@livedesk/client 0.1.231 → 0.1.233

package/bin/livedesk-client.js

@@ -26,6 +26,12 @@ import {
     inspectLinuxVideoAcceleration,
     installLinuxVideoAcceleration
 } from '../src/runtime/linux-video-acceleration.js';
+import {
+    ensureRepairedFastRuntime,
+    inspectFastRuntimePackage,
+    inspectRepairedFastRuntime,
+    resolveFastPlatformSpec
+} from '../src/runtime/fast-runtime-repair.js';
 import { normalizeRuntimeAuthSession } from '../../runtime-core/src/auth-session.js';
 import { createOsSecretStore, OS_SECRET_REFERENCE } from '../../runtime-core/src/os-secret-store.js';
 import { startRoleTransitionSupervisor } from '../../runtime-core/src/role-transition-supervisor.js';
@@ -330,8 +336,8 @@ Options:
   --version                       Show the agent version.
   --help                          Show this help.
 
-Auto uses C# RemoteFast when supported and falls back to Node only when a
-packaged RemoteFast runtime is unavailable.
+Auto uses the verified C# RemoteFast screen engine on supported desktop platforms.
+If an npx cache omitted it, LiveDesk restores the exact pinned platform package before connecting.
 Enable Windows auto-start from the connection page when this client signs in.
 `.trimStart());
 }
@@ -340,6 +346,14 @@ function readPackageVersion() {
     return readClientPackageVersion();
 }
 
+function readClientPackageManifest() {
+    try {
+        return JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8'));
+    } catch {
+        return null;
+    }
+}
+
 function isTruthy(value) {
     return /^(1|true|yes|on)$/i.test(String(value || '').trim());
 }
@@ -4667,42 +4681,67 @@ async function prepareLoginConnection(parsed, existingConnectionPage = null, get
     };
 }
 
+function getFastRuntimeSpec() {
+    return resolveFastPlatformSpec({
+        platform: os.platform(),
+        arch: os.arch(),
+        manifest: readClientPackageManifest()
+    });
+}
+
 function getFastRuntime() {
-    const platform = os.platform();
-    const arch = os.arch();
-    const resolvePackagedRuntime = (packageName, rid, executableName) => {
-        try {
-            const packagePath = require.resolve(`${packageName}/package.json`);
-            const fastRoot = join(dirname(packagePath), 'fast');
-            return {
-                rid,
-                packageName,
-                executable: join(fastRoot, executableName),
-                dll: join(fastRoot, 'livedesk-client-fast.dll')
-            };
-        } catch {
-            return {
-                rid,
-                packageName: '',
-                executable: join(packageRoot, 'fast', rid, executableName),
-                dll: join(packageRoot, 'fast', rid, 'livedesk-client-fast.dll')
-            };
-        }
+    const spec = getFastRuntimeSpec();
+    if (!spec) return null;
+    try {
+        const packagePath = require.resolve(`${spec.packageName}/package.json`);
+        const installed = inspectFastRuntimePackage(dirname(packagePath), spec);
+        if (installed) return { ...installed, source: 'optional-dependency' };
+    } catch {
+        // A cached npx install can be complete except for its optional platform package.
+    }
+    const bundledFastRoot = join(packageRoot, 'fast', spec.rid);
+    const bundled = {
+        rid: spec.rid,
+        packageName: '',
+        packageVersion: spec.version,
+        executable: join(bundledFastRoot, spec.executableName),
+        dll: join(bundledFastRoot, 'livedesk-client-fast.dll'),
+        source: 'bundled-development-runtime'
     };
-    if (platform === 'win32' && arch === 'x64') {
-        return resolvePackagedRuntime('@livedesk/fast-win-x64', 'win-x64', 'livedesk-client-fast.exe');
-    }
-    if (platform === 'darwin' && arch === 'arm64') {
-        return resolvePackagedRuntime('@livedesk/fast-osx-arm64', 'osx-arm64', 'livedesk-client-fast');
-    }
-    if (platform === 'darwin' && arch === 'x64') {
-        return resolvePackagedRuntime('@livedesk/fast-osx-x64', 'osx-x64', 'livedesk-client-fast');
-    }
-    if (platform === 'linux' && arch === 'x64') {
-        return resolvePackagedRuntime('@livedesk/fast-linux-x64', 'linux-x64', 'livedesk-client-fast');
-    }
-
-    return null;
+    if (hasFastExecutable(bundled) || hasFastDll(bundled)) return bundled;
+    const repaired = inspectRepairedFastRuntime(UNIFIED_CLIENT_STATE_DIR, spec);
+    if (repaired) return { ...repaired, source: 'repaired-runtime-cache' };
+    return { ...bundled, packageName: spec.packageName, source: 'missing' };
+}
+
+async function repairFastRuntimeIfMissing(runtime, connectionPage = null) {
