@livedesk/hub 0.1.17 → 0.1.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "LiveDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",

package/src/agents/agent-manager.js

@@ -42,7 +42,11 @@ export function createAgentManager({
 
   async function publicSettings() {
     const current = await settings.get();
-    const { codexMaxTurns: _codexMaxTurns, ...exposedSettings } = current;
+    const {
+      codexMaxTurns: _codexMaxTurns,
+      provider: _provider,
+      ...exposedSettings
+    } = current;
     const codex = await getCodexStatus();
     const securityStatus = runtime?.getSecurityStatus?.() || {
       isolatedCodexHome: false,
@@ -55,7 +59,6 @@ export function createAgentManager({
     };
     return {
       ...exposedSettings,
-      provider: AGENT_PROVIDER_CODEX,
       codexInstallation: codex.installed ? 'installed' : 'not-installed',
       codexAuth: codex.authenticated,
       codexStatus: codex.status,

package/src/agents/codex-agent-runtime.js

@@ -3,10 +3,9 @@ import { access, link, mkdir, stat, unlink } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
-import { createRequire } from 'node:module';
-import { AgentProviderError } from './provider-errors.js';
-import { AGENT_PROVIDER_CODEX } from './agent-settings.js';
-import { AGENT_TOOL_NAMES } from './agent-tool-registry.js';
+import { createRequire } from 'node:module';
+import { AgentProviderError } from './provider-errors.js';
+import { AGENT_TOOL_NAMES } from './agent-tool-registry.js';
 import { createAgentPermissionPolicy, hashAgentPermissionPolicy } from './agent-permissions.js';
 
 const require = createRequire(import.meta.url);
@@ -427,11 +426,10 @@ export function createCodexAgentRuntime({
   }
 
   function publicRun(run) {
-    return {
-      runId: run.runId,
-      status: run.status,
-      provider: AGENT_PROVIDER_CODEX,
-      instruction: run.instruction,
+    return {
+      runId: run.runId,
+      status: run.status,
+      instruction: run.instruction,
       threadId: run.threadId,
       finalResponse: run.finalResponse,
       error: run.error,
@@ -654,10 +652,9 @@ export function createCodexAgentRuntime({
     const permissionPolicy = freezeAgentPermissionPolicy(input.permissionPolicy && typeof input.permissionPolicy === 'object'
       ? input.permissionPolicy
       : createAgentPermissionPolicy({ mode: input.permissionMode || 'safe-auto', deviceIds, maxToolCalls: settings.codexMaxToolCalls }));
-    const run = {
-      runId: crypto.randomUUID(),
-      status: 'queued',
-      provider: AGENT_PROVIDER_CODEX,
+    const run = {
+      runId: crypto.randomUUID(),
+      status: 'queued',
       instruction,
       deviceIds,
       threadId: '',

package/src/remote-hub.js

@@ -4232,9 +4232,11 @@ export function createRemoteHub(options = {}) {
         const captureTimingAvailable = hasFrameCaptureTiming(message);
         const videoTransport = transport === 'udp-p2p'
             ? 'p2p-udp'
-            : transport === 'ws-binary'
-                ? 'direct-ws'
-                : 'direct-tcp';
+            : transport === 'relay-binary'
+                ? 'encrypted-relay'
+                : transport === 'ws-binary'
+                    ? 'direct-ws'
+                    : 'direct-tcp';
         device.latestLiveFrame = {
             streamId,
             frameSeq,
@@ -4322,9 +4324,16 @@ export function createRemoteHub(options = {}) {
             deltaRefreshTileCount: Number.isFinite(Number(message.deltaRefreshTileCount)) ? Number(message.deltaRefreshTileCount) : 0,
             deltaTotalTiles: Number.isFinite(Number(message.deltaTotalTiles)) ? Number(message.deltaTotalTiles) : 0,
             videoTransport,
-            frameTransportActive: safeString(message.frameTransportActive, 20) || (videoTransport === 'p2p-udp' ? 'p2p' : 'direct'),
+            frameTransportActive: safeString(message.frameTransportActive, 20)
+                || (videoTransport === 'p2p-udp' ? 'p2p' : videoTransport === 'encrypted-relay' ? 'relay' : 'direct'),
             frameTransportProtocol: safeString(message.frameTransportProtocol, 20)
-                || (videoTransport === 'p2p-udp' ? 'udp' : videoTransport === 'direct-ws' ? 'ws' : 'tcp'),
+                || (videoTransport === 'p2p-udp'
+                    ? 'udp'
+                    : videoTransport === 'encrypted-relay'
+                        ? 'relay'
+                        : videoTransport === 'direct-ws'
+                            ? 'ws'
+                            : 'tcp'),
             frameTransportState: safeString(message.frameTransportState, 20) || 'active',
             frameTransportP2pReady: message.frameTransportP2pReady === true,
             frameTransportReason: safeString(message.frameTransportReason, 240),
@@ -4518,7 +4527,11 @@ export function createRemoteHub(options = {}) {
         }
 
