@livedesk/hub 0.1.30 → 0.1.31

package/src/server.js

@@ -39,15 +39,17 @@ import { createAgentDeviceScope, resolveAgentTargetIds } from './agents/agent-de
 import { AgentRuntimeError } from './agents/agent-runtime-error.js';
 import { AGENT_PERMISSION_MODES, createAgentPermissionPolicy, evaluateAgentToolPermission, hashAgentPermissionPolicy } from './agents/agent-permissions.js';
 import { createAgentPermissionStore } from './agents/agent-permission-store.js';
-import { createAgentAuditStore } from './agents/agent-audit-store.js';
-import { getAgentToolDefinition } from './agents/agent-tool-registry.js';
+import { createAgentAuditStore } from './agents/agent-audit-store.js';
+import { createSecurityAuditStore } from './security/security-audit-store.js';
+import { getAgentToolDefinition, isRetiredAgentMutatingToolName } from './agents/agent-tool-registry.js';
 import { LiveDeskSettingsStore, SettingsConflictError } from './settings/settings-store.js';
 import { effectiveDevicePolicy } from './settings/settings-schema.js';
 import { buildEffectiveDevicePolicy } from './settings/effective-device-policy.js';
 import { CaptureStore } from './captures/capture-store.js';
 import { createLiveDeskUpdateManager } from './live-desk-update.js';
 import { createHubUdpTransport } from './transport/udp-hub-transport.js';
-import { normalizeRuntimeAuthSession, runtimeRoleError } from '../../runtime-core/src/index.js';
+import { normalizeRuntimeAuthSession, runtimeRoleError } from '../../runtime-core/src/index.js';
+import { createOsSecretStore, OS_SECRET_REFERENCE } from '../../runtime-core/src/os-secret-store.js';
 import { fetchAuthResponse, AUTH_REQUEST_TIMEOUT_MS } from '../../runtime-core/src/auth-http.js';
 import { PRODUCTION_SUPABASE_PUBLISHABLE_KEY, PRODUCTION_SUPABASE_URL } from '../../runtime-core/src/auth-config.js';
 import { createHubRuntime } from './runtime/hub-runtime.js';
@@ -63,8 +65,20 @@ const webDistCandidates = [
 const webDistPath = webDistCandidates.find(candidate => existsSync(resolve(candidate, 'index.html'))) || webDistCandidates[webDistCandidates.length - 1];
 const webIndexPath = resolve(webDistPath, 'index.html');
 const packageInfo = JSON.parse(readFileSync(resolve(__dirname, '..', 'package.json'), 'utf8'));
-const httpHost = process.env.LIVEDESK_HUB_HTTP_HOST || '127.0.0.1';
-const httpPort = Number(process.env.LIVEDESK_HUB_HTTP_PORT || process.env.PORT || 5179);
+const httpHost = process.env.LIVEDESK_HUB_HTTP_HOST || '127.0.0.1';
+const httpPort = Number(process.env.LIVEDESK_HUB_HTTP_PORT || process.env.PORT || 5179);
+if (!isLoopbackBindHost(httpHost) && process.env.LIVEDESK_TEST_MODE !== '1') {
+  throw new Error('hub-http-lan-bind-requires-tls-authenticated-proxy');
+}
+const localAdminSessionToken = crypto.randomBytes(32).toString('base64url');
+const localAdminCsrfToken = crypto.randomBytes(32).toString('base64url');
+const localAdminSessionId = crypto.randomUUID();
+const launcherShutdownToken = /^[A-Za-z0-9_-]{43}$/.test(
+  String(process.env.LIVEDESK_LAUNCHER_SHUTDOWN_TOKEN || '').trim()
+)
+  ? String(process.env.LIVEDESK_LAUNCHER_SHUTDOWN_TOKEN).trim()
+  : '';
+const enforceLocalAdminAuth = process.env.LIVEDESK_TEST_MODE !== '1';
 const runtimeRole = String(process.env.LIVEDESK_RUNTIME_ROLE || 'hub').trim().toLowerCase() === 'client' ? 'client' : 'hub';
 const runtimeDeviceId = String(process.env.LIVEDESK_DEVICE_ID || '').trim();
 const runtimeDeviceName = String(process.env.LIVEDESK_DEVICE_NAME || os.hostname()).trim() || os.hostname();
@@ -165,13 +179,21 @@ const SUPABASE_AUTH_TIMEOUT_MS = process.env.LIVEDESK_AUTH_TEST_MODE === '1'
   ? readPositiveIntegerEnv('LIVEDESK_AUTH_TEST_TIMEOUT_MS', AUTH_REQUEST_TIMEOUT_MS)
   : AUTH_REQUEST_TIMEOUT_MS;
 const CLIENT_AUTH_STORAGE_KEY = 'livedesk.client.supabase.auth';
-const runtimeAuthStatePath = process.env.LIVEDESK_DESKTOP_HOST === '1'
+const runtimeAuthStatePath = process.env.LIVEDESK_DESKTOP_HOST === '1'
   ? ''
-  : String(process.env.LIVEDESK_AUTH_STATE_PATH || '').trim();
-const testLicensePlan = process.env.LIVEDESK_TEST_MODE === '1'
+  : String(process.env.LIVEDESK_AUTH_STATE_PATH || '').trim();
+const runtimeRefreshSecretStore = createOsSecretStore({
+  service: 'LiveDesk',
+  account: 'client-refresh-token',
+  dataDir: process.env.LIVEDESK_STATE_DIR || (runtimeAuthStatePath ? dirname(runtimeAuthStatePath) : undefined)
+});
+const testLicensePlan = process.env.LIVEDESK_TEST_MODE === '1'
   && ['ltd', 'pro'].includes(String(process.env.LIVEDESK_TEST_LICENSE_PLAN || '').toLowerCase())
-  ? String(process.env.LIVEDESK_TEST_LICENSE_PLAN).toLowerCase()
-  : '';
+  ? String(process.env.LIVEDESK_TEST_LICENSE_PLAN).toLowerCase()
+  : '';
+const testSecurityAccountId = process.env.LIVEDESK_TEST_MODE === '1'
+  ? String(process.env.LIVEDESK_ACCOUNT_ID || '').trim().slice(0, 128)
+  : '';
 const persistentSessionGcEnabled =
   process.env.LIVEDESK_TEST_MODE === '1'
   && process.env.LIVEDESK_PERSISTENT_SESSION_TEST_GC === '1';
@@ -181,10 +203,12 @@ const traceRemoteTestEventsEnabled =
 const persistentSessionGcToken = persistentSessionGcEnabled
   ? String(process.env.LIVEDESK_PERSISTENT_SESSION_TEST_TOKEN || '').trim()
   : '';
-let connectedDeviceCount = 0;
-let runtimeAccessToken = '';
-let runtimeRefreshToken = '';
-let runtimeAccessTokenExpiresAt = 0;
+let connectedDeviceCount = 0;
+let runtimeAccessToken = '';
+let runtimeRefreshToken = '';
+let runtimeAccessTokenExpiresAt = 0;
+let runtimeSessionGeneration = 0;
+let runtimeRefreshPromise = null;
 let roleWatchInFlight = false;
 let verifiedLicense = {
   userId: '',
@@ -196,8 +220,10 @@ let verifiedLicense = {
 let frameClientSeq = 0;
 let inputClientSeq = 0;
 let audioClientSeq = 0;
-let liveDeskUpdateManager = null;
-let hubTransferJobs = null;
+let liveDeskUpdateManager = null;
+let hubTransferJobs = null;
+let securityAuditStore = null;
+let securityAuditHealthy = true;
 const HUB_HOST_TARGET_LEASE_MS = Math.max(5000, readPositiveIntegerEnv('LIVEDESK_HOST_TARGET_LEASE_MS', 60_000));
 const HUB_HOST_TARGET_RENEW_MS = Math.max(1000, Math.min(
   readPositiveIntegerEnv('LIVEDESK_HOST_TARGET_RENEW_MS', 20_000),
@@ -228,7 +254,7 @@ let hubWakeNotificationState = {
 };
 let hubWakeNextAttemptAtMs = 0;
 