+    if (hasFastExecutable(runtime) || hasFastDll(runtime)) return runtime;
+    const spec = getFastRuntimeSpec();
+    if (!spec) return runtime;
+    const label = `${spec.packageName}@${spec.version}`;
+    console.warn(`[LiveDesk Client] RemoteFast ${spec.rid} is missing from the npx installation. Repairing ${label}.`);
+    connectionPage?.update({
+        message: `Installing the verified ${spec.rid} screen engine. This is needed only when the npx cache omitted it.`,
+        agent: {
+            requestedEngine: 'fast',
+            engine: 'fast',
+            state: 'repairing',
+            runtimeId: spec.rid,
+            command: label,
+            args: []
+        }
+    });
+    const repaired = await ensureRepairedFastRuntime({
+        stateDir: UNIFIED_CLIENT_STATE_DIR,
+        spec,
+        nodeExecutable: process.execPath,
+        npmExecPath: process.env.npm_execpath || process.env.NPM_EXECPATH,
+        npmExecutable: process.env.LIVEDESK_NPM_EXECUTABLE,
+        env: process.env
+    });
+    clearFastPreflightCache();
+    console.log(`[LiveDesk Client] Repaired ${label} in the private LiveDesk runtime cache.`);
+    return { ...repaired, source: 'repaired-runtime-cache' };
 }
 
 function summarizeText(value, maxLength = 600) {
@@ -5356,7 +5395,31 @@ export async function runClientRuntime(argv = process.argv.slice(2), runtimeOpti
             connectionPage?.close?.();
             process.exit(0);
         }
-        const fastRuntime = getFastRuntime();
+        let fastRuntime = getFastRuntime();
+        const fastSpec = getFastRuntimeSpec();
+        let fastRepairError = null;
+        if (prepared.engine !== 'node'
+            && fastSpec
+            && !hasFastExecutable(fastRuntime)
+            && !hasFastDll(fastRuntime)) {
+            try {
+                fastRuntime = await repairFastRuntimeIfMissing(fastRuntime, prepared.connectionPage);
+            } catch (error) {
+                fastRepairError = error;
+                const message = summarizeText(error?.message || error, 600);
+                console.error(`[LiveDesk Client] RemoteFast repair failed: ${message}`);
+                prepared.connectionPage?.update({
+                    agent: {
+                        requestedEngine: prepared.engine,
+                        engine: 'fast',
+                        state: 'failed',
+                        runtimeId: fastSpec.rid,
+                        error: message
+                    },
+                    message: 'The screen engine could not be restored. LiveDesk did not start a reduced Node connection.'
+                });
+            }
+        }
         const fastRequired = requiresFastTransport(prepared);
         if (fastRequired && prepared.engine === 'node') {
             throw new Error(
@@ -5407,13 +5470,25 @@ export async function runClientRuntime(argv = process.argv.slice(2), runtimeOpti
                         state: 'running'
                     });
                 });
-            } else if (prepared.engine === 'fast' || fastRequired) {
-                console.error(
-                    `C# RemoteFast is unavailable: ${fastLaunch.reason}. `
-                    + (fastRequired
-                        ? 'The requested P2P, WebSocket, or encrypted relay transport requires the packaged RemoteFast runtime; the legacy Node agent was not started.'
-                        : 'Use --engine node to run the legacy Node agent.')
-                );
+            } else if (prepared.engine === 'fast'
+                || fastRequired
+                || fastRepairError
+                || (fastSpec && fastRuntime?.source === 'missing')) {
+                const repairDetail = fastRepairError
+                    ? ` Automatic repair failed: ${summarizeText(fastRepairError?.message || fastRepairError, 500)}`
+                    : '';
+                const unavailableMessage = `C# RemoteFast is unavailable: ${fastLaunch.reason}.${repairDetail}`;
+                console.error(`${unavailableMessage} The reduced Node connection was not started because it cannot provide the required LiveDesk screen stream.`);
+                prepared.connectionPage?.update({
+                    agent: {
+                        requestedEngine: prepared.engine,
+                        engine: 'fast',
+                        state: 'failed',
+                        runtimeId: fastRuntime?.rid || fastSpec?.rid || '',
+                        error: unavailableMessage
+                    },
+                    message: 'LiveDesk could not start the verified screen engine. Restart the same @latest command after network access is restored.'