         const frameKind = safeString(header.frameKind || header.kind || header.frameType || '', 40).toLowerCase();
-        const binaryTransport = state.binaryTransport === 'ws-binary' ? 'ws-binary' : 'binary';
+        const binaryTransport = socket.__liveDeskRelayControl === true
+            ? 'relay-binary'
+            : state.binaryTransport === 'ws-binary'
+                ? 'ws-binary'
+                : 'binary';
         if (frameKind === 'thumbnail' || header.type === 'thumbnail.binary') {
             applyThumbnailFrame(device, header, framePayload, binaryTransport);
             return;

package/src/server.js

@@ -2127,9 +2127,11 @@ function buildRemoteFrameBinaryPacket(frameEvent, diagnostics = {}) {
     transport: frame.transport || '',
     videoTransport: frame.videoTransport || (frame.transport === 'udp-p2p'
       ? 'p2p-udp'
-      : frame.transport === 'ws-binary'
-        ? 'direct-ws'
-        : 'direct-tcp'),
+      : frame.transport === 'relay-binary'
+        ? 'encrypted-relay'
+        : frame.transport === 'ws-binary'
+          ? 'direct-ws'
+          : 'direct-tcp'),
     frameTransportActive: frame.frameTransportActive || '',
     frameTransportProtocol: frame.frameTransportProtocol || '',
     frameTransportState: frame.frameTransportState || '',

package/src/transport/udp-hub-transport.js

@@ -2,10 +2,10 @@ import crypto from 'node:crypto';
 import { lookup } from 'node:dns/promises';
 import dgram from 'node:dgram';
 import {
-    UDP_MAX_DATAGRAM_BYTES,
-    UDP_P2P_PROTOCOL,
-    UdpFrameReassembler,
-    UdpReplayWindow,
+    UDP_MAX_DATAGRAM_BYTES,
+    UDP_P2P_PROTOCOL,
+    UdpFrameReassembler,
+    UdpReplayWindow,
     decodeRendezvousMessage,
     decodeUdpPacket,
     encodeRendezvousMessage,
@@ -52,7 +52,7 @@ export function createHubUdpTransport({ env = process.env, logEvent = () => {},
     const socket = dgram.createSocket('udp4');
     const sessions = new Map();
     let frameHandler = () => {};
-    let eventHandler = () => {};
+    let eventHandler = () => {};
     let started = false;
     let boundPort = requestedPort;
     let sequence = crypto.randomInt(1, 0x7fffffff);
@@ -65,20 +65,20 @@ export function createHubUdpTransport({ env = process.env, logEvent = () => {},
         if (trace) logEvent('udp', `${type} ${JSON.stringify({ deviceId: event.deviceId || '', state: event.state || '', reason: event.reason || '' })}`);
     }
 
