctx.strategy}=${ctx.selector} → ${result ? 'active' : 'deleted'} (api_key=${ctx.apiKeyId})`);
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_CANCELLED, result
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_CANCELLED, result
                 ? serialize(result)
                 : {
                     original_strategy: ctx.strategy,
                     original_selector: ctx.selector,
                     status: 'deleted',
-                });
+                }, selectorOf(ctx));
             return result;
         });
     }
@@ -329,7 +333,7 @@ let SelectorStateService = class SelectorStateService {
                 return updated;
             }));
             scopedLog.warn(`onHealRecorded: ${ctx.strategy}=${ctx.selector} regressed from ${existing.status} (session=${ctx.sessionId})`);
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_REGRESSED, serialize(row));
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_REGRESSED, serialize(row), selectorOf(ctx));
             return row;
         });
     }