-function readPositiveIntegerEnv(name, fallback) {
+function readPositiveIntegerEnv(name, fallback) {
   const value = Number(process.env[name]);
   return Number.isFinite(value) && value > 0 ? Math.round(value) : fallback;
 }
@@ -241,9 +267,42 @@ function secureExactTestTokenMatches(actual, expected) {
     && crypto.timingSafeEqual(actualBytes, expectedBytes);
 }
 
-function handleRemoteHubEvent(type, event) {
-  liveDeskUpdateManager?.handleRemoteEvent(type, event);
-  hubTransferJobs?.handleRemoteEvent(type, event);
+function handleRemoteHubEvent(type, event) {
+  liveDeskUpdateManager?.handleRemoteEvent(type, event);
+  hubTransferJobs?.handleRemoteEvent(type, event);
+  const auditedRemoteActions = {
+    RemoteSecurityHandshakeAudit: event?.action || 'remote.handshake',
+    RemoteSecurityPolicyAudit: 'remote.connection-policy',
+    RemoteAbuseDefense: 'remote.abuse-defense',
+    RemoteDeviceConnected: 'remote.device.connected',
+    RemoteDeviceDisconnected: 'remote.device.disconnected',
+    RemoteInputSocketConnected: 'remote.control.channel-started',
+    RemoteInputSocketDisconnected: 'remote.control.channel-ended',
+    RemoteControlSessionStarted: 'remote.control.session-started',
+    RemoteControlSessionEnded: 'remote.control.session-ended',
+    RemoteFileSocketConnected: 'remote.file.channel-started',
+    RemoteFileSocketDisconnected: 'remote.file.channel-ended',
+    RemoteEnrollmentTokenRotated: 'remote.enrollment-token.rotated'
+  };
+  if (auditedRemoteActions[type]) {
+    const device = event?.device || {};
+    recordSecurityAudit({
+      action: auditedRemoteActions[type],
+      phase: /Disconnected|ended|rotated/i.test(`${type}:${auditedRemoteActions[type]}`) ? 'complete' : 'start',
+      result: event?.result || (event?.reason && /RemoteSecurity(?:Handshake|Policy)Audit|RemoteAbuseDefense/.test(type) ? 'rejected' : 'success'),
+      reason: event?.reason || '',
+      actorAccountId: event?.accountId || '',
+      hubId: event?.hubId || event?.remoteHub?.hostInstanceId || '',
+      deviceId: event?.deviceId || device.deviceId || '',
+      sessionId: event?.sessionId || device.sessionId || '',
+      authMethod: /RemoteSecurity(?:Handshake|Policy)Audit|RemoteAbuseDefense/.test(type) ? 'device-credential-p256' : 'authenticated-device-session',
+      details: {
+        transport: event?.transport || device.transport || '',
+        channel: event?.channel || '',
+        credentialSerial: event?.credentialSerial || ''
+      }
+    });
+  }
   if (traceRemoteTestEventsEnabled
     && (type === 'RemoteFrameDropped' || type === 'RemoteFrameTransportProofAccepted')) {
     console.warn(`[LiveDesk Hub Test Event] ${type} ${JSON.stringify({
@@ -290,10 +349,16 @@ function handleRemoteHubEvent(type, event) {
     }
     return;
   }
-  if (type === 'RemoteDeviceConnected' || type === 'RemoteDeviceDisconnected') {
-    connectedDeviceCount = Number(remoteHub.getStatus({ includeSecrets: false }).connectedDeviceCount || 0);
-  }
-  if (type !== 'RemoteDeviceConnected') {
+  if (type === 'RemoteDeviceConnected' || type === 'RemoteDeviceDisconnected') {
+    connectedDeviceCount = Number(remoteHub.getStatus({ includeSecrets: false }).connectedDeviceCount || 0);
+  }
+  if (type === 'RemoteEnrollmentTokenRotated') {
+    void publishHubHostTargetWithPendingRoleTakeover('enrollment-token-rotated').catch(error => {
+      console.warn(`[LiveDesk Hub] Enrollment token publication failed: ${error?.message || error}`);
+    });
+    return;
+  }
+  if (type !== 'RemoteDeviceConnected') {
     return;
   }
   const deviceId = String(event?.deviceId || event?.device?.deviceId || '').trim();
@@ -425,11 +490,23 @@ function readRuntimeAuthState() {
   }
 }
 
-function readPersistedRuntimeSession(state = readRuntimeAuthState()) {
+function readPersistedRuntimeSession(state = readRuntimeAuthState()) {
   try {
     const raw = state?.[CLIENT_AUTH_STORAGE_KEY];
     const session = typeof raw === 'string' ? JSON.parse(raw) : raw;
-    return session && typeof session === 'object' ? session : null;
+    if (!session || typeof session !== 'object') return null;
+    const plaintextRefreshToken = String(session.refresh_token || '').trim();
+    const refreshToken = plaintextRefreshToken || (session.refresh_token_ref === OS_SECRET_REFERENCE
+      ? runtimeRefreshSecretStore.read()
+      : '');
+    if (plaintextRefreshToken) {
+      if (!runtimeRefreshSecretStore.write(plaintextRefreshToken)) return null;
+      const migrated = { ...session, refresh_token_ref: OS_SECRET_REFERENCE };
+      delete migrated.refresh_token;
+      state[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(migrated);
+      writePrivateRuntimeAuthState(state);
+    }
+    return { ...session, refresh_token: refreshToken };
   } catch {
     return null;
   }
@@ -472,28 +549,34 @@ function persistRuntimeSession(session) {
       ...(session?.user && typeof session.user === 'object' ? session.user : {})
     }
   }, { requireRefreshToken: true });
-  if (!normalized.ok) return false;
-  state[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(normalized.session);
+  if (!normalized.ok) return false;
+  if (!runtimeRefreshSecretStore.write(normalized.session.refresh_token)) return false;
+  const persisted = { ...normalized.session, refresh_token_ref: OS_SECRET_REFERENCE };
+  delete persisted.refresh_token;
+  state[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(persisted);
   writePrivateRuntimeAuthState(state);
   return true;
 }
 
-function clearPersistedRuntimeSession() {
+function clearPersistedRuntimeSession() {
   if (!runtimeAuthStatePath) return false;
   const state = readRuntimeAuthState();
-  delete state[CLIENT_AUTH_STORAGE_KEY];
+  delete state[CLIENT_AUTH_STORAGE_KEY];
+  runtimeRefreshSecretStore.clear();
   return writePrivateRuntimeAuthState(state);
 }
 
-function clearRuntimeSession() {
-  runtimeAccessToken = '';
-  runtimeRefreshToken = '';
+function clearRuntimeSession() {
+  runtimeSessionGeneration += 1;
+  runtimeRefreshPromise = null;
+  runtimeAccessToken = '';
+  runtimeRefreshToken = '';
   runtimeAccessTokenExpiresAt = 0;
   runtimeManager.setAuthenticated(false);
   try { clearPersistedRuntimeSession(); } catch { /* runtime auth is already invalid */ }
 }
 