+                });
                 prepared.connectionPage?.close?.();
                 process.exit(2);
             } else {

package/package.json

@@ -1,53 +1,53 @@
-{
-  "name": "@livedesk/client",
-  "version": "0.1.231",
-  "description": "LiveDesk local remote client",
-  "type": "module",
-  "bin": {
-    "client": "bin/livedesk-client.js",
-    "livedesk-client": "bin/livedesk-client.js",
-    "livedesk-client-node": "bin/livedesk-client-node.js",
-    "livedesk-client-fast": "bin/livedesk-client-fast.js"
-  },
-  "files": [
-    "bin/",
-    "src/",
-    "tests/",
-    "README.md",
-    "THIRD_PARTY_NOTICES.md"
-  ],
-  "scripts": {
-    "check": "node --check bin/client-version.js && node --check bin/livedesk-client.js && node --check bin/livedesk-client-node.js && node --check bin/livedesk-client-update-bootstrap.cjs && node --check bin/livedesk-client-fast.js",
-    "test:version": "node --test tests/client-version.test.mjs",
-    "pack:dry": "npm pack --dry-run",
-    "prepublishOnly": "node ../../scripts/livedesk-release-git-gate.mjs"
-  },
-  "keywords": [
-    "livedesk",
-    "remote",
-    "agent",
-    "local",
-    "desktop"
-  ],
-  "license": "MIT",
-  "engines": {
-    "node": ">=20"
-  },
-  "dependencies": {
-    "@ffmpeg-installer/ffmpeg": "^1.1.0",
-    "ffmpeg-static": "^5.3.0",
-    "@livedesk/runtime-core": "0.1.4",
-    "@supabase/supabase-js": "^2.110.0",
-    "node-screenshots": "^0.2.8",
-    "ws": "^8.18.3"
-  },
-  "optionalDependencies": {
-    "@livedesk/fast-linux-x64": "0.1.430",
-    "@livedesk/fast-osx-arm64": "0.1.430",
-    "@livedesk/fast-osx-x64": "0.1.430",
-    "@livedesk/fast-win-x64": "0.1.430"
-  },
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "@livedesk/client",
+  "version": "0.1.233",
+  "description": "LiveDesk local remote client",
+  "type": "module",
+  "bin": {
+    "client": "bin/livedesk-client.js",
+    "livedesk-client": "bin/livedesk-client.js",
+    "livedesk-client-node": "bin/livedesk-client-node.js",
+    "livedesk-client-fast": "bin/livedesk-client-fast.js"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "tests/",
+    "README.md",
+    "THIRD_PARTY_NOTICES.md"
+  ],
+  "scripts": {
+    "check": "node --check bin/client-version.js && node --check bin/livedesk-client.js && node --check bin/livedesk-client-node.js && node --check bin/livedesk-client-update-bootstrap.cjs && node --check bin/livedesk-client-fast.js",
+    "test:version": "node --test tests/client-version.test.mjs",
+    "pack:dry": "npm pack --dry-run",
+    "prepublishOnly": "node ../../scripts/livedesk-release-git-gate.mjs"
+  },
+  "keywords": [
+    "livedesk",
+    "remote",
+    "agent",
+    "local",
+    "desktop"
+  ],
+  "license": "MIT",
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "@ffmpeg-installer/ffmpeg": "^1.1.0",
+    "ffmpeg-static": "^5.3.0",
+    "@livedesk/runtime-core": "0.1.4",
+    "@supabase/supabase-js": "^2.110.0",
+    "node-screenshots": "^0.2.8",
+    "ws": "^8.18.3"
+  },
+  "optionalDependencies": {
+    "@livedesk/fast-linux-x64": "0.1.431",
+    "@livedesk/fast-osx-arm64": "0.1.431",
+    "@livedesk/fast-osx-x64": "0.1.431",
+    "@livedesk/fast-win-x64": "0.1.431"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/runtime/fast-runtime-repair.js

@@ -0,0 +1,300 @@
+import { randomBytes } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+
+const DEFAULT_TIMEOUT_MS = 120_000;
+const LOCK_POLL_MS = 200;
+const LOCK_STALE_MS = 10 * 60_000;
+const MAX_OUTPUT_CHARS = 64 * 1024;
+
+const PLATFORM_SPECS = Object.freeze({
+  'win32:x64': Object.freeze({
+    packageName: '@livedesk/fast-win-x64',
+    rid: 'win-x64',
+    executableName: 'livedesk-client-fast.exe'
+  }),
+  'linux:x64': Object.freeze({
+    packageName: '@livedesk/fast-linux-x64',
+    rid: 'linux-x64',
+    executableName: 'livedesk-client-fast'
+  }),
+  'darwin:x64': Object.freeze({
+    packageName: '@livedesk/fast-osx-x64',
+    rid: 'osx-x64',
+    executableName: 'livedesk-client-fast'
+  }),
+  'darwin:arm64': Object.freeze({
+    packageName: '@livedesk/fast-osx-arm64',
+    rid: 'osx-arm64',
+    executableName: 'livedesk-client-fast'
+  })
+});
+
+function exactVersion(value) {
+  const version = String(value || '').trim();
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version)
+    ? version
+    : '';
+}
+
+function boundedText(previous, chunk) {
+  const next = `${previous}${String(chunk || '')}`;
+  return next.length <= MAX_OUTPUT_CHARS ? next : next.slice(next.length - MAX_OUTPUT_CHARS);
+}
+
+function delay(milliseconds) {
+  return new Promise(resolveDelay => setTimeout(resolveDelay, milliseconds));
+}
+
+function packageDirectory(installRoot, packageName) {
+  return join(installRoot, 'node_modules', ...String(packageName).split('/'));
+}
+
+function safeSegment(value) {
+  return String(value || '').replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 160) || 'unknown';
+}
+
+function readJson(filePath) {
+  try {
+    return JSON.parse(readFileSync(filePath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function isPidAlive(value) {
+  const pid = Number(value);
+  if (!Number.isInteger(pid) || pid <= 1) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === 'EPERM';
+  }
+}
+
+function reclaimStaleLock(lockPath) {
+  try {
+    const owner = readJson(join(lockPath, 'owner.json'));
+    const ageMs = Math.max(0, Date.now() - Number(statSync(lockPath).mtimeMs || 0));
+    const ownerAlive = isPidAlive(owner?.pid);
+    if ((owner?.pid && !ownerAlive && ageMs >= 1_000) || ageMs >= LOCK_STALE_MS) {
+      rmSync(lockPath, { recursive: true, force: true });
+      return true;
+    }
+  } catch {
+    // A concurrent owner may be creating or removing the lock.
