@livedesk/client 0.1.215 → 0.1.217

package/bin/livedesk-client-update-bootstrap.cjs

@@ -0,0 +1,59 @@
+const { execFile, spawn } = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
+const bootstrapPath = String(process.env.LIVEDESK_CLIENT_UPDATE_BOOTSTRAP_PATH || "").trim(); if (bootstrapPath) { try { fs.rmSync(bootstrapPath, { force: true }); } catch {} }
+const operationId = String(process.env.LIVEDESK_CLIENT_UPDATE_OPERATION_ID || "").trim();
+const originalCwd = path.resolve(String(process.env.LIVEDESK_UPDATE_ORIGINAL_CWD || process.cwd()));
+const statePath = path.resolve(originalCwd, String(process.env.LIVEDESK_CLIENT_UPDATE_STATE_PATH || path.join(require("node:os").homedir(), ".livedesk", "client-update.json")));
+const neutralCwdValue = String(process.env.LIVEDESK_UPDATE_NEUTRAL_CWD || "").trim();
+const neutralCwd = neutralCwdValue ? path.resolve(neutralCwdValue) : "";
+const cleanVersion = value => String(value || "").trim().replace(/^v/i, "");
+const targetProductVersion = cleanVersion(process.env.LIVEDESK_CLIENT_UPDATE_TARGET_PRODUCT_VERSION || process.env.LIVEDESK_CLIENT_UPDATE_TARGET_VERSION);
+const updateDeadlineEpochMs = Number(process.env.LIVEDESK_CLIENT_UPDATE_DEADLINE_EPOCH_MS || 0);
+const deadlineExpired = () => !Number.isSafeInteger(updateDeadlineEpochMs) || Date.now() >= updateDeadlineEpochMs;
+const versionPattern = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const readState = () => { try { return JSON.parse(fs.readFileSync(statePath, "utf8")); } catch { return {}; } };
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+const isAlive = pid => { try { process.kill(pid, 0); return true; } catch (error) { return error?.code === "EPERM"; } };
+const isGroupAlive = pid => { try { process.kill(-pid, 0); return true; } catch (error) { return error?.code === "EPERM"; } };
+const WINDOWS_PROCESS_VERIFY_MAX_CIM_QUERIES = 4; const WINDOWS_PROCESS_VERIFY_MAX_POWERSHELL_SPAWNS = 4; const WINDOWS_PROCESS_VERIFY_TIMEOUT_MS = 4000; const WINDOWS_PROCESS_VERIFY_MAX_TOTAL_CIM_MS = 8000; const WINDOWS_PROCESS_VERIFY_MAX_CPU_MS = 2000; const WINDOWS_PROCESS_VERIFY_MAX_RSS_BYTES = 256 * 1024 * 1024; const WINDOWS_PROCESS_VERIFY_MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
+const windowsProcessVerification = { powerShellSpawnCount: 0, activePowerShellChildren: 0, maximumConcurrentPowerShellChildren: 0, powerShellResourceEvidenceCount: 0, powerShellResourceEvidenceMissingCount: 0, cimQueryCount: 0, activeCimQueries: 0, cimTotalDurationMs: 0, maximumCimProviderDurationMs: 0, totalPowerShellCpuMs: 0, maximumPowerShellCpuMs: 0, maximumPowerShellRssBytes: 0, activeVerificationWatchdogTimers: 0, stateReadCount: 0, stateWatchEventCount: 0, activeStateWatchers: 0, activeStateFallbackTimers: 0, cleanupCompletedCount: 0, cleanupFailureCount: 0, cleanupBlockedCount: 0, forcedCleanupProofFailureCount: 0, failClosedOwnershipHeld: false, failClosedOwnershipTimerCount: 0, terminalZeroProved: false, blockedExactIdentityCount: 0, blockedExactIdentities: [], directChildKillAttempted: false, directChildExitProved: false };
+const assertWindowsVerificationBudget = () => { if (windowsProcessVerification.powerShellSpawnCount > WINDOWS_PROCESS_VERIFY_MAX_POWERSHELL_SPAWNS) throw new Error("Windows update cleanup exceeded its total PowerShell spawn budget."); if (windowsProcessVerification.cimQueryCount > WINDOWS_PROCESS_VERIFY_MAX_CIM_QUERIES) throw new Error("Windows update cleanup exceeded its total CIM query budget."); if (windowsProcessVerification.cimTotalDurationMs > WINDOWS_PROCESS_VERIFY_MAX_TOTAL_CIM_MS) throw new Error("Windows update cleanup exceeded its total CIM duration budget."); if (windowsProcessVerification.powerShellResourceEvidenceMissingCount !== 0 || windowsProcessVerification.powerShellResourceEvidenceCount !== windowsProcessVerification.powerShellSpawnCount) throw new Error("Windows update cleanup has unknown PowerShell resource evidence."); if (windowsProcessVerification.totalPowerShellCpuMs > WINDOWS_PROCESS_VERIFY_MAX_CPU_MS * WINDOWS_PROCESS_VERIFY_MAX_POWERSHELL_SPAWNS) throw new Error("Windows update cleanup exceeded its cumulative PowerShell CPU budget."); if (windowsProcessVerification.maximumPowerShellCpuMs > WINDOWS_PROCESS_VERIFY_MAX_CPU_MS) throw new Error("Windows update cleanup exceeded its per-process PowerShell CPU budget."); if (windowsProcessVerification.maximumPowerShellRssBytes > WINDOWS_PROCESS_VERIFY_MAX_RSS_BYTES) throw new Error("Windows update cleanup exceeded its PowerShell peak RSS budget."); };
+const writeWindowsVerificationEvidence = (outcome, child = null) => { const evidencePath = String(process.env.LIVEDESK_CLIENT_UPDATE_PROCESS_EVIDENCE_PATH || "").trim(); if (!evidencePath) return; try { const evidence = { outcome, platform: process.platform, budgets: { maximumCimQueries: WINDOWS_PROCESS_VERIFY_MAX_CIM_QUERIES, maximumPowerShellSpawns: WINDOWS_PROCESS_VERIFY_MAX_POWERSHELL_SPAWNS, maximumCimDurationMs: WINDOWS_PROCESS_VERIFY_MAX_TOTAL_CIM_MS, maximumPowerShellCpuMs: WINDOWS_PROCESS_VERIFY_MAX_CPU_MS, maximumPowerShellRssBytes: WINDOWS_PROCESS_VERIFY_MAX_RSS_BYTES, maximumTotalPowerShellCpuMs: WINDOWS_PROCESS_VERIFY_MAX_CPU_MS * WINDOWS_PROCESS_VERIFY_MAX_POWERSHELL_SPAWNS, scope: "whole-cleanup-operation" }, ...windowsProcessVerification, terminalSnapshotPromise: Boolean(child?.livedeskWindowsSnapshotPromise), terminalDrainPromise: Boolean(child?.livedeskWindowsDrainPromise), terminalTrackingTimer: false }; const temporary = evidencePath + "." + process.pid + ".tmp"; fs.mkdirSync(path.dirname(evidencePath), { recursive: true }); fs.writeFileSync(temporary, JSON.stringify(evidence, null, 2), { encoding: "utf8", mode: 0o600 }); fs.renameSync(temporary, evidencePath); } catch {} };
+const encodePowerShellCommand = value => Buffer.from(String(value || ""), "utf16le").toString("base64");
+const spawnCapturedWindowsPowerShell = command => { const child = spawn("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-EncodedCommand", encodePowerShellCommand(command)], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] }); windowsProcessVerification.powerShellSpawnCount += 1; windowsProcessVerification.activePowerShellChildren += 1; windowsProcessVerification.maximumConcurrentPowerShellChildren = Math.max(windowsProcessVerification.maximumConcurrentPowerShellChildren, windowsProcessVerification.activePowerShellChildren); let stdoutBytes = 0; let stderrBytes = 0; let stdout = ""; let stderr = ""; let outputOverflow = false; const append = (chunk, isError) => { const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk); const previous = isError ? stderrBytes : stdoutBytes; const remaining = Math.max(0, WINDOWS_PROCESS_VERIFY_MAX_OUTPUT_BYTES - previous); if (buffer.length > remaining) outputOverflow = true; const retained = remaining > 0 ? buffer.subarray(0, remaining).toString("utf8") : ""; if (isError) { stderrBytes += buffer.length; stderr += retained; } else { stdoutBytes += buffer.length; stdout += retained; } }; child.stdout?.on("data", chunk => append(chunk, false)); child.stderr?.on("data", chunk => append(chunk, true)); const completion = new Promise(resolve => { let settled = false; const finish = (code, signal, error) => { if (settled) return; settled = true; windowsProcessVerification.activePowerShellChildren -= 1; resolve({ code, signal, error, stdout, stderr, outputOverflow }); }; child.once("error", error => finish(null, null, error)); child.once("close", (code, signal) => finish(code, signal, null)); }); return { child, completion }; };
