simlock simctl and simlock adb on a worker run only against the caller's lease, and fill the device in #948

Problem

On a worker, simlock simctl <args> and simlock adb <args> are not tied to the caller's lease. driver.passthrough has no authorization beyond the agent role (src/contract/operations.ts, driverPassthrough), the dispatcher resolves the command with only the tool and arguments (src/daemon/dispatcher.ts, #driverPassthrough), and the CLI spawns whatever comes back. Any UDID or serial on the command line runs, held or not. Through a gateway the same command goes through device.exec, which refuses without a lease (#deviceExec, UnknownLeaseError). --lease on a worker is "accepted and ignored" (working-with-a-device.mdx). The docs' own list of product gaps from the website rewrite (commit daa279ada) names this.

Two things follow from scoping the wrappers to the lease:

1. Enforcement of the one promise Simlock makes. simlock simctl install <other agent's UDID> … is refused with a message naming the caller's own device. booted and an adb call without -s are refused when the caller holds a lease, since they can reach another agent's device on the shared set or server. This is still an accident boundary: xcrun simctl stays reachable. It closes the case where an agent follows the rule "use simlock simctl" and still hits the wrong device because it copied the wrong id.

2. Less for the agent to carry. When the caller holds exactly one lease, the device argument can be filled in: simlock simctl install ./MyApp.app and simlock adb install app-debug.apk run against the caller's device. With several leases, --lease <id> picks one, as on a gateway today. The agent no longer copies the UDID out of the grant JSON into every command, and the instructions text shrinks.

Context

Found in the 2026-10-23 product review. The maintainer agreed to pursue it.

Facts for the spec session:

• The caller's identity on the socket is the requester (SIMLOCK_AGENT_ID, the Claude Code or Codex session id, else the pid). Leases are found by requester, as heldForAnother in the agent-device front already does with lease.list.
• The admin role bypasses ownsLease today. Whether an operator at the terminal keeps unscoped passthrough (likely yes, with --lease optional) is a decision.
• Where the device argument sits differs per tool: simctl <verb> <udid> … for most verbs, adb -s <serial> before the verb, devicectl --device <udid>. The drivers already know their refusal lists per verb and can own the insertion rule.
• --export-env and the grant environment carry no device identifier for virtual devices; filling the argument in removes most of the need (simlock run holds a lease around one command, and a detached lease follows the agent process #944 covers the environment side).
• Tests pin today's behaviour that a worker's passthrough takes no lease; they change with this.

Written by an agent.