@xenon-device-management/xenon 2.14.0 → 2.16.0

package/lib/src/services/SelectorVerificationJob.js

@@ -32,10 +32,17 @@ const selectorKeys_1 = require("./selector-health/selectorKeys");
 const log = logger_1.default.scope('SelectorVerification');
 /**
  * Threshold of distinct clean build_ids required to promote a Pending
- * SelectorState row to Resolved. "Clean" means at least one findElement
- * for the (strategy, selector) tuple ran in the build with no heal.
+ * SelectorState row to Resolved. "Clean" means the selector was found without
+ * healing in the build: a findElement of the (strategy, selector) tuple that
+ * answered an element, or a findElements that answered at least one, and no
+ * heal of it. Through 2.14 a find that failed outright counted too, so a
+ * selector that was never found again was verified as fixed.
  */
 const CLEAN_BUILDS_TO_RESOLVE = 3;
+/** The selector a row is about, as the socket server's scoped emit names it. */
+function keyOfRow(row) {
+    return { strategy: row.original_strategy, selector: row.original_selector };
+}
 /**
  * Periodically scans Pending SelectorState rows and promotes them to Resolved
  * once enough clean CI builds have been observed (no heals on the selector
@@ -127,12 +134,20 @@ let SelectorVerificationJob = class SelectorVerificationJob {
             // that ran under a CI build (build_id IS NOT NULL); ad-hoc local runs
             // intentionally don't move verification forward.
             //
+            // A find that found the selector is one that didn't fail (`is_error`,
+            // the dashboard's record of an error answer) and didn't answer an empty
+            // list (`{"value":[]`, findElements finding nothing). The command log
+            // keeps the answer as JSON.stringify wrote it, or as the node sent it.
+            //
             // Identifier names (PascalCase tables, camelCase createdAt) match the
             // actual SQLite schema generated by Prisma — see
             // `sqlite3 prisma/dev.db ".schema SessionLog"`.
             const heals = yield this.prisma.$queryRaw `
       SELECT s."build_id" AS build_id,
-             MAX(CASE WHEN sl."is_healed" THEN 1 ELSE 0 END) AS healed
+             MAX(CASE WHEN sl."is_healed" THEN 1 ELSE 0 END) AS healed,
+             MAX(CASE WHEN NOT sl."is_healed" AND NOT sl."is_error"
+                       AND sl."response" NOT LIKE '{"value":[]%'
+                      THEN 1 ELSE 0 END) AS found
       FROM "SessionLog" sl
       INNER JOIN "Session" s ON sl."session_id" = s."id"
       WHERE sl."original_strategy" = ${row.original_strategy}
@@ -142,7 +157,7 @@ let SelectorVerificationJob = class SelectorVerificationJob {
         AND s."build_id" IS NOT NULL
       GROUP BY s."build_id"
     `;
-            const cleanBuildCount = heals.filter((r) => Number(r.healed) === 0).length;
+            const cleanBuildCount = heals.filter((r) => Number(r.healed) === 0 && Number(r.found) === 1).length;
             if (cleanBuildCount >= CLEAN_BUILDS_TO_RESOLVE) {
                 yield this.promoteToResolved(row);
             }
@@ -169,7 +184,7 @@ let SelectorVerificationJob = class SelectorVerificationJob {
                 return promoted;
             }));
             log.info(`[${row.id}] promoted to resolved (${row.original_strategy}=${row.original_selector})`);
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_RESOLVED, this.serialize(updated));
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_RESOLVED, this.serialize(updated), keyOfRow(row));
         });
     }
     updateProgress(row, cleanBuildCount) {
@@ -178,7 +193,7 @@ let SelectorVerificationJob = class SelectorVerificationJob {
                 where: { id: row.id },
                 data: { clean_builds_count: cleanBuildCount, last_event_at: new Date() },
             });
-            this.socket.emitToDashboard(SocketEvents_1.SocketEvents.SELECTOR_PROGRESS, this.serialize(updated));
+            void this.socket.emitToDashboardForSelector(SocketEvents_1.SocketEvents.SELECTOR_PROGRESS, this.serialize(updated), keyOfRow(row));
         });
     }
     serialize(row) {

package/lib/src/services/ServerManager.js

@@ -79,6 +79,7 @@ const IPluginArgs_1 = require("../interfaces/IPluginArgs");
 const config_service_1 = require("../data-service/config-service");
 const PluginContext_1 = require("../PluginContext");
 const SelfHealingSwitch_1 = require("./settings/SelfHealingSwitch");
+const aiEngineSettings_1 = require("./settings/aiEngineSettings");
 const device_store_1 = require("../data-service/device-store");
 const device_utils_1 = require("../device-utils");
 const localDeviceHosts_1 = require("../device-managers/localDeviceHosts");
@@ -140,6 +141,9 @@ let ServerManager = ServerManager_1 = class ServerManager {
             // The Settings page's AI self-healing toggle, which the command interceptor
             // reads from memory at every command: load it before a command can arrive.