+const runWindowsPowerShell = async (script, kind = "control") => { if (windowsProcessVerification.powerShellSpawnCount + 1 > WINDOWS_PROCESS_VERIFY_MAX_POWERSHELL_SPAWNS) throw new Error("Windows update cleanup exhausted its measured PowerShell spawn budget."); if (kind === "cim" && windowsProcessVerification.cimQueryCount >= WINDOWS_PROCESS_VERIFY_MAX_CIM_QUERIES) throw new Error("Windows update cleanup exhausted its CIM query budget."); const remainingCimDurationMs = WINDOWS_PROCESS_VERIFY_MAX_TOTAL_CIM_MS - windowsProcessVerification.cimTotalDurationMs; if (kind === "cim" && remainingCimDurationMs <= 0) throw new Error("Windows update cleanup exhausted its cumulative CIM duration budget."); const timeoutMs = kind === "cim" ? Math.max(1, Math.min(WINDOWS_PROCESS_VERIFY_TIMEOUT_MS, Math.ceil(remainingCimDurationMs))) : WINDOWS_PROCESS_VERIFY_TIMEOUT_MS; const startedAtMs = Date.now(); if (kind === "cim") { windowsProcessVerification.cimQueryCount += 1; windowsProcessVerification.activeCimQueries += 1; } const action = Buffer.from(String(script || ""), "utf16le").toString("base64"); const wrapper = `$ErrorActionPreference = "Stop"; $result = [ordered]@{ EvidenceAvailable = $false; ProcessId = [int]$PID; StartOrder = ""; CpuMs = $null; PeakRssBytes = $null; Ok = $false; Output = ""; ActionError = "" }; $self = [Diagnostics.Process]::GetCurrentProcess(); try { $rawStartTicks = [long]$self.StartTime.ToUniversalTime().Ticks; $result.StartOrder = [string]($rawStartTicks - ($rawStartTicks % 10000)); $actionText = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String("${action}")); $actionOutput = & ([ScriptBlock]::Create($actionText)) | Out-String; $result.Output = [string]$actionOutput.TrimEnd(); $result.Ok = $true } catch { $result.ActionError = $_.Exception.Message } finally { try { $self.Refresh(); $result.CpuMs = [double]$self.TotalProcessorTime.TotalMilliseconds; $result.PeakRssBytes = [double]$self.PeakWorkingSet64; $result.EvidenceAvailable = $true } catch { if (-not $result.ActionError) { $result.ActionError = $_.Exception.Message } }; $result | ConvertTo-Json -Compress }`; let owner = null; let watchdog = null; let watchdogExpired = false; let completion = null; try { owner = spawnCapturedWindowsPowerShell(wrapper); windowsProcessVerification.activeVerificationWatchdogTimers += 1; watchdog = setTimeout(() => { watchdogExpired = true; try { owner?.child.kill("SIGKILL"); } catch {} }, timeoutMs); completion = await owner.completion; } finally { if (watchdog) { clearTimeout(watchdog); watchdog = null; windowsProcessVerification.activeVerificationWatchdogTimers -= 1; } if (owner?.child.exitCode === null && owner?.child.signalCode === null) { try { owner.child.kill("SIGKILL"); } catch {} } if (owner) await owner.completion; if (kind === "cim") { windowsProcessVerification.activeCimQueries -= 1; const elapsedCimMs = Math.max(0, Date.now() - startedAtMs); windowsProcessVerification.cimTotalDurationMs += elapsedCimMs; } } let envelope = null; try { envelope = JSON.parse(String(completion?.stdout || "").trim()); } catch {} const cpuMs = Number(envelope?.CpuMs); const peakRssBytes = Number(envelope?.PeakRssBytes); const exactResourceEvidence = envelope?.EvidenceAvailable === true && Number(envelope?.ProcessId) === Number(owner?.child.pid) && /^\d+$/.test(String(envelope?.StartOrder || "")) && Number.isFinite(cpuMs) && cpuMs >= 0 && Number.isFinite(peakRssBytes) && peakRssBytes > 0; if (!exactResourceEvidence) { windowsProcessVerification.powerShellResourceEvidenceMissingCount += 1; throw new Error("Windows PowerShell returned unknown exact-identity CPU/RSS evidence."); } windowsProcessVerification.powerShellResourceEvidenceCount += 1; windowsProcessVerification.totalPowerShellCpuMs += cpuMs; windowsProcessVerification.maximumPowerShellCpuMs = Math.max(windowsProcessVerification.maximumPowerShellCpuMs, cpuMs); windowsProcessVerification.maximumPowerShellRssBytes = Math.max(windowsProcessVerification.maximumPowerShellRssBytes, peakRssBytes); assertWindowsVerificationBudget(); if (watchdogExpired) throw new Error("Windows PowerShell child exceeded its exact timeout."); if (completion?.outputOverflow) throw new Error("Windows PowerShell output exceeded its bounded buffer."); if (completion?.error || Number(completion?.code) !== 0) throw new Error(String(completion?.stderr || completion?.error?.message || "PowerShell failed without a complete resource envelope.").trim()); if (envelope.Ok !== true || envelope.ActionError) throw new Error(String(envelope.ActionError || "PowerShell action failed.").trim()); return String(envelope.Output || "").trim(); };
+const queryWindowsProcessTable = async () => { const stdout = await runWindowsPowerShell(`$ErrorActionPreference = "Stop"; $watch = [Diagnostics.Stopwatch]::StartNew(); $records = @(Get-CimInstance Win32_Process -Property ProcessId,ParentProcessId,CreationDate | ForEach-Object { if ($_.CreationDate) { $rawTicks = [long]$_.CreationDate.ToUniversalTime().Ticks; [pscustomobject]@{ ProcessId = [int]$_.ProcessId; ParentProcessId = [int]$_.ParentProcessId; CreationUtcTicks = [string]($rawTicks - ($rawTicks % 10000)) } } }); $watch.Stop(); [pscustomobject]@{ Records = $records; CimDurationMs = [double]$watch.Elapsed.TotalMilliseconds } | ConvertTo-Json -Compress -Depth 4`, "cim"); if (!stdout) throw new Error("Windows process snapshot returned no data"); const parsed = JSON.parse(stdout); const cimDurationMs = Number(parsed?.CimDurationMs); if (!Number.isFinite(cimDurationMs) || cimDurationMs < 0) throw new Error("Windows process snapshot omitted bounded CIM evidence."); windowsProcessVerification.maximumCimProviderDurationMs = Math.max(windowsProcessVerification.maximumCimProviderDurationMs, cimDurationMs); assertWindowsVerificationBudget(); const values = parsed?.Records == null ? [] : (Array.isArray(parsed.Records) ? parsed.Records : [parsed.Records]); return values.map(item => ({ pid: Number(item?.ProcessId || 0), parentPid: Number(item?.ParentProcessId || 0), startOrder: String(item?.CreationUtcTicks || "") })).filter(item => Number.isInteger(item.pid) && item.pid > 1 && /^\d+$/.test(item.startOrder)); };
+const queryTrackedWindowsProcessTable = child => { if (child.livedeskWindowsSnapshotPromise) return child.livedeskWindowsSnapshotPromise; const pending = queryWindowsProcessTable(); child.livedeskWindowsSnapshotPromise = pending; const clear = () => { if (child.livedeskWindowsSnapshotPromise === pending) child.livedeskWindowsSnapshotPromise = null; }; pending.then(clear, clear); return pending; };
+const sameWindowsIdentity = (left, right) => Number(left?.pid || 0) === Number(right?.pid || 0) && String(left?.startOrder || "") === String(right?.startOrder || "");
+const windowsTicksAtMilliseconds = value => BigInt(Math.trunc(Number(value) || Date.now())) * 10000n + 621355968000000000n;
