[thymikee]

Summary

• Every remote device lease the CLI holds (proxy, cloud device such as Limrun and Revyl, cloud WebDriver) now requests one idle TTL of five minutes, REMOTE_LEASE_IDLE_TTL_MS in contracts/lease-scope. Before, Limrun and Revyl fell to the 60 s daemon default, so a session ended one minute after the last command. WebDriver moves from 10 to 5 minutes.
• One remoteLeaseTtlMs rule replaces the per-policy TTLs; the duplicate WebDriver policy and constant are deleted. The daemon is untouched.
• Limrun's API default inactivity timeout is 3 minutes, which ended instances before their lease. Created instances now request inactivityTimeout: 5m. Attached instances are unchanged. LIMRUN_KEEP_ALIVE stays opt-in.
• New validated optional capability holdsCloudDevice keeps local TV providers on the daemon default.
• Docs: limrun.md, plugins.md, ADR 0007. Found while validating feat(apple): serve the Simulator AX bridge from the XCTest runner #4182.

Validation

• SHA: ec358341f19eb7b5fd8b5c77fea039eb882efacf. check:affected passed, exactCommit=true, receipt .tmp/validation/run-GzfvWF/receipt.json.
• Tests: a policy table per provider kind, and the create body carries 5m on iOS and Android.
• Live Limrun iOS: before, LEASE_EXPIRED 62 s after the last command. After, without keep-alive, a 270 s idle gap survives and the next snapshot succeeds. The Limrun API reads inactivityTimeout 5m0s on that instance. With keep-alive, gaps of 120 s and 270 s survive.
• Revyl is not run live: it needs a public app build URL. It rests on the shared policy and declaration tests.

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	5.86 MB	5.86 MB	+428 B
Package (unpacked)	5.86 MB	5.86 MB	+428 B
Package (download)	1.78 MB	1.78 MB	+217 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	29.1 ms	25.6 ms	-3.6 ms
CLI --help	52.9 ms	54.3 ms	+1.4 ms

[cubic-dev-ai]

All reported issues were addressed across 11 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[apex-sentinel-staging]

Apex Sentinel

Verdict: approve

Since the last review: 3 new · 0 still open · 1 no longer raised

3 finding(s): 3 minor. Verdict: approve.

🟡 Minor (3)

Where	Finding
packages/provider-limrun/src/session-allocation.ts:19	🆕 Created Limrun instances no longer outlive their lease: the inactivity timeout is set equal to it, not above it
src/cli/commands/connection-lease-policy.ts:21	🆕 Cloud-device and holdsCloudDevice providers now always request 5m, so a daemon with a lower AGENT_DEVICE_LEASE_MAX_TTL_MS fails every lease-using command
src/cli/commands/connection-lease-policy.ts:21	🆕 A CLI heartbeat now overwrites a longer externally-allocated lease TTL with five minutes

3 findings below minor not shown (user_settings.min_severity).

Reply under an inline comment with @apex-sentinel-staging note ... or @apex-sentinel-staging pivot ... to re-check that finding.
Comment @apex-sentinel-staging review on this conversation to run a full review.

Earlier reviews

Review of 03b6e24e · 04.11.2026 18:29 UTC

Apex Sentinel

Verdict: approve

Since the last review: 1 new · 0 still open · 3 no longer raised

1 finding(s): 1 minor. Verdict: approve.

🟡 Minor (1)

Where	Finding
packages/daemon/src/resources/lease-registry-scope.ts:115	🆕 Daemon grants the cloud-TTL ceiling exemption by matching a magic number, not a cloud lease

2 findings below minor not shown (user_settings.min_severity).

Review of edc1a9aa · 04.11.2026 17:57 UTC

Apex Sentinel

Verdict: approve

3 finding(s): 3 minor. Verdict: approve.

