@livedesk/client 0.1.235 → 0.1.236

package/bin/livedesk-client.js

@@ -20,20 +20,11 @@ import {
 } from '../src/runtime/agent-process-lifecycle.js';
 import { writeWindowsOwnedProcessManifest } from '../src/runtime/windows-owned-process-manifest.js';
 import { createHubWakeListener } from '../src/runtime/hub-wake-listener.js';
-import { createClientDeviceCredentialStore } from '../src/security/device-credential-store.js';
-import { connectSecureDirect } from '../src/security/secure-direct-client.js';
 import {
     inspectLinuxVideoAcceleration,
     installLinuxVideoAcceleration
 } from '../src/runtime/linux-video-acceleration.js';
-import {
-    ensureRepairedFastRuntime,
-    inspectFastRuntimePackage,
-    inspectRepairedFastRuntime,
-    resolveFastPlatformSpec
-} from '../src/runtime/fast-runtime-repair.js';
 import { normalizeRuntimeAuthSession } from '../../runtime-core/src/auth-session.js';
-import { createOsSecretStore, OS_SECRET_REFERENCE } from '../../runtime-core/src/os-secret-store.js';
 import { startRoleTransitionSupervisor } from '../../runtime-core/src/role-transition-supervisor.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -75,11 +66,6 @@ const UNIFIED_CLIENT_AUTH_PATH = join(UNIFIED_CLIENT_STATE_DIR, 'auth.json');
 const UNIFIED_CLIENT_PIN_PATH = join(UNIFIED_CLIENT_STATE_DIR, 'pin.json');
 const CLIENT_AUTH_STORAGE_KEY = 'livedesk.client.supabase.auth';
 const CLIENT_HUB_TARGET_CACHE_STORAGE_KEY = 'livedesk.client.last-hub-target';
-const CLIENT_REFRESH_SECRET_STORE = createOsSecretStore({
-    service: 'LiveDesk',
-    account: 'client-refresh-token',
-    dataDir: UNIFIED_CLIENT_STATE_DIR
-});
 const DEVICE_ROLE_CACHE_PATH = join(UNIFIED_CLIENT_STATE_DIR, 'device-role.json');
 const FAST_PREFLIGHT_CACHE_PATH = join(UNIFIED_CLIENT_STATE_DIR, 'fast-preflight.json');
 const CLIENT_SLOT_PATH = join(UNIFIED_CLIENT_STATE_DIR, 'device-slot.json');
@@ -96,7 +82,6 @@ let agentRestartRequest = null;
 let linuxVideoAccelerationStatus = null;
 let discoveryWakeController = new AbortController();
 let networkChangeMonitor = null;
-let deviceRoleMutationTail = Promise.resolve();
 const sessionRefreshesInFlight = new WeakMap();
 const disposeAgentTerminationHandlers = installAgentTerminationHandlers({
     getAgentProcess: () => activeAgentProcess
@@ -184,17 +169,6 @@ export function requestLocalDiscoveryWake(reason = 'local-trigger') {
     previous.abort(String(reason || 'local-trigger'));
 }
 
-export function enqueueDeviceRoleMutation(operation) {
-    if (typeof operation !== 'function') {
-        return Promise.reject(new TypeError('device-role-mutation-operation-required'));
-    }
-    const pending = deviceRoleMutationTail
-        .catch(() => undefined)
-        .then(operation);
-    deviceRoleMutationTail = pending.catch(() => undefined);
-    return pending;
-}
-
 function networkInterfaceSignature() {
     return Object.entries(os.networkInterfaces())
         .flatMap(([name, entries]) => (entries || [])
@@ -336,8 +310,8 @@ Options:
   --version                       Show the agent version.
   --help                          Show this help.
 
-Auto uses the verified C# RemoteFast screen engine on supported desktop platforms.
-If an npx cache omitted it, LiveDesk restores the exact pinned platform package before connecting.
+Auto uses C# RemoteFast when supported and falls back to Node only when a
+packaged RemoteFast runtime is unavailable.
 Enable Windows auto-start from the connection page when this client signs in.
 `.trimStart());
 }
@@ -346,14 +320,6 @@ function readPackageVersion() {
     return readClientPackageVersion();
 }
 
-function readClientPackageManifest() {
-    try {
-        return JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8'));
-    } catch {
-        return null;
-    }
-}
-
 function isTruthy(value) {
     return /^(1|true|yes|on)$/i.test(String(value || '').trim());
 }
@@ -1088,20 +1054,7 @@ function readSavedSessionFromFile() {
             const raw = state?.[CLIENT_AUTH_STORAGE_KEY];
             if (typeof raw !== 'string' || !raw.trim()) continue;
             const session = JSON.parse(raw);
-            const plaintextRefreshToken = String(session?.refresh_token || '').trim();
-            const refreshToken = plaintextRefreshToken || (session?.refresh_token_ref === OS_SECRET_REFERENCE
-                ? CLIENT_REFRESH_SECRET_STORE.read()
-                : '');
-            if (plaintextRefreshToken) {
-                if (!CLIENT_REFRESH_SECRET_STORE.write(plaintextRefreshToken)) {
-                    createFileStorage(path).removeItem(CLIENT_AUTH_STORAGE_KEY);
-                    continue;
-                }
-                const migrated = { ...session, refresh_token_ref: OS_SECRET_REFERENCE };
-                delete migrated.refresh_token;
-                createFileStorage(path).setItem(CLIENT_AUTH_STORAGE_KEY, JSON.stringify(migrated));
-            }
-            const normalized = normalizeRuntimeAuthSession({ ...session, refresh_token: refreshToken }, { requireRefreshToken: true });
+            const normalized = normalizeRuntimeAuthSession(session, { requireRefreshToken: true });
             if (normalized.ok) return { ...session, ...normalized.session };
         } catch {
             // Try the next compatible state location.
@@ -1115,16 +1068,12 @@ function writeSavedSessionToFile(session) {
     if (!normalized.ok) {
         return false;
     }
-    if (!CLIENT_REFRESH_SECRET_STORE.write(normalized.session.refresh_token)) return false;
     const storage = createFileStorage(preferredClientAuthPath());
-    const persisted = { ...session, ...normalized.session, refresh_token_ref: OS_SECRET_REFERENCE };
-    delete persisted.refresh_token;
-    storage.setItem(CLIENT_AUTH_STORAGE_KEY, JSON.stringify(persisted));
+    storage.setItem(CLIENT_AUTH_STORAGE_KEY, JSON.stringify({ ...session, ...normalized.session }));
     return true;
 }
 
