* fix(daemon): let admitted work keep the lease it is working on
A lease renewed only at admission, so a command slower than its own inactivity TTL
expired the lease that was paying for the device it was using. Expiry then tore the
provider session down underneath a client still waiting for that same command's
result, and every later command on the session reported a lease that was no longer
active. The session's own work was the thing that killed it.
Admitted work now preserves its lease the way a human-control hold does: while the
request is still wanted it defers expiry, and finishing while still wanted renews
the lease for its existing TTL from the moment the work ended. Work whose client
hung up preserves nothing — it neither defers expiry past that cancellation nor
renews the lease when it finally lands — so a handler that ignores its cancellation
cannot hold a rented device open.
Found while investigating #2509. Not its reported mechanism: a cloud WebDriver
connection profile asks for a ten-minute lease, so a one-minute hang cannot starve
it. This reaches leases on the daemon's one-minute default.
* fix(daemon): drop a released lease's work claims instead of leaving them empty
A completed pass emptied its set but left the key behind, and only the expiry sweep
removed keys — which never reads a released lease again. Every connect-and-close that
ran a command on a leased device left another permanent entry in the daemon.
Releasing the last pass now removes its lease's entry, and releasing the lease drops
its claims outright and disarms the passes still running on them, so work that
outlives its own lease renews nothing.
* docs(daemon): state the lease invariant without borrowing #2509's cause
Four comments told the report's story as though it were this mechanism. A cloud
WebDriver connection profile asks for a ten-minute lease, so the reported one-minute
hang cannot have expired anything. The invariant stands on its own; where it came from
and which leases it reaches belong in ADR 0007 and the commit, not in each test.
* feat: add integrated device leasing
* fix: keep metro bearer token out of generated proxy profile
The proxy connect profile is written to disk as a non-secret remote config,
but it unconditionally copied `metroBearerToken` into that file, leaking the
secret at rest. Mirror the cloud path, which keeps `daemonAuthToken` in-memory
only: the token still flows through this connect via the returned flags, and
later commands re-supply it via AGENT_DEVICE_METRO_BEARER_TOKEN. Extend the
non-secret-profile test to assert the bearer token is absent from disk.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VPa5Z9GBkeqoxVctC85N7e
* fix: always release device lease on session close
releaseSessionLease + sessionStore.delete ran only on the happy path, after
several awaits (app-log/perf/snapshot teardown, platform close dispatch,
runner stop) that can throw. A failed close therefore stranded the device
lease until the inactivity expiry. Wrap teardown in try/finally so ownership
is always freed; the original error still propagates after finally.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VPa5Z9GBkeqoxVctC85N7e
* fix: reconcile integrated device leasing
* docs: simplify remote lease guidance
* refactor: satisfy leasing fallow checks
* fix: harden integrated device leasing
* refactor: deepen device lease lifecycle
* refactor: centralize lease scope projection
* fix: harden proxy lease e2e flow
* fix: address lease review feedback
* refactor: tighten lease release cleanup
* fix: simplify proxy startup output
* fix: harden cloud lease identity
* fix: color proxy startup output
* fix: simplify proxy tunnel placeholder
---------
Co-authored-by: Claude <noreply@anthropic.com>
Michał Pierzchała