             yield typedi_1.Container.get(SelfHealingSwitch_1.SelfHealingSwitch).load();
+            // The AI engine page's provider, model and base URL, over the startup
+            // options applied above (what a cleared value goes back to).
+            yield typedi_1.Container.get(aiEngineSettings_1.AiEngineSettings).load();
             this.registerRoutes(expressApp, httpServer, cliArgs, pluginArgs);
             yield this.bootEmulators(pluginArgs);
             this.registerDependenciesInContainer(pluginArgs, cliArgs, nodeId);
@@ -397,6 +401,7 @@ let ServerManager = ServerManager_1 = class ServerManager {
             const { bootstrapIdentity } = yield Promise.resolve().then(() => __importStar(require('./identity/bootstrap')));
             yield bootstrapIdentity();
             typedi_1.Container.get(EmailService_1.EmailService).warnIfLogFallbackEnabled();
+            typedi_1.Container.get(EmailService_1.EmailService).warnAboutPublicUrl();
             const { startUserSessionCleanupCron } = yield Promise.resolve().then(() => __importStar(require('./identity/sessionCleanupCron')));
             startUserSessionCleanupCron();
             // Hub-issued JWT signing key (REST/MCP tokens, stream tickets) — key
@@ -445,7 +450,12 @@ let ServerManager = ServerManager_1 = class ServerManager {
         });
     }
     registerRoutes(expressApp, httpServer, cliArgs, pluginArgs) {
-        expressApp.use('/xenon', (0, app_1.createRouter)(pluginArgs));
+        expressApp.use('/xenon', (0, app_1.createRouter)(pluginArgs, {
+            address: cliArgs.address,
+            port: cliArgs.port,
+            // Appium serves HTTPS with both of these (base-driver's server()).
+            tls: !!(cliArgs.sslCertificatePath && cliArgs.sslKeyPath),
+        }));
         // The session gateway goes in front of Appium's routes: Xenon's own
         // /wd-internal calls (with the per-process secret), per-command auth
         // (XENON_REQUIRE_COMMAND_AUTH), then, on a hub, forwarding of the sessions

package/lib/src/services/SessionLifecycleService.js

@@ -56,8 +56,6 @@ const typedi_1 = require("typedi");
 const uuid_1 = require("uuid");
 const lodash_1 = __importDefault(require("lodash"));
 const axios_1 = __importDefault(require("axios"));
-const https_proxy_agent_1 = require("https-proxy-agent");
-const http_proxy_agent_1 = require("http-proxy-agent");
 const logger_1 = __importDefault(require("../logger"));
 const helpers_1 = require("../helpers");
 const InternalHttpClient_1 = require("../InternalHttpClient");
@@ -69,7 +67,6 @@ const device_utils_1 = require("../device-utils");
 const TracingService_1 = require("./TracingService");
 const PortAllocator_1 = require("./PortAllocator");
 const XenonCapabilityManager_1 = require("../XenonCapabilityManager");
-const JwtKeyService_1 = require("./token/JwtKeyService");
 const sessionIdentity_1 = require("./session/sessionIdentity");
 const leaseSessionCaps_1 = require("./lease/leaseSessionCaps");
 const sessionCredentials_1 = require("./session/sessionCredentials");
@@ -80,6 +77,7 @@ const callerTeamIds_1 = require("./device-access/callerTeamIds");
 const queueVisibility_1 = require("./device-access/queueVisibility");
 const appVisibility_1 = require("./device-access/appVisibility");
 const LiveSessionOwners_1 = require("./device-access/LiveSessionOwners");
+const sessionMemory_1 = require("../sessions/sessionMemory");
 const SessionMetricsService_1 = require("./metrics/SessionMetricsService");