+  }
+  return false;
+}
+
+export function resolveFastPlatformSpec({
+  platform = process.platform,
+  arch = process.arch,
+  manifest = null
+} = {}) {
+  const base = PLATFORM_SPECS[`${platform}:${arch}`];
+  if (!base) return null;
+  const version = exactVersion(manifest?.optionalDependencies?.[base.packageName]);
+  if (!version) return null;
+  return Object.freeze({ ...base, version });
+}
+
+export function inspectFastRuntimePackage(packageRoot, spec) {
+  if (!packageRoot || !spec) return null;
+  const manifest = readJson(join(packageRoot, 'package.json'));
+  if (manifest?.name !== spec.packageName || manifest?.version !== spec.version) return null;
+  if (Array.isArray(manifest.os) && !manifest.os.includes(process.platform)) return null;
+  if (Array.isArray(manifest.cpu) && !manifest.cpu.includes(process.arch)) return null;
+  const fastRoot = join(packageRoot, 'fast');
+  const executable = join(fastRoot, spec.executableName);
+  const dll = join(fastRoot, 'livedesk-client-fast.dll');
+  if (!existsSync(executable) && !existsSync(dll)) return null;
+  return Object.freeze({
+    rid: spec.rid,
+    packageName: spec.packageName,
+    packageVersion: spec.version,
+    packageRoot,
+    executable,
+    dll
+  });
+}
+
+export function repairedFastInstallRoot(stateDir, spec) {
+  return join(
+    resolve(stateDir),
+    'runtime-packages',
+    `${safeSegment(spec.packageName)}-${safeSegment(spec.version)}`
+  );
+}
+
+export function inspectRepairedFastRuntime(stateDir, spec) {
+  const installRoot = repairedFastInstallRoot(stateDir, spec);
+  return inspectFastRuntimePackage(packageDirectory(installRoot, spec.packageName), spec);
+}
+
+function resolveNpmInvocation({ nodeExecutable, npmExecPath, npmExecutable }) {
+  const exactNode = resolve(String(nodeExecutable || process.execPath));
+  const cli = String(npmExecPath || '').trim();
+  const cliCandidates = cli
+    ? (/npx-cli\.js$/i.test(cli) ? [join(dirname(cli), 'npm-cli.js')] : [cli])
+    : [];
+  const npmCli = cliCandidates.find(candidate => existsSync(candidate));
+  if (npmCli) {
+    return { command: exactNode, argsPrefix: [resolve(npmCli)] };
+  }
+  const executable = String(npmExecutable || '').trim();
+  if (executable) return { command: executable, argsPrefix: [] };
+  const nodeDir = dirname(exactNode);
+  const candidates = process.platform === 'win32'
+    ? [join(nodeDir, 'npm.cmd'), join(nodeDir, 'npm.exe')]
+    : [join(nodeDir, 'npm')];
+  const fallback = candidates.find(existsSync);
+  return fallback ? { command: fallback, argsPrefix: [] } : null;
+}
+
+function runInstall({ invocation, installRoot, spec, timeoutMs, env }) {
+  return new Promise((resolveInstall, rejectInstall) => {
+    const args = [
+      ...invocation.argsPrefix,
+      'install',
+      '--ignore-scripts',
+      '--no-audit',
+      '--no-fund',
+      '--package-lock=false',
+      '--save=false',
+      '--omit=dev',
+      '--prefix', installRoot,
+      `${spec.packageName}@${spec.version}`
+    ];
+    const child = spawn(invocation.command, args, {
+      env: {
+        ...env,
+        npm_config_audit: 'false',
+        npm_config_fund: 'false',
+        npm_config_ignore_scripts: 'true',
+        npm_config_package_lock: 'false'
+      },
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+    let stdout = '';
+    let stderr = '';
+    let settled = false;
+    let timer = null;
+    const finish = (error, result = null) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      if (error) rejectInstall(error);
+      else resolveInstall(result);
+    };
+    child.stdout?.on('data', chunk => { stdout = boundedText(stdout, chunk); });
+    child.stderr?.on('data', chunk => { stderr = boundedText(stderr, chunk); });
+    child.once('error', error => finish(error));
+    child.once('exit', (code, signal) => finish(null, {
+      code: Number.isInteger(code) ? code : 1,
+      signal: String(signal || ''),
+      stdout,
+      stderr
+    }));
+    timer = setTimeout(() => {
+      try { child.kill('SIGKILL'); } catch { }
+      finish(new Error(`remote-fast-repair-timeout:${timeoutMs}`));
+    }, timeoutMs);
+    timer.unref?.();
+  });
+}
+
+export async function ensureRepairedFastRuntime({
+  stateDir,
+  spec,
+  nodeExecutable = process.execPath,
+  npmExecPath = process.env.npm_execpath || process.env.NPM_EXECPATH,
+  npmExecutable = process.env.LIVEDESK_NPM_EXECUTABLE,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  env = process.env,
+  installRunner = runInstall
+} = {}) {
+  if (!stateDir || !spec) throw new Error('remote-fast-repair-plan-required');
+  const alreadyRepaired = inspectRepairedFastRuntime(stateDir, spec);
+  if (alreadyRepaired) return alreadyRepaired;