+const setWindowsRootLifetimeEnd = (child, ticks) => { const candidate = BigInt(ticks); const previous = child.livedeskWindowsRootLifetimeEndTicks; if (!previous || candidate < BigInt(previous)) child.livedeskWindowsRootLifetimeEndTicks = String(candidate); return BigInt(child.livedeskWindowsRootLifetimeEndTicks); };
+const mergeRootAbsentWindowsTree = (child, rootPid, snapshot) => { const tracked = child.livedeskWindowsTrackedRecords || (child.livedeskWindowsTrackedRecords = new Map()); const currentByPid = new Map(snapshot.map(item => [item.pid, item])); const exactCurrentByPid = new Map(); for (const record of tracked.values()) { const current = currentByPid.get(record.pid); if (sameWindowsIdentity(current, record)) exactCurrentByPid.set(record.pid, record); } const lowerBound = windowsTicksAtMilliseconds(Number(child.livedeskWindowsSpawnedAtMs || Date.now()) - 2000); const upperBound = child.livedeskWindowsRootLifetimeEndTicks ? BigInt(child.livedeskWindowsRootLifetimeEndTicks) : null; let changed = true; while (changed) { changed = false; for (const record of snapshot) { const key = `${record.pid}:${record.startOrder}`; if (record.pid === rootPid || tracked.has(key)) continue; let recordStart; try { recordStart = BigInt(record.startOrder); if (recordStart < lowerBound || (upperBound && recordStart > upperBound)) continue; } catch { continue; } const parent = record.parentPid === rootPid ? { depth: 0 } : exactCurrentByPid.get(record.parentPid); if (!parent) continue; const descendant = { ...record, depth: Number(parent.depth || 0) + 1 }; tracked.set(key, descendant); exactCurrentByPid.set(descendant.pid, descendant); changed = true; } } return tracked; };
+const mergeExactWindowsTree = (child, root, snapshot) => { const tracked = child.livedeskWindowsTrackedRecords || (child.livedeskWindowsTrackedRecords = new Map()); const currentByPid = new Map(snapshot.map(item => [item.pid, item])); const currentRoot = currentByPid.get(root.pid) || null; const rootIsExact = sameWindowsIdentity(currentRoot, root); const rootWasReused = Boolean(currentRoot && !rootIsExact); if (rootWasReused) setWindowsRootLifetimeEnd(child, BigInt(currentRoot.startOrder) - 1n); else if (!currentRoot && child.livedeskWindowsRootExitedAtMs) setWindowsRootLifetimeEnd(child, windowsTicksAtMilliseconds(child.livedeskWindowsRootExitedAtMs)); const rootLifetimeClosed = Boolean(child.livedeskWindowsRootLifetimeEndTicks); if (rootIsExact) tracked.set(`${root.pid}:${root.startOrder}`, { ...root, depth: 0 }); const exactCurrentByPid = new Map(); if (rootIsExact) exactCurrentByPid.set(root.pid, { ...root, depth: 0 }); for (const record of tracked.values()) { const current = currentByPid.get(record.pid); if (sameWindowsIdentity(current, record)) exactCurrentByPid.set(record.pid, record); } let changed = true; while (changed) { changed = false; for (const record of snapshot) { const key = `${record.pid}:${record.startOrder}`; if (record.pid === root.pid || tracked.has(key)) continue; let recordStart; try { recordStart = BigInt(record.startOrder); if (recordStart < BigInt(root.startOrder)) continue; if (rootLifetimeClosed && recordStart > BigInt(child.livedeskWindowsRootLifetimeEndTicks)) continue; } catch { continue; } let parent = exactCurrentByPid.get(record.parentPid) || null; if (!parent && !currentRoot && rootLifetimeClosed && record.parentPid === root.pid) parent = { ...root, depth: 0 }; if (!parent) continue; const descendant = { ...record, depth: Number(parent.depth || 0) + 1 }; tracked.set(key, descendant); exactCurrentByPid.set(descendant.pid, descendant); changed = true; } } return tracked; };
+const refreshTrackedWindowsTree = async (child, state = readState()) => { const snapshot = await queryTrackedWindowsProcessTable(child); const lowerBound = windowsTicksAtMilliseconds(Number(child.livedeskWindowsSpawnedAtMs || Date.now()) - 2000); const upperBound = child.livedeskWindowsRootLifetimeEndTicks ? BigInt(child.livedeskWindowsRootLifetimeEndTicks) : null; const currentByPid = new Map(snapshot.map(item => [item.pid, item])); const seedPids = new Set([Number(child.pid || 0), Number(state?.supervisorPid || 0)].filter(pid => Number.isInteger(pid) && pid > 1)); for (const seedPid of seedPids) { const seed = currentByPid.get(seedPid); if (!seed) continue; let seedStart; try { seedStart = BigInt(seed.startOrder); } catch { continue; } if (seedStart < lowerBound || (upperBound && seedStart > upperBound)) continue; mergeExactWindowsTree(child, seed, snapshot); } mergeRootAbsentWindowsTree(child, Number(child.pid || 0), snapshot); return snapshot; };
+const stopExactWindowsRecords = async records => { if (!Array.isArray(records) || records.length === 0) return false; const encoded = Buffer.from(JSON.stringify(records.map(record => ({ pid: record.pid, startOrder: record.startOrder }))), "utf8").toString("base64"); const script = `$ErrorActionPreference = "Stop"; $targetsJson = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("${encoded}")); $targets = @(ConvertFrom-Json -InputObject $targetsJson); $failures = [System.Collections.Generic.List[string]]::new(); foreach ($item in $targets) { $targetPid = [int]$item.pid; $expectedStartTicks = [string]$item.startOrder; try { $target = Get-Process -Id $targetPid -ErrorAction SilentlyContinue | Select-Object -First 1; if (-not $target) { continue }; $rawTicks = [long]$target.StartTime.ToUniversalTime().Ticks; $targetStartTicks = [string]($rawTicks - ($rawTicks % 10000)); if ($targetStartTicks -ne $expectedStartTicks) { continue }; Stop-Process -Id $targetPid -Force -ErrorAction Stop; try { [void]$target.WaitForExit(750) } catch {} } catch { $failures.Add("pid=$targetPid $($_.Exception.Message)") } }; $verifiedAbsent = 0; foreach ($item in $targets) { $targetPid = [int]$item.pid; $expectedStartTicks = [string]$item.startOrder; try { $current = Get-Process -Id $targetPid -ErrorAction SilentlyContinue | Select-Object -First 1; if ($current) { $rawTicks = [long]$current.StartTime.ToUniversalTime().Ticks; $currentStartTicks = [string]($rawTicks - ($rawTicks % 10000)); if ($currentStartTicks -eq $expectedStartTicks) { $failures.Add("pid=$targetPid exact identity survived Stop-Process"); continue } }; $verifiedAbsent += 1 } catch { $failures.Add("pid=$targetPid verification failed: $($_.Exception.Message)") } }; if ($failures.Count -gt 0) { throw ($failures -join "; ") }; [pscustomobject]@{ TerminalIdentityProof = $true; VerifiedAbsent = $verifiedAbsent; TargetCount = $targets.Count } | ConvertTo-Json -Compress`; const stdout = await runWindowsPowerShell(script, "control"); const proof = JSON.parse(stdout || "{}"); if (proof?.TerminalIdentityProof !== true || Number(proof?.VerifiedAbsent) !== records.length || Number(proof?.TargetCount) !== records.length) throw new Error("Windows exact stop omitted terminal identity proof."); return true; };