 const appCapability_1 = require("./session/appCapability");
 const CircuitBreaker_1 = require("../data-service/CircuitBreaker");
@@ -100,6 +98,21 @@ const async_lock_1 = __importDefault(require("async-lock"));
 const base_driver_1 = require("@appium/base-driver");
 const PhoneNetworkRestore_1 = require("./network/PhoneNetworkRestore");
 const interceptorOptions_1 = require("./interceptor/interceptorOptions");
+/**
+ * A session token admits a session only with the `sessions` scope, as a key
+ * pair does. Tokens minted before this check carry no `scopes` claim, and
+ * POST /auth/token gave one to any credential, a read-only one included:
+ * they are refused too.
+ */
+function sessionTokenGrantsSessions(scopes) {
+    if (typeof scopes !== 'string')
+        return false;
+    const owned = scopes.split(',').map((s) => s.trim());
+    return owned.includes('sessions') || owned.includes('admin');
+}
+const SESSION_TOKEN_LACKS_SCOPE = 'session rejected: xe:options.sessionToken carries no `sessions` scope; tokens minted by ' +
+    'Xenon 2.14 or earlier carry none — mint a new one with POST /xenon/api/auth/token ' +
+    '({"audience":"xenon-mcp"}) using a credential that has the `sessions` scope.';
 /**
  * How long the hub waits for a node (or cloud provider) to create a session.
  * A create is sent once (InternalRequestConfig `retry: false`): the node may
@@ -263,6 +276,7 @@ let SessionLifecycleService = class SessionLifecycleService {
                 apiKeyId: authResult.apiKeyId,
                 userId: authResult.userId,
                 appDownload,
+                allocatedAt: Date.now(),
             };
             // The grant opens one phone, on this node. A token taken to another node
             // (an emulator's udid repeats across machines), or naming a phone this
@@ -391,7 +405,7 @@ let SessionLifecycleService = class SessionLifecycleService {
             this.logger.debug(`📱 Removing pending session with capability_id: ${allocation.pendingSessionId}`);
             yield (0, pending_sessions_service_1.removePendingSession)(allocation.pendingSessionId);
             if (this.isCreateSessionResponseInternal(session)) {
-                yield this.finalizeSession(session, device, caps, driver, remote, allocation.apiKeyId, allocation.userId);
+                yield this.finalizeSession(session, device, caps, driver, remote, allocation.apiKeyId, allocation.userId, allocation.allocatedAt);
             }
             else {
                 yield this.handleSessionFailure(session, device, remote);
@@ -505,9 +519,11 @@ let SessionLifecycleService = class SessionLifecycleService {
     // took out of `xe:options` (or its `xenon:options` alias): an access-key +
     // token pair, or a session token. Today this is best-effort: if none is
     // supplied we log a warning and let the request through to avoid breaking
-    // pre-existing test clients, unless XENON_REQUIRE_SESSION_TOKEN is on. A
-    // supplied key that is invalid / revoked / has insufficient scope is
-    // rejected. Respects the global `authDisabled` flag.
+    // pre-existing test clients, unless XENON_REQUIRE_SESSION_TOKEN is on.
+    // Credentials that don't verify — a wrong, revoked or expired key or token,
+    // or one whose user is deleted or not ACTIVE — count as none. Credentials
+    // that verify without the `sessions` scope are rejected. Respects the
+    // global `authDisabled` flag.
