@xenon-device-management/xenon 2.17.0 → 2.17.1

package/lib/src/gateway/internalCall.js

@@ -4,8 +4,10 @@ exports.INTERNAL_CALL_MARKER = exports.INTERNAL_CALL_HEADER = void 0;
 exports.internalCallHeaders = internalCallHeaders;
 exports.hasInternalCallSecret = hasInternalCallSecret;
 exports.isInternalCall = isInternalCall;
+exports.isInsideInternalCall = isInsideInternalCall;
 exports.internalCallBaseUrl = internalCallBaseUrl;
 exports.createInternalCallLayer = createInternalCallLayer;
+const async_hooks_1 = require("async_hooks");
 const crypto_1 = require("crypto");
 const appiumBasePath_1 = require("../app/appiumBasePath");
 /**
@@ -27,11 +29,20 @@ const appiumBasePath_1 = require("../app/appiumBasePath");
  * The secret never leaves the process: it is sent only to this server's own
  * address, with any HTTP proxy bypassed, and the gateway removes the header
  * before anything after it sees the request.
+ *
+ * Such a call is never one of the test's commands. The rest of its request
+ * runs in an async context the plugin can read (`isInsideInternalCall`), since
+ * the plugin's `handle`, deep inside Appium's route, is never given the
+ * request. Through 2.16 it couldn't tell, so the dashboard recorded the call
+ * as the session's own: a performance recording's stop the driver refused at
+ * the end of an iPhone session (through 2.15, of every simulator session)
+ * failed a session whose commands had all passed.
  */
 exports.INTERNAL_CALL_HEADER = 'x-xenon-internal';
 exports.INTERNAL_CALL_MARKER = '/wd-internal';
 const SECRET = Buffer.from((0, crypto_1.randomBytes)(32).toString('base64url'));
 const INTERNAL = Symbol('xenon.internalCall');
+const internalCalls = new async_hooks_1.AsyncLocalStorage();
 /** The headers a loopback call to this process's own server carries. */
 function internalCallHeaders() {
     return { [exports.INTERNAL_CALL_HEADER]: SECRET.toString() };
@@ -48,6 +59,19 @@ function hasInternalCallSecret(headers) {
 function isInternalCall(req) {
     return !!req && req[INTERNAL] === true;
 }
+/**
+ * Whether this code runs for a request the internal-call layer accepted: the
+ * plugin's `handle` and the driver's command under it, which never see the
+ * request itself.
+ *
+ * Read it where a command enters the plugin (CommandInterceptor.handle). It
+ * also holds in whatever the driver starts during the call and runs later (a
+ * timer, a socket's callback): base-driver's new-command timer, restarted at
+ * the call's end, fires inside it, and so does an idle session's shutdown.
+ */
+function isInsideInternalCall() {
+    return internalCalls.getStore() === true;
+}
 /**
  * Where a local session's loopback calls go: this server, under its base
  * path, marked `/wd-internal`. A wildcard bind address is reached on 127.0.0.1.
@@ -80,11 +104,15 @@ function createInternalCallLayer(basePath) {
         req.originalUrl = req.url;
         return true;
     }
-    // One call to next() for every outcome: Appium's 404 carries a stack trace,
-    // and a second call site would make a refused /wd-internal request's answer
-    // differ from any other unknown route's by that one frame.
+    // Every request this layer leaves alone goes on through the one call to
+    // next() below: Appium's 404 carries a stack trace, and a second call site
+    // would make a refused /wd-internal request's answer differ from any other
+    // unknown route's by that one frame. An accepted call goes on inside its
+    // context, down to the plugin's handle (isInsideInternalCall).
     return function xenonInternalCalls(req, _res, next) {
-        accept(req);
-        next();
+        if (accept(req))
+            internalCalls.run(true, next);
+        else
+            next();
     };
 }