 function clearSavedSession() {
-    CLIENT_REFRESH_SECRET_STORE.clear();
     rmSync(CLIENT_AUTH_PATH, { force: true });
     rmSync(UNIFIED_CLIENT_AUTH_PATH, { force: true });
 }
@@ -1168,99 +1117,9 @@ export async function fetchSupabaseWithDeadline(
     }
 }
 
-const LIVEDESK_AUTHENTICATED_FETCH = '__liveDeskAuthenticatedFetch';
-
-function decodeSupabaseJwtRole(accessToken) {
-    try {
-        const parts = String(accessToken || '').split('.');
-        if (parts.length !== 3) return '';
-        const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
-        return String(payload?.role || '').trim().toLowerCase();
-    } catch {
-        return '';
-    }
-}
-
-function authenticatedSupabaseError(response, payload, fallback) {
-    const message = String(
-        payload?.message
-        || payload?.error_description
-        || payload?.error
-        || payload?.details
-        || fallback
-        || `Supabase request failed with HTTP ${response.status}.`
-    ).trim();
-    const error = new Error(message);
-    error.code = String(payload?.code || '').trim();
-    error.status = Number(response.status || 0);
-    error.details = String(payload?.details || '').trim();
-    error.hint = String(payload?.hint || '').trim();
-    return error;
-}
-
-export async function fetchAuthenticatedSupabaseJson(session, pathname, options = {}) {
-    const normalized = normalizeRuntimeAuthSession(session);
-    if (!normalized.ok) throw new Error(normalized.error);
-    const role = decodeSupabaseJwtRole(normalized.session.access_token);
-    if (role && role !== 'authenticated') {
-        throw new Error(`LiveDesk sign-in token has unexpected database role ${role}. Sign out and sign in again.`);
-    }
-    const cleanPath = String(pathname || '').replace(/^\/+/, '');
-    if (!cleanPath || cleanPath.includes('..')) throw new Error('invalid-supabase-rest-path');
-    const url = new URL(`${SUPABASE_URL.replace(/\/+$/, '')}/rest/v1/${cleanPath}`);
-    for (const [key, value] of Object.entries(options.query || {})) {
-        if (value === undefined || value === null || value === '') continue;
-        url.searchParams.set(key, String(value));
-    }
-    const headers = new Headers(options.headers || {});
-    headers.set('apikey', SUPABASE_PUBLISHABLE_KEY);
-    headers.set('Authorization', `Bearer ${normalized.session.access_token}`);
-    headers.set('Accept', 'application/json');
-    const method = String(options.method || 'GET').toUpperCase();
-    let body;
-    if (options.body !== undefined) {
-        headers.set('Content-Type', 'application/json');
-        body = JSON.stringify(options.body);
-    }
-    const fetchImpl = typeof options.fetchImpl === 'function'
-        ? options.fetchImpl
-        : fetchSupabaseWithDeadline;
-    const response = await fetchImpl(url, { method, headers, body, signal: options.signal });
-    const text = await response.text();
-    let payload = null;
-    if (text) {
-        try { payload = JSON.parse(text); }
-        catch { payload = { message: text }; }
-    }
-    if (!response.ok) throw authenticatedSupabaseError(response, payload, options.errorMessage);
-    return payload;
-}
-
-function explicitAuthenticatedFetch(supabase, override = null) {
-    if (typeof override === 'function') return override;
-    return typeof supabase?.[LIVEDESK_AUTHENTICATED_FETCH] === 'function'
-        ? supabase[LIVEDESK_AUTHENTICATED_FETCH]
-        : null;
-}
-
-export async function callVerifiedSupabaseRpc(supabase, session, functionName, args = {}, options = {}) {
-    const name = String(functionName || '').trim();
-    if (!/^[a-z0-9_]+$/u.test(name)) throw new Error('invalid-supabase-rpc-name');
-    const fetchImpl = explicitAuthenticatedFetch(supabase, options.fetchImpl);
-    if (!fetchImpl) return supabase.rpc(name, args);
-    const data = await fetchAuthenticatedSupabaseJson(session, `rpc/${name}`, {
-        method: 'POST',
-        body: args,
-        fetchImpl,
-        signal: options.signal,
-        errorMessage: `${name} failed.`
-    });
-    return { data, error: null };
-}
-
 async function createSupabaseClient() {
     const { createClient } = await import('@supabase/supabase-js');
-    const client = createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
+    return createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
         global: {
             fetch: fetchSupabaseWithDeadline
         },
@@ -1273,13 +1132,6 @@ async function createSupabaseClient() {
             storage: createFileStorage(preferredClientAuthPath())
         }
     });
-    Object.defineProperty(client, LIVEDESK_AUTHENTICATED_FETCH, {
-        value: fetchSupabaseWithDeadline,
-        enumerable: false,
-        configurable: false,
-        writable: false
-    });
-    return client;
 }
 