+const trackWindowsChild = child => { if (process.platform !== "win32" || Number(child?.pid || 0) <= 1 || child.livedeskWindowsTrackingInitialized) return; child.livedeskWindowsTrackingInitialized = true; child.livedeskWindowsTrackedRecords = new Map(); child.livedeskWindowsSpawnedAtMs = Date.now(); child.livedeskWindowsRootExitedAtMs = null; child.livedeskWindowsTrackingStopped = false; child.once("exit", () => { if (!child.livedeskWindowsRootExitedAtMs) child.livedeskWindowsRootExitedAtMs = Date.now(); setWindowsRootLifetimeEnd(child, windowsTicksAtMilliseconds(child.livedeskWindowsRootExitedAtMs)); }); };
+const stopWindowsTracking = child => { child.livedeskWindowsTrackingStopped = true; child.livedeskWindowsSnapshotPromise = null; };
+const terminateExactWindowsTrackedTree = child => { if (child.livedeskWindowsDrainPromise) return child.livedeskWindowsDrainPromise; const pending = (async () => { let emptyPasses = 0; let lastError = null; for (let attempt = 1; attempt <= WINDOWS_PROCESS_VERIFY_MAX_CIM_QUERIES; attempt += 1) { try { const snapshot = await refreshTrackedWindowsTree(child, readState()); const currentByPid = new Map(snapshot.map(item => [item.pid, item])); const remaining = [...child.livedeskWindowsTrackedRecords.values()].filter(target => sameWindowsIdentity(currentByPid.get(target.pid), target)).sort((left, right) => Number(right.depth || 0) - Number(left.depth || 0)); if (Number(process.env.LIVEDESK_TEST_FORCE_CLEANUP_PROOF_FAILURE_ONCE || 0) > 0 && windowsProcessVerification.forcedCleanupProofFailureCount === 0 && remaining.length > 0) { windowsProcessVerification.forcedCleanupProofFailureCount = 1; throw new Error("Simulated exact cleanup proof failure."); } if (remaining.length === 0) { emptyPasses += 1; } else { emptyPasses = await stopExactWindowsRecords(remaining) ? 1 : 0; } if (emptyPasses >= 2) { stopWindowsTracking(child); assertWindowsVerificationBudget(); windowsProcessVerification.terminalZeroProved = true; return; } child.livedeskWindowsTrackingError = null; lastError = null; } catch (error) { if (error?.message === "Simulated exact cleanup proof failure.") throw error; emptyPasses = 0; lastError = error; child.livedeskWindowsTrackingError = error; } if (attempt < WINDOWS_PROCESS_VERIFY_MAX_CIM_QUERIES) await sleep(150 * attempt); } stopWindowsTracking(child); throw lastError || new Error("Windows update cleanup did not reach two exact terminal identity proofs."); })(); child.livedeskWindowsDrainPromise = pending; const clear = () => { if (child.livedeskWindowsDrainPromise === pending) child.livedeskWindowsDrainPromise = null; }; pending.then(clear, clear); return pending; };
+const stateLockPath = statePath + ".lock"; const lockWaitBuffer = new Int32Array(new SharedArrayBuffer(4));
+const waitForStateLock = ms => Atomics.wait(lockWaitBuffer, 0, 0, Math.max(1, ms));
+const removeAbandonedStateLock = () => { let owner = null; try { owner = JSON.parse(fs.readFileSync(stateLockPath, "utf8")); } catch {} const ownerPid = Number(owner?.pid || 0); if (Number.isInteger(ownerPid) && ownerPid > 1) { if (isAlive(ownerPid)) return false; } else { try { if (Date.now() - fs.statSync(stateLockPath).mtimeMs < 5000) return false; } catch { return true; } } try { fs.rmSync(stateLockPath); return true; } catch { return false; } };
+const withStateLock = callback => { fs.mkdirSync(path.dirname(stateLockPath), { recursive: true }); const deadline = Date.now() + 10000; let descriptor = null; let token = ""; while (descriptor === null) { try { descriptor = fs.openSync(stateLockPath, "wx", 0o600); token = process.pid + "-" + Date.now() + "-" + Math.random().toString(16).slice(2); fs.writeFileSync(descriptor, JSON.stringify({ pid: process.pid, token, acquiredAt: new Date().toISOString() }), "utf8"); } catch (error) { if (descriptor !== null) { try { fs.closeSync(descriptor); } catch {} descriptor = null; try { fs.rmSync(stateLockPath, { force: true }); } catch {} } if (error?.code !== "EEXIST") throw error; if (removeAbandonedStateLock()) continue; if (Date.now() >= deadline) throw new Error("Timed out waiting for the LiveDesk update state lock: " + stateLockPath); waitForStateLock(Math.min(25, Math.max(1, deadline - Date.now()))); } } try { return callback(); } finally { try { fs.closeSync(descriptor); } catch {} try { const owner = JSON.parse(fs.readFileSync(stateLockPath, "utf8")); if (owner?.token === token && Number(owner?.pid) === process.pid) fs.rmSync(stateLockPath, { force: true }); } catch {} } };
+const writeFailure = (error, cancelRequested = false) => { try { withStateLock(() => { const previous = readState(); if (previous.operationId && previous.operationId !== operationId) return; if (previous.stage === "preflight-ready" || previous.stage === "waiting-for-shutdown" || previous.stage === "connected" || previous.stage === "restored") return; const now = new Date().toISOString(); const next = { ...previous, operationId, stage: "failed", targetProductVersion, restartVerified: false, cancelRequested: cancelRequested || previous.cancelRequested === true, error: String(error?.message || error).slice(0, 4000), failedAt: now, updatedAt: now }; const temporary = statePath + "." + process.pid + ".handoff.tmp"; fs.writeFileSync(temporary, JSON.stringify(next, null, 2), { encoding: "utf8", mode: 0o600 }); fs.renameSync(temporary, statePath); }); } catch {} process.stderr.write("LiveDesk update handoff failed: " + (error?.message || error) + "\n"); process.exitCode = 1; };
+const writeCleanupBlocked = error => { try { withStateLock(() => { const previous = readState(); if (previous.operationId && previous.operationId !== operationId) return; if (previous.stage === "preflight-ready" || previous.stage === "waiting-for-shutdown" || previous.stage === "connected" || previous.stage === "restored") return; const now = new Date().toISOString(); const next = { ...previous, operationId, stage: "failed", targetProductVersion, restartVerified: false, cleanupBlocked: true, cleanupTerminalZero: false, cleanupBlockedExactIdentities: windowsProcessVerification.blockedExactIdentities, error: String(error?.message || error).slice(0, 4000), failedAt: now, updatedAt: now }; const temporary = statePath + "." + process.pid + ".cleanup-blocked.tmp"; fs.writeFileSync(temporary, JSON.stringify(next, null, 2), { encoding: "utf8", mode: 0o600 }); fs.renameSync(temporary, statePath); }); } catch {} process.stderr.write("LiveDesk update cleanup blocked: " + (error?.message || error) + "\n"); process.exitCode = 1; };
+const writeCancellation = error => withStateLock(() => { const previous = readState(); if (previous.operationId && previous.operationId !== operationId) return "superseded"; if (previous.operationId !== operationId) return false; if (previous.stage === "preflight-ready" || previous.stage === "waiting-for-shutdown") return "ready"; if (previous.stage === "failed") return previous.cancelRequested === true ? "cancelled" : "failed"; const now = new Date().toISOString(); const next = { ...previous, operationId, stage: "failed", targetProductVersion, restartVerified: false, cancelRequested: true, error: String(error?.message || error).slice(0, 4000), cancelledAt: now, failedAt: now, updatedAt: now }; const temporary = statePath + "." + process.pid + ".cancel.tmp"; fs.writeFileSync(temporary, JSON.stringify(next, null, 2), { encoding: "utf8", mode: 0o600 }); fs.renameSync(temporary, statePath); return "cancelled"; });
