refactor(record): spread the request scope into manifest re-resolution and show it in the request log

The manifest lane hand-picked the scope and lease keys to forward; a key added
to ResolveDeviceFlags later would be dropped silently on this lane. Admission
(namesSessionWithoutTarget) already proves the request states no device, udid,
serial, platform, or target, so spreading its flags carries exactly the scope
and lease keys — now and later — while the manifest still decides family and
identity. This deletes LeaseDiscoveryContext, its key list, and the helper.

The resolve_target_device phase now echoes the requested udid and simulator
set when the request states them, so a manifest-first recovery is provable
from the request log alone (the maintainer's scoped-set evidence requirement).
Pinned: dropping the spread fails all three recovery scope pins; dropping
either echoed field fails the new phase test.

Author: thymikee

packages/daemon/src/core/device/device-selector-intent.ts

@@ -8,39 +8,6 @@ const LOCKABLE_DEVICE_SCOPE_KEYS: ReadonlyArray<keyof CommandFlags> = [
   'androidDeviceAllowlist',
 ];
 
-/**
- * Request-scoped lease and provider-discovery context. These say WHO may see which devices
- * (a lease or a provider client narrows the inventory the resolver can reach), never WHICH
- * device, so a lane that rebuilds a selector must forward them or resolution silently
- * widens outside the lease. `device-selector-intent` classifies selectors; this is the one
- * read that keeps that classification's non-identity discovery keys together.
- */
-export type LeaseDiscoveryContext = {
-  leaseId?: string;
-  leaseProvider?: string;
-  deviceKey?: string;
-  clientId?: string;
-};
-
-const LEASE_DISCOVERY_KEYS = [
-  'leaseId',
-  'leaseProvider',
-  'deviceKey',
-  'clientId',
-] as const satisfies ReadonlyArray<keyof LeaseDiscoveryContext & keyof CommandFlags>;
-
-export function leaseDiscoveryContextFromFlags(
-  flags: CommandFlags | undefined,
-): LeaseDiscoveryContext {
-  if (!flags) return {};
-  const context: Record<string, string> = {};
-  for (const key of LEASE_DISCOVERY_KEYS) {
-    const value = flags[key];
-    if (typeof value === 'string' && value.trim().length > 0) context[key] = value;
-  }
-  return context;
-}
-
 export function hasExplicitDeviceSelector(flags: CommandFlags | undefined): boolean {
   return hasExplicitDeviceIdentitySelector({
     deviceName: flags?.device,

packages/daemon/src/sessions/handlers/record-runtime.ts

@@ -29,10 +29,7 @@ import {
   resolveTargetDevice,
   type ResolveDeviceFlags,
 } from '@agent-device/device-selection/dispatch-resolve';
-import {
-  hasDeviceSelectionInput,
-  leaseDiscoveryContextFromFlags,
-} from '../../core/device/device-selector-intent.ts';
+import { hasDeviceSelectionInput } from '../../core/device/device-selector-intent.ts';
 import { ensureBoundDeviceReady } from '../../core/request-runtime-binding.ts';
 import { type ScreenRecordingAdmissionLedger } from '@agent-device/capture-kit/screen-recording-admission-ledger';
 import { createScreenRecordingRecoveryControl } from '@agent-device/capture-kit/screen-recording-recovery';
@@ -176,9 +173,10 @@ async function resolveRecordingSession(
  *
  * A request that names a session this daemon does not hold and states no device is answered from
  * the durable manifest the session address finds, never from a sweep of every device on the host:
- * a decodable manifest is re-resolved under the manifest's family (plus the request's host
- * scoping), and a start or a stop with no decodable manifest to recover from refuses with the
- * named-session error. `assertManifestBelongsToRequest` owns the proof that the resolved device
+ * a decodable manifest is re-resolved with the request's scope and lease keys under the manifest's
+ * family (admission proved the request states no device), and a start or a stop with no decodable
+ * manifest to recover from refuses with the named-session error.
+ * `assertManifestBelongsToRequest` owns the proof that the resolved device
  * and session address match the manifest.
  *
  * The two shapes that keep their chosen target are unchanged: a request that never named a
@@ -210,24 +208,20 @@ function namesSessionWithoutTarget(req: DaemonRequest): boolean {
 }
 