package/lib/src/gateway/sessionGateway.js

@@ -168,10 +168,15 @@ function createHubRouting(deps) {
                     yield deleteRemote(req, res, sessionId, location);
                     return;
                 }
-                yield deps
-                    .touch(sessionId)
-                    .catch((error) => logger.warn(`Could not record activity for session ${sessionId}: ${(0, commandAuth_1.summarize)(error)}`));
-                const hooks = location.session && !location.cloud ? deps.dashboard : undefined;
+                // Xenon's own call (internalCall.ts) is never one of the test's
+                // commands: it isn't the session's activity, nor in its record.
+                const own = (0, internalCall_1.isInternalCall)(req);
+                if (!own) {
+                    yield deps
+                        .touch(sessionId)
+                        .catch((error) => logger.warn(`Could not record activity for session ${sessionId}: ${(0, commandAuth_1.summarize)(error)}`));
+                }
+                const hooks = location.session && !location.cloud && !own ? deps.dashboard : undefined;
                 const command = hooks
                     ? deps.commandName(`${deps.basePath}/session/${sessionId}${rest.split('?')[0]}`, req.method)
                     : undefined;

package/lib/src/helpers/index.js

@@ -176,15 +176,18 @@ function stripAppiumPrefixes(caps) {
     }
     return strippedCaps;
 }
-function isXenonRunning(host, tlsRejectUnauthorized) {
-    return __awaiter(this, void 0, void 0, function* () {
+function probeConfig(probe) {
+    return Object.assign(Object.assign({}, (probe.timeoutMs !== undefined ? { timeout: probe.timeoutMs } : {})), (probe.retry === false ? { retry: false } : {}));
+}
+function isXenonRunning(host_1, tlsRejectUnauthorized_1) {
+    return __awaiter(this, arguments, void 0, function* (host, tlsRejectUnauthorized, probe = {}) {
         try {
             const client = InternalHttpClient_1.InternalHttpClient.getClient(tlsRejectUnauthorized);
             // /health is the one /xenon/api route with no login. The hub probes its
             // nodes, and a node its hub, without credentials, so a login-only route
             // (/status) called a server with auth on dead: the hub pruned its node's
             // phones, and the node never registered with its hub.
-            yield client.get(`${host}/xenon/api/health`);
+            yield client.get(`${host}/xenon/api/health`, probeConfig(probe));
             return true;
         }
         catch (error) {
@@ -193,11 +196,11 @@ function isXenonRunning(host, tlsRejectUnauthorized) {
         }
     });
 }
-function isAppiumRunningAt(url, tlsRejectUnauthorized) {
-    return __awaiter(this, void 0, void 0, function* () {
+function isAppiumRunningAt(url_1, tlsRejectUnauthorized_1) {
+    return __awaiter(this, arguments, void 0, function* (url, tlsRejectUnauthorized, probe = {}) {
         try {
             const client = InternalHttpClient_1.InternalHttpClient.getClient(tlsRejectUnauthorized);
-            yield client.get(`${url}/status`);
+            yield client.get(`${url}/status`, probeConfig(probe));
             return true;
         }
         catch (error) {

package/lib/src/interceptors/CommandInterceptor.js

@@ -70,6 +70,7 @@ const waitFor_1 = require("../services/autowait/waitFor");
 const SelfHealingSwitch_1 = require("../services/settings/SelfHealingSwitch");
 const xenonScripts_1 = require("./xenonScripts");
 const healReport_1 = require("../gateway/healReport");
+const internalCall_1 = require("../gateway/internalCall");
 const W3C_ELEMENT_KEY = 'element-6066-11e4-a52e-4f735466cecf';
 /**
  * The commands the interceptor answers itself for an element Xenon found in a
@@ -116,6 +117,15 @@ let CommandInterceptor = class CommandInterceptor {
             const IGNORED_COMMANDS = ['getScreenshot', 'stopRecordingScreen', 'startRecordingScreen'];
             if (IGNORED_COMMANDS.includes(commandName))
                 return yield next();
+            // Xenon's own call to the session (a LocalSession's loopback, when its
+            // in-process call failed; gateway/internalCall.ts) goes straight to the
+            // driver. It isn't one of the test's commands: it isn't recorded with
+            // them, so it can't decide the session's status, and it doesn't reset
+            // Xenon's idle clock. Through 2.16 a performance recording's stop the
+            // driver refused at the end was recorded as a failed `execute`, and the
+            // session ended failed.
+            if ((0, internalCall_1.isInsideInternalCall)())
+                return yield next();
             const sessionId = driver.sessionId || args[args.length - 1];
             const tracingService = typedi_1.Container.get(TracingService_1.TracingService);
             const spanId = `${sessionId}:${commandName}`;