+
+  const installRoot = repairedFastInstallRoot(stateDir, spec);
+  mkdirSync(dirname(installRoot), { recursive: true });
+  const lockPath = `${installRoot}.lock`;
+  const deadline = Date.now() + Math.max(10_000, Math.min(300_000, Number(timeoutMs) || DEFAULT_TIMEOUT_MS));
+  let ownsLock = false;
+  while (!ownsLock && Date.now() < deadline) {
+    try {
+      mkdirSync(lockPath, { recursive: false });
+      writeFileSync(join(lockPath, 'owner.json'), JSON.stringify({
+        pid: process.pid,
+        createdAt: new Date().toISOString(),
+        packageName: spec.packageName,
+        version: spec.version
+      }), { encoding: 'utf8', mode: 0o600 });
+      ownsLock = true;
+    } catch {
+      const concurrent = inspectRepairedFastRuntime(stateDir, spec);
+      if (concurrent) return concurrent;
+      if (!reclaimStaleLock(lockPath)) await delay(LOCK_POLL_MS);
+    }
+  }
+  if (!ownsLock) throw new Error('remote-fast-repair-lock-timeout');
+
+  const temporaryRoot = `${installRoot}.tmp-${process.pid}-${randomBytes(6).toString('hex')}`;
+  try {
+    const afterLock = inspectRepairedFastRuntime(stateDir, spec);
+    if (afterLock) return afterLock;
+    rmSync(temporaryRoot, { recursive: true, force: true });
+    mkdirSync(temporaryRoot, { recursive: true });
+    writeFileSync(join(temporaryRoot, 'package.json'), JSON.stringify({
+      private: true,
+      name: 'livedesk-fast-runtime-repair',
+      version: '0.0.0'
+    }), { encoding: 'utf8', mode: 0o600 });
+
+    const invocation = resolveNpmInvocation({ nodeExecutable, npmExecPath, npmExecutable });
+    if (!invocation && installRunner === runInstall) throw new Error('remote-fast-repair-npm-unavailable');
+    const remainingMs = Math.max(1_000, deadline - Date.now());
+    const result = await installRunner({
+      invocation,
+      installRoot: temporaryRoot,
+      spec,
+      timeoutMs: remainingMs,
+      env
+    });
+    if (result?.code !== 0) {
+      const detail = String(result?.stderr || result?.stdout || `exit-${result?.code ?? 'unknown'}`)
+        .replace(/\s+/g, ' ')
+        .trim()
+        .slice(0, 600);
+      throw new Error(`remote-fast-repair-install-failed:${detail || 'unknown'}`);
+    }
+    const temporaryRuntime = inspectFastRuntimePackage(
+      packageDirectory(temporaryRoot, spec.packageName),
+      spec
+    );
+    if (!temporaryRuntime) throw new Error('remote-fast-repair-package-invalid');
+
+    rmSync(installRoot, { recursive: true, force: true });
+    mkdirSync(dirname(installRoot), { recursive: true });
+    renameSync(temporaryRoot, installRoot);
+    const committed = inspectRepairedFastRuntime(stateDir, spec);
+    if (!committed) throw new Error('remote-fast-repair-commit-invalid');
+    return committed;
+  } finally {
+    rmSync(temporaryRoot, { recursive: true, force: true });
+    rmSync(lockPath, { recursive: true, force: true });
+  }
+}

package/src/security/device-credential-store.js

@@ -1,190 +1,219 @@
-import crypto from 'node:crypto';
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { decodeCanonicalBase64Url } from '@livedesk/runtime-core';
-import { createOsSecretStore, OS_SECRET_REFERENCE } from '@livedesk/runtime-core/os-secret-store';
-
-const STORE_VERSION = 1;
-
-function credentialError(code) {
-  const error = new Error(code);
-  error.code = code;
-  return error;
-}
-
-function clean(value, maximum = 512) {
-  return String(value || '').replace(/[\0\r\n]/g, '').trim().slice(0, maximum);
-}
-
-function atomicPrivateJson(filePath, value) {
-  mkdirSync(path.dirname(filePath), { recursive: true });
-  const temporary = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
-  writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-  renameSync(temporary, filePath);
-}
-
-function loadJson(filePath) {
-  try {
-    const value = JSON.parse(readFileSync(filePath, 'utf8'));
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
-  } catch {
-    return null;
-  }
-}
-
-function requirePrivateKey(value) {
-  const der = decodeCanonicalBase64Url(value, 100, 512);
-  let key;
-  try {
-    key = crypto.createPrivateKey({ key: der, format: 'der', type: 'pkcs8' });
-  } catch {
-    throw credentialError('device-private-key-invalid');
-  }
-  if (key.asymmetricKeyType !== 'ec' || key.asymmetricKeyDetails?.namedCurve !== 'prime256v1') {
-    throw credentialError('device-private-key-invalid');
-  }
-  return key;
-}
-
-function parseCredential(credential) {
-  const text = String(credential || '');
-  const parts = text.split('.');
-  if (parts.length !== 2 || text.length > 8192) throw credentialError('device-credential-invalid');
-  const payloadBytes = decodeCanonicalBase64Url(parts[0], 32, 4096);
