@livedesk/hub 0.1.32 → 0.1.34

package/src/server.js

@@ -39,17 +39,17 @@ import { createAgentDeviceScope, resolveAgentTargetIds } from './agents/agent-de
 import { AgentRuntimeError } from './agents/agent-runtime-error.js';
 import { AGENT_PERMISSION_MODES, createAgentPermissionPolicy, evaluateAgentToolPermission, hashAgentPermissionPolicy } from './agents/agent-permissions.js';
 import { createAgentPermissionStore } from './agents/agent-permission-store.js';
-import { createAgentAuditStore } from './agents/agent-audit-store.js';
-import { createSecurityAuditStore } from './security/security-audit-store.js';
-import { getAgentToolDefinition, isRetiredAgentMutatingToolName } from './agents/agent-tool-registry.js';
+import { createAgentAuditStore } from './agents/agent-audit-store.js';
+import { createSecurityAuditStore } from './security/security-audit-store.js';
+import { getAgentToolDefinition, isRetiredAgentMutatingToolName } from './agents/agent-tool-registry.js';
 import { LiveDeskSettingsStore, SettingsConflictError } from './settings/settings-store.js';
 import { effectiveDevicePolicy } from './settings/settings-schema.js';
 import { buildEffectiveDevicePolicy } from './settings/effective-device-policy.js';
 import { CaptureStore } from './captures/capture-store.js';
 import { createLiveDeskUpdateManager } from './live-desk-update.js';
 import { createHubUdpTransport } from './transport/udp-hub-transport.js';
-import { normalizeRuntimeAuthSession, runtimeRoleError } from '../../runtime-core/src/index.js';
-import { createOsSecretStore, OS_SECRET_REFERENCE } from '../../runtime-core/src/os-secret-store.js';
+import { normalizeRuntimeAuthSession, runtimeRoleError } from '../../runtime-core/src/index.js';
+import { createOsSecretStore, OS_SECRET_REFERENCE } from '../../runtime-core/src/os-secret-store.js';
 import { fetchAuthResponse, AUTH_REQUEST_TIMEOUT_MS } from '../../runtime-core/src/auth-http.js';
 import { PRODUCTION_SUPABASE_PUBLISHABLE_KEY, PRODUCTION_SUPABASE_URL } from '../../runtime-core/src/auth-config.js';
 import { createHubRuntime } from './runtime/hub-runtime.js';
@@ -65,20 +65,20 @@ const webDistCandidates = [
 const webDistPath = webDistCandidates.find(candidate => existsSync(resolve(candidate, 'index.html'))) || webDistCandidates[webDistCandidates.length - 1];
 const webIndexPath = resolve(webDistPath, 'index.html');
 const packageInfo = JSON.parse(readFileSync(resolve(__dirname, '..', 'package.json'), 'utf8'));
-const httpHost = process.env.LIVEDESK_HUB_HTTP_HOST || '127.0.0.1';
-const httpPort = Number(process.env.LIVEDESK_HUB_HTTP_PORT || process.env.PORT || 5179);
-if (!isLoopbackBindHost(httpHost) && process.env.LIVEDESK_TEST_MODE !== '1') {
-  throw new Error('hub-http-lan-bind-requires-tls-authenticated-proxy');
-}
-const localAdminSessionToken = crypto.randomBytes(32).toString('base64url');
-const localAdminCsrfToken = crypto.randomBytes(32).toString('base64url');
-const localAdminSessionId = crypto.randomUUID();
-const launcherShutdownToken = /^[A-Za-z0-9_-]{43}$/.test(
-  String(process.env.LIVEDESK_LAUNCHER_SHUTDOWN_TOKEN || '').trim()
-)
-  ? String(process.env.LIVEDESK_LAUNCHER_SHUTDOWN_TOKEN).trim()
-  : '';
-const enforceLocalAdminAuth = process.env.LIVEDESK_TEST_MODE !== '1';
+const httpHost = process.env.LIVEDESK_HUB_HTTP_HOST || '127.0.0.1';
+const httpPort = Number(process.env.LIVEDESK_HUB_HTTP_PORT || process.env.PORT || 5179);
+if (!isLoopbackBindHost(httpHost) && process.env.LIVEDESK_TEST_MODE !== '1') {
+  throw new Error('hub-http-lan-bind-requires-tls-authenticated-proxy');