     //
     // Returns the caller's { apiKeyId, callerTeamIds } so allocation can filter
     // devices, and app resolution uploaded apps, by team. `apiKeyId` is null
@@ -549,23 +565,47 @@ let SessionLifecycleService = class SessionLifecycleService {
             }
             const { ApiKeyService } = yield Promise.resolve().then(() => __importStar(require('./ApiKeyService')));
             const svc = typedi_1.Container.get(ApiKeyService);
+            const { verifyKeyPairCredential, verifySessionTokenCredential, isWrongSessionToken } = yield Promise.resolve().then(() => __importStar(require('../middleware/verifyCredential')));
             // xe:options.{accessKey, token} — the only key-pair credential shape.
+            // Checked by REST's rule (verifyKeyPairCredential): a live key whose owner
+            // exists and is ACTIVE. The key alone (verifyPair) let a user set to
+            // Inactive, or deleted, keep creating sessions as themselves. The owner
+            // found here is the one lookup the session's scope and lease use.
             const pair = credentials.pair;
-            const row = pair ? yield svc.verifyPair(pair.accessKey, pair.token) : null;
+            const verifiedPair = pair ? yield verifyKeyPairCredential(pair.accessKey, pair.token) : null;
+            // The session token, verified once for both the gate and attribution, by
+            // REST's rule too: a live signature and an ACTIVE subject, looked up now.
+            let tokenCheck;
+            const verifyToken = (t) => {
+                if (!tokenCheck)
+                    tokenCheck = verifySessionTokenCredential(t);
+                return tokenCheck;
+            };
+            // Both readers below treat any failure as a token that doesn't check out:
+            // the gate refuses it as "invalid or expired", attribution ignores it. A
+            // check that could not run (the database or the signing key unavailable)
+            // is not that: it refuses the create here, as a key whose owner can't be
+            // looked up does, rather than run the session with no owner.
+            if (!verifiedPair && credentials.sessionToken) {
+                yield verifyToken(credentials.sessionToken).catch((err) => {
+                    if (!isWrongSessionToken(err))
+                        throw err;
+                });
+            }
             const { assertSessionTokenGate, sessionTokenGateEnabled } = yield Promise.resolve().then(() => __importStar(require('./sessionTokenGate')));
             try {
                 yield assertSessionTokenGate({
                     enabled: sessionTokenGateEnabled(),
-                    hasValidKeyPair: !!row,
+                    hasValidKeyPair: !!verifiedPair,
                     token: credentials.sessionToken,
-                    verify: (t) => typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(t, { audience: 'xenon-session' }),
+                    verify: verifyToken,
                 });
             }
             catch (err) {
                 this.logger.error(`❌ ${err.message}`);
                 throw new base_driver_1.errors.InvalidArgumentError(err.message);
             }
-            if (!row) {
+            if (!verifiedPair) {
                 // No key pair. An xe:options.sessionToken still identifies the caller,
                 // so read it for attribution even when the gate is off — otherwise the
                 // ownership guard fails closed on a session whose owner we actually know.
@@ -573,23 +613,36 @@ let SessionLifecycleService = class SessionLifecycleService {
                 // The token's teamId claim narrows it the way a key's team does; kept
                 // from the one verify rather than verifying again.
                 let tokenTeamId = null;
+                let tokenScopes;
+                let tokenOwner;
                 const identity = yield (0, sessionIdentity_1.resolveSessionIdentity)({
                     row: null,
                     sessionToken: credentials.sessionToken,
                     verify: (t) => __awaiter(this, void 0, void 0, function* () {
-                        const payload = yield typedi_1.Container.get(JwtKeyService_1.JwtKeyService).verify(t, {
-                            audience: 'xenon-session',
-                        });
+                        const { payload, user } = yield verifyToken(t);
                         tokenTeamId = typeof (payload === null || payload === void 0 ? void 0 : payload.teamId) === 'string' ? payload.teamId : null;
+                        tokenScopes = payload === null || payload === void 0 ? void 0 : payload.scopes;
+                        tokenOwner = user;
                         return payload;
                     }),
                 });
+                // A token that names its owner may create sessions only with the
+                // `sessions` scope, as a key pair may: refused, like a key without it.