-async function getRuntimeAccessToken() {
+async function getRuntimeAccessToken() {
   const accessToken = String(runtimeAccessToken || '').trim();
   const expiresSoon = runtimeAccessTokenExpiresAt > 0
     && runtimeAccessTokenExpiresAt <= Date.now() + HUB_ACCESS_TOKEN_REFRESH_SKEW_MS;
@@ -502,51 +585,112 @@ async function getRuntimeAccessToken() {
   }
 
   const refreshToken = String(runtimeRefreshToken || '').trim();
-  if (!refreshToken) {
-    return accessToken;
-  }
-
-  const response = await fetchAuthResponse(
-    fetch,
-    `${supabaseUrl}/auth/v1/token?grant_type=refresh_token`,
-    {
-      method: 'POST',
-      headers: {
-        apikey: supabasePublishableKey,
-        'Content-Type': 'application/json',
-        Accept: 'application/json'
-      },
-      body: JSON.stringify({ refresh_token: refreshToken })
-    },
-    SUPABASE_AUTH_TIMEOUT_MS
-  );
-  if (!response.ok) {
-    if (response.status === 400 || response.status === 401 || response.status === 403) {
-      clearRuntimeSession();
-      throw new Error(`hub-session-refresh-failed:${response.status}`);
-    }
-    throw new Error(`hub-session-refresh-provider-failed:${response.status}`);
-  }
-  const refreshed = await response.json().catch(() => null);
-  const nextAccessToken = String(refreshed?.access_token || '').trim();
-  if (!nextAccessToken) {
-    throw new Error('hub-session-refresh-missing-access-token');
-  }
-  runtimeAccessToken = nextAccessToken;
-  runtimeRefreshToken = String(refreshed?.refresh_token || refreshToken).trim();
-  runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(refreshed?.expires_at)
-    || (Number(refreshed?.expires_in) > 0 ? Date.now() + Number(refreshed.expires_in) * 1000 : 0);
-  try {
-    persistRuntimeSession({
-      access_token: runtimeAccessToken,
-      refresh_token: runtimeRefreshToken,
-      expires_at: Math.floor(runtimeAccessTokenExpiresAt / 1000)
-    });
-  } catch (error) {
-    console.warn(`[LiveDesk Hub] Refreshed session persistence failed: ${error?.message || error}`);
-  }
-  return runtimeAccessToken;
-}
+  if (!refreshToken) {
+    return accessToken;
+  }
+
+  if (runtimeRefreshPromise) return runtimeRefreshPromise;
+
+  const ownerGeneration = runtimeSessionGeneration;
+  const refreshOperation = (async () => {
+    const response = await fetchAuthResponse(
+      fetch,
+      `${supabaseUrl}/auth/v1/token?grant_type=refresh_token`,
+      {
+        method: 'POST',
+        headers: {
+          apikey: supabasePublishableKey,
+          'Content-Type': 'application/json',
+          Accept: 'application/json'
+        },
+        body: JSON.stringify({ refresh_token: refreshToken })
+      },
+      SUPABASE_AUTH_TIMEOUT_MS
+    );
+    if (!response.ok) {
+      if (response.status === 400 || response.status === 401 || response.status === 403) {
+        if (runtimeSessionGeneration === ownerGeneration && runtimeRefreshToken === refreshToken) {
+          clearRuntimeSession();
+        }
+        throw new Error(`hub-session-refresh-failed:${response.status}`);
+      }
+      throw new Error(`hub-session-refresh-provider-failed:${response.status}`);
+    }
+    const refreshed = await response.json().catch(() => null);
+    const nextAccessToken = String(refreshed?.access_token || '').trim();
+    if (!nextAccessToken) {
+      throw new Error('hub-session-refresh-missing-access-token');
+    }
+    if (runtimeSessionGeneration !== ownerGeneration || runtimeRefreshToken !== refreshToken) {
+      throw new Error('hub-session-refresh-owner-retired');
+    }
+    runtimeAccessToken = nextAccessToken;
+    runtimeRefreshToken = String(refreshed?.refresh_token || refreshToken).trim();
+    runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(refreshed?.expires_at)
+      || (Number(refreshed?.expires_in) > 0 ? Date.now() + Number(refreshed.expires_in) * 1000 : 0);
+    try {
+      persistRuntimeSession({
+        access_token: runtimeAccessToken,
+        refresh_token: runtimeRefreshToken,
+        expires_at: Math.floor(runtimeAccessTokenExpiresAt / 1000)
+      });
+    } catch (error) {
+      console.warn(`[LiveDesk Hub] Refreshed session persistence failed: ${error?.message || error}`);
+    }
+    return runtimeAccessToken;
+  })();
+  runtimeRefreshPromise = refreshOperation;
+  try {
+    return await refreshOperation;
+  } finally {
+    if (runtimeRefreshPromise === refreshOperation) runtimeRefreshPromise = null;
+  }
+}
+
+function isLoopbackBindHost(value) {
+  const host = String(value || '').trim().toLowerCase().replace(/^\[|\]$/g, '');
+  return host === '127.0.0.1' || host === 'localhost' || host === '::1';
+}
+
+async function revokeRuntimeProviderSession() {
+  const hasRuntimeSession = Boolean(runtimeAccessToken || runtimeRefreshToken);
+  if (!hasRuntimeSession) return { ok: true, skipped: true, reason: 'no-runtime-session' };
+
+  let accessToken = String(runtimeAccessToken || '').trim();
+  try {
+    accessToken = await getRuntimeAccessToken() || accessToken;
+  } catch (error) {
+    const message = String(error?.message || error);
+    if (/^hub-session-refresh-failed:(?:400|401|403)$/.test(message)) {
+      return { ok: true, alreadyInvalid: true };
+    }
+    return { ok: false, error: message };
+  }
+  if (!accessToken) return { ok: false, error: 'provider-session-token-unavailable' };
+
+  try {
+    const response = await fetchAuthResponse(
+      fetch,
+      `${supabaseUrl}/auth/v1/logout?scope=local`,
+      {
+        method: 'POST',
+        headers: {
+          apikey: supabasePublishableKey,
+          Authorization: `Bearer ${accessToken}`,
+          Accept: 'application/json'
+        }
+      },
+      SUPABASE_AUTH_TIMEOUT_MS
+    );
+    if (response.ok) return { ok: true, revoked: true };
+    if ([401, 403, 404].includes(response.status)) {
+      return { ok: true, alreadyInvalid: true, status: response.status };
+    }
+    return { ok: false, error: `provider-session-revoke-failed:${response.status}` };
+  } catch (error) {
+    return { ok: false, error: String(error?.message || error) };
+  }
+}
 
 async function verifySupabaseUser(accessToken) {
   const token = String(accessToken || '').trim();
@@ -659,15 +803,57 @@ function requireHubFeatureAccess(_req, res, next) {
   res.status(402).json({ ok: false, error: 'livedesk-plan-device-limit', license: licenseSnapshot() });
 }
 
-const agentDataDir = process.env.LIVEDESK_DATA_DIR || undefined;
-const liveDeskSettingsStore = new LiveDeskSettingsStore({ dataDir: agentDataDir });
-const captureStore = new CaptureStore({ dataDir: agentDataDir });
-void captureStore.initialize().catch(error => {
-  console.warn(`[LiveDesk Hub] capture store initialization failed: ${error instanceof Error ? error.message : String(error)}`);
-});
-void liveDeskSettingsStore.getRecord().catch(error => {
-  console.warn(`[LiveDesk Hub] settings load failed: ${error instanceof Error ? error.message : String(error)}`);
-});
+const agentDataDir = process.env.LIVEDESK_DATA_DIR || undefined;
+securityAuditStore = createSecurityAuditStore({ dataDir: agentDataDir });
+
+function requestAuditHash(value) {
+  try {
+    return crypto.createHash('sha256').update(JSON.stringify(value ?? {}), 'utf8').digest('base64url');
+  } catch {
+    return crypto.createHash('sha256').update('[unserializable]', 'utf8').digest('base64url');
+  }
+}
+
+function recordSecurityAudit(event = {}) {
+  if (!securityAuditStore) return;
+  const runtime = runtimeManager.getSnapshot();
+  void securityAuditStore.record({
+    actorAccountId: event.actorAccountId || runtime.userId || '',
+    actorUserId: event.actorUserId || runtime.userId || '',
+    hubId: event.hubId || runtime.deviceId || '',
+    ...event
+  }).catch(error => {
+    securityAuditHealthy = false;
+    console.error(`[LiveDesk Hub] SECURITY AUDIT FAILURE: ${error?.message || error}`);
+  });
+}
+
+const liveDeskSettingsStore = new LiveDeskSettingsStore({ dataDir: agentDataDir });
+const captureStore = new CaptureStore({
+  dataDir: agentDataDir,
+  getRetentionPolicy: () => liveDeskSettingsStore.getCached()?.filesAudio?.captureAutoDelete || 'never',
+  onRetentionDelete: result => recordSecurityAudit({
+    action: 'privacy.capture.retention-delete',
+    phase: 'complete',
+    result: 'success',
+    authMethod: 'settings-retention-policy',
+    details: result
+  })
+});
+void captureStore.initialize().catch(error => {
+  console.warn(`[LiveDesk Hub] capture store initialization failed: ${error instanceof Error ? error.message : String(error)}`);
+});
+void liveDeskSettingsStore.getRecord()
+  .then(() => captureStore.enforceRetention())
+  .catch(error => {
+    console.warn(`[LiveDesk Hub] settings or capture retention load failed: ${error instanceof Error ? error.message : String(error)}`);
+  });
+const captureRetentionTimer = setInterval(() => {
+  void captureStore.enforceRetention().catch(error => {
+    console.warn(`[LiveDesk Hub] capture retention failed: ${error instanceof Error ? error.message : String(error)}`);
+  });
+}, 60 * 60_000);
+captureRetentionTimer.unref?.();
 