 function getNestedErrorCode(error) {
@@ -1327,18 +1179,12 @@ function isTransientNetworkError(error) {
     return /fetch failed|network|dns|socket|connection|timeout|getaddrinfo/i.test(getNestedErrorMessage(error));
 }
 
-export function formatDiscoveryError(error) {
+function formatDiscoveryError(error) {
     if (isTransientNetworkError(error)) {
         const code = getNestedErrorCode(error);
         return `Network is not ready yet${code ? ` (${code})` : ''}. Waiting for DNS/Wi-Fi after sleep.`;
     }
-    const message = getNestedErrorMessage(error);
-    if (message) return message;
-    for (const key of ['error_description', 'reason', 'details', 'hint', 'error', 'code']) {
-        const value = error?.[key];
-        if (typeof value === 'string' && value.trim()) return value.trim();
-    }
-    return 'LiveDesk could not read the current Hub registration yet.';
+    return error instanceof Error ? error.message : String(error);
 }
 
 function createHubDiscoveryError(code, message, cause = null) {
@@ -1439,11 +1285,8 @@ async function refreshSessionIfNeededCore(supabase) {
     const session = { ...candidate, ...normalized.session };
     const expiresAt = Number(session.expires_at || 0);
     if (expiresAt <= 0 || expiresAt - Math.floor(Date.now() / 1000) > SESSION_REFRESH_SKEW_SECONDS) {
-        // A persisted session is not automatically installed into this
-        // memory-only Supabase client after a process restart. Returning the
-        // file value without setSession makes the UI say "Signed in" while
-        // PostgREST still sends the publishable-key request as anon.
-        return activateSupabaseSession(supabase, session);
+        writeSavedSessionToFile(session);
+        return session;
     }
     const { data, error } = await supabase.auth.refreshSession(session);
     if (error) {
@@ -1494,10 +1337,14 @@ async function activateSupabaseSession(supabase, session) {
     if (!normalized.ok) {
         throw new Error(normalized.error);
     }
-    // Always install the verified session into this exact Supabase client.
-    // A freshly created client can read the persisted token through getSession()
-    // before PostgREST has adopted its Authorization header. Skipping setSession
-    // in that state makes the UI look signed in while table and RPC calls run as anon.
+    const { data: current } = await supabase.auth.getSession();
+    if (current?.session?.access_token === normalized.session.access_token) {
+        const activeSession = current.session;
+        if (!writeSavedSessionToFile(activeSession)) {
+            throw new Error('refresh-token-required');
+        }
+        return activeSession;
+    }
     const { data, error } = await supabase.auth.setSession({
         access_token: normalized.session.access_token,
         refresh_token: normalized.session.refresh_token
@@ -1516,27 +1363,6 @@ async function activateSupabaseSession(supabase, session) {
     return activeSession;
 }
 
-export async function activateRoleChangeSession(supabase, currentSession = null) {
-    if (!supabase?.auth) {
-        throw new Error('Google sign-in is temporarily unavailable. Try again in a moment.');
-    }
-    const current = normalizeRuntimeAuthSession(currentSession, { requireRefreshToken: true });
-    let session = current.ok ? current.session : await refreshSessionIfNeeded(supabase);
-    if (!session?.access_token) {
-        throw new Error('Sign in again before switching this computer to Hub.');
-    }
-    try {
-        return await activateSupabaseSession(supabase, session);
-    } catch (error) {
-        if (!isRefreshTokenAlreadyUsedError(error)) throw error;
-        session = await refreshSessionIfNeeded(supabase);
-        if (!session?.access_token) {
-            throw new Error('Sign in again before switching this computer to Hub.');
-        }
-        return activateSupabaseSession(supabase, session);
-    }
-}
-
 function escapeHtml(value) {
     return String(value ?? '')
         .replaceAll('&', '&amp;')
@@ -3254,17 +3080,14 @@ async function startConnectionChoiceServer(supabase, options = {}) {
                         res.end(JSON.stringify(hubClientPortPreflightError(portPreflight)));
                         return;
                     }
-                    const session = await activateRoleChangeSession(
-                        supabase,
-                        dashboardState.choice?.session || savedSession
-                    );
+                    const session = await refreshSessionIfNeeded(supabase);
                     const expectedRoleVersion = Number(dashboardState.roleVersion || 0);
-                    const { data, error } = await enqueueDeviceRoleMutation(() => callVerifiedSupabaseRpc(supabase, session, 'set_livedesk_device_role', {
+                    const { data, error } = await supabase.rpc('set_livedesk_device_role', {
                         p_device_id: deviceId,
                         p_role: 'hub',
                         p_assigned_hub_id: null,
                         p_expected_role_version: expectedRoleVersion > 0 ? expectedRoleVersion : null
-                    }));
+                    });
                     const result = Array.isArray(data) ? data[0] : data;
                     if (error || result?.ok === false || !session?.access_token) {
                         const reason = error?.message || result?.reason || 'role-change-rejected';
@@ -3296,7 +3119,7 @@ async function startConnectionChoiceServer(supabase, options = {}) {
 