-    function nextSequence() {
-        sequence = (sequence + 1) >>> 0;
-        return sequence;
-    }
-
+    function nextSequence() {
+        sequence = (sequence + 1) >>> 0;
+        return sequence;
+    }
+
     function sendPacket(session, type, header = {}, payload = Buffer.alloc(0), address = session.clientEndpoint || session.peerEndpoint) {
         if (!address || !session) return false;
-        let packet;
-        try {
-            packet = encodeUdpPacket({ type, sessionId: session.sessionId, key: session.key, sequence: nextSequence(), header, payload });
-        } catch (error) {
-            logWarn('udp', `UDP packet rejected device=${session.deviceId}: ${error?.message || error}`);
-            return false;
-        }
+        let packet;
+        try {
+            packet = encodeUdpPacket({ type, sessionId: session.sessionId, key: session.key, sequence: nextSequence(), header, payload });
+        } catch (error) {
+            logWarn('udp', `UDP packet rejected device=${session.deviceId}: ${error?.message || error}`);
+            return false;
+        }
         socket.send(packet, address.port, address.address);
         return true;
     }
@@ -288,9 +288,9 @@ export function createHubUdpTransport({ env = process.env, logEvent = () => {},
             keyBase64: key.toString('base64'),
             rendezvousToken: crypto.randomBytes(16).toString('hex'),
             sendControl,
-            clientEndpoint: null,
-            peerEndpoint: null,
-            replay: new UdpReplayWindow(),
+            clientEndpoint: null,
+            peerEndpoint: null,
+            replay: new UdpReplayWindow(),
             reassembler: new UdpFrameReassembler({ maxPending: maxPendingFrames, timeoutMs: frameTimeoutMs }),
             ready: false,
             createdAt: Date.now(),
@@ -333,8 +333,8 @@ export function createHubUdpTransport({ env = process.env, logEvent = () => {},
         return {
             enabled,
             preferred: preferP2p,
-            state: session.ready ? 'udp-ready' : 'udp-session-created',
-            ready: session.ready,
+            state: session.ready ? 'udp-ready' : 'udp-session-created',
+            ready: session.ready,
             sessionId: session.sessionId,
             lastPacketAt: session.lastPacketAt ? new Date(session.lastPacketAt).toISOString() : '',
             framesReceived: session.framesReceived,

package/src/transport/udp-protocol.js

@@ -2,9 +2,11 @@ import crypto from 'node:crypto';
 import { inflateRawSync } from 'node:zlib';
 
 export const UDP_P2P_PROTOCOL = 'livedesk.udp.p2p.v1';
-export const UDP_P2P_VERSION = 1;
-export const UDP_MAX_DATAGRAM_BYTES = 1200;
-export const UDP_PACKET_TYPES = Object.freeze({
+export const UDP_P2P_VERSION = 1;
+export const UDP_MAX_DATAGRAM_BYTES = 1200;
+const UDP_SERIAL_MODULUS = 0x1_0000_0000;
+const UDP_SERIAL_HALF_RANGE = 0x8000_0000;
+export const UDP_PACKET_TYPES = Object.freeze({
     probe: 1,
     'probe-ack': 2,
     ready: 3,
@@ -83,13 +85,21 @@ function decodeFramedPayload(payload, legacyHeader = null) {
     }
 }
 
-function packetTypeCode(type) {
+function packetTypeCode(type) {
     const code = typeof type === 'number' ? type : UDP_PACKET_TYPES[String(type || '').toLowerCase()];
     if (!code || !UDP_PACKET_TYPE_NAMES.has(code)) throw new Error('invalid-udp-packet-type');
     return code;
-}
-
-function encodeHeader(header) {
+}
+
+function normalizeSequence(value) {
+    const sequence = Number(value);
+    if (!Number.isInteger(sequence) || sequence < 0 || sequence >= UDP_SERIAL_MODULUS) {
+        throw new Error('invalid-udp-packet-sequence');
+    }
+    return sequence;
+}
+
+function encodeHeader(header) {
     const bytes = Buffer.from(JSON.stringify(header && typeof header === 'object' ? header : {}), 'utf8');
     if (bytes.length > UDP_MAX_HEADER_BYTES) throw new Error('udp-packet-header-too-large');
     return bytes;
@@ -103,9 +113,9 @@ export function createUdpSessionKey() {
     return crypto.randomBytes(32);
 }
 