 const udpTransport = createHubUdpTransport({
   env: process.env,
@@ -675,9 +861,10 @@ const udpTransport = createHubUdpTransport({
   logWarn: (_scope, message) => console.warn(`[LiveDesk Hub] ${message}`)
 });
 
-const remoteHub = createRemoteHub({
-  managerPackage: '@livedesk/hub',
-  managerVersion: packageInfo.version,
+const remoteHub = createRemoteHub({
+  managerPackage: '@livedesk/hub',
+  managerVersion: packageInfo.version,
+  dataDir: agentDataDir,
   env: {
     ...process.env,
     MINDEXEC_MANAGER_PACKAGE: '@livedesk/hub',
@@ -688,7 +875,11 @@ const remoteHub = createRemoteHub({
   logWarn: (_scope, message) => console.warn(`[LiveDesk Hub] ${message}`),
   emitEvent: handleRemoteHubEvent,
   emitFrame: broadcastRemoteBinaryFrame,
-  emitAudio: broadcastRemoteBinaryAudio,
+  emitAudio: broadcastRemoteBinaryAudio,
+  getSecurityIdentity: () => ({
+    accountId: runtimeManager.getSnapshot().userId || testSecurityAccountId,
+    hubId: remoteHub?.getSecurityStatus?.().hubId || ''
+  }),
   getEffectiveDevicePolicy: ({ deviceId, capabilities }) => buildEffectiveDevicePolicy(liveDeskSettingsStore.getCached(), { deviceId, capabilities }),
   getWelcomeDevicePolicy: ({ deviceId, capabilities }) => {
     const policy = buildEffectiveDevicePolicy(liveDeskSettingsStore.getCached(), { deviceId, capabilities });
@@ -791,9 +982,11 @@ function getLiveDeskUpdateStatus() {
 if (process.env.LIVEDESK_DESKTOP_HOST !== '1') {
   liveDeskUpdateManager = createLiveDeskUpdateManager({
     remoteHub,
-    currentManagerVersion: process.env.LIVEDESK_MANAGER_VERSION || packageInfo.version,
-    currentClientVersion: process.env.LIVEDESK_CLIENT_PACKAGE_VERSION || '',
-    restartSupported: !!String(process.env.LIVEDESK_HUB_UPDATE_REQUEST_PATH || '').trim(),
+    currentManagerVersion: process.env.LIVEDESK_MANAGER_VERSION || packageInfo.version,
+    currentClientVersion: process.env.LIVEDESK_CLIENT_PACKAGE_VERSION || '',
+    updateManifestUrl: process.env.LIVEDESK_UPDATE_MANIFEST_URL || '',
+    updatePublicKey: process.env.LIVEDESK_UPDATE_PUBLIC_KEY || '',
+    restartSupported: !!String(process.env.LIVEDESK_HUB_UPDATE_REQUEST_PATH || '').trim(),
     requestHubRestart
   });
 }
@@ -1111,7 +1304,7 @@ function validateAgentMcpArguments(name, args) {
   return '';
 }
 
-async function dispatchAgentMcpTool(session, name, args = {}) {
+async function dispatchAgentMcpTool(session, name, args = {}) {
   if (session.cancelled || session.signal?.aborted) return { ok: false, error: 'cancelled-by-user' };
   // This check runs synchronously before the first await, so concurrent Node
   // requests cannot pass the same remaining budget and queue extra Client work.
@@ -1119,8 +1312,23 @@ async function dispatchAgentMcpTool(session, name, args = {}) {
     session.toolLimitReached = true;
     return { ok: false, error: 'codex-tool-limit-reached' };
   }
-  session.toolCallCount += 1;
-  const tool = getAgentToolDefinition(name);
+  session.toolCallCount += 1;
+  if (isRetiredAgentMutatingToolName(name)) {
+    recordAgentAudit({
+      event: 'tool-rejected',
+      runId: session.runId,
+      deviceIds: [],
+      toolName: name,
+      category: 'mutation',
+      decision: 'deny',
+      status: 'rejected',
+      permissionMode: session.permissionPolicy?.mode,
+      policyHash: session.permissionPolicyHash,
+      details: { reason: 'agent-mutating-tool-disabled' }
+    });
+    return { ok: false, error: 'agent-mutating-tool-disabled' };
+  }
+  const tool = getAgentToolDefinition(name);
   if (!tool) return { ok: false, error: 'codex-tool-not-allowed' };
   const validationError = validateAgentMcpArguments(name, args);
   if (validationError) return { ok: false, error: validationError };
@@ -1312,12 +1520,15 @@ async function synchronizeAgentEnablement() {
 }
 