 /**
- * Re-resolves the device a durable manifest names: the manifest's family always, its identity flag
- * where the family has one, plus the request's host-scoping and lease/discovery selectors —
- * `iosSimulatorDeviceSet` and `androidDeviceAllowlist` say WHERE to look, the lease fields say WHO
- * may see the inventory, and none of them states WHICH device. Dropping any of them would resolve
- * a scoped or leased recording outside the scope or lease it started under. No request
- * device/identity selector reaches here: `assertManifestBelongsToRequest` proves the resolved
- * device against the manifest.
+ * Re-resolves the device a durable manifest names. Admission (`namesSessionWithoutTarget`) has
+ * already proven this request states no device, udid, serial, platform, or target, so spreading
+ * its flags carries exactly the scope and lease keys `ResolveDeviceFlags` declares — now and
+ * later — without carrying any device choice. The manifest then decides which device: family
+ * always, identity flag where the family has one. `assertManifestBelongsToRequest` proves the
+ * resolved device against the manifest.
  */
 async function resolveManifestDevice(
   params: RecordRuntimeHandlerParams,
   recorded: DeviceIdentity,
 ): Promise<DeviceInfo> {
-  const { iosSimulatorDeviceSet, androidDeviceAllowlist } = params.req.flags ?? {};
   const selector: ResolveDeviceFlags = {
+    ...(params.req.flags ?? {}),
     platform: recorded.family,
-    ...leaseDiscoveryContextFromFlags(params.req.flags),
-    ...(iosSimulatorDeviceSet === undefined ? {} : { iosSimulatorDeviceSet }),
-    ...(androidDeviceAllowlist === undefined ? {} : { androidDeviceAllowlist }),
   };
   const identityFlag = deviceIdentityFlag(recorded.family);
   if (identityFlag) selector[identityFlag] = recorded.id;

packages/device-selection/package.json

@@ -35,5 +35,8 @@
       "types": "./src/inventory-gateways.fixtures.ts",
       "default": "./src/inventory-gateways.fixtures.ts"
     }
+  },
+  "devDependencies": {
+    "@agent-device/test-kit": "workspace:*"
   }
 }

packages/device-selection/src/__tests__/dispatch-resolve.test.ts

@@ -1,5 +1,11 @@
 import { afterEach, beforeEach, test, vi } from 'vitest';
 import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import { mkdtempForTestSync } from '@agent-device/test-kit';
+import {
+  flushDiagnosticsToSessionFile,
+  withDiagnosticsScope,
+} from '@agent-device/host-kit/diagnostics';
 
 const mockFindIosSimulatorInstalledApp = vi.fn();
 const mockListAppleDevices = vi.fn();
@@ -599,6 +605,42 @@ test('resolveTargetDevice keeps simulator-set scope separate from the macOS host
   assert.equal(requests[1]?.iosSimulatorSetPath, undefined);
 });
 
+test('the resolve_target_device phase shows the requested udid and simulator set', async () => {
+  // Recovery lanes answer FROM the request log: a manifest-first stop must be provable from the
+  // phase line alone, so the requested identity and the set it was scoped to are echoed there.
+  const logDir = mkdtempForTestSync('dispatch-resolve-diag-');
+  const logPath = `${logDir}/requests.ndjson`;
+  await withTestDeviceInventory(
+    {
+      local: async () => [simulator],
+      findInstalledApp: mockFindIosSimulatorInstalledApp,
+    },
+    async () => {
+      await withDiagnosticsScope(
+        { session: 'qa', command: 'record', debug: true, logPath },
+        async () => {
+          await resolveTargetDeviceInContext({
+            platform: 'apple',
+            udid: simulator.id,
+            iosSimulatorDeviceSet: '/tmp/recovery-set',
+          });
+          flushDiagnosticsToSessionFile({ force: true });
+        },
+      );
+    },
+  );
+
+  const phases = fs
+    .readFileSync(logPath, 'utf8')
+    .split('\n')
+    .filter(Boolean)
+    .map((line) => JSON.parse(line) as { phase: string; data?: Record<string, unknown> })
+    .filter((entry) => entry.phase === 'resolve_target_device');
+  assert.equal(phases.length, 1);
+  assert.equal(phases[0]?.data?.udid, simulator.id);
+  assert.equal(phases[0]?.data?.iosSimulatorSetPath, '/tmp/recovery-set');
+});
+
 test('resolveTargetDevice discovers simulators in the daemon operator set when the request names none', async () => {
   vi.stubEnv('AGENT_DEVICE_IOS_SIMULATOR_DEVICE_SET', '/tmp/operator-set');
   const requests: DeviceInventoryRequest[] = [];

packages/device-selection/src/dispatch-resolve.ts

@@ -104,6 +104,11 @@ export async function resolveTargetDeviceSelection(
   const diagnosticData = {
     platform: inventoryRequest.platform,
     target: flags.target,
+    // The selector the resolution was asked for, echoed for recovery lanes whose whole job is
+    // re-resolving one stated device: which udid was requested and which simulator set was
+    // scoped must be visible in the request log without debug-only dumps.
+    ...(inventoryRequest.udid ? { udid: inventoryRequest.udid } : {}),
+    ...(iosSimulatorSetPath ? { iosSimulatorSetPath } : {}),
     cacheHit: false,
   };
   return await withDiagnosticTimer(

packages/device-selection/tsconfig.json

@@ -10,5 +10,18 @@
     "tsBuildInfoFile": "./dist-types/index.tsbuildinfo"
   },
   "include": ["src"],
-  "references": [{ "path": "../contracts" }, { "path": "../host-kit" }, { "path": "../kernel" }]
+  "references": [
+    {
+      "path": "../contracts"
+    },
+    {
+      "path": "../host-kit"
+    },
+    {
+      "path": "../kernel"
+    },
+    {
+      "path": "../test-kit"
+    }
+  ]
 }