+}
+const localAdminSessionToken = crypto.randomBytes(32).toString('base64url');
+const localAdminCsrfToken = crypto.randomBytes(32).toString('base64url');
+const localAdminSessionId = crypto.randomUUID();
+const launcherShutdownToken = /^[A-Za-z0-9_-]{43}$/.test(
+  String(process.env.LIVEDESK_LAUNCHER_SHUTDOWN_TOKEN || '').trim()
+)
+  ? String(process.env.LIVEDESK_LAUNCHER_SHUTDOWN_TOKEN).trim()
+  : '';
+const enforceLocalAdminAuth = process.env.LIVEDESK_TEST_MODE !== '1';
 const runtimeRole = String(process.env.LIVEDESK_RUNTIME_ROLE || 'hub').trim().toLowerCase() === 'client' ? 'client' : 'hub';
 const runtimeDeviceId = String(process.env.LIVEDESK_DEVICE_ID || '').trim();
 const runtimeDeviceName = String(process.env.LIVEDESK_DEVICE_NAME || os.hostname()).trim() || os.hostname();
@@ -179,21 +179,21 @@ const SUPABASE_AUTH_TIMEOUT_MS = process.env.LIVEDESK_AUTH_TEST_MODE === '1'
   ? readPositiveIntegerEnv('LIVEDESK_AUTH_TEST_TIMEOUT_MS', AUTH_REQUEST_TIMEOUT_MS)
   : AUTH_REQUEST_TIMEOUT_MS;
 const CLIENT_AUTH_STORAGE_KEY = 'livedesk.client.supabase.auth';
-const runtimeAuthStatePath = process.env.LIVEDESK_DESKTOP_HOST === '1'
+const runtimeAuthStatePath = process.env.LIVEDESK_DESKTOP_HOST === '1'
   ? ''
-  : String(process.env.LIVEDESK_AUTH_STATE_PATH || '').trim();
-const runtimeRefreshSecretStore = createOsSecretStore({
-  service: 'LiveDesk',
-  account: 'client-refresh-token',
-  dataDir: process.env.LIVEDESK_STATE_DIR || (runtimeAuthStatePath ? dirname(runtimeAuthStatePath) : undefined)
-});
-const testLicensePlan = process.env.LIVEDESK_TEST_MODE === '1'
+  : String(process.env.LIVEDESK_AUTH_STATE_PATH || '').trim();
+const runtimeRefreshSecretStore = createOsSecretStore({
+  service: 'LiveDesk',
+  account: 'client-refresh-token',
+  dataDir: process.env.LIVEDESK_STATE_DIR || (runtimeAuthStatePath ? dirname(runtimeAuthStatePath) : undefined)
+});
+const testLicensePlan = process.env.LIVEDESK_TEST_MODE === '1'
   && ['ltd', 'pro'].includes(String(process.env.LIVEDESK_TEST_LICENSE_PLAN || '').toLowerCase())
-  ? String(process.env.LIVEDESK_TEST_LICENSE_PLAN).toLowerCase()
-  : '';
-const testSecurityAccountId = process.env.LIVEDESK_TEST_MODE === '1'
-  ? String(process.env.LIVEDESK_ACCOUNT_ID || '').trim().slice(0, 128)
-  : '';
+  ? String(process.env.LIVEDESK_TEST_LICENSE_PLAN).toLowerCase()
+  : '';
+const testSecurityAccountId = process.env.LIVEDESK_TEST_MODE === '1'
+  ? String(process.env.LIVEDESK_ACCOUNT_ID || '').trim().slice(0, 128)
+  : '';
 const persistentSessionGcEnabled =
   process.env.LIVEDESK_TEST_MODE === '1'
   && process.env.LIVEDESK_PERSISTENT_SESSION_TEST_GC === '1';
@@ -203,12 +203,12 @@ const traceRemoteTestEventsEnabled =
 const persistentSessionGcToken = persistentSessionGcEnabled
   ? String(process.env.LIVEDESK_PERSISTENT_SESSION_TEST_TOKEN || '').trim()
   : '';
-let connectedDeviceCount = 0;
-let runtimeAccessToken = '';
-let runtimeRefreshToken = '';
-let runtimeAccessTokenExpiresAt = 0;
-let runtimeSessionGeneration = 0;
-let runtimeRefreshPromise = null;
+let connectedDeviceCount = 0;
+let runtimeAccessToken = '';
+let runtimeRefreshToken = '';
+let runtimeAccessTokenExpiresAt = 0;
+let runtimeSessionGeneration = 0;
+let runtimeRefreshPromise = null;
 let roleWatchInFlight = false;
 let verifiedLicense = {
   userId: '',
@@ -220,10 +220,10 @@ let verifiedLicense = {
 let frameClientSeq = 0;
 let inputClientSeq = 0;
 let audioClientSeq = 0;
-let liveDeskUpdateManager = null;
-let hubTransferJobs = null;
-let securityAuditStore = null;