+                if (identity.userId && !sessionTokenGrantsSessions(tokenScopes)) {
+                    this.logger.error('Rejecting session: xe:options.sessionToken lacks the `sessions` scope');
+                    throw new base_driver_1.errors.InvalidArgumentError(SESSION_TOKEN_LACKS_SCOPE);
+                }
                 if (!identity.userId) {
                     this.logger.warn('Session created without valid credentials. Pass `xe:options.accessKey` + ' +
                         '`xe:options.token`, or `xe:options.sessionToken`.');
                 }
-                const leaseAccess = this.leaseAccessFor(identity.userId
-                    ? { kind: 'session-token', userId: identity.userId, teamId: tokenTeamId }
+                const leaseAccess = this.leaseAccessFor(identity.userId && tokenOwner
+                    ? {
+                        kind: 'session-token',
+                        scopes: String(tokenScopes),
+                        user: tokenOwner,
+                        teamId: tokenTeamId,
+                    }
                     : { kind: 'none' });
                 // A token's user is scoped as REST scopes them. No credentials at all
                 // stays unscoped (the back-compat path), with no lookup.
@@ -599,6 +652,7 @@ let SessionLifecycleService = class SessionLifecycleService {
                         teamId: identity.userId ? tokenTeamId : null,
                     } });
             }
+            const { row, user: owner } = verifiedPair;
             if (!svc.hasScope(row, ['sessions'])) {
                 this.logger.error('Rejecting session: credentials lack the `sessions` scope');
                 throw new base_driver_1.errors.InvalidArgumentError('credentials are invalid, revoked, or lack the `sessions` scope');
@@ -607,7 +661,7 @@ let SessionLifecycleService = class SessionLifecycleService {
             const leaseAccess = this.leaseAccessFor({
                 kind: 'api-key',
                 scopes: row.scopes,
-                userId: row.userId,
+                user: owner,
                 teamId: (_a = row.teamId) !== null && _a !== void 0 ? _a : null,
             });
             // The phones and apps this session may use: REST's rule
@@ -642,7 +696,8 @@ let SessionLifecycleService = class SessionLifecycleService {
     // How a session that names a lease is judged, looked up at most once and
     // only when asked. Who may override follows canOverrideLease; which phones
     // it can see follows REST's computeTeamIds. Both need the owner's live role,
-    // as authMiddleware reads it for every REST request.
+    // as authMiddleware reads it for every REST request: the owner the
+    // credential check looked up a moment ago, ACTIVE then.
     leaseAccessFor(credential) {
         let looked;
         return () => {
@@ -659,24 +714,24 @@ let SessionLifecycleService = class SessionLifecycleService {
             if (credential.kind === 'none') {
                 return { canOverride: (0, leaseOverride_1.canOverrideLease)({ kind: 'none' }), teamIds: undefined };
             }
+            const { user } = credential;
             try {
-                const { UserService } = yield Promise.resolve().then(() => __importStar(require('./UserService')));
-                const found = yield typedi_1.Container.get(UserService).findById(credential.userId);
-                const user = found && found.status === 'ACTIVE' ? found : null;
-                const canOverride = (0, leaseOverride_1.canOverrideLease)(credential.kind === 'api-key'
-                    ? { kind: 'api-key', scopes: credential.scopes, user }
-                    : { kind: 'session-token', user });
-                const role = (user === null || user === void 0 ? void 0 : user.role) === 'SUPER_ADMIN' || (user === null || user === void 0 ? void 0 : user.role) === 'ADMIN' ? user.role : 'MEMBER';
+                const canOverride = (0, leaseOverride_1.canOverrideLease)({
+                    kind: credential.kind,
+                    scopes: credential.scopes,
+                    user,
+                });
+                const role = user.role === 'SUPER_ADMIN' || user.role === 'ADMIN' ? user.role : 'MEMBER';
                 const teamIds = yield (0, callerTeamIds_1.computeTeamIds)({
                     role,
-                    userId: credential.userId,
+                    userId: user.id,
                     apiKeyTeamId: credential.teamId,
                 });
                 return { canOverride, teamIds };
             }
             catch (err) {
                 // Fail closed: no override, and the shared pool only.