+const terminateTree = async child => { const pid = Number(child?.pid || 0); if (pid <= 1) return; if (process.platform === "win32") { await terminateExactWindowsTrackedTree(child); if (windowsProcessVerification.activePowerShellChildren !== 0 || windowsProcessVerification.activeCimQueries !== 0) throw new Error("Windows update cleanup retained an active verification child."); return; } try { process.kill(-pid, "SIGTERM"); } catch { try { child.kill("SIGTERM"); } catch {} } const gracefulDeadline = Date.now() + 2000; while (Date.now() < gracefulDeadline && (isGroupAlive(pid) || isAlive(pid))) await sleep(100); if (isGroupAlive(pid) || isAlive(pid)) { try { process.kill(-pid, "SIGKILL"); } catch { try { child.kill("SIGKILL"); } catch {} } } };
+const writeHandoffStarted = () => withStateLock(() => { if (deadlineExpired()) throw new Error("The absolute LiveDesk Client update deadline expired before handoff."); const previous = readState(); if (previous.operationId !== operationId) throw new Error("LiveDesk update handoff was superseded before exact-package launch."); const now = new Date().toISOString(); const next = { ...previous, operationId, stage: "handoff-started", starterPid: process.pid, updateDeadlineEpochMs, restartVerified: false, error: "", updatedAt: now }; const temporary = statePath + "." + process.pid + ".handoff-started.tmp"; fs.writeFileSync(temporary, JSON.stringify(next, null, 2), { encoding: "utf8", mode: 0o600 }); fs.renameSync(temporary, statePath); });
+const stopDirectOwnedChild = async child => { const alreadyExited = child.exitCode !== null || child.signalCode !== null; windowsProcessVerification.directChildKillAttempted = !alreadyExited; if (!alreadyExited) { try { child.kill("SIGKILL"); } catch {} } const exited = child.exitCode !== null || child.signalCode !== null ? true : await new Promise(resolve => { let settled = false; const finish = value => { if (settled) return; settled = true; clearTimeout(deadline); child.removeListener("close", onClose); resolve(value); }; const onClose = () => finish(true); const deadline = setTimeout(() => finish(false), 750); child.once("close", onClose); }); for (const stream of [child.stdin, child.stdout, child.stderr]) { try { stream?.destroy?.(); } catch {} } windowsProcessVerification.directChildExitProved = exited || child.exitCode !== null || child.signalCode !== null; return windowsProcessVerification.directChildExitProved; };
+const monitorPreflight = child => { let settled = false; let draining = false; let drainPromise = null; let stageWatcher = null; let stageFallback = null; let timeout = null; let inspectScheduled = false; const releaseObservation = () => { if (stageFallback) { clearInterval(stageFallback); stageFallback = null; windowsProcessVerification.activeStateFallbackTimers -= 1; } if (timeout) { clearTimeout(timeout); timeout = null; } if (stageWatcher) { try { stageWatcher.close(); } catch {} stageWatcher = null; windowsProcessVerification.activeStateWatchers -= 1; } }; const finish = (error, preserveFailure = false) => { if (settled) return; settled = true; releaseObservation(); stopWindowsTracking(child); child.unref(); windowsProcessVerification.failClosedOwnershipHeld = false; windowsProcessVerification.failClosedOwnershipTimerCount = 0; writeWindowsVerificationEvidence(error ? "error" : (preserveFailure ? "failed" : "preflight-ready"), child); if (preserveFailure) process.exitCode = 1; else if (error) writeFailure(error); }; const finishCleanupBlocked = async cleanupError => { if (settled) return; settled = true; draining = false; releaseObservation(); child.livedeskWindowsDrainPromise = null; drainPromise = null; windowsProcessVerification.cleanupBlockedCount += 1; windowsProcessVerification.failClosedOwnershipHeld = false; windowsProcessVerification.failClosedOwnershipTimerCount = 0; windowsProcessVerification.terminalZeroProved = false; windowsProcessVerification.blockedExactIdentities = [...(child.livedeskWindowsTrackedRecords?.values?.() || [])].map(record => ({ pid: Number(record.pid || 0), startOrder: String(record.startOrder || ""), depth: Number(record.depth || 0) })).filter(record => record.pid > 1 && /^\d+$/.test(record.startOrder)); windowsProcessVerification.blockedExactIdentityCount = windowsProcessVerification.blockedExactIdentities.length; await stopDirectOwnedChild(child); stopWindowsTracking(child); child.unref(); writeWindowsVerificationEvidence("cleanup-blocked", child); writeCleanupBlocked(cleanupError); }; const drainAndFinish = (error, preserveFailure = false) => { if (settled) return Promise.resolve(); draining = true; if (!drainPromise) drainPromise = terminateTree(child).then(() => { windowsProcessVerification.cleanupCompletedCount += 1; finish(error, preserveFailure); }).catch(async cleanupError => { windowsProcessVerification.cleanupFailureCount += 1; child.livedeskWindowsDrainPromise = null; drainPromise = null; await finishCleanupBlocked(cleanupError); }); return drainPromise; }; const inspect = () => { if (draining || settled) return; windowsProcessVerification.stateReadCount += 1; const state = readState(); if (state.operationId !== operationId) return; const committedOwner = Number(state.starterPid || 0) === process.pid && Number(state.supervisorPid || 0) > 1; if ((state.stage === "preflight-ready" || state.stage === "waiting-for-shutdown") && committedOwner) finish(); else if (state.stage === "failed") void drainAndFinish(null, true); }; const scheduleInspect = () => { if (inspectScheduled || draining || settled) return; inspectScheduled = true; setImmediate(() => { inspectScheduled = false; inspect(); }); }; const cancelTimedOutHandoff = async () => { const error = new Error(deadlineExpired() ? "The absolute LiveDesk Client update deadline expired before exact-package preflight." : "Timed out waiting for exact-package update preflight."); draining = true; while (!settled) { let outcome; try { outcome = writeCancellation(error); } catch (lockError) { await drainAndFinish(lockError); return; } if (outcome === "ready") { draining = false; inspect(); return; } if (outcome === "failed" || outcome === "cancelled" || outcome === "superseded") { await drainAndFinish(null, true); return; } await sleep(25); } }; try { stageWatcher = fs.watch(path.dirname(statePath), { persistent: false }, (_event, filename) => { if (filename && String(filename) !== path.basename(statePath)) return; windowsProcessVerification.stateWatchEventCount += 1; scheduleInspect(); }); windowsProcessVerification.activeStateWatchers += 1; stageWatcher.once("error", error => { if (settled || draining) return; void drainAndFinish(error); }); } catch {} stageFallback = setInterval(inspect, 2000); windowsProcessVerification.activeStateFallbackTimers += 1; stageFallback.unref?.(); const timeoutMs = Math.max(1, Math.min(Math.max(1000, Number(process.env.LIVEDESK_CLIENT_UPDATE_HANDOFF_TIMEOUT_MS || 140000)), updateDeadlineEpochMs - Date.now())); timeout = setTimeout(() => { void cancelTimedOutHandoff().catch(error => { void drainAndFinish(error); }); }, timeoutMs); child.once("exit", (code, signal) => { inspect(); if (settled || draining) return; const error = new Error("Exact-package update supervisor exited before preflight (code=" + (code ?? "none") + ", signal=" + (signal || "none") + ")."); void drainAndFinish(error); }); inspect(); };