 const hubFilesystem = createHubFilesystem();
-hubTransferJobs = createHubTransferJobs({
-  filesystem: hubFilesystem,
-  remoteHub,
-  maxConcurrent: Number(process.env.LIVEDESK_MAX_FILE_JOBS || 2),
-  commandResultTimeoutMs: readPositiveIntegerEnv('LIVEDESK_FILE_CHUNK_ACK_TIMEOUT_MS', 30_000)
-});
+hubTransferJobs = createHubTransferJobs({
+  filesystem: hubFilesystem,
+  remoteHub,
+  maxConcurrent: Number(process.env.LIVEDESK_MAX_FILE_JOBS || 2),
+  commandResultTimeoutMs: readPositiveIntegerEnv('LIVEDESK_FILE_CHUNK_ACK_TIMEOUT_MS', 30_000),
+  getMaxFileSizeBytes: () => Number(
+    liveDeskSettingsStore.getCached()?.filesAudio?.maxFileSizeBytes
+    || 1024 * 1024 * 1024)
+});
 const hubSharedFolders = createHubSharedFolders({
   filesystem: hubFilesystem,
   transferJobs: hubTransferJobs,
@@ -1437,16 +1648,74 @@ app.use((req, res, next) => {
     res.setHeader('Access-Control-Allow-Origin', origin);
     res.setHeader('Access-Control-Allow-Private-Network', 'true');
     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-LiveDesk-Admin-Session, X-LiveDesk-Admin-CSRF, X-LiveDesk-CSRF');
     res.setHeader('Vary', 'Origin, Access-Control-Request-Headers, Access-Control-Request-Private-Network');
   }
   if (req.method === 'OPTIONS') {
     res.status(204).end();
     return;
   }
-  next();
-});
-app.use(express.json({ limit: '32mb' }));
+  next();
+});
+app.use((req, res, next) => {
+  if (!enforceLocalAdminAuth || req.path === '/api/security/session' || req.method === 'OPTIONS') {
+    next();
+    return;
+  }
+  const authorizedLauncherShutdown = req.method === 'POST'
+    && req.path === '/api/runtime/shutdown'
+    && isLoopbackAddress(req.socket?.remoteAddress)
+    && launcherShutdownToken
+    && secureExactTestTokenMatches(
+      String(req.headers['x-livedesk-launcher-shutdown'] || ''),
+      launcherShutdownToken
+    );
+  if (authorizedLauncherShutdown) {
+    req.liveDeskLauncherShutdown = true;
+    next();
+    return;
+  }
+  const mutating = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method);
+  const sensitiveRead = req.method === 'GET'
+    && ['/api/security/audit', '/api/privacy/inventory'].includes(req.path);
+  if (!mutating && !sensitiveRead) {
+    next();
+    return;
+  }
+  const adminToken = String(req.headers['x-livedesk-admin-session'] || '');
+  const csrfToken = String(req.headers['x-livedesk-admin-csrf'] || '');
+  if (!secureExactTestTokenMatches(adminToken, localAdminSessionToken)) {
+    recordSecurityAudit({
+      action: 'local-admin.request',
+      phase: 'complete',
+      result: 'rejected',
+      reason: 'admin-session-required',
+      requestHash: requestAuditHash({ method: req.method, path: req.path }),
+      authMethod: 'local-admin-session'
+    });
+    res.status(401).json({ ok: false, error: 'local-admin-session-required' });
+    return;
+  }
+  if (mutating && !secureExactTestTokenMatches(csrfToken, localAdminCsrfToken)) {
+    recordSecurityAudit({
+      action: 'local-admin.request',
+      phase: 'complete',
+      result: 'rejected',
+      reason: 'csrf-token-required',
+      requestHash: requestAuditHash({ method: req.method, path: req.path }),
+      authMethod: 'local-admin-session'
+    });
+    res.status(403).json({ ok: false, error: 'csrf-token-required' });
+    return;
+  }
+  if (!securityAuditHealthy) {
+    res.status(503).json({ ok: false, error: 'security-audit-unavailable' });
+    return;
+  }
+  req.liveDeskAdminSessionId = localAdminSessionId;
+  next();
+});
+app.use(express.json({ limit: '32mb' }));
 app.use((req, res, next) => {
   if (runtimeRole === 'client' && req.path.startsWith('/api/remote')) {
     res.status(403).json(roleGuardResponse(runtimeRole, 'hub'));
@@ -1597,11 +1866,12 @@ function normalizeTransferFiles(value) {
     if (totalBytes > MAX_FILE_TRANSFER_BYTES) {
       return { ok: false, error: 'file-transfer-too-large', files: [], totalBytes };
     }
-    files.push({
-      name,
-      relativePath,
-      size: byteLength,
-      mimeType: String(entry?.type || entry?.mimeType || '').slice(0, 160),
+    files.push({
+      name,
+      relativePath,
+      size: byteLength,
+      sha256: crypto.createHash('sha256').update(Buffer.from(dataBase64, 'base64')).digest('hex'),
+      mimeType: String(entry?.type || entry?.mimeType || '').slice(0, 160),
       lastModified: Number(entry?.lastModified || 0) || 0,
       dataBase64
     });
@@ -1612,24 +1882,39 @@ function normalizeTransferFiles(value) {
   return { ok: true, files, totalBytes };
 }
 
-function normalizeTransferChunk(body = {}) {
+function normalizeTransferChunk(body = {}) {
   const dataBase64 = String(body.dataBase64 || '').replace(/^data:[^,]*,/i, '').trim();
   const name = String(body.name || '').replace(/[\r\n\t\0]/g, ' ').trim().slice(0, 240);
   const relativePath = String(body.relativePath || name).replace(/[\r\n\t\0]/g, ' ').trim().slice(0, 600);
   const offset = Math.max(0, Math.floor(Number(body.offset) || 0));
   const totalBytes = Math.max(0, Math.floor(Number(body.totalBytes) || 0));
-  const byteLength = dataBase64 ? Buffer.byteLength(dataBase64, 'base64') : 0;
-  const final = body.final === true;
-
-  if (!name || !relativePath || offset > totalBytes || offset + byteLength > totalBytes) {
-    return { ok: false, error: 'invalid-file-transfer-chunk' };
-  }
+  const byteLength = dataBase64 ? Buffer.byteLength(dataBase64, 'base64') : 0;
+  const final = body.final === true;
+  const maxFileSizeBytes = Math.max(1, Number(
+    liveDeskSettingsStore.getCached()?.filesAudio?.maxFileSizeBytes
+    || 1024 * 1024 * 1024));
+
+  if (!name || !relativePath || offset > totalBytes || offset + byteLength > totalBytes) {
+    return { ok: false, error: 'invalid-file-transfer-chunk' };
+  }
+  if (totalBytes > maxFileSizeBytes) {
+    return { ok: false, error: 'file-transfer-file-too-large', totalBytes };
+  }
   if (byteLength > MAX_FILE_TRANSFER_CHUNK_BYTES) {
     return { ok: false, error: 'file-transfer-chunk-too-large', byteLength };
   }
-  if (byteLength === 0 && !(final && totalBytes === 0 && offset === 0)) {
-    return { ok: false, error: 'empty-file-transfer-chunk' };
-  }
+  if (byteLength === 0 && !(final && totalBytes === 0 && offset === 0)) {
+    return { ok: false, error: 'empty-file-transfer-chunk' };
+  }
+  const suppliedSha256 = String(body.sha256 || '').trim().toLowerCase();
+  const sha256 = /^[a-f0-9]{64}$/.test(suppliedSha256)
+    ? suppliedSha256
+    : final && offset === 0 && totalBytes === byteLength
+      ? crypto.createHash('sha256').update(Buffer.from(dataBase64, 'base64')).digest('hex')
+      : '';
+  if (final && !sha256) {
+    return { ok: false, error: 'file-transfer-sha256-required', byteLength };
+  }
 
   return {
     ok: true,
@@ -1639,8 +1924,9 @@ function normalizeTransferChunk(body = {}) {
       offset,
       totalBytes,
       byteLength,
-      dataBase64,
-      final,
+      dataBase64,
+      final,
+      sha256,
       mimeType: String(body.type || body.mimeType || '').slice(0, 160),
       lastModified: Number(body.lastModified || 0) || 0
     }
@@ -2746,6 +3032,37 @@ function updateFrameSubscription(ws, payload = {}) {
   }
 }
 
+function refreshFrameSubscriptionLive(ws, payload = {}) {
+  if (!ws || ws.readyState !== 1) {
+    return;
+  }
+  const requestedIds = normalizeDeviceIds(payload.deviceIds ?? payload.devices ?? payload.deviceId);
+  const subscribedIds = [...(ws.liveDeskDeviceIds || [])];
+  const targetIds = requestedIds.length > 0
+    ? requestedIds.filter(deviceId => ws.liveDeskDeviceIds?.has?.(deviceId))
+    : subscribedIds;
+  if (targetIds.length === 0) {
+    return;
+  }
+  ws.liveDeskAutoStart = /^(1|true|yes|on|live)$/i.test(String(
+    payload.autoStartLive ?? payload.startLive ?? ws.liveDeskAutoStart ?? ''
+  ));
+  ws.liveDeskLiveOptions = normalizeLiveOptions({
+    ...(ws.liveDeskLiveOptions || {}),
+    ...payload,
+    monitorSelections: {
+      ...(ws.liveDeskLiveOptions?.monitorSelections || {}),
+      ...(payload.monitorSelections || {})
+    }
+  });
+  for (const deviceId of targetIds.slice(0, 80)) {
+    startFrameSubscriptionLive(ws, 'watchdog', deviceId, {
+      ...ws.liveDeskLiveOptions,
+      reuseExisting: true
+    });
+  }
+}
+
 function startFrameSubscriptionLive(
   ws,
   reason = 'subscribe',
@@ -3677,10 +3994,26 @@ function buildHubHealthPayload({
   };
 }
 