-                this.logger.warn(`Could not look up how user ${credential.userId} may use a lease: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
+                this.logger.warn(`Could not look up how user ${user.id} may use a lease: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`);
                 return { canOverride: false, teamIds: [] };
             }
         });
@@ -790,8 +845,8 @@ let SessionLifecycleService = class SessionLifecycleService {
         }
     }
     finalizeSession(session_1, device_1, caps_1, driver_1, isRemote_1) {
-        return __awaiter(this, arguments, void 0, function* (session, device, caps, driver, isRemote, apiKeyId = null, userId = null) {
-            var _a;
+        return __awaiter(this, arguments, void 0, function* (session, device, caps, driver, isRemote, apiKeyId = null, userId = null, allocatedAt) {
+            var _a, _b;
             const sessionId = session.value[0];
             const sessionResponse = session.value[1];
             const requestedCaps = Object.assign({}, ((_a = caps.firstMatch) === null || _a === void 0 ? void 0 : _a[0]) || {}, caps.alwaysMatch || {});
@@ -808,6 +863,23 @@ let SessionLifecycleService = class SessionLifecycleService {
                     'xenon.udid': device.udid,
                 });
             }
+            try {
+                yield this.registerSession(sessionId, sessionResponse, device, xenonCapabilities, driver, isRemote, apiKeyId, userId, allocatedAt);
+            }
+            catch (err) {
+                // The create fails, so no ending of the session will come to end it.
+                tracingService.endSessionSpan(sessionId, {
+                    failed: true,
+                    reason: `Xenon could not finish creating the session: ${(_b = err === null || err === void 0 ? void 0 : err.message) !== null && _b !== void 0 ? _b : err}`,
+                });
+                throw err;
+            }
+        });
+    }
+    /** The rest of finalizeSession, once the session's span has started. */
+    registerSession(sessionId, sessionResponse, device, xenonCapabilities, driver, isRemote, apiKeyId, userId, allocatedAt) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const context = typedi_1.Container.get(PluginContext_1.PluginContext);
             // The session takes over the pending claim its phone was allocated with.
             yield (0, device_service_1.claimDeviceForSession)(device, sessionId, {
                 session_id: sessionId,
@@ -826,6 +898,7 @@ let SessionLifecycleService = class SessionLifecycleService {
             const sessionInstance = this.createSessionInstance(sessionId, freshDevice, sessionResponse, xenonCapabilities, driver, webDriverUrl);
             sessionInstance.apiKeyId = apiKeyId;
             sessionInstance.userId = userId;
+            sessionInstance.allocatedAt = allocatedAt;
             // A session this server drives: its owner is known while it runs, row or
             // not (a node writes none for the hub's sessions; LiveSessionOwners).
             if (sessionInstance instanceof LocalSession_1.LocalSession) {
@@ -1005,19 +1078,8 @@ let SessionLifecycleService = class SessionLifecycleService {
                 timeout: exports.REMOTE_CREATE_TIMEOUT_MS,
                 retry: false,
             };
-            if (context.pluginArgs.proxy) {
-                this.logger.info(`Added proxy to axios config: ${JSON.stringify(context.pluginArgs.proxy)}`);
-                const proxyUrl = typeof context.pluginArgs.proxy === 'string'
-                    ? context.pluginArgs.proxy
-                    : `http://${context.pluginArgs.proxy.host}:${context.pluginArgs.proxy.port}`;
-                config.httpsAgent = new https_proxy_agent_1.HttpsProxyAgent(proxyUrl, {
-                    rejectUnauthorized: context.pluginArgs.tlsRejectUnauthorized,
-                });
-                config.httpAgent = new http_proxy_agent_1.HttpProxyAgent(proxyUrl, {
-                    rejectUnauthorized: context.pluginArgs.tlsRejectUnauthorized,
-                });
-                config.proxy = false;
-            }
+            // Its proxy is InternalHttpClient's, by Xenon's one rule: the `proxy`
+            // option, else the environment's (helpers/outboundProxy.ts).