+const prepareNeutralCwd = () => { if (!neutralCwd) throw new Error("LiveDesk update neutral working directory is unavailable"); fs.mkdirSync(neutralCwd, { recursive: true }); const unexpectedEntry = fs.readdirSync(neutralCwd)[0]; if (unexpectedEntry) { const shadow = path.join(neutralCwd, unexpectedEntry); throw new Error("LiveDesk update neutral working directory is shadowed by " + shadow + ": " + neutralCwd); } };
+if (!operationId || !versionPattern.test(targetProductVersion) || deadlineExpired()) { writeFailure(new Error("Invalid or expired LiveDesk exact-package update handoff."), true); } else { try { prepareNeutralCwd(); writeHandoffStarted();
+const env = { ...process.env, LIVEDESK_UPDATE_STARTER_PID: String(process.pid) }; const isolated = new Set(["init_cwd", "npm_config_local_prefix", "npm_config_workspace", "npm_config_workspaces", "npm_config_include_workspace_root", "npm_package_json", "npm_lifecycle_event", "npm_lifecycle_script"]); for (const key of Object.keys(env)) if (isolated.has(key.toLowerCase())) delete env[key]; env.INIT_CWD = neutralCwd; env.npm_config_local_prefix = neutralCwd; env.npm_config_workspaces = "false"; env.npm_config_include_workspace_root = "false";
+const nodeDir = path.dirname(process.execPath);
+const npxCli = [env.LIVEDESK_NPX_CLI_PATH, env.npm_execpath ? path.join(path.dirname(env.npm_execpath), "npx-cli.js") : "", env.LIVEDESK_NPX_EXECUTABLE ? path.join(path.dirname(env.LIVEDESK_NPX_EXECUTABLE), "node_modules", "npm", "bin", "npx-cli.js") : "", path.join(nodeDir, "node_modules", "npm", "bin", "npx-cli.js")].find(value => value && fs.existsSync(value));
+const npx = env.LIVEDESK_NPX_EXECUTABLE || (process.platform === "win32" ? "npx.cmd" : "npx");
+const args = ["-y", "--prefer-online", "--prefix", neutralCwd, "--workspaces=false", "livedesk@" + targetProductVersion, "--internal-legacy-client-update"];
+const quoteCmd = value => "\"" + String(value).replaceAll("%", "%%").replaceAll("\"", "\"\"") + "\"";
+const invocation = npxCli ? { command: process.execPath, args: [npxCli, ...args] } : process.platform === "win32" ? { command: env.ComSpec || "cmd.exe", args: ["/d", "/s", "/c", "call " + quoteCmd(npx) + " " + args.map(quoteCmd).join(" ")] } : { command: npx, args };
+if (!npxCli && path.isAbsolute(npx) && !fs.existsSync(npx)) { writeFailure(new Error("LiveDesk npx executable was not found: " + npx)); } else { try { const child = spawn(invocation.command, invocation.args, { cwd: neutralCwd, env, detached: true, stdio: "ignore", windowsHide: true }); trackWindowsChild(child); child.once("error", writeFailure); child.once("spawn", () => { trackWindowsChild(child); monitorPreflight(child); }); } catch (error) { writeFailure(error); } }
+} catch (error) { writeFailure(error, deadlineExpired()); } }

package/bin/livedesk-client.js

@@ -50,6 +50,7 @@ const DISCOVERY_RETRY_JITTER_RATIO = 0.2;
 const EXIT_INVALID_PAIR_TOKEN = 23;
 const EXIT_CLIENT_UPDATE = 42;
 const SESSION_REFRESH_SKEW_SECONDS = 60;
+const SUPABASE_REQUEST_TIMEOUT_MS = 8_000;
 const HUB_TARGET_CACHE_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
 const HUB_TARGET_CACHE_FUTURE_SKEW_MS = 5 * 60 * 1000;
 const WINDOWS_STARTUP_SCRIPT_NAME = 'LiveDesk Desktop.vbs';
@@ -1077,10 +1078,52 @@ function clearSavedSession() {
     rmSync(UNIFIED_CLIENT_AUTH_PATH, { force: true });
 }
 
+export async function fetchSupabaseWithDeadline(
+    input,
+    init = {},
+    timeoutMs = SUPABASE_REQUEST_TIMEOUT_MS
+) {
+    const boundedTimeoutMs = Number.isFinite(Number(timeoutMs)) && Number(timeoutMs) > 0
+        ? Math.min(60_000, Math.max(1, Math.round(Number(timeoutMs))))
+        : SUPABASE_REQUEST_TIMEOUT_MS;
+    const controller = new AbortController();
+    const callerSignal = init?.signal;
+    const forwardCallerAbort = () => {
+        if (!controller.signal.aborted) {
+            controller.abort(callerSignal?.reason);
+        }
+    };
+    if (callerSignal?.aborted) {
+        forwardCallerAbort();
+    } else {
+        callerSignal?.addEventListener?.('abort', forwardCallerAbort, { once: true });
+    }
+    const timer = setTimeout(() => {
+        if (!controller.signal.aborted) {
+            controller.abort(new Error('supabase-request-timeout'));
+        }
+    }, boundedTimeoutMs);
+    timer.unref?.();
+    try {
+        return await fetch(input, { ...init, signal: controller.signal });
+    } catch (error) {
+        if (controller.signal.aborted && !callerSignal?.aborted) {
+            throw new Error('supabase-request-timeout', { cause: error });
+        }
+        throw error;
+    } finally {
+        clearTimeout(timer);
+        callerSignal?.removeEventListener?.('abort', forwardCallerAbort);
+    }
+}
+
 async function createSupabaseClient() {
-    const { createClient } = await import('@supabase/supabase-js');
-    return createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
-        auth: {
+    const { createClient } = await import('@supabase/supabase-js');
+    return createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
+        global: {
+            fetch: fetchSupabaseWithDeadline
+        },
+        auth: {
             autoRefreshToken: false,
             persistSession: true,
             detectSessionInUrl: false,
@@ -3291,8 +3334,14 @@ async function startConnectionChoiceServer(supabase, options = {}) {
     };
 }
 
-async function chooseClientConnection(supabase, options = {}) {
-    if (isTruthy(process.env.LIVEDESK_UNIFIED_RUNTIME)) {
+async function chooseClientConnection(supabase, options = {}) {
+    const getSupabase = async () => {
+        const resolved = typeof supabase === 'function'
+            ? await supabase()
+            : await supabase;
+        return resolved;
+    };
+    if (isTruthy(process.env.LIVEDESK_UNIFIED_RUNTIME)) {
         const connectionPage = createClientRuntimeServer({
             host: process.env.LIVEDESK_CLIENT_RUNTIME_HOST || '127.0.0.1',
             port: options.authPort || DEFAULT_AUTH_CALLBACK_PORT,
@@ -3304,11 +3353,13 @@ async function chooseClientConnection(supabase, options = {}) {
             assignedHubId: process.env.LIVEDESK_ASSIGNED_HUB_ID,
             roleVersion: process.env.LIVEDESK_ROLE_VERSION,
             savedSession: options.savedSession,
+            loadSavedSession: options.loadSavedSession,
             initialChoice: options.initialChoice,
             initialChoiceMessage: options.initialChoiceMessage,
             beginGoogleSignIn: async redirectTo => {
-                if (!supabase?.auth) throw new Error('supabase-session-required');
-                const { data, error } = await supabase.auth.signInWithOAuth({
+                const activeSupabase = await getSupabase();
+                if (!activeSupabase?.auth) throw new Error('supabase-session-required');
+                const { data, error } = await activeSupabase.auth.signInWithOAuth({
                     provider: 'google',
                     options: {