-app.get('/api/health', (_req, res) => {
-  noStore(res);
-  res.json(buildHubHealthPayload());
-});
+app.get('/api/health', (_req, res) => {
+  noStore(res);
+  res.json(buildHubHealthPayload());
+});
+
+app.get('/api/security/session', (req, res) => {
+  noStore(res);
+  if (!isLoopbackAddress(req.socket?.remoteAddress) || !isLoopbackHostname(requestHostname(req))) {
+    res.status(403).json({ ok: false, error: 'local-admin-session-loopback-only' });
+    return;
+  }
+  res.json({
+    ok: true,
+    sessionId: localAdminSessionId,
+    adminToken: localAdminSessionToken,
+    csrfToken: localAdminCsrfToken,
+    issuedAt: new Date().toISOString(),
+    expiresOnProcessExit: true
+  });
+});
 
 if (persistentSessionGcEnabled) {
   app.post('/api/test/persistent-session/gc', (req, res) => {
@@ -3733,9 +4066,18 @@ app.patch('/api/settings', async (req, res) => {
     const record = await liveDeskSettingsStore.update(patch, revision);
     if (patch.agent && Object.prototype.hasOwnProperty.call(patch.agent, 'enabled')) {
       await agentSettingsStore.update({ enabled: record.settings.agent?.enabled === true });
-    }
-    remoteHub.refreshDevicePolicies();
-    res.json({ ok: true, revision: record.revision, updatedAt: record.updatedAt, settings: record.settings });
+    }
+    remoteHub.refreshDevicePolicies();
+    void captureStore.enforceRetention().catch(() => undefined);
+    recordSecurityAudit({
+      action: 'settings.security-policy.updated',
+      phase: 'complete',
+      result: 'success',
+      requestHash: requestAuditHash(patch),
+      authMethod: 'local-admin-session',
+      details: { revision: record.revision, sections: Object.keys(patch) }
+    });
+    res.json({ ok: true, revision: record.revision, updatedAt: record.updatedAt, settings: record.settings });
   } catch (error) {
     if (error instanceof SettingsConflictError) {
       res.status(409).json({ ok: false, error: error.code, revision: error.settings.revision, updatedAt: error.settings.updatedAt, settings: error.settings.settings });
@@ -3890,7 +4232,7 @@ app.get('/api/settings/capabilities', async (_req, res) => {
   });
 });
 
-app.get('/api/security/trusted-devices', (_req, res) => {
+app.get('/api/security/trusted-devices', (_req, res) => {
   noStore(res);
   const devices = remoteHub.listDevices({ includeDataUrl: false }).map(device => ({
     deviceId: device.deviceId,
@@ -3902,24 +4244,128 @@ app.get('/api/security/trusted-devices', (_req, res) => {
     lastSeenAt: device.lastSeenAt || '',
     ipRange: String(device.remoteAddress || '').replace(/^::ffff:/, '').split(':')[0]
   }));
-  res.json({ ok: true, devices });
-});
-
-app.delete('/api/security/trusted-devices/:deviceId', (req, res) => {
-  noStore(res);
-  const result = remoteHub.disconnectDevice(req.params.deviceId, 'trusted-device-revoked');
-  res.json({ ok: result === true, revoked: result === true, deviceId: req.params.deviceId });
-});
+  res.json({ ok: true, devices });
+});
+
+app.get('/api/security/audit', async (req, res) => {
+  noStore(res);
+  try {
+    res.json({
+      ok: true,
+      healthy: securityAuditHealthy,
+      verification: await securityAuditStore.verify(),
+      audit: await securityAuditStore.list({ limit: req.query?.limit, action: req.query?.action })
+    });
+  } catch (error) {
+    securityAuditHealthy = false;
+    res.status(503).json({ ok: false, error: error?.code || 'security-audit-unavailable' });
+  }
+});
+
+app.get('/api/privacy/inventory', async (_req, res) => {
+  noStore(res);
+  try {
+    const [captures, sharedFolders, verification] = await Promise.all([
+      captureStore.list(),
+      hubSharedFolders.list(),
+      securityAuditStore.verify()
+    ]);
+    res.json({
+      ok: true,
+      inventory: {
+        authenticated: runtimeManager.getSnapshot().authenticated === true,
+        captures: captures.length,
+        sharedFolderDefinitions: sharedFolders.length,
+        trustedDeviceCredentials: remoteHub.getSecurityStatus().devices.length,
+        securityAuditRecords: verification.records,
+        agentAuditRetained: (await agentAuditStore.list({ limit: 500 })).length
+      }
+    });
+  } catch (error) {
+    res.status(503).json({ ok: false, error: String(error?.code || error?.message || 'privacy-inventory-unavailable').slice(0, 120) });
+  }
+});
+
+app.delete('/api/privacy/local-data', async (req, res) => {
+  noStore(res);
+  if (String(req.body?.confirmation || '') !== 'DELETE-LIVEDESK-LOCAL-DATA') {
+    res.status(400).json({ ok: false, error: 'privacy-delete-confirmation-required' });
+    return;
+  }
+  try {
+    const providerLogout = await revokeRuntimeProviderSession();
+    const hostTarget = runtimeRole === 'hub'
+      ? await clearHubHostTarget('privacy-delete')
+      : { ok: true, active: false };
+    clearRuntimeSession();
+    for (const device of remoteHub.getSecurityStatus().devices) {
+      remoteHub.disconnectDevice(device.deviceId, 'privacy-local-data-delete');
+    }
+    const trustedDeviceCredentials = remoteHub.clearDeviceCredentials();
+    const transferJobs = hubTransferJobs.clear();
+    const captures = await captureStore.removeAll();
+    const sharedFolders = await hubSharedFolders.clear();
+    await agentAuditStore.clear();
+    await securityAuditStore.reset();
+    securityAuditHealthy = true;
+    await securityAuditStore.record({
+      action: 'privacy.local-data.deleted',
+      phase: 'complete',
+      result: 'success',
+      authMethod: 'local-admin-session',
+      details: {
+        capturesRemoved: captures.removed,
+        captureBytesRemoved: captures.removedBytes,
+        sharedFolderDefinitionsRemoved: sharedFolders.removed,
+        trustedDeviceCredentialsRemoved: trustedDeviceCredentials,
+        transferJobRecordsRemoved: transferJobs.removed,
+        providerSessionRevoked: providerLogout.revoked === true
+      }
+    });
+    res.json({
+      ok: true,
+      localDeleted: true,
+      providerLogout,
+      hostTarget,
+      captures,
+      sharedFolders,
+      trustedDeviceCredentials,
+      transferJobs,
+      preserved: ['settings-preferences', 'hub-device-identity', 'application-binaries']
+    });
+  } catch (error) {
+    securityAuditHealthy = false;
+    res.status(503).json({ ok: false, error: String(error?.code || error?.message || 'privacy-delete-failed').slice(0, 120) });
+  }
+});
+
+app.delete('/api/security/trusted-devices/:deviceId', (req, res) => {
+  noStore(res);
+  const disconnected = remoteHub.disconnectDevice(req.params.deviceId, 'trusted-device-revoked');
+  const credentialRevoked = remoteHub.revokeDeviceCredential(req.params.deviceId, 'trusted-device-revoked');
+  const revoked = disconnected === true || credentialRevoked === true;
+  recordSecurityAudit({
+    action: 'security.device.revoked',
+    phase: 'complete',
+    result: revoked ? 'success' : 'not-found',
+    deviceId: req.params.deviceId,
+    authMethod: 'local-admin-session'
+  });
+  res.json({ ok: revoked, revoked, deviceId: req.params.deviceId });
+});
 