             const createdSession = yield this.invokeSessionRequest(config, context.pluginArgs.tlsRejectUnauthorized);
             if (createdSession instanceof Error) {
                 return createdSession;
@@ -1148,6 +1210,13 @@ let SessionLifecycleService = class SessionLifecycleService {
             finally {
                 if (sessionId) {
                     typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).forget(sessionId);
+                    (0, sessionMemory_1.forgetSessionMemory)(sessionId);
+                    // Whether or not SESSION_MANAGER holds the session (a local one with
+                    // the dashboard off), and once: a second delete finds no span.
+                    typedi_1.Container.get(TracingService_1.TracingService).endSessionSpan(sessionId, {
+                        failed: status === SessionStatus_1.SessionStatus.FAILED,
+                        reason,
+                    });
                     // Before the lock's "still in memory?" check, which a dashboard-off
                     // node fails. On a node this ends the figures it holds for its hub;
                     // on a hub it collects a node session's last ones. Idempotent.
@@ -1181,8 +1250,11 @@ let SessionLifecycleService = class SessionLifecycleService {
                     logger_1.default.warn(`Port release failed: ${err.message}`);
                 }
             }
-            // 1. iOS Profiling Archival
-            if (device && ((_a = device.platform) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'ios') {
+            // 1. iOS Profiling Archival. Only on an iPhone, the one place
+            // EventManager.onSessionStarted starts it. A simulator's driver refuses
+            // the stop without relaxed security, and the refused stop counted as a
+            // failed command of the session: every simulator session ended failed.
+            if (device && ((_a = device.platform) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === 'ios' && device.realDevice === true) {
                 this.logger.info(`[${sessionId}] Stopping iOS profiling for asset archival`);
                 try {
                     const traceBase64 = yield session.stopPerformanceRecording();
@@ -1263,6 +1335,8 @@ let SessionLifecycleService = class SessionLifecycleService {
                 }
                 SessionManager_1.SESSION_MANAGER.removeSession(sessionId);
                 typedi_1.Container.get(LiveSessionOwners_1.LiveSessionOwners).forget(sessionId);
+                (0, sessionMemory_1.forgetSessionMemory)(sessionId);
+                typedi_1.Container.get(TracingService_1.TracingService).endSessionSpan(sessionId, { failed: true, reason });
                 yield typedi_1.Container.get(SessionMetricsService_1.SessionMetricsService).stop(sessionId);
             }));
         });

package/lib/src/services/SocketClient.js

@@ -15,6 +15,7 @@ const typedi_1 = require("typedi");
 const logger_1 = __importDefault(require("../logger"));
 const config_1 = require("../config");
 const SocketEvents_1 = require("../enums/SocketEvents");
+const outboundProxy_1 = require("../helpers/outboundProxy");
 let SocketClient = class SocketClient {
     constructor() {
         this.socket = null;
@@ -46,6 +47,16 @@ let SocketClient = class SocketClient {
             reconnectionDelay: 1000,
             reconnectionDelayMax: 5000,
             auth: socketAuth,
+            // The proxy the node's other calls to its hub take (its phone reports,
+            // its JWKS fetch); it used to go straight to the hub whatever the
+            // environment said. Polling goes as plain requests, as axios sends
+            // them; only the WebSocket upgrade needs a CONNECT tunnel, and when the
+            // proxy refuses one (a stock Squid allows port 443 only) the
+            // connection stays on polling.
+            transportOptions: {
+                polling: { agent: (0, outboundProxy_1.proxyAgentFor)(normalizedHubUrl) },
+                websocket: { agent: (0, outboundProxy_1.socketProxyAgentFor)(normalizedHubUrl) },
+            },
         });
         this.socket.on('connect', () => {
             var _a, _b, _c;