                         redirectTo,
@@ -3321,34 +3372,37 @@ async function chooseClientConnection(supabase, options = {}) {
                 return { url: data.url };
             },
             exchangeGoogleCode: async code => {
-                if (!supabase?.auth) throw new Error('supabase-session-required');
-                const { data, error } = await supabase.auth.exchangeCodeForSession(code);
+                const activeSupabase = await getSupabase();
+                if (!activeSupabase?.auth) throw new Error('supabase-session-required');
+                const { data, error } = await activeSupabase.auth.exchangeCodeForSession(code);
                 if (error) throw error;
                 if (!data?.session) throw new Error('google-session-missing');
                 if (!writeSavedSessionToFile(data.session)) throw new Error('refresh-token-required');
                 return data.session;
             },
-            resolvePin: pin => {
-                if (!supabase) throw new Error('supabase-session-required');
-                return resolveManagerFromPin(supabase, pin, {
+            resolvePin: async pin => {
+                const activeSupabase = await getSupabase();
+                if (!activeSupabase) throw new Error('supabase-session-required');
+                return resolveManagerFromPin(activeSupabase, pin, {
                     allowRelayFallback: options.allowRelayFallback === true,
                     relayEndpoint: options.relayEndpoint
                 });
             },
             changeRole: async (role, snapshot) => {
-                if (!supabase) {
+                const activeSupabase = await getSupabase();
+                if (!activeSupabase) {
                     return { ok: false, error: 'supabase-session-required' };
                 }
                 const portPreflight = await preflightHubClientPort();
                 if (!portPreflight.ok) {
                     return hubClientPortPreflightError(portPreflight);
                 }
-                const session = await refreshSessionIfNeeded(supabase);
+                const session = await refreshSessionIfNeeded(activeSupabase);
                 if (!session?.access_token) {
                     return { ok: false, error: 'supabase-session-required' };
                 }
                 const expectedRoleVersion = Number(snapshot?.roleVersion || 0);
-                const { data, error } = await supabase.rpc('set_livedesk_device_role', {
+                const { data, error } = await activeSupabase.rpc('set_livedesk_device_role', {
                     p_device_id: options.deviceId,
                     p_role: role,
                     p_assigned_hub_id: null,
@@ -3412,6 +3466,7 @@ async function chooseClientConnection(supabase, options = {}) {
             }
         });
         await connectionPage.start();
+        options.onStarted?.(connectionPage);
         if (options.openBrowser !== false) {
             console.log('Opening LiveDesk Client page...');
             openBrowser(connectionPage.url);
@@ -3980,7 +4035,7 @@ export async function waitForManagerFromSupabase(supabase, options = {}) {
     }
 }
 
-async function prepareLoginConnection(parsed, existingConnectionPage = null) {
+async function prepareLoginConnection(parsed, existingConnectionPage = null, getSupabaseClient = createSupabaseClient) {
     if (parsed.logout) {
         clearSavedSession();
     }
@@ -3996,15 +4051,31 @@ async function prepareLoginConnection(parsed, existingConnectionPage = null) {
     let connectionTransport = '';
     let directReachable = false;
     const allowRelayFallback = transportAllowsRelay(parsed.transport);
-
+
     if (shouldLogin) {
-        const supabase = await createSupabaseClient();
-        const startupArgs = buildStartupClientArgs(parsed);
-        let savedSession = null;
-        try {
-            savedSession = await refreshSessionIfNeeded(supabase);
-        } catch (err) {
-            console.warn(`LiveDesk saved sign-in could not be refreshed: ${err?.message || err}`);
+        let supabase = null;
+        try {
+            supabase = await getSupabaseClient();
+        } catch (error) {
+            console.warn(`LiveDesk auth provider is unavailable: ${error?.message || error}`);
+            existingConnectionPage?.update({
+                lastError: 'auth-provider-unavailable',
+                message: 'The local Client is ready. LiveDesk sign-in is temporarily unavailable; retry from this page.'
+            });
+            if (!existingConnectionPage) throw error;
+        }
+        const startupArgs = buildStartupClientArgs(parsed);
+        let savedSession = null;
+        if (supabase) {
+            try {
+                savedSession = await refreshSessionIfNeeded(supabase);
+            } catch (err) {
+                console.warn(`LiveDesk saved sign-in could not be refreshed: ${err?.message || err}`);
+                existingConnectionPage?.update({
+                    lastError: 'auth-provider-delayed',
+                    message: 'The local Client is ready. Saved sign-in is delayed; retry sign-in from this page.'
+                });
+            }
         }
         const savedPin = readSavedPin();
         const previousChoice = existingConnectionPage?.getLastChoice?.() || null;
@@ -4021,21 +4092,31 @@ async function prepareLoginConnection(parsed, existingConnectionPage = null) {
             choice = previousChoice;
         }
         if (!choice) {
-            choice = await chooseClientConnection(supabase, {
-                authPort: parsed.authPort,
-                autoGoogle: !savedSession?.access_token && !savedPin,
-                deviceId: parsed.deviceId,
-                engine: parsed.engine,
-                slot: parsed.slot,
-                startupArgs,
-                savedSession,
-                savedPin,
-                allowRelayFallback,
-                relayEndpoint: parsed.relay,
-                openBrowser: parsed.openBrowserOnStart
-            });
-        }
-        connectionPage = existingConnectionPage || choice.connectionPage || null;
+            choice = existingConnectionPage
+                ? await existingConnectionPage.waitForChoice
+                : await chooseClientConnection(supabase, {
+                    authPort: parsed.authPort,
+                    autoGoogle: !savedSession?.access_token && !savedPin,
+                    deviceId: parsed.deviceId,
+                    engine: parsed.engine,
+                    slot: parsed.slot,
+                    startupArgs,
+                    savedSession,
+                    savedPin,
+                    allowRelayFallback,
+                    relayEndpoint: parsed.relay,
+                    openBrowser: parsed.openBrowserOnStart
+                });
+        }
+        connectionPage = existingConnectionPage || choice.connectionPage || null;
+        if (existingConnectionPage && choice) {
+            existingConnectionPage.acceptChoice?.(
+                choice,
+                choice.type === 'google'
+                    ? 'Saved sign-in found. Finding the LiveDesk Hub.'