-let securityAuditHealthy = true;
+let liveDeskUpdateManager = null;
+let hubTransferJobs = null;
+let securityAuditStore = null;
+let securityAuditHealthy = true;
 const HUB_HOST_TARGET_LEASE_MS = Math.max(5000, readPositiveIntegerEnv('LIVEDESK_HOST_TARGET_LEASE_MS', 60_000));
 const HUB_HOST_TARGET_RENEW_MS = Math.max(1000, Math.min(
   readPositiveIntegerEnv('LIVEDESK_HOST_TARGET_RENEW_MS', 20_000),
@@ -254,7 +254,7 @@ let hubWakeNotificationState = {
 };
 let hubWakeNextAttemptAtMs = 0;
 
-function readPositiveIntegerEnv(name, fallback) {
+function readPositiveIntegerEnv(name, fallback) {
   const value = Number(process.env[name]);
   return Number.isFinite(value) && value > 0 ? Math.round(value) : fallback;
 }
@@ -267,42 +267,42 @@ function secureExactTestTokenMatches(actual, expected) {
     && crypto.timingSafeEqual(actualBytes, expectedBytes);
 }
 
-function handleRemoteHubEvent(type, event) {
-  liveDeskUpdateManager?.handleRemoteEvent(type, event);
-  hubTransferJobs?.handleRemoteEvent(type, event);
-  const auditedRemoteActions = {
-    RemoteSecurityHandshakeAudit: event?.action || 'remote.handshake',
-    RemoteSecurityPolicyAudit: 'remote.connection-policy',
-    RemoteAbuseDefense: 'remote.abuse-defense',
-    RemoteDeviceConnected: 'remote.device.connected',
-    RemoteDeviceDisconnected: 'remote.device.disconnected',
-    RemoteInputSocketConnected: 'remote.control.channel-started',
-    RemoteInputSocketDisconnected: 'remote.control.channel-ended',
-    RemoteControlSessionStarted: 'remote.control.session-started',
-    RemoteControlSessionEnded: 'remote.control.session-ended',
-    RemoteFileSocketConnected: 'remote.file.channel-started',
-    RemoteFileSocketDisconnected: 'remote.file.channel-ended',
-    RemoteEnrollmentTokenRotated: 'remote.enrollment-token.rotated'
-  };
-  if (auditedRemoteActions[type]) {
-    const device = event?.device || {};
-    recordSecurityAudit({
-      action: auditedRemoteActions[type],
-      phase: /Disconnected|ended|rotated/i.test(`${type}:${auditedRemoteActions[type]}`) ? 'complete' : 'start',
-      result: event?.result || (event?.reason && /RemoteSecurity(?:Handshake|Policy)Audit|RemoteAbuseDefense/.test(type) ? 'rejected' : 'success'),
-      reason: event?.reason || '',
-      actorAccountId: event?.accountId || '',
-      hubId: event?.hubId || event?.remoteHub?.hostInstanceId || '',
-      deviceId: event?.deviceId || device.deviceId || '',
-      sessionId: event?.sessionId || device.sessionId || '',
-      authMethod: /RemoteSecurity(?:Handshake|Policy)Audit|RemoteAbuseDefense/.test(type) ? 'device-credential-p256' : 'authenticated-device-session',
-      details: {
-        transport: event?.transport || device.transport || '',
-        channel: event?.channel || '',
-        credentialSerial: event?.credentialSerial || ''
-      }
-    });
-  }
+function handleRemoteHubEvent(type, event) {
+  liveDeskUpdateManager?.handleRemoteEvent(type, event);
+  hubTransferJobs?.handleRemoteEvent(type, event);
+  const auditedRemoteActions = {
+    RemoteSecurityHandshakeAudit: event?.action || 'remote.handshake',
+    RemoteSecurityPolicyAudit: 'remote.connection-policy',
+    RemoteAbuseDefense: 'remote.abuse-defense',
+    RemoteDeviceConnected: 'remote.device.connected',
+    RemoteDeviceDisconnected: 'remote.device.disconnected',
+    RemoteInputSocketConnected: 'remote.control.channel-started',
+    RemoteInputSocketDisconnected: 'remote.control.channel-ended',
+    RemoteControlSessionStarted: 'remote.control.session-started',