package/lib/src/services/ServerManager.js

@@ -265,10 +265,7 @@ let ServerManager = ServerManager_1 = class ServerManager {
             // Cleanup any remaining zombie sessions (cross-node fallback)
             const { cleanupZombieSessions } = yield Promise.resolve().then(() => __importStar(require('../dashboard/services/session-service')));
             yield cleanupZombieSessions(recoveredSessionIds);
-            // Initial device discovery poll to start managers and trackers
-            yield (0, device_utils_1.updateDeviceList)(localHosts, pluginArgs.hub, pluginArgs.tlsRejectUnauthorized);
-            // remove stale devices
-            yield (0, device_utils_1.removeStaleDevices)(localHosts, pluginArgs.tlsRejectUnauthorized);
+            yield this.syncDevicesAtBoot(localHosts, pluginArgs);
             // In the background: put back the network a previous run left changed on
             // this server's phones (an Offline profile, an interceptor proxy).
             void this.cleanUpPhoneNetworks(localHosts, nodeId);
@@ -280,6 +277,30 @@ let ServerManager = ServerManager_1 = class ServerManager {
             }
         });
     }
+    /**
+     * The phones as this server starts, the last step before Appium opens its
+     * port, which it does only once every plugin's updateServer has finished.
+     * So it never waits long on another server. Through 2.17 a row naming a
+     * host that drops packets (a node gone, or this machine's own old DHCP
+     * address) kept the port closed for two minutes.
+     */
+    syncDevicesAtBoot(localHosts, pluginArgs) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { hub, tlsRejectUnauthorized } = pluginArgs;
+            // Initial device discovery poll to start managers and trackers. A session
+            // is allocated from these rows, so they are written before the port opens.
+            const { devices, gone } = yield (0, device_utils_1.syncLocalDevices)(localHosts);
+            // A node's first report to its hub, in the background: nothing here is
+            // allocated from it, and the hub may not answer for minutes.
+            if (hub) {
+                void (0, device_utils_1.reportDevicesToHub)(hub, devices, gone, tlsRejectUnauthorized).catch((err) => { var _a; return this.logger.warn(`Could not report this node's phones to its hub: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`); });
+            }
+            // Other servers' phones whose server is gone, asked once each, briefly
+            // (BOOT_PROBE). Before the port opens: a session could otherwise be
+            // allocated one of them and sent to a server that never answers.
+            yield (0, device_utils_1.removeStaleDevices)(localHosts, tlsRejectUnauthorized, device_utils_1.BOOT_PROBE);
+        });
+    }
     /**
      * What a previous run of this server left on its phones' network: the
      * changes its ledger holds, and on this server's own Android phones a proxy

package/lib/src/services/UserService.js

@@ -20,7 +20,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UserService = void 0;
 const typedi_1 = require("typedi");
-const bcrypt_1 = __importDefault(require("bcrypt"));
+// Pure JavaScript, so it needs no install script: npm 12 skips a dependency's
+// install scripts unless the installing project allows them, and Appium's home
+// allows none. Through 2.17 this was the native `bcrypt`, whose binary only
+// its install script downloads, and the plugin then failed to load. The hashes
+// are the same `$2b$` format both ways.
+const bcryptjs_1 = __importDefault(require("bcryptjs"));
 const crypto_1 = __importDefault(require("crypto"));
 const logger_1 = __importDefault(require("../logger"));
 const prisma_1 = require("../prisma");
@@ -40,14 +45,14 @@ let UserService = class UserService {
             if (!password || password.length < PASSWORD_MIN) {
                 throw new Error(`password must be at least ${PASSWORD_MIN} characters`);
             }
-            return bcrypt_1.default.hash(password, this.bcryptCost);
+            return bcryptjs_1.default.hash(password, this.bcryptCost);
         });
     }
     verifyPassword(password, hash) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!password || !hash)
                 return false;
-            return bcrypt_1.default.compare(password, hash);
+            return bcryptjs_1.default.compare(password, hash);
         });
     }
     generateAccessKey() {