             if (requestUrl.pathname === '/logout') {
                 try {
-                    await supabase.auth.signOut({ scope: 'local' });
+                    await supabase.auth.signOut();
                 } catch {
                 }
                 clearSavedSession();
@@ -3567,62 +3390,35 @@ async function chooseClientConnection(supabase, options = {}) {
                     relayEndpoint: options.relayEndpoint
                 });
             },
-            changeRole: async (role, snapshot, currentSession) => {
-                console.log('[LiveDesk Client] Hub role transition requested. Validating the signed-in session and local Hub port.');
+            changeRole: async (role, snapshot) => {
                 const activeSupabase = await getSupabase();
                 if (!activeSupabase) {
-                    console.warn('[LiveDesk Client] Hub role transition rejected: Google sign-in is temporarily unavailable.');
-                    return { ok: false, error: 'Google sign-in is temporarily unavailable. Try again in a moment.' };
+                    return { ok: false, error: 'supabase-session-required' };
                 }
                 const portPreflight = await preflightHubClientPort();
                 if (!portPreflight.ok) {
-                    console.warn(`[LiveDesk Client] Hub role transition rejected: ${hubClientPortPreflightError(portPreflight).error}`);
                     return hubClientPortPreflightError(portPreflight);
                 }
-                let session;
-                try {
-                    session = await activateRoleChangeSession(activeSupabase, currentSession);
-                } catch (error) {
-                    const message = formatDiscoveryError(error);
-                    console.warn(`[LiveDesk Client] Hub role transition rejected: ${message}`);
-                    if (/sign in again|refresh-token-required|invalid refresh token/i.test(message)) {
-                        return {
-                            ok: false,
-                            error: 'role-change-auth-required',
-                            message: 'Sign in again before switching this computer to Hub.',
-                            authRequired: true
-                        };
-                    }
-                    return { ok: false, error: message };
-                }
+                const session = await refreshSessionIfNeeded(activeSupabase);
                 if (!session?.access_token) {
-                    console.warn('[LiveDesk Client] Hub role transition rejected: a fresh Google sign-in is required.');
-                    return {
-                        ok: false,
-                        error: 'role-change-auth-required',
-                        message: 'Sign in again before switching this computer to Hub.',
-                        authRequired: true
-                    };
+                    return { ok: false, error: 'supabase-session-required' };
                 }
                 const expectedRoleVersion = Number(snapshot?.roleVersion || 0);
-                const { data, error } = await enqueueDeviceRoleMutation(() => callVerifiedSupabaseRpc(activeSupabase, session, 'set_livedesk_device_role', {
+                const { data, error } = await activeSupabase.rpc('set_livedesk_device_role', {
                     p_device_id: options.deviceId,
                     p_role: role,
                     p_assigned_hub_id: null,
                     p_expected_role_version: expectedRoleVersion > 0 ? expectedRoleVersion : null
-                }));
+                });
                 const result = Array.isArray(data) ? data[0] : data;
                 if (error || result?.ok === false) {
-                    const reason = error?.message || result?.reason || 'role-change-rejected';
-                    console.warn(`[LiveDesk Client] Hub role transition rejected: ${reason}`);
-                    return { ok: false, error: reason };
+                    return { ok: false, error: error?.message || result?.reason || 'role-change-rejected' };
                 }
                 const roleVersion = Number.isInteger(result?.role_version) ? result.role_version : expectedRoleVersion + 1;
                 writeLocalRoleCache(role, options.deviceId, roleVersion);
                 roleRestartRequest = { role, requestedAt: new Date().toISOString() };
                 requestLocalDiscoveryWake('role-change');
                 try { requestActiveAgentStop(); } catch { /* the lifecycle loop observes the role request */ }
-                console.log(`[LiveDesk Client] Hub role transition accepted at role revision ${roleVersion}. Starting the Hub runtime.`);
                 return { ok: true, restarting: true, role, roleVersion };
             },
             videoAcceleration: linuxVideoAccelerationStatus,
@@ -3774,57 +3570,45 @@ export function shouldSkipAutomaticDirectProbe(endpoint, options = {}) {
         && !isEndpointOnLocalNetwork(endpoint, options.networkInterfaces);
 }
 
-export async function requestHubSlotAssignment({ manager, pairToken, deviceId, slotNumber, timeoutMs = 5000 }) {
+function requestHubSlotAssignment({ manager, pairToken, deviceId, slotNumber, timeoutMs = 5000 }) {
     const endpoint = parseManagerEndpoint(manager);
     const normalizedPairToken = String(pairToken || '').trim();
     const normalizedDeviceId = String(deviceId || '').trim();
     const normalizedSlot = normalizeSlotNumber(slotNumber);
     if (!endpoint) {
-        return { ok: false, error: 'hub-endpoint-unavailable' };
+        return Promise.resolve({ ok: false, error: 'hub-endpoint-unavailable' });
     }
     if (!normalizedPairToken) {
-        return { ok: false, error: 'hub-pair-token-unavailable' };
+        return Promise.resolve({ ok: false, error: 'hub-pair-token-unavailable' });
     }
     if (!normalizedDeviceId) {
-        return { ok: false, error: 'device-id-required' };
+        return Promise.resolve({ ok: false, error: 'device-id-required' });
     }
     if (!normalizedSlot) {
-        return { ok: false, error: 'invalid-slot-number' };
-    }
-
-    let socket;
-    try {
-        const credentialStore = createClientDeviceCredentialStore({ deviceId: normalizedDeviceId });
-        socket = await connectSecureDirect({
-            host: endpoint.host,
-            port: endpoint.port,
-            channel: 'control',
-            deviceId: normalizedDeviceId,
-            enrollmentToken: normalizedPairToken,
-            credentialStore,
-            timeoutMs
-        });
-    } catch (error) {
-        return { ok: false, error: error?.code || error?.message || 'hub-slot-secure-connect-failed' };
+        return Promise.resolve({ ok: false, error: 'invalid-slot-number' });
     }
 