 app.post('/api/security/revoke-all', (_req, res) => {
   noStore(res);
-  const devices = remoteHub.listDevices({ includeDataUrl: false });
-  let revoked = 0;
-  for (const device of devices) {
-    if (device.connected && remoteHub.disconnectDevice(device.deviceId, 'trusted-devices-revoked')) revoked += 1;
-  }
-  res.json({ ok: true, revoked });
-});
+  const devices = remoteHub.listDevices({ includeDataUrl: false });
+  let revoked = 0;
+  for (const device of devices) {
+    const disconnected = device.connected && remoteHub.disconnectDevice(device.deviceId, 'trusted-devices-revoked');
+    const credentialRevoked = remoteHub.revokeDeviceCredential(device.deviceId, 'trusted-devices-revoked');
+    if (disconnected || credentialRevoked) revoked += 1;
+  }
+  recordSecurityAudit({ action: 'security.devices.revoke-all', phase: 'complete', result: 'success', authMethod: 'local-admin-session', details: { revoked } });
+  res.json({ ok: true, revoked });
+});
 
 app.get('/api/settings/agent', async (_req, res) => {
   noStore(res);
@@ -4281,9 +4727,17 @@ app.post('/api/runtime/restart', (_req, res) => {
   }, 150);
 });
 
-app.post('/api/runtime/shutdown', (_req, res) => {
-  noStore(res);
-  runtimeManager.emit('runtime.shutdown.requested', { role: runtimeRole });
+app.post('/api/runtime/shutdown', (req, res) => {
+  noStore(res);
+  recordSecurityAudit({
+    action: 'runtime.shutdown',
+    phase: 'requested',
+    result: 'accepted',
+    authMethod: req.liveDeskLauncherShutdown === true
+      ? 'launcher-internal-shutdown-token'
+      : 'local-admin-session'
+  });
+  runtimeManager.emit('runtime.shutdown.requested', { role: runtimeRole });
   res.json({ ok: true, shuttingDown: true, role: runtimeRole });
   setTimeout(() => {
     void shutdownHub('API_SHUTDOWN')
@@ -4320,8 +4774,10 @@ app.post('/api/auth/session', async (req, res) => {
   }
   const { access_token: accessToken, refresh_token: refreshToken, expires_at: expiresAt } = normalized.session;
   try {
-    const user = await verifySupabaseUser(accessToken);
-    runtimeAccessToken = accessToken;
+    const user = await verifySupabaseUser(accessToken);
+    runtimeSessionGeneration += 1;
+    runtimeRefreshPromise = null;
+    runtimeAccessToken = accessToken;
     runtimeRefreshToken = refreshToken;
     runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(expiresAt);
     runtimeManager.setAuthenticated(true, user.id);
@@ -4334,12 +4790,29 @@ app.post('/api/auth/session', async (req, res) => {
     const hostTarget = runtimeRole === 'hub'
       ? await publishHubHostTargetWithPendingRoleTakeover('session-received')
       : { ok: true, active: false };
-    if (runtimeRole === 'hub') {
-      startHubHostTargetLeaseRenewal();
-    }
-    res.json({ ok: true, authenticated: true, persisted, userId: user.id, role: runtimeRole, hostTarget });
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
+    if (runtimeRole === 'hub') {
+      startHubHostTargetLeaseRenewal();
+    }
+    recordSecurityAudit({
+      action: 'auth.session.established',
+      phase: 'complete',
+      result: 'success',
+      actorAccountId: user.id,
+      actorUserId: user.id,
+      authMethod: 'supabase-access-refresh',
+      requestHash: requestAuditHash({ userId: user.id, expiresAt })
+    });
+    res.json({ ok: true, authenticated: true, persisted, userId: user.id, role: runtimeRole, hostTarget });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    recordSecurityAudit({
+      action: 'auth.session.establish',
+      phase: 'complete',
+      result: 'rejected',
+      reason: message,
+      authMethod: 'supabase-access-refresh',
+      requestHash: requestAuditHash({ hasAccessToken: Boolean(req.body?.accessToken || req.body?.access_token), hasRefreshToken: Boolean(req.body?.refreshToken || req.body?.refresh_token) })
+    });
     const status = authVerificationHttpStatus(message);
     res.status(status).json({ ok: false, error: message });
   }
@@ -4633,14 +5106,33 @@ function startHubHostTargetLeaseRenewal() {
   hubHostTargetRenewTimer.unref?.();
 }
 
-app.delete('/api/auth/session', async (_req, res) => {
-  noStore(res);
-  const hostTarget = runtimeRole === 'hub'
-    ? await clearHubHostTarget('logout')
-    : { ok: true, active: false };
-  clearRuntimeSession();
-  res.json({ ok: true, authenticated: false, role: runtimeRole, hostTarget });
-});
+app.delete('/api/auth/session', async (_req, res) => {
+  noStore(res);
+  const actorUserId = runtimeManager.getSnapshot().userId || '';
+  const hostTarget = runtimeRole === 'hub'
+    ? await clearHubHostTarget('logout')
+    : { ok: true, active: false };
+  const providerLogout = await revokeRuntimeProviderSession();
+  clearRuntimeSession();
+  recordSecurityAudit({
+    action: 'auth.session.revoked',
+    phase: 'complete',
+    result: providerLogout.ok ? 'success' : 'provider-error',
+    actorAccountId: actorUserId,
+    actorUserId,
+    reason: providerLogout.error || '',
+    authMethod: 'supabase-local-signout',
+    details: { localCleared: true, providerRevoked: providerLogout.revoked === true, alreadyInvalid: providerLogout.alreadyInvalid === true }
+  });
+  res.status(providerLogout.ok ? 200 : 502).json({
+    ok: providerLogout.ok,
+    authenticated: false,
+    localCleared: true,
+    role: runtimeRole,
+    hostTarget,
+    providerLogout
+  });
+});
 
 app.get('/api/hub/status', (_req, res) => {
   noStore(res);
@@ -5072,15 +5564,17 @@ app.post('/api/remote/filesystem/shared-folders/:folderId/sync', requireHubFeatu
   }
 });
 
-app.post('/api/remote/files/transfer', requireHubFeatureAccess, (req, res) => {
+app.post('/api/remote/files/transfer', requireHubFeatureAccess, (req, res) => {
   noStore(res);
   const deviceIds = normalizeDeviceIds(req.body?.deviceIds);
-  if (deviceIds.length === 0) {
-    res.status(400).json({ ok: false, error: 'no-target-devices' });
+  if (deviceIds.length === 0) {
+    recordSecurityAudit({ action: 'remote.file.transfer', phase: 'complete', result: 'rejected', reason: 'no-target-devices', authMethod: 'local-admin-session' });
+    res.status(400).json({ ok: false, error: 'no-target-devices' });
     return;
   }
   const normalized = normalizeTransferFiles(req.body?.files);
-  if (!normalized.ok) {
+  if (!normalized.ok) {
+    recordSecurityAudit({ action: 'remote.file.transfer', phase: 'complete', result: 'rejected', reason: normalized.error, deviceIds, authMethod: 'local-admin-session' });
     res.status(400).json({ ok: false, error: normalized.error, totalBytes: normalized.totalBytes || 0 });
     return;
   }
@@ -5100,7 +5594,18 @@ app.post('/api/remote/files/transfer', requireHubFeatureAccess, (req, res) => {
       }
     })
   }));
-  const queued = results.filter(result => result.ok).length;
+  const queued = results.filter(result => result.ok).length;
+  recordSecurityAudit({
+    action: 'remote.file.transfer',
+    phase: 'start',
+    result: queued > 0 ? 'queued' : 'rejected',
+    reason: queued > 0 ? '' : 'no-transfer-queued',
+    deviceIds,
+    sessionId: transferId,
+    requestHash: requestAuditHash({ transferId, remoteDirectory, files: normalized.files.map(file => ({ name: file.name, relativePath: file.relativePath, byteLength: file.size })), totalBytes: normalized.totalBytes }),
+    authMethod: 'local-admin-session',
+    details: { queued, total: deviceIds.length, totalBytes: normalized.totalBytes, files: normalized.files.length }
+  });
   res.json({
     ok: queued > 0,
     transferId,
@@ -5113,15 +5618,17 @@ app.post('/api/remote/files/transfer', requireHubFeatureAccess, (req, res) => {
   });
 });
 