package/lib/src/sessions/appiumUmbrella.js

@@ -25,6 +25,17 @@ let AppiumUmbrella = class AppiumUmbrella {
             return false;
         return !!this.umbrella.sessionExists(sessionId);
     }
+    /**
+     * The options this session's driver runs with (its capabilities, without
+     * the `appium:` prefix), or undefined for a session Appium doesn't have.
+     * Read, never a command: see hasSession.
+     */
+    driverOptions(sessionId) {
+        var _a, _b;
+        if (!sessionId || !this.umbrella)
+            return undefined;
+        return (_b = (_a = this.umbrella.sessions) === null || _a === void 0 ? void 0 : _a[sessionId]) === null || _b === void 0 ? void 0 : _b.opts;
+    }
 };
 exports.AppiumUmbrella = AppiumUmbrella;
 exports.AppiumUmbrella = AppiumUmbrella = __decorate([

package/lib/src/sessions/sessionMemory.js

@@ -1,13 +1,19 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.forgetSessionMemory = forgetSessionMemory;
 const typedi_1 = require("typedi");
 const OmniVisionService_1 = require("../services/omni-vision/OmniVisionService");
 const AutowaitService_1 = require("../services/autowait/AutowaitService");
+const IOSStreamService_1 = __importDefault(require("../device-managers/ios/IOSStreamService"));
+const logger_1 = __importDefault(require("../logger"));
 /**
  * Drop what this server keeps in memory for a session's commands: the
- * elements its finds and heals found in screenshots (OmniVisionService) and
- * its autowait settings (AutowaitService). Called however the session ends
+ * elements its finds and heals found in screenshots (OmniVisionService), its
+ * autowait settings (AutowaitService), and a simulator's live preview of its
+ * picture (IOSStreamService). Called however the session ends
  * here: the test's delete (SessionLifecycleService.deleteSession), Appium's
  * new-command timeout or a crash (XenonPlugin.onUnexpectedShutdown), the idle
  * release (releaseBlockedDevices), a stale heartbeat (OrphanSweeper) and a
@@ -22,4 +28,7 @@ function forgetSessionMemory(sessionId) {
         return;
     typedi_1.Container.get(OmniVisionService_1.OmniVisionService).forgetSession(sessionId);
     typedi_1.Container.get(AutowaitService_1.AutowaitService).clearSession(sessionId);
+    typedi_1.Container.get(IOSStreamService_1.default)
+        .endSimulatorPreviews(sessionId)
+        .catch((err) => { var _a; return logger_1.default.warn(`Ending the simulator preview of ${sessionId} failed: ${(_a = err === null || err === void 0 ? void 0 : err.message) !== null && _a !== void 0 ? _a : err}`); });
 }

package/lib/test/unit/UserService.test.js

@@ -26,6 +26,14 @@ describe('UserService', () => {
             (0, chai_1.expect)(yield svc.verifyPassword('correct-horse-staple', hash)).to.be.true;
             (0, chai_1.expect)(yield svc.verifyPassword('wrong', hash)).to.be.false;
         }));
+        // Written by the native `bcrypt` 5 that hashed passwords through 2.17, at
+        // its cost of 12: every stored password is one of these.
+        it('verifies a password stored before 2.18', () => __awaiter(void 0, void 0, void 0, function* () {
+            const stored = '$2b$12$5kTngvxC6mQpOaiVCcexfuHPHKvxQMKz/IFm3Gxzia4Sb3lzK85dC';
+            const svc = new UserService_1.UserService();
+            (0, chai_1.expect)(yield svc.verifyPassword('signed-in-before-2.18', stored)).to.be.true;
+            (0, chai_1.expect)(yield svc.verifyPassword('signed-in-before-2.17', stored)).to.be.false;
+        }));
         it('rejects passwords shorter than 8 characters', () => __awaiter(void 0, void 0, void 0, function* () {
             const svc = new UserService_1.UserService();
             let err;