     return new Promise(resolveAssignment => {
+        const socket = net.createConnection(endpoint);
         let settled = false;
         let buffer = '';
-        const timer = setTimeout(
-            () => settle({ ok: false, error: 'hub-slot-request-timeout' }),
-            Math.max(250, Math.min(30_000, Number(timeoutMs) || 5000))
-        );
-        timer.unref?.();
         const settle = result => {
             if (settled) return;
             settled = true;
-            clearTimeout(timer);
             socket.removeAllListeners();
             socket.destroy();
             resolveAssignment(result);
         };
         socket.setEncoding('utf8');
+        socket.setTimeout(timeoutMs);
+        socket.once('connect', () => {
+            socket.write(`${JSON.stringify({
+                type: 'slot.assign',
+                pairToken: normalizedPairToken,
+                deviceId: normalizedDeviceId,
+                slotNumber: Number(normalizedSlot)
+            })}\n`);
+        });
         socket.on('data', chunk => {
             buffer += chunk;
             const newlineIndex = buffer.indexOf('\n');
@@ -3840,15 +3624,11 @@ export async function requestHubSlotAssignment({ manager, pairToken, deviceId, s
                 settle({ ok: false, error: 'invalid-hub-response' });
             }
         });
+        socket.once('timeout', () => settle({ ok: false, error: 'hub-slot-request-timeout' }));
         socket.once('error', error => settle({ ok: false, error: error?.message || 'hub-slot-request-failed' }));
         socket.once('close', () => {
-                if (!settled) settle({ ok: false, error: 'hub-slot-response-missing' });
+            if (!settled) settle({ ok: false, error: 'hub-slot-response-missing' });
         });
-        socket.write(`${JSON.stringify({
-            type: 'slot.assign',
-            deviceId: normalizedDeviceId,
-            slotNumber: Number(normalizedSlot)
-        })}\n`);
     });
 }
 