-  const signature = decodeCanonicalBase64Url(parts[1], 64, 64);
-  let payload;
-  try {
-    payload = JSON.parse(payloadBytes.toString('utf8'));
-  } catch {
-    throw credentialError('device-credential-invalid');
-  }
-  if (!payload || Number(payload.version) !== 1) throw credentialError('device-credential-invalid');
-  const hubPublicDer = decodeCanonicalBase64Url(payload.hubPublicKey, 80, 160);
-  let hubPublicKey;
-  try {
-    hubPublicKey = crypto.createPublicKey({ key: hubPublicDer, format: 'der', type: 'spki' });
-  } catch {
-    throw credentialError('device-credential-invalid');
-  }
-  if (hubPublicKey.asymmetricKeyType !== 'ec'
-    || hubPublicKey.asymmetricKeyDetails?.namedCurve !== 'prime256v1'
-    || !crypto.verify('sha256', Buffer.from(parts[0], 'utf8'), { key: hubPublicKey, dsaEncoding: 'ieee-p1363' }, signature)) {
-    throw credentialError('device-credential-signature-invalid');
-  }
-  const normalized = {
-    serial: clean(payload.serial, 128),
-    accountId: clean(payload.accountId, 128),
-    hubId: clean(payload.hubId, 128),
-    deviceId: clean(payload.deviceId, 128),
-    devicePublicKey: clean(payload.devicePublicKey, 512),
-    hubPublicKey: hubPublicDer.toString('base64url'),
-    issuedAt: Number(payload.issuedAt),
-    expiresAt: Number(payload.expiresAt)
-  };
-  if (!normalized.serial || !normalized.accountId || !normalized.hubId || !normalized.deviceId
-    || !Number.isSafeInteger(normalized.issuedAt) || !Number.isSafeInteger(normalized.expiresAt)
-    || normalized.expiresAt <= Date.now()) {
-    throw credentialError('device-credential-expired');
-  }
-  return { text, payloadText: parts[0], payload: normalized, hubPublicKey };
-}
-
-export function createClientDeviceCredentialStore({
-  filePath = String(process.env.LIVEDESK_DEVICE_CREDENTIAL_PATH || '').trim()
-    || path.join(os.homedir(), '.livedesk-client', 'device-credential-v1.json'),
-  deviceId
-} = {}) {
-  const normalizedDeviceId = clean(deviceId, 128);
-  if (!normalizedDeviceId) throw credentialError('device-id-required');
-  const privateKeyStore = createOsSecretStore({
-    service: 'LiveDesk',
-    account: `client-device-private-key:${normalizedDeviceId}`,
-    dataDir: path.dirname(filePath)
-  });
-  let state = loadJson(filePath);
-  let privateKey;
-  let publicKey;
-  if (state) {
-    if (Number(state.version) !== STORE_VERSION || state.deviceId !== normalizedDeviceId) throw credentialError('device-key-state-invalid');
-    const plaintextPrivateKey = clean(state.privateKey, 1024);
-    if (plaintextPrivateKey) {
-      if (!privateKeyStore.write(plaintextPrivateKey)) throw credentialError('device-private-key-migration-failed');
-      state = { ...state, privateKeyRef: OS_SECRET_REFERENCE, updatedAt: new Date().toISOString() };
-      delete state.privateKey;
-      atomicPrivateJson(filePath, state);
-    }
-    if (state.privateKeyRef !== OS_SECRET_REFERENCE) throw credentialError('device-private-key-reference-invalid');
-    const privateKeyText = privateKeyStore.read();
-    if (!privateKeyText) throw credentialError('device-private-key-secure-store-unavailable');
-    privateKey = requirePrivateKey(privateKeyText);
-    publicKey = crypto.createPublicKey(privateKey);
-    const publicText = publicKey.export({ format: 'der', type: 'spki' }).toString('base64url');
-    if (publicText !== state.publicKey) throw credentialError('device-key-mismatch');
-  } else {
-    const generated = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
-    privateKey = generated.privateKey;
-    publicKey = generated.publicKey;
-    const privateKeyText = privateKey.export({ format: 'der', type: 'pkcs8' }).toString('base64url');
-    if (!privateKeyStore.write(privateKeyText)) throw credentialError('device-private-key-secure-store-unavailable');
-    state = {
-      version: STORE_VERSION,
-      deviceId: normalizedDeviceId,
-      publicKey: publicKey.export({ format: 'der', type: 'spki' }).toString('base64url'),
-      privateKeyRef: OS_SECRET_REFERENCE,
-      credential: '',
-      createdAt: new Date().toISOString(),
-      updatedAt: new Date().toISOString()
-    };
-    atomicPrivateJson(filePath, state);
-  }
-
-  function saveCredential(credential) {
-    const parsed = parseCredential(credential);
-    if (parsed.payload.deviceId !== normalizedDeviceId || parsed.payload.devicePublicKey !== state.publicKey) {
-      throw credentialError('device-credential-binding-invalid');
-    }
-    state.credential = parsed.text;
-    state.accountId = parsed.payload.accountId;
-    state.hubId = parsed.payload.hubId;
-    state.updatedAt = new Date().toISOString();
-    atomicPrivateJson(filePath, state);
-    return parsed;
-  }
-
-  function readCredential() {