package/lib/test/unit/boot-device-sync.spec.js

@@ -0,0 +1,195 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("reflect-metadata");
+const net_1 = __importDefault(require("net"));
+const chai_1 = require("chai");
+const sinon_1 = __importDefault(require("sinon"));
+const typedi_1 = require("typedi");
+const async_wait_until_1 = __importDefault(require("async-wait-until"));
+const prisma_1 = require("../../src/prisma");
+const prisma_store_1 = require("../../src/data-service/prisma-store");
+const device_store_1 = require("../../src/data-service/device-store");
+const deviceUtils = __importStar(require("../../src/device-utils"));
+const helpers = __importStar(require("../../src/helpers"));
+const NodeDevices_1 = __importDefault(require("../../src/device-managers/NodeDevices"));
+const device_managers_1 = require("../../src/device-managers");
+const iOSTracker_1 = require("../../src/device-managers/iOSTracker");
+const localDeviceHosts_1 = require("../../src/device-managers/localDeviceHosts");
+const ServerManager_1 = require("../../src/services/ServerManager");
+const SocketServer_1 = require("../../src/services/SocketServer");
+const NotificationService_1 = require("../../src/services/NotificationService");
+const container_registration_1 = require("../helpers/container-registration");
+const fake_device_table_1 = require("../helpers/fake-device-table");
+/**
+ * Appium opens its port only once every plugin's updateServer has finished,
+ * so a start must not wait long on another server. Seen with 2.17.0: a hub
+ * whose database still listed its own phones under its old DHCP address
+ * (http://192.168.0.104:4723, now .102) asked that address whether it was a
+ * live node, and a host that drops packets takes four 30 s timeouts to give
+ * up, so the port opened 2 min 4 s after the plugin loaded. A node whose hub
+ * doesn't answer waited the same way before reporting its phones.
+ */
+const IP = '192.168.0.102';
+const HUB = `http://${IP}:4723`;
+const NODE = `http://${IP}:4725`;
+const phone = (udid, host, over = {}) => (Object.assign({ udid,
+    host, name: udid, platform: 'android', deviceType: 'real', realDevice: true, state: 'device', sdk: '14' }, over));
+/** A promise this test settles when it chooses, as a host that drops packets never does. */
+const deferred = () => {
+    let resolve;
+    const promise = new Promise((r) => (resolve = r));
+    return { promise, resolve };
+};
+/** Whether a promise settles within a time no probe of another server can beat. */
+const settlesSoon = (p) => Promise.race([
+    p.then(() => true),
+    new Promise((r) => setTimeout(() => r(false), 1000)),
+]);
+describe('A start never waits on another server', () => {
+    let table;
+    let discover;
+    let restoreContainer;
+    let savedStore;
+    const seed = (rows) => {
+        table = (0, fake_device_table_1.fakeDeviceTable)(rows);
+        for (const m of Object.keys(table.delegate)) {
+            sinon_1.default.stub(prisma_1.prisma.device, m).callsFake(table.delegate[m]);
+        }
+        const settings = (0, fake_device_table_1.fakeDeviceSettingTable)();
+        for (const m of Object.keys(settings.delegate)) {
+            sinon_1.default.stub(prisma_1.prisma.deviceSetting, m).callsFake(settings.delegate[m]);
+        }
+    };
+    const boot = (port, args) => typedi_1.Container.get(ServerManager_1.ServerManager).syncDevicesAtBoot((0, localDeviceHosts_1.localDeviceHosts)({ bindHostOrIp: IP }, port), args);
+    beforeEach(() => {
+        discover = () => __awaiter(void 0, void 0, void 0, function* () { return []; });
+        restoreContainer = (0, container_registration_1.saveRegistrations)(device_managers_1.XenonManager, SocketServer_1.SocketServer, NotificationService_1.NotificationService, iOSTracker_1.IosTracker);
+        typedi_1.Container.set({
+            id: device_managers_1.XenonManager,
+            value: { getDevices: (known) => discover(known) },
+        });
+        typedi_1.Container.set({
+            id: SocketServer_1.SocketServer,
+            value: {
+                emitToDashboard: () => undefined,
+                emitToDashboardForDevices: () => __awaiter(void 0, void 0, void 0, function* () { return undefined; }),
+                hasScopedDashboard: () => false,
+            },