@@ -4032,9 +3812,7 @@ export async function runFreshHubRegistryLookup(resolveFreshTarget, options = {}
     }
     const timeoutMs = normalizeFreshRegistryTimeoutMs(options.timeoutMs);
     const controller = new AbortController();
-    const externalSignal = options.signal;
     let timeoutHandle = null;
-    let removeExternalAbort = () => undefined;
     const lookupOutcome = Promise.resolve()
         .then(() => resolveFreshTarget(controller.signal))
         .then(
@@ -4048,17 +3826,6 @@ export async function runFreshHubRegistryLookup(resolveFreshTarget, options = {}
         );
     });
     const outcomes = [lookupOutcome, timeoutOutcome];
-    if (externalSignal) {
-        outcomes.push(new Promise(resolveAbort => {
-            const onAbort = () => resolveAbort({ type: 'local-trigger' });
-            if (externalSignal.aborted) {
-                onAbort();
-                return;
-            }
-            externalSignal.addEventListener('abort', onAbort, { once: true });
-            removeExternalAbort = () => externalSignal.removeEventListener('abort', onAbort);
-        }));
-    }
     if (options.wakePromise && typeof options.wakePromise.then === 'function') {
         outcomes.push(Promise.resolve(options.wakePromise).then(
             event => ({ type: 'hub-online', event }),
@@ -4067,12 +3834,7 @@ export async function runFreshHubRegistryLookup(resolveFreshTarget, options = {}
     }
     const outcome = await Promise.race(outcomes).finally(() => {
         clearTimeout(timeoutHandle);
-        removeExternalAbort();
     });
-    if (outcome.type === 'local-trigger') {
-        controller.abort('local-trigger');
-        return outcome;
-    }
     if (outcome.type === 'hub-online') {
         controller.abort('hub-online');
         return outcome;
@@ -4185,45 +3947,20 @@ export async function resolveManagerFromSupabase(supabase, options = {}) {
     if (options.signal?.aborted) {
         throw createHubDiscoveryError('hub-registry-aborted', 'LiveDesk Hub registry lookup was cancelled.');
     }
-    const fetchImpl = explicitAuthenticatedFetch(supabase, options.fetchImpl);
-    const supplied = normalizeRuntimeAuthSession(options.session, { requireRefreshToken: true });
-    const suppliedExpiresAt = Number(supplied.session?.expires_at || 0);
-    const suppliedFresh = supplied.ok && (suppliedExpiresAt <= 0
-        || suppliedExpiresAt - Math.floor(Date.now() / 1000) > SESSION_REFRESH_SKEW_SECONDS);
-    let session = suppliedFresh ? supplied.session : await refreshSessionIfNeeded(supabase);
-    if (!session?.access_token) {
-        throw createHubDiscoveryError('hub-registry-auth-required', 'Sign in again before finding the LiveDesk Hub.');
-    }
-    if (!fetchImpl && suppliedFresh) {
-        session = await activateSupabaseSession(supabase, session);
-    }
+    await refreshSessionIfNeeded(supabase);
     if (options.signal?.aborted) {
         throw createHubDiscoveryError('hub-registry-aborted', 'LiveDesk Hub registry lookup was cancelled.');
     }
-    let data;
-    if (fetchImpl) {
-        const payload = await fetchAuthenticatedSupabaseJson(session, 'livedesk_remote_host_targets', {
-            fetchImpl,
-            signal: options.signal,
-            query: {
-                select: 'node_id,endpoint,endpoint_candidates,pair_token,active,expires_at,updated_at,manager_version',
-                product_key: 'eq.livedesk',
-                limit: '1'
-            },
-            errorMessage: 'LiveDesk could not read the current Hub registration.'
-        });
-        data = Array.isArray(payload) ? payload[0] : payload;
-    } else {
-        let query = supabase
-            .from('livedesk_remote_host_targets')
-            .select('node_id, endpoint, endpoint_candidates, pair_token, active, expires_at, updated_at, manager_version')
-            .eq('product_key', 'livedesk');
-        if (options.signal && typeof query.abortSignal === 'function') {
-            query = query.abortSignal(options.signal);
-        }
-        const result = await query.maybeSingle();
-        if (result.error) throw result.error;
-        data = result.data;
+    let query = supabase
+        .from('livedesk_remote_host_targets')
+        .select('node_id, endpoint, endpoint_candidates, pair_token, active, expires_at, updated_at, manager_version')
+        .eq('product_key', 'livedesk');
+    if (options.signal && typeof query.abortSignal === 'function') {
+        query = query.abortSignal(options.signal);
+    }
+    const { data, error } = await query.maybeSingle();
+    if (error) {
+        throw error;
     }
     if (!data?.active) {
         throw createHubDiscoveryError(
@@ -4276,28 +4013,17 @@ async function registerClientDeviceWithSupabase(supabase, options = {}) {
     if (!options.deviceId || !options.session?.access_token) {
         return null;
     }
-    if (roleRestartRequest?.role) {
-        return { ok: false, skipped: true, reason: 'role-transition-pending' };
-    }
     try {
-        const { data, error } = await enqueueDeviceRoleMutation(() => {
-            if (roleRestartRequest?.role) {
-                return { data: { ok: false, skipped: true, reason: 'role-transition-pending' }, error: null };
-            }
-            return callVerifiedSupabaseRpc(supabase, options.session, 'register_livedesk_device', {
-                p_device_id: options.deviceId,
-                p_device_name: options.deviceName || os.hostname(),
-                p_role: 'client',
-                p_assigned_hub_id: options.assignedHubId || null,
-                p_platform: os.platform(),
-                p_os_version: os.release(),
-                p_app_version: readPackageVersion()
-            });
+        const { data, error } = await supabase.rpc('register_livedesk_device', {
+            p_device_id: options.deviceId,
+            p_device_name: options.deviceName || os.hostname(),
+            p_role: 'client',
+            p_assigned_hub_id: options.assignedHubId || null,
+            p_platform: os.platform(),
+            p_os_version: os.release(),
+            p_app_version: readPackageVersion()
         });
         const result = Array.isArray(data) ? data[0] : data;
-        if (result?.skipped === true && result?.reason === 'role-transition-pending') {
-            return result;
-        }
         if (error || result?.ok === false) {
             console.warn(`[LiveDesk Client] Device role registration unavailable: ${error?.message || result?.reason || 'unknown-error'}`);
         }
@@ -4318,7 +4044,6 @@ export async function waitForManagerFromSupabase(supabase, options = {}) {
     let lastMessage = '';
     let wakeListener = null;
     let initialError = options.initialError || null;
-    let discoverySession = options.session || null;
     console.log('Waiting for a LiveDesk Hub. LiveDesk is listening for Hub-online events with adaptive registry retries as a fallback.');
     try {
         while (true) {
@@ -4328,16 +4053,7 @@ export async function waitForManagerFromSupabase(supabase, options = {}) {
             if (!wakeListener) {
                 try {
                     wakeListener = await createWakeListener({
-                        getAccessToken: async () => {
-                            const normalized = normalizeRuntimeAuthSession(discoverySession, { requireRefreshToken: true });
-                            const expiresAt = Number(normalized.session?.expires_at || 0);
-                            if (normalized.ok && (expiresAt <= 0
-                                || expiresAt - Math.floor(Date.now() / 1000) > SESSION_REFRESH_SKEW_SECONDS)) {
-                                return normalized.session.access_token;
-                            }
-                            discoverySession = await refreshSessionIfNeeded(supabase);
-                            return discoverySession?.access_token || '';
-                        }
+                        getAccessToken: async () => (await refreshSessionIfNeeded(supabase))?.access_token || ''
                     });
                 } catch (error) {
                     if (attempts === 0) {
@@ -4356,19 +4072,13 @@ export async function waitForManagerFromSupabase(supabase, options = {}) {
                     signal => resolveManagerFromSupabase(supabase, {
                         allowRelayFallback: options.allowRelayFallback === true,
                         probeEndpoint: options.probeEndpoint,
-                        session: discoverySession,
                         signal
                     }),
                     {
                         timeoutMs: options.freshTimeoutMs,
-                        wakePromise: wakeListener?.promise,
-                        signal: discoveryWakeController.signal
+                        wakePromise: wakeListener?.promise
                     }
                 );
-                if (outcome.type === 'local-trigger') {
-                    if (shouldStop()) return null;
-                    continue;
-                }
                 if (outcome.type === 'hub-online') {
                     wakeListener?.close();
                     wakeListener = null;
@@ -4527,7 +4237,6 @@ async function prepareLoginConnection(parsed, existingConnectionPage = null, get
                         }
                         return await resolveManagerFromSupabase(supabase, {
                             allowRelayFallback,
-                            session,
                             signal
                         });
                     }
@@ -4535,18 +4244,6 @@ async function prepareLoginConnection(parsed, existingConnectionPage = null, get
             } catch (error) {
                 initialDiscoveryError = error;
             }
-            if (roleRestartRequest?.role) {
-                return {
-                    ...parsed,
-                    manager,
-                    pair,
-                    slot: normalizeSlotNumber(parsed.slot),
-                    connectionPage,
-                    forwarded,
-                    rediscoverOnDisconnect: shouldLogin,
-                    rediscoverOnInvalidPair: shouldLogin
-                };
-            }
             discoverySource = resolved?.discoverySource || 'supabase';
             if (resolved?.discoverySource === 'cache') {
                 writeSavedSessionToFile(session);
@@ -4560,13 +4257,12 @@ async function prepareLoginConnection(parsed, existingConnectionPage = null, get
             if (!resolved) {
                 resolved = await waitForManagerFromSupabase(supabase, {
                     allowRelayFallback,
-                    session,
                     initialError: initialDiscoveryError,
                     shouldStop: () => Boolean(roleRestartRequest?.role)
                 });
                 discoverySource = 'supabase';
             }
-            if (roleRestartRequest?.role) {
+            if (!resolved && roleRestartRequest?.role) {
                 return {
                     ...parsed,
                     manager,
@@ -4681,67 +4377,42 @@ async function prepareLoginConnection(parsed, existingConnectionPage = null, get
     };
 }
 