-    if (!state.credential) return null;
-    try {
-      const parsed = parseCredential(state.credential);
-      if (parsed.payload.deviceId !== normalizedDeviceId || parsed.payload.devicePublicKey !== state.publicKey) return null;
-      return parsed;
-    } catch {
-      return null;
-    }
-  }
-
-  function clearCredential() {
-    state.credential = '';
-    state.accountId = '';
-    state.hubId = '';
-    state.updatedAt = new Date().toISOString();
-    atomicPrivateJson(filePath, state);
-  }
-
-  return Object.freeze({
-    filePath,
-    deviceId: normalizedDeviceId,
-    publicKey: state.publicKey,
-    privateKey,
-    sign(message) {
-      return crypto.sign('sha256', Buffer.from(String(message || ''), 'utf8'), {
-        key: privateKey,
-        dsaEncoding: 'ieee-p1363'
-      }).toString('base64url');
-    },
-    readCredential,
-    saveCredential,
-    clearCredential,
-    parseCredential
-  });
-}
+import crypto from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { decodeCanonicalBase64Url } from '@livedesk/runtime-core';
+import { createOsSecretStore, OS_SECRET_REFERENCE } from '@livedesk/runtime-core/os-secret-store';
+
+const STORE_VERSION = 1;
+
+function credentialError(code) {
+  const error = new Error(code);
+  error.code = code;
+  return error;
+}
+
+function clean(value, maximum = 512) {
+  return String(value || '').replace(/[\0\r\n]/g, '').trim().slice(0, maximum);
+}
+
+function credentialRoot() {
+  const configured = clean(process.env.LIVEDESK_CLIENT_CREDENTIAL_ROOT, 4096);
+  return configured ? path.resolve(configured) : path.join(os.homedir(), '.livedesk-client');
+}
+
+function defaultCredentialPath(deviceId) {
+  const deviceHash = crypto.createHash('sha256').update(String(deviceId), 'utf8').digest('hex');
+  return path.join(credentialRoot(), 'security', 'device-credentials', `${deviceHash}.json`);
+}
+
+function legacyCredentialPath() {
+  return path.join(credentialRoot(), 'device-credential-v1.json');
+}
+
+function atomicPrivateJson(filePath, value) {
+  mkdirSync(path.dirname(filePath), { recursive: true });
+  const temporary = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+  renameSync(temporary, filePath);
+}
+
+function loadJson(filePath) {
+  try {
+    const value = JSON.parse(readFileSync(filePath, 'utf8'));
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+function requirePrivateKey(value) {
+  const der = decodeCanonicalBase64Url(value, 100, 512);
+  let key;
+  try {
+    key = crypto.createPrivateKey({ key: der, format: 'der', type: 'pkcs8' });
+  } catch {
+    throw credentialError('device-private-key-invalid');
+  }
+  if (key.asymmetricKeyType !== 'ec' || key.asymmetricKeyDetails?.namedCurve !== 'prime256v1') {
+    throw credentialError('device-private-key-invalid');
+  }
+  return key;
+}
+
+function parseCredential(credential) {
+  const text = String(credential || '');
+  const parts = text.split('.');
+  if (parts.length !== 2 || text.length > 8192) throw credentialError('device-credential-invalid');
+  const payloadBytes = decodeCanonicalBase64Url(parts[0], 32, 4096);
+  const signature = decodeCanonicalBase64Url(parts[1], 64, 64);
+  let payload;
+  try {
+    payload = JSON.parse(payloadBytes.toString('utf8'));
+  } catch {
+    throw credentialError('device-credential-invalid');
+  }
+  if (!payload || Number(payload.version) !== 1) throw credentialError('device-credential-invalid');
+  const hubPublicDer = decodeCanonicalBase64Url(payload.hubPublicKey, 80, 160);
+  let hubPublicKey;
+  try {
+    hubPublicKey = crypto.createPublicKey({ key: hubPublicDer, format: 'der', type: 'spki' });
+  } catch {
+    throw credentialError('device-credential-invalid');
+  }
+  if (hubPublicKey.asymmetricKeyType !== 'ec'
+    || hubPublicKey.asymmetricKeyDetails?.namedCurve !== 'prime256v1'
+    || !crypto.verify('sha256', Buffer.from(parts[0], 'utf8'), { key: hubPublicKey, dsaEncoding: 'ieee-p1363' }, signature)) {
+    throw credentialError('device-credential-signature-invalid');
+  }
+  const normalized = {
+    serial: clean(payload.serial, 128),
+    accountId: clean(payload.accountId, 128),
+    hubId: clean(payload.hubId, 128),
+    deviceId: clean(payload.deviceId, 128),
+    devicePublicKey: clean(payload.devicePublicKey, 512),
+    hubPublicKey: hubPublicDer.toString('base64url'),
+    issuedAt: Number(payload.issuedAt),
+    expiresAt: Number(payload.expiresAt)
+  };
+  if (!normalized.serial || !normalized.accountId || !normalized.hubId || !normalized.deviceId
+    || !Number.isSafeInteger(normalized.issuedAt) || !Number.isSafeInteger(normalized.expiresAt)
+    || normalized.expiresAt <= Date.now()) {
+    throw credentialError('device-credential-expired');