+                    : 'Client credentials accepted. Finding the LiveDesk Hub.'
+            );
+        }
         if (choice.type === 'pin') {
             manager = choice.manager;
             pair = choice.pair;
@@ -4148,27 +4229,35 @@ async function prepareLoginConnection(parsed, existingConnectionPage = null) {
     // supervisor uses that API to prove the new launcher and Agent are stable
     // before it commits the update.
     if (!shouldLogin
-        && !existingConnectionPage
         && isTruthy(process.env.LIVEDESK_UNIFIED_RUNTIME)
         && manager
         && pair) {
         const preservedSession = readSavedSessionFromFile();
-        const explicitConnection = await chooseClientConnection(null, {
-            authPort: parsed.authPort,
-            deviceId: parsed.deviceId,
-            engine: parsed.engine,
-            savedSession: preservedSession,
-            openBrowser: false,
-            initialChoice: {
-                type: 'explicit',
-                manager,
-                pair,
-                endpointCandidates: [manager],
-                ...(preservedSession?.access_token ? { session: preservedSession } : {})
-            },
-            initialChoiceMessage: `Using the existing LiveDesk Hub pairing at ${manager}.`
-        });
-        connectionPage = explicitConnection.connectionPage || null;
+        const initialChoice = {
+            type: 'explicit',
+            manager,
+            pair,
+            endpointCandidates: [manager],
+            ...(preservedSession?.access_token ? { session: preservedSession } : {})
+        };
+        if (existingConnectionPage) {
+            existingConnectionPage.acceptChoice?.(
+                initialChoice,
+                `Using the existing LiveDesk Hub pairing at ${manager}.`
+            );
+            connectionPage = existingConnectionPage;
+        } else {
+            const explicitConnection = await chooseClientConnection(null, {
+                authPort: parsed.authPort,
+                deviceId: parsed.deviceId,
+                engine: parsed.engine,
+                savedSession: preservedSession,
+                openBrowser: false,
+                initialChoice,
+                initialChoiceMessage: `Using the existing LiveDesk Hub pairing at ${manager}.`
+            });
+            connectionPage = explicitConnection.connectionPage || null;
+        }
     }
 
     const slot = normalizeSlotNumber(parsed.slot);
@@ -4784,7 +4873,7 @@ export function requiresFastTransport(prepared = {}) {
         || prepared.relayExplicit === true;
 }
 
-export async function runClientRuntime(argv = process.argv.slice(2)) {
+export async function runClientRuntime(argv = process.argv.slice(2), runtimeOptions = {}) {
     startNetworkChangeMonitor();
     if (isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) {
         unregisterWindowsStartup();
@@ -4823,13 +4912,61 @@ export async function runClientRuntime(argv = process.argv.slice(2)) {
         console.log(`[LiveDesk Client] Linux video acceleration: ${accelerationLabel}`);
     }
 
+    let supabaseClientPromise = null;
+    const createSupabaseClientForRuntime = typeof runtimeOptions.createSupabaseClient === 'function'
+        ? runtimeOptions.createSupabaseClient
+        : createSupabaseClient;
+    const getSupabaseClient = () => {
+        if (!supabaseClientPromise) {
+            const pending = Promise.resolve().then(() => createSupabaseClientForRuntime());
+            supabaseClientPromise = pending;
+            void pending.catch(() => {
+                if (supabaseClientPromise === pending) {
+                    supabaseClientPromise = null;
+                }
+            });
+        }
+        return supabaseClientPromise;
+    };
     let connectionPage = null;
+    if (isTruthy(process.env.LIVEDESK_UNIFIED_RUNTIME)) {
+        let resolveStarted;
+        let rejectStarted;
+        const started = new Promise((resolve, reject) => {
+            resolveStarted = resolve;
+            rejectStarted = reject;
+        });
+        const startupChoice = chooseClientConnection(getSupabaseClient, {
+            authPort: parsed.authPort,
+            autoGoogle: false,
+            deviceId: parsed.deviceId,
+            engine: parsed.engine,
+            slot: parsed.slot,
+            startupArgs: buildStartupClientArgs(parsed),
+            savedSession: null,
+            loadSavedSession: false,
+            savedPin: null,
+            allowRelayFallback: transportAllowsRelay(parsed.transport),
+            relayEndpoint: parsed.relay,
+            openBrowser: parsed.openBrowserOnStart,
+            onStarted: page => {
+                connectionPage = page;
+                resolveStarted(page);
+            }
+        });
+        void startupChoice.catch(rejectStarted);
+        connectionPage = await started;
+        connectionPage.update({
+            message: 'Checking saved sign-in and the current LiveDesk Hub.'
+        });
+        console.log(`[LiveDesk Client] Local status is ready at ${connectionPage.url}`);
+    }
     while (true) {
         const savedSlot = readSavedDeviceSlot(parsed.deviceId);
         if (savedSlot) {
             parsed.slot = savedSlot;
         }
-        const prepared = await prepareLoginConnection(parsed, connectionPage);
+        const prepared = await prepareLoginConnection(parsed, connectionPage, getSupabaseClient);
         connectionPage = prepared.connectionPage || connectionPage;
         prepared.connectionPage?.update({
             manager: prepared.manager,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/client",
-  "version": "0.1.215",
+  "version": "0.1.217",
   "description": "LiveDesk local remote client",
   "type": "module",
   "bin": {
@@ -10,14 +10,14 @@
     "livedesk-client-fast": "bin/livedesk-client-fast.js"
   },
   "files": [
-    "bin/",
-    "src/",
-    "tests/",
-    "README.md",
+    "bin/",
+    "src/",
+    "tests/",
+    "README.md",
     "THIRD_PARTY_NOTICES.md"
   ],
   "scripts": {
-    "check": "node --check bin/client-version.js && node --check bin/livedesk-client.js && node --check bin/livedesk-client-node.js && node --check bin/livedesk-client-fast.js",
+    "check": "node --check bin/client-version.js && node --check bin/livedesk-client.js && node --check bin/livedesk-client-node.js && node --check bin/livedesk-client-update-bootstrap.cjs && node --check bin/livedesk-client-fast.js",
     "test:version": "node --test tests/client-version.test.mjs",
     "pack:dry": "npm pack --dry-run"
   },
@@ -35,16 +35,16 @@
   "dependencies": {
     "@ffmpeg-installer/ffmpeg": "^1.1.0",
     "ffmpeg-static": "^5.3.0",
-    "@livedesk/runtime-core": "0.1.0",
+    "@livedesk/runtime-core": "0.1.1",
     "@supabase/supabase-js": "^2.110.0",
     "node-screenshots": "^0.2.8",
     "ws": "^8.18.3"
   },
   "optionalDependencies": {
-    "@livedesk/fast-linux-x64": "0.1.419",
-    "@livedesk/fast-osx-arm64": "0.1.419",
-    "@livedesk/fast-osx-x64": "0.1.419",
-    "@livedesk/fast-win-x64": "0.1.419"
+    "@livedesk/fast-linux-x64": "0.1.422",
+    "@livedesk/fast-osx-arm64": "0.1.422",
+    "@livedesk/fast-osx-x64": "0.1.422",
+    "@livedesk/fast-win-x64": "0.1.422"
   },
   "publishConfig": {
     "access": "public"