-function getFastRuntimeSpec() {
-    return resolveFastPlatformSpec({
-        platform: os.platform(),
-        arch: os.arch(),
-        manifest: readClientPackageManifest()
-    });
-}
-
 function getFastRuntime() {
-    const spec = getFastRuntimeSpec();
-    if (!spec) return null;
-    try {
-        const packagePath = require.resolve(`${spec.packageName}/package.json`);
-        const installed = inspectFastRuntimePackage(dirname(packagePath), spec);
-        if (installed) return { ...installed, source: 'optional-dependency' };
-    } catch {
-        // A cached npx install can be complete except for its optional platform package.
-    }
-    const bundledFastRoot = join(packageRoot, 'fast', spec.rid);
-    const bundled = {
-        rid: spec.rid,
-        packageName: '',
-        packageVersion: spec.version,
-        executable: join(bundledFastRoot, spec.executableName),
-        dll: join(bundledFastRoot, 'livedesk-client-fast.dll'),
-        source: 'bundled-development-runtime'
-    };
-    if (hasFastExecutable(bundled) || hasFastDll(bundled)) return bundled;
-    const repaired = inspectRepairedFastRuntime(UNIFIED_CLIENT_STATE_DIR, spec);
-    if (repaired) return { ...repaired, source: 'repaired-runtime-cache' };
-    return { ...bundled, packageName: spec.packageName, source: 'missing' };
-}
-
-async function repairFastRuntimeIfMissing(runtime, connectionPage = null) {
-    if (hasFastExecutable(runtime) || hasFastDll(runtime)) return runtime;
-    const spec = getFastRuntimeSpec();
-    if (!spec) return runtime;
-    const label = `${spec.packageName}@${spec.version}`;
-    console.warn(`[LiveDesk Client] RemoteFast ${spec.rid} is missing from the npx installation. Repairing ${label}.`);
-    connectionPage?.update({
-        message: `Installing the verified ${spec.rid} screen engine. This is needed only when the npx cache omitted it.`,
-        agent: {
-            requestedEngine: 'fast',
-            engine: 'fast',
-            state: 'repairing',
-            runtimeId: spec.rid,
-            command: label,
-            args: []
+    const platform = os.platform();
+    const arch = os.arch();
+    const resolvePackagedRuntime = (packageName, rid, executableName) => {
+        try {
+            const packagePath = require.resolve(`${packageName}/package.json`);
+            const fastRoot = join(dirname(packagePath), 'fast');
+            return {
+                rid,
+                packageName,
+                executable: join(fastRoot, executableName),
+                dll: join(fastRoot, 'livedesk-client-fast.dll')
+            };
+        } catch {
+            return {
+                rid,
+                packageName: '',
+                executable: join(packageRoot, 'fast', rid, executableName),
+                dll: join(packageRoot, 'fast', rid, 'livedesk-client-fast.dll')
+            };
         }
-    });
-    const repaired = await ensureRepairedFastRuntime({
-        stateDir: UNIFIED_CLIENT_STATE_DIR,
-        spec,
-        nodeExecutable: process.execPath,
-        npmExecPath: process.env.npm_execpath || process.env.NPM_EXECPATH,
-        npmExecutable: process.env.LIVEDESK_NPM_EXECUTABLE,
-        env: process.env
-    });
-    clearFastPreflightCache();
-    console.log(`[LiveDesk Client] Repaired ${label} in the private LiveDesk runtime cache.`);
-    return { ...repaired, source: 'repaired-runtime-cache' };
+    };
+    if (platform === 'win32' && arch === 'x64') {
+        return resolvePackagedRuntime('@livedesk/fast-win-x64', 'win-x64', 'livedesk-client-fast.exe');
+    }
+    if (platform === 'darwin' && arch === 'arm64') {
+        return resolvePackagedRuntime('@livedesk/fast-osx-arm64', 'osx-arm64', 'livedesk-client-fast');
+    }
+    if (platform === 'darwin' && arch === 'x64') {
+        return resolvePackagedRuntime('@livedesk/fast-osx-x64', 'osx-x64', 'livedesk-client-fast');
+    }
+    if (platform === 'linux' && arch === 'x64') {
+        return resolvePackagedRuntime('@livedesk/fast-linux-x64', 'linux-x64', 'livedesk-client-fast');
+    }
+
+    return null;
 }
 