+  }
+  return { text, payloadText: parts[0], payload: normalized, hubPublicKey };
+}
+
+export function createClientDeviceCredentialStore({
+  filePath = String(process.env.LIVEDESK_DEVICE_CREDENTIAL_PATH || '').trim(),
+  deviceId
+} = {}) {
+  const normalizedDeviceId = clean(deviceId, 128);
+  if (!normalizedDeviceId) throw credentialError('device-id-required');
+  const configuredPath = clean(filePath, 4096);
+  const resolvedFilePath = configuredPath
+    ? path.resolve(configuredPath)
+    : defaultCredentialPath(normalizedDeviceId);
+  const privateKeyStore = createOsSecretStore({
+    service: 'LiveDesk',
+    account: `client-device-private-key:${normalizedDeviceId}`,
+    dataDir: path.dirname(resolvedFilePath)
+  });
+  let state = loadJson(resolvedFilePath);
+  let migratedLegacy = false;
+  if (!state && !configuredPath && !existsSync(resolvedFilePath)) {
+    const legacyState = loadJson(legacyCredentialPath());
+    if (Number(legacyState?.version) === STORE_VERSION && legacyState?.deviceId === normalizedDeviceId) {
+      state = legacyState;
+      migratedLegacy = true;
+    }
+  }
+  let privateKey;
+  let publicKey;
+  if (state) {
+    if (Number(state.version) !== STORE_VERSION || state.deviceId !== normalizedDeviceId) throw credentialError('device-key-state-invalid');
+    const plaintextPrivateKey = clean(state.privateKey, 1024);
+    if (plaintextPrivateKey) {
+      if (!privateKeyStore.write(plaintextPrivateKey)) throw credentialError('device-private-key-migration-failed');
+      state = { ...state, privateKeyRef: OS_SECRET_REFERENCE, updatedAt: new Date().toISOString() };
+      delete state.privateKey;
+      atomicPrivateJson(resolvedFilePath, state);
+    }
+    if (state.privateKeyRef !== OS_SECRET_REFERENCE) throw credentialError('device-private-key-reference-invalid');
+    const privateKeyText = privateKeyStore.read();
+    if (!privateKeyText) throw credentialError('device-private-key-secure-store-unavailable');
+    privateKey = requirePrivateKey(privateKeyText);
+    publicKey = crypto.createPublicKey(privateKey);
+    const publicText = publicKey.export({ format: 'der', type: 'spki' }).toString('base64url');
+    if (publicText !== state.publicKey) throw credentialError('device-key-mismatch');
+    if (migratedLegacy) {
+      atomicPrivateJson(resolvedFilePath, state);
+      try { rmSync(legacyCredentialPath(), { force: true }); } catch {}
+    }
+  } else {
+    const generated = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+    privateKey = generated.privateKey;
+    publicKey = generated.publicKey;
+    const privateKeyText = privateKey.export({ format: 'der', type: 'pkcs8' }).toString('base64url');
+    if (!privateKeyStore.write(privateKeyText)) throw credentialError('device-private-key-secure-store-unavailable');
+    state = {
+      version: STORE_VERSION,
+      deviceId: normalizedDeviceId,
+      publicKey: publicKey.export({ format: 'der', type: 'spki' }).toString('base64url'),
+      privateKeyRef: OS_SECRET_REFERENCE,
+      credential: '',
+      createdAt: new Date().toISOString(),
+      updatedAt: new Date().toISOString()
+    };
+    atomicPrivateJson(resolvedFilePath, state);
+  }
+
+  function saveCredential(credential) {
+    const parsed = parseCredential(credential);
+    if (parsed.payload.deviceId !== normalizedDeviceId || parsed.payload.devicePublicKey !== state.publicKey) {
+      throw credentialError('device-credential-binding-invalid');
+    }
+    state.credential = parsed.text;
+    state.accountId = parsed.payload.accountId;
+    state.hubId = parsed.payload.hubId;
+    state.updatedAt = new Date().toISOString();
+    atomicPrivateJson(resolvedFilePath, state);
+    return parsed;
+  }
+
+  function readCredential() {
+    if (!state.credential) return null;
+    try {
+      const parsed = parseCredential(state.credential);
+      if (parsed.payload.deviceId !== normalizedDeviceId || parsed.payload.devicePublicKey !== state.publicKey) return null;
+      return parsed;
+    } catch {
+      return null;
+    }
+  }
+
+  function clearCredential() {
+    state.credential = '';
+    state.accountId = '';
+    state.hubId = '';
+    state.updatedAt = new Date().toISOString();
+    atomicPrivateJson(resolvedFilePath, state);
+  }
+
+  return Object.freeze({
+    filePath: resolvedFilePath,
+    deviceId: normalizedDeviceId,
+    publicKey: state.publicKey,
+    privateKey,
+    sign(message) {
+      return crypto.sign('sha256', Buffer.from(String(message || ''), 'utf8'), {
+        key: privateKey,
+        dsaEncoding: 'ieee-p1363'
+      }).toString('base64url');
+    },
+    readCredential,
+    saveCredential,
+    clearCredential,
+    parseCredential
+  });
+}