+        });
+        typedi_1.Container.set({ id: NotificationService_1.NotificationService, value: { dispatchEvent: () => __awaiter(void 0, void 0, void 0, function* () { return undefined; }) } });
+        sinon_1.default.stub(prisma_1.prisma.lease, 'findMany').resolves([]);
+        savedStore = device_store_1.DeviceStoreFactory._deviceStore;
+        device_store_1.DeviceStoreFactory._deviceStore = new prisma_store_1.PrismaDeviceStore();
+    });
+    afterEach(() => {
+        device_store_1.DeviceStoreFactory._deviceStore = savedStore;
+        sinon_1.default.restore();
+        restoreContainer();
+    });
+    describe('on a hub, a row whose server never answers', () => {
+        // Takes the connection and never answers, as a host past a dropped route
+        // looks to the client: nothing but the timeout ends the request.
+        let silent;
+        let sockets;
+        let silentHost;
+        beforeEach(() => __awaiter(void 0, void 0, void 0, function* () {
+            sockets = [];
+            silent = net_1.default.createServer((s) => {
+                sockets.push(s);
+            });
+            yield new Promise((r) => silent.listen(0, '127.0.0.1', r));
+            silentHost = `http://127.0.0.1:${silent.address().port}`;
+            // The real probe, with a limit this test can wait for.
+            sinon_1.default.stub(deviceUtils.BOOT_PROBE, 'timeoutMs').value(300);
+        }));
+        afterEach(() => __awaiter(void 0, void 0, void 0, function* () {
+            sockets.forEach((s) => s.destroy());
+            yield new Promise((r) => silent.close(() => r()));
+        }));
+        it('is asked once, briefly, and gone before the port opens', () => __awaiter(void 0, void 0, void 0, function* () {
+            seed([phone('old-row', silentHost)]);
+            discover = () => __awaiter(void 0, void 0, void 0, function* () { return [phone('own-phone', HUB)]; });
+            (0, chai_1.expect)(yield settlesSoon(boot(4723, {}))).to.equal(true);
+            (0, chai_1.expect)(table.row('own-phone')).to.include({ host: HUB });
+            (0, chai_1.expect)(table.row('old-row')).to.equal(undefined);
+            (0, chai_1.expect)(sockets).to.have.length(1);
+        }));
+    });
+    it('a node opens while its hub never answers, and reports its phones once it does', () => __awaiter(void 0, void 0, void 0, function* () {
+        seed([]);
+        discover = () => __awaiter(void 0, void 0, void 0, function* () { return [phone('node-phone', NODE)]; });
+        const hubAnswer = deferred();
+        const alive = sinon_1.default.stub(helpers, 'isXenonRunning').returns(hubAnswer.promise);
+        const post = sinon_1.default.stub(NodeDevices_1.default.prototype, 'postDevicesToHub').resolves();
+        (0, chai_1.expect)(yield settlesSoon(boot(4725, { hub: HUB }))).to.equal(true);
+        (0, chai_1.expect)(table.row('node-phone')).to.include({ host: NODE });
+        (0, chai_1.expect)(alive.calledWith(HUB)).to.equal(true);
+        (0, chai_1.expect)(post.called).to.equal(false);
+        hubAnswer.resolve(true);
+        yield (0, async_wait_until_1.default)(() => post.called, { timeout: 2000 });
+        (0, chai_1.expect)(post.firstCall.args[1]).to.equal('add');
+        (0, chai_1.expect)(post.firstCall.args[0].map((d) => d.udid)).to.deep.equal(['node-phone']);
+    }));
+    it("a node's report that fails is logged, and never fails the start", () => __awaiter(void 0, void 0, void 0, function* () {
+        seed([]);
+        sinon_1.default.stub(deviceUtils, 'reportDevicesToHub').rejects(new Error('hub refused'));
+        const warn = sinon_1.default.spy(typedi_1.Container.get(ServerManager_1.ServerManager).logger, 'warn');
+        const unhandled = sinon_1.default.spy();
+        process.on('unhandledRejection', unhandled);
+        try {
+            yield boot(4725, { hub: HUB });
+            yield (0, async_wait_until_1.default)(() => warn.called, { timeout: 2000 });
+            (0, chai_1.expect)(String(warn.firstCall.args[0])).to.include('hub refused');
+            yield new Promise((r) => setImmediate(r));
+            (0, chai_1.expect)(unhandled.called).to.equal(false);
+        }
+        finally {
+            process.off('unhandledRejection', unhandled);
+        }
+    }));
+});