-app.post('/api/remote/files/chunk', requireHubFeatureAccess, (req, res) => {
+app.post('/api/remote/files/chunk', requireHubFeatureAccess, (req, res) => {
   noStore(res);
   const deviceIds = normalizeDeviceIds(req.body?.deviceIds);
-  if (deviceIds.length === 0) {
+  if (deviceIds.length === 0) {
+    recordSecurityAudit({ action: 'remote.file.chunk', phase: 'complete', result: 'rejected', reason: 'no-target-devices', authMethod: 'local-admin-session' });
     res.status(400).json({ ok: false, error: 'no-target-devices' });
     return;
   }
   const normalized = normalizeTransferChunk(req.body || {});
-  if (!normalized.ok) {
+  if (!normalized.ok) {
+    recordSecurityAudit({ action: 'remote.file.chunk', phase: 'complete', result: 'rejected', reason: normalized.error, deviceIds, authMethod: 'local-admin-session' });
     res.status(400).json({ ok: false, error: normalized.error, byteLength: normalized.byteLength || 0 });
     return;
   }
@@ -5141,7 +5648,18 @@ app.post('/api/remote/files/chunk', requireHubFeatureAccess, (req, res) => {
       }
     })
   }));
-  const queued = results.filter(result => result.ok).length;
+  const queued = results.filter(result => result.ok).length;
+  recordSecurityAudit({
+    action: 'remote.file.chunk',
+    phase: normalized.chunk.final ? 'complete' : 'progress',
+    result: queued > 0 ? 'queued' : 'rejected',
+    reason: queued > 0 ? '' : 'no-transfer-queued',
+    deviceIds,
+    sessionId: transferId,
+    requestHash: requestAuditHash({ transferId, remoteDirectory, offset: normalized.chunk.offset, byteLength: normalized.chunk.byteLength, final: normalized.chunk.final }),
+    authMethod: 'local-admin-session',
+    details: { queued, total: deviceIds.length, byteLength: normalized.chunk.byteLength, offset: normalized.chunk.offset, final: normalized.chunk.final }
+  });
   res.json({
     ok: queued > 0,
     transferId,
@@ -5426,7 +5944,7 @@ app.post('/api/remote/devices/:deviceId/audio/stop', async (req, res, next) => {
   }
 });
 
-if (existsSync(webIndexPath)) {
+if (existsSync(webIndexPath)) {
   app.use(express.static(webDistPath, {
     etag: true,
     index: false,
@@ -5439,14 +5957,39 @@ if (existsSync(webIndexPath)) {
     }
     res.sendFile(webIndexPath);
   });
-}
-
-httpServer.on('upgrade', (req, socket, head) => {
-  if (!isTrustedBrowserRequest(req)) {
+}
+
+function isAuthorizedAdminWebSocket(req) {
+  if (!enforceLocalAdminAuth) return true;
+  const protocols = String(req.headers['sec-websocket-protocol'] || '')
+    .split(',')
+    .map(value => value.trim())
+    .filter(Boolean);
+  const adminToken = protocols.find(value => value.startsWith('livedesk-admin-'))?.slice('livedesk-admin-'.length) || '';
+  const csrfToken = protocols.find(value => value.startsWith('livedesk-admin-csrf-'))?.slice('livedesk-admin-csrf-'.length) || '';
+  return secureExactTestTokenMatches(adminToken, localAdminSessionToken)
+    && secureExactTestTokenMatches(csrfToken, localAdminCsrfToken);
+}
+
+httpServer.on('upgrade', (req, socket, head) => {
+  if (!isTrustedBrowserRequest(req)) {
     socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
     socket.destroy();
-    return;
-  }
+    return;
+  }
+  if (!isAuthorizedAdminWebSocket(req)) {
+    recordSecurityAudit({
+      action: 'local-admin.websocket',
+      phase: 'complete',
+      result: 'rejected',
+      reason: 'admin-session-required',
+      requestHash: requestAuditHash({ path: req.url || '' }),
+      authMethod: 'local-admin-websocket'
+    });
+    socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
+    socket.destroy();
+    return;
+  }
   try {
     const parsed = new URL(req.url || '/', `http://${req.headers.host || '127.0.0.1'}`);
     if (parsed.pathname === '/api/remote/frames/ws') {
@@ -5496,6 +6039,8 @@ frameWss.on('connection', (ws, req) => {
       const payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));
       if (payload?.type === 'subscribe') {
         updateFrameSubscription(ws, payload);
+      } else if (payload?.type === 'refresh-live') {
+        refreshFrameSubscriptionLive(ws, payload);
       } else if (payload?.type === 'restart-live') {
         restartFrameSubscriptionLive(ws, payload);
       }
@@ -5581,10 +6126,17 @@ audioWss.on('connection', (ws, req) => {
   });
 });
 
-inputWss.on('connection', ws => {
+inputWss.on('connection', ws => {
   inputClients.add(ws);
   ws.liveDeskInputClientId = `riws-${++inputClientSeq}`;
-  ws.liveDeskInputDeviceIds = new Set();
+  ws.liveDeskInputDeviceIds = new Set();
+  recordSecurityAudit({
+    action: 'remote.control.browser-session',
+    phase: 'start',
+    result: 'success',
+    sessionId: ws.liveDeskInputClientId,
+    authMethod: 'local-admin-websocket'
+  });
   try {
     ws._socket?.setNoDelay?.(true);
   } catch {
@@ -5630,11 +6182,22 @@ inputWss.on('connection', ws => {
       timestamp: new Date().toISOString()
     });
   });
-  const releaseBrowserInputOwner = reason => {
-    inputClients.delete(ws);
-    for (const deviceId of ws.liveDeskInputDeviceIds || []) {
-      remoteHub.releaseInputOwner(deviceId, ws.liveDeskInputClientId, reason);
-    }
+  const releaseBrowserInputOwner = reason => {
+    if (ws.liveDeskInputReleased) return;
+    ws.liveDeskInputReleased = true;
+    inputClients.delete(ws);
+    for (const deviceId of ws.liveDeskInputDeviceIds || []) {
+      remoteHub.releaseInputOwner(deviceId, ws.liveDeskInputClientId, reason);
+    }
+    recordSecurityAudit({
+      action: 'remote.control.browser-session',
+      phase: 'complete',
+      result: 'success',
+      reason,
+      deviceIds: [...(ws.liveDeskInputDeviceIds || [])],
+      sessionId: ws.liveDeskInputClientId,
+      authMethod: 'local-admin-websocket'
+    });
     ws.liveDeskInputDeviceIds?.clear?.();
   };
   ws.on('close', () => releaseBrowserInputOwner('browser-input-websocket-closed'));
@@ -5739,7 +6302,8 @@ function shutdownHub(signal) {
   hubShutdownPromise = (async () => {
     const startedAt = Date.now();
     console.log(`[LiveDesk Hub] Shutdown started signal=${signal} grace=${hubShutdownGraceMs}ms timeout=${hubShutdownTimeoutMs}ms.`);
-    if (roleWatchTimer) clearInterval(roleWatchTimer);
+    if (roleWatchTimer) clearInterval(roleWatchTimer);
+    clearInterval(captureRetentionTimer);
     clearInterval(browserWebSocketHeartbeatTimer);
     runSynchronousShutdownStep('update manager close', () => liveDeskUpdateManager?.close());
     atlasClients.clear();