-export function encodeUdpPacket({ type, sessionId, key, sequence = 0, header = {}, payload = Buffer.alloc(0) }) {
-    const normalizedSessionId = normalizeSessionId(sessionId);
-    const sessionBytes = Buffer.from(normalizedSessionId, 'utf8');
+export function encodeUdpPacket({ type, sessionId, key, sequence = 0, header = {}, payload = Buffer.alloc(0) }) {
+    const normalizedSessionId = normalizeSessionId(sessionId);
+    const sessionBytes = Buffer.from(normalizedSessionId, 'utf8');
     const headerBytes = encodeHeader(header);
     const payloadBytes = asBuffer(payload);
     if (payloadBytes.length > UDP_MAX_PAYLOAD_BYTES) throw new Error('udp-packet-payload-too-large');
@@ -117,8 +127,8 @@ export function encodeUdpPacket({ type, sessionId, key, sequence = 0, header = {
     preamble[6] = sessionBytes.length;
     preamble.writeUInt16BE(headerBytes.length, 7);
     preamble.writeUInt16BE(payloadBytes.length, 9);
-    preamble.writeUInt32BE((Number(sequence) >>> 0), 11);
-    const nonce = crypto.randomBytes(UDP_NONCE_BYTES);
+    preamble.writeUInt32BE((Number(sequence) >>> 0), 11);
+    const nonce = crypto.randomBytes(UDP_NONCE_BYTES);
     const associatedData = Buffer.concat([preamble, nonce, sessionBytes, headerBytes]);
     const cipher = crypto.createCipheriv('aes-256-gcm', normalizeKey(key), nonce);
     cipher.setAAD(associatedData);
@@ -169,26 +179,41 @@ export function decodeUdpPacket(packet, key) {
     }
 }
 
-export class UdpReplayWindow {
+export class UdpReplayWindow {
     constructor(size = 512) {
         this.size = Math.max(32, Math.min(4096, Math.floor(Number(size) || 512)));
         this.highest = -1;
         this.seen = new Set();
     }
 
-    accept(sequence) {
-        const value = Number(sequence) >>> 0;
-        if (this.highest >= 0 && value + this.size < this.highest) return false;
-        if (this.seen.has(value)) return false;
-        this.seen.add(value);
-        if (this.highest < 0 || value > this.highest) this.highest = value;
-        const minimum = Math.max(0, this.highest - this.size);
-        for (const item of this.seen) {
-            if (item < minimum) this.seen.delete(item);
-        }
-        return true;
-    }
-}
+    accept(sequence) {
+        let value;
+        try {
+            value = normalizeSequence(sequence);
+        } catch {
+            return false;
+        }
+        if (this.seen.has(value)) return false;
+        if (this.highest >= 0) {
+            const forward = (value - this.highest + UDP_SERIAL_MODULUS) % UDP_SERIAL_MODULUS;
+            if (forward === 0 || forward === UDP_SERIAL_HALF_RANGE) return false;
+            if (forward > UDP_SERIAL_HALF_RANGE) {
+                const age = (this.highest - value + UDP_SERIAL_MODULUS) % UDP_SERIAL_MODULUS;
+                if (age > this.size) return false;
+            } else {
+                this.highest = value;
+            }
+        } else {
+            this.highest = value;
+        }
+        this.seen.add(value);
+        for (const item of this.seen) {
+            const age = (this.highest - item + UDP_SERIAL_MODULUS) % UDP_SERIAL_MODULUS;
+            if (age > this.size) this.seen.delete(item);
+        }
+        return true;
+    }
+}
 
 export class UdpFrameReassembler {
     constructor({ maxPending = 2, timeoutMs = 500, maxFrameBytes = 8 * 1024 * 1024 } = {}) {