package/lib/test/unit/hub-node-gateway-appium-server.spec.js

@@ -67,6 +67,7 @@ const prisma_store_1 = require("../../src/data-service/prisma-store");
 const SessionManager_1 = require("../../src/sessions/SessionManager");
 const RemoteSession_1 = require("../../src/sessions/RemoteSession");
 const event_manager_1 = require("../../src/dashboard/event-manager");
+const deviceService = __importStar(require("../../src/data-service/device-service"));
 const hubSessionToken_1 = require("../../src/gateway/hubSessionToken");
 const internalCall_1 = require("../../src/gateway/internalCall");
 const nodeWebDriverUrl_1 = require("../../src/gateway/nodeWebDriverUrl");
@@ -657,6 +658,26 @@ describe('the session gateway between a hub and a node, in Appium 3’s own serv
             (0, chai_1.expect)(nodeRequests).to.have.length(1);
             (0, chai_1.expect)(nodeRequests[0].headers[internalCall_1.INTERNAL_CALL_HEADER]).to.equal(undefined);
         }));
+        it('is never logged as one of the session’s commands, though forwarded', () => __awaiter(this, void 0, void 0, function* () {
+            yield boot({ dashboard: true });
+            const { id } = yield remoteSession();
+            const before = sinon_1.default.stub(event_manager_1.DASHBORD_EVENT_MANAGER, 'beforeSessionCommand').resolves(true);
+            const after = sinon_1.default.stub(event_manager_1.DASHBORD_EVENT_MANAGER, 'afterSessionCommand').resolves();
+            const touched = sinon_1.default.stub(deviceService, 'updateCmdExecutedTime').resolves();
+            yield (0, loopbackRequest_1.default)(hubUrl)
+                .get(`/wd/hub/wd-internal/session/${id}/url`)
+                .set((0, internalCall_1.internalCallHeaders)())
+                .expect(200);
+            (0, chai_1.expect)(node.commands).to.deep.equal(['getUrl']);
+            (0, chai_1.expect)(before.called, 'the dashboard’s before hook').to.equal(false);
+            (0, chai_1.expect)(after.called, 'the dashboard’s after hook').to.equal(false);
+            (0, chai_1.expect)(touched.called, 'counted as the session’s activity').to.equal(false);
+            // The test's own command is, as before.
+            yield (0, loopbackRequest_1.default)(hubUrl).get(`/wd/hub/session/${id}/url`).expect(200);
+            (0, chai_1.expect)(before.callCount).to.equal(1);
+            (0, chai_1.expect)(after.callCount).to.equal(1);
+            (0, chai_1.expect)(touched.calledOnceWith(id)).to.equal(true);
+        }));
     });
     describe('per-command auth on a remote session (at the hub)', () => {
         it('lets the owner through to the node', () => __awaiter(this, void 0, void 0, function* () {