🟡 Minor (3)

Where	Finding
packages/contracts/src/provider-connection.ts:29	holdsCloudDevice bypasses plugin capability validation and is read by truthiness
src/cli/commands/connection-lease-policy.ts:21	New cloud lease TTL silently equals the daemon's hard MAX_LEASE_TTL_MS ceiling
src/cli/commands/connection-lease-policy.ts:97	holdsCloudDevice is documented as the switch for the 10-minute renewal, but the cloud WebDriver policy renews regardless of it

[apex-sentinel-staging]

Apex Sentinel: 3 new findings on edc1a9a. The verdict and the full list are in the summary comment.

[cubic-dev-ai]

All reported issues were addressed across 11 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[apex-sentinel-staging]

Apex Sentinel: 1 new finding on 03b6e24. The verdict and the full list are in the summary comment.

[thymikee]

At 03b6e24, the lease change has no correctness problem. The live Limrun results in the PR body match the code, and the new tests cover the 10 minute request. There are no conflicts. The Coverage job log I could see stops at the macOS helper build and shows no failing test, so I cannot say yet whether that job passes. The full log or a rerun will settle it.

Not blocking, and you can take or leave these: CLOUD_WEBDRIVER_CONNECTION_LEASE_POLICY is now identical to DEFAULT_CONNECTION_LEASE_POLICY (connection-lease-policy.ts), so the usesCloudWebDriverLease branch and the constant can go. Also, the live evidence is Limrun iOS only, and it uses a different policy from Revyl (provider-revyl). Either cite one Revyl run with a gap over 60 s and a second command on the same lease with no LEASE_EXPIRED, or say in the PR body that Revyl rests on the shared policy and the declaration tests.

One design question: could we drop the number-keyed carve-out in createLeaseTtlResolver and the CLOUD_DEVICE_LEASE_TTL_MS import in the daemon? A cloud lease would then act like the WebDriver cloud providers did before this PR. A daemon with AGENT_DEVICE_LEASE_MAX_TTL_MS under 10 minutes would refuse the request with the existing INVALID_ARGS message, which names the ceiling, and plugins.md could say that such a daemon needs a matching lower value. If a lowered ceiling with Limrun or Revyl is a supported setup, the rule should be explicit and not keyed on 600000. Either clamp every over-ceiling request to the ceiling (and update the INVALID_ARGS test), or add a typed request field from the CLI that states the clamp intent. Please decide first whether a daemon ceiling below 10 minutes is supported for these providers.

The open inline threads on the 600000 match in lease-registry-scope.ts and the same match still apply, and one fix closes both. The impact is narrow, because it grants less and not more.

Before merge, please settle the daemon ceiling rule, delete the duplicate policy constant, and get the full Coverage log or a rerun.

[apex-sentinel-staging]

Apex Sentinel: 1 new finding on ec35834. The verdict and the full list are in the summary comment.

[thymikee]

At ec35834, the code looks good. The daemon carve-out and the magic-number exemption from the earlier review are gone, so every remote lease takes its TTL from one five-minute rule in the CLI connection policy. CI is green (22 checks) and there are no conflicts.

Not blocking, take or leave: the JSDoc at session-allocation.ts:19 says the instance "outlives" the lease's idle window, but the value equals it; "the same window as the lease, so Limrun's 3 minute default never ends an instance before its lease" would be exact. The ${REMOTE_LEASE_IDLE_TTL_MS / 60_000}m template would also produce 2.5m if the constant stopped being whole minutes, so seconds may be safer if the API accepts them.

The two open inline threads (lease shortening, keep-alive comment) are non-blocking wording notes. The earlier threads about the daemon carve-out, the magic-number exemption and the 10 minute ceiling no longer apply and can be resolved.

Evidence: the live Limrun iOS numbers in the PR body (62 s expiry before, 270 s survival after) match the code. Revyl and cloud WebDriver were not run live, and Node client or MCP leases without a connection policy keep the 60 s daemon default, which fits the PR scope.