 function summarizeText(value, maxLength = 600) {
@@ -5345,12 +5016,6 @@ export async function runClientRuntime(argv = process.argv.slice(2), runtimeOpti
     };
     let connectionPage = null;
     if (isTruthy(process.env.LIVEDESK_UNIFIED_RUNTIME)) {
-        // Hydrate the local runtime from the DPAPI/keychain-backed saved session
-        // before opening the browser. Starting the page as anonymous and only
-        // reading this session later lets the renderer begin a redundant Google
-        // OAuth flow on every process restart. The discovery path below still
-        // refreshes and installs this session into the exact Supabase client.
-        const persistedStartupSession = readSavedSessionFromFile();
         let resolveStarted;
         let rejectStarted;
         const started = new Promise((resolve, reject) => {
@@ -5364,8 +5029,8 @@ export async function runClientRuntime(argv = process.argv.slice(2), runtimeOpti
             engine: parsed.engine,
             slot: parsed.slot,
             startupArgs: buildStartupClientArgs(parsed),
-            savedSession: persistedStartupSession,
-            loadSavedSession: true,
+            savedSession: null,
+            loadSavedSession: false,
             savedPin: null,
             allowRelayFallback: transportAllowsRelay(parsed.transport),
             relayEndpoint: parsed.relay,
@@ -5401,31 +5066,7 @@ export async function runClientRuntime(argv = process.argv.slice(2), runtimeOpti
             connectionPage?.close?.();
             process.exit(0);
         }
-        let fastRuntime = getFastRuntime();
-        const fastSpec = getFastRuntimeSpec();
-        let fastRepairError = null;
-        if (prepared.engine !== 'node'
-            && fastSpec
-            && !hasFastExecutable(fastRuntime)
-            && !hasFastDll(fastRuntime)) {
-            try {
-                fastRuntime = await repairFastRuntimeIfMissing(fastRuntime, prepared.connectionPage);
-            } catch (error) {
-                fastRepairError = error;
-                const message = summarizeText(error?.message || error, 600);
-                console.error(`[LiveDesk Client] RemoteFast repair failed: ${message}`);
-                prepared.connectionPage?.update({
-                    agent: {
-                        requestedEngine: prepared.engine,
-                        engine: 'fast',
-                        state: 'failed',
-                        runtimeId: fastSpec.rid,
-                        error: message
-                    },
-                    message: 'The screen engine could not be restored. LiveDesk did not start a reduced Node connection.'
-                });
-            }
-        }
+        const fastRuntime = getFastRuntime();
         const fastRequired = requiresFastTransport(prepared);
         if (fastRequired && prepared.engine === 'node') {
             throw new Error(
@@ -5476,25 +5117,13 @@ export async function runClientRuntime(argv = process.argv.slice(2), runtimeOpti
                         state: 'running'
                     });
                 });
-            } else if (prepared.engine === 'fast'
-                || fastRequired
-                || fastRepairError
-                || (fastSpec && fastRuntime?.source === 'missing')) {
-                const repairDetail = fastRepairError
-                    ? ` Automatic repair failed: ${summarizeText(fastRepairError?.message || fastRepairError, 500)}`
-                    : '';
-                const unavailableMessage = `C# RemoteFast is unavailable: ${fastLaunch.reason}.${repairDetail}`;
-                console.error(`${unavailableMessage} The reduced Node connection was not started because it cannot provide the required LiveDesk screen stream.`);
-                prepared.connectionPage?.update({
-                    agent: {
-                        requestedEngine: prepared.engine,
-                        engine: 'fast',
-                        state: 'failed',
-                        runtimeId: fastRuntime?.rid || fastSpec?.rid || '',
-                        error: unavailableMessage
-                    },
-                    message: 'LiveDesk could not start the verified screen engine. Restart the same @latest command after network access is restored.'
-                });
+            } else if (prepared.engine === 'fast' || fastRequired) {
+                console.error(
+                    `C# RemoteFast is unavailable: ${fastLaunch.reason}. `
+                    + (fastRequired
+                        ? 'The requested P2P, WebSocket, or encrypted relay transport requires the packaged RemoteFast runtime; the legacy Node agent was not started.'
+                        : 'Use --engine node to run the legacy Node agent.')
+                );
                 prepared.connectionPage?.close?.();
                 process.exit(2);
             } else {