package/lib/test/unit/install-scripts.spec.js

@@ -0,0 +1,98 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const root = path_1.default.join(__dirname, '..', '..');
+const readJson = (file) => JSON.parse(fs_1.default.readFileSync(file, 'utf8'));
+/**
+ * npm 12 runs a dependency's install scripts only when the project installing
+ * it allows them (`allowScripts` in its package.json), and skips the rest with
+ * a warning. Appium installs a plugin with npm into its own home, whose
+ * package.json allows nothing, so every install script in Xenon's tree is
+ * skipped there and `appium plugin install` still reports success.
+ *
+ * Through 2.17 passwords were hashed with `bcrypt`, whose native binary only
+ * its `install` script downloads. Installed with npm 12, the plugin then
+ * failed to load: "Cannot find module .../bcrypt/lib/binding/napi-v3/bcrypt_lib.node".
+ *
+ * Each package here has an install script and works without it, for the
+ * reason given, checked with npm 12. A new one needs its own reason, checked
+ * the same way, or a replacement that needs no script.
+ */
+const WORKS_WITHOUT_ITS_SCRIPT = {
+    '@ffmpeg-installer/*': 'chmod u+x ffmpeg: every platform package ships ffmpeg executable already',
+    '@prisma/client': 'generates the default client in node_modules/.prisma; Xenon imports its own (src/generated/client)',
+    '@prisma/engines': "downloads Prisma's engines: the schema engine is fetched on its first use at startup, " +
+        'and the generated client carries its query engines',
+    '@scarf/scarf': "swagger-ui-dist's install analytics",
+    'appium-chromedriver': 'downloads a Chromedriver; Xenon downloads its own when needed (ChromeDriverManager)',
+    prisma: 'warns about incompatible older Prisma packages',
+    protobufjs: 'warns about a dependent pinned to another version scheme',
+    sharp: 'checks for its prebuilt binary, which comes in an @img/sharp-* package with no script',
+    'tesseract.js': 'prints an Open Collective notice',
+};
+const matches = (key, name) => key.endsWith('/*') ? name.startsWith(key.slice(0, -1)) : name === key;
+const nameOf = (id) => id.slice(0, id.lastIndexOf('@'));
+/** Where Node would find `name` from `from`: its node_modules, then each parent's. */
+function packageDir(name, from) {
+    for (let dir = from;; dir = path_1.default.dirname(dir)) {
+        const candidate = path_1.default.join(dir, 'node_modules', name, 'package.json');
+        if (fs_1.default.existsSync(candidate))
+            return path_1.default.dirname(candidate);
+        if (path_1.default.dirname(dir) === dir)
+            return undefined;
+    }
+}
+/**
+ * Every package Xenon runs with (its dependencies, theirs, and so on, as
+ * installed) that has an install script: `preinstall`, `install` or
+ * `postinstall`, or a `binding.gyp`, which npm builds with `node-gyp rebuild`
+ * when no script says otherwise. An optional dependency for another platform
+ * isn't installed, and is left out.
+ */
+function packagesWithInstallScripts() {
+    const found = new Map();
+    const seen = new Set();
+    const runtimeDeps = (pkg) => Object.keys(Object.assign(Object.assign({}, pkg.dependencies), pkg.optionalDependencies));
+    const queue = runtimeDeps(readJson(path_1.default.join(root, 'package.json'))).map((name) => ({
+        name,
+        from: root,
+    }));
+    for (let next = queue.shift(); next; next = queue.shift()) {
+        const { name, from } = next;
+        const dir = packageDir(name, from);
+        if (!dir || seen.has(dir))
+            continue;
+        seen.add(dir);
+        const pkg = readJson(path_1.default.join(dir, 'package.json'));
+        const scripts = ['preinstall', 'install', 'postinstall']
+            .filter((hook) => { var _a; return (_a = pkg.scripts) === null || _a === void 0 ? void 0 : _a[hook]; })
+            .map((hook) => `${hook}: ${pkg.scripts[hook]}`);
+        if (scripts.length === 0 && fs_1.default.existsSync(path_1.default.join(dir, 'binding.gyp'))) {
+            scripts.push('binding.gyp: node-gyp rebuild');
+        }
+        if (scripts.length > 0)
+            found.set(`${pkg.name}@${pkg.version}`, scripts.join(' | '));
+        queue.push(...runtimeDeps(pkg).map((dep) => ({ name: dep, from: dir })));
+    }
+    return found;
+}
+describe('install scripts in the runtime dependency tree', () => {
+    const found = packagesWithInstallScripts();
+    const keys = Object.keys(WORKS_WITHOUT_ITS_SCRIPT);
+    it('belong only to packages that work without them, since npm 12 skips them', () => {
+        const unexplained = [...found]
+            .filter(([id]) => !keys.some((key) => matches(key, nameOf(id))))
+            .map(([id, scripts]) => `${id} (${scripts})`);
+        (0, chai_1.expect)(unexplained).to.deep.equal([]);
+    });
+    it('name no package the tree no longer has', () => {
+        const names = [...found.keys()].map(nameOf);
+        const stale = keys.filter((key) => !names.some((name) => matches(key, name)));
+        (0, chai_1.expect)(stale).to.deep.equal([]);
+    });
+});