+    RemoteControlSessionEnded: 'remote.control.session-ended',
+    RemoteFileSocketConnected: 'remote.file.channel-started',
+    RemoteFileSocketDisconnected: 'remote.file.channel-ended',
+    RemoteEnrollmentTokenRotated: 'remote.enrollment-token.rotated'
+  };
+  if (auditedRemoteActions[type]) {
+    const device = event?.device || {};
+    recordSecurityAudit({
+      action: auditedRemoteActions[type],
+      phase: /Disconnected|ended|rotated/i.test(`${type}:${auditedRemoteActions[type]}`) ? 'complete' : 'start',
+      result: event?.result || (event?.reason && /RemoteSecurity(?:Handshake|Policy)Audit|RemoteAbuseDefense/.test(type) ? 'rejected' : 'success'),
+      reason: event?.reason || '',
+      actorAccountId: event?.accountId || '',
+      hubId: event?.hubId || event?.remoteHub?.hostInstanceId || '',
+      deviceId: event?.deviceId || device.deviceId || '',
+      sessionId: event?.sessionId || device.sessionId || '',
+      authMethod: /RemoteSecurity(?:Handshake|Policy)Audit|RemoteAbuseDefense/.test(type) ? 'device-credential-p256' : 'authenticated-device-session',
+      details: {
+        transport: event?.transport || device.transport || '',
+        channel: event?.channel || '',
+        credentialSerial: event?.credentialSerial || ''
+      }
+    });
+  }
   if (traceRemoteTestEventsEnabled
     && (type === 'RemoteFrameDropped' || type === 'RemoteFrameTransportProofAccepted')) {
     console.warn(`[LiveDesk Hub Test Event] ${type} ${JSON.stringify({
@@ -349,16 +349,16 @@ function handleRemoteHubEvent(type, event) {
     }
     return;
   }
-  if (type === 'RemoteDeviceConnected' || type === 'RemoteDeviceDisconnected') {
-    connectedDeviceCount = Number(remoteHub.getStatus({ includeSecrets: false }).connectedDeviceCount || 0);
-  }
-  if (type === 'RemoteEnrollmentTokenRotated') {
-    void publishHubHostTargetWithPendingRoleTakeover('enrollment-token-rotated').catch(error => {
-      console.warn(`[LiveDesk Hub] Enrollment token publication failed: ${error?.message || error}`);
-    });
-    return;
-  }
-  if (type !== 'RemoteDeviceConnected') {
+  if (type === 'RemoteDeviceConnected' || type === 'RemoteDeviceDisconnected') {
+    connectedDeviceCount = Number(remoteHub.getStatus({ includeSecrets: false }).connectedDeviceCount || 0);
+  }
+  if (type === 'RemoteEnrollmentTokenRotated') {
+    void publishHubHostTargetWithPendingRoleTakeover('enrollment-token-rotated').catch(error => {
+      console.warn(`[LiveDesk Hub] Enrollment token publication failed: ${error?.message || error}`);
+    });
+    return;
+  }
+  if (type !== 'RemoteDeviceConnected') {
     return;
   }
   const deviceId = String(event?.deviceId || event?.device?.deviceId || '').trim();
@@ -490,23 +490,23 @@ function readRuntimeAuthState() {
   }
 }
 
-function readPersistedRuntimeSession(state = readRuntimeAuthState()) {
+function readPersistedRuntimeSession(state = readRuntimeAuthState()) {
   try {
     const raw = state?.[CLIENT_AUTH_STORAGE_KEY];
     const session = typeof raw === 'string' ? JSON.parse(raw) : raw;
-    if (!session || typeof session !== 'object') return null;
-    const plaintextRefreshToken = String(session.refresh_token || '').trim();
-    const refreshToken = plaintextRefreshToken || (session.refresh_token_ref === OS_SECRET_REFERENCE
-      ? runtimeRefreshSecretStore.read()
-      : '');
-    if (plaintextRefreshToken) {
-      if (!runtimeRefreshSecretStore.write(plaintextRefreshToken)) return null;
-      const migrated = { ...session, refresh_token_ref: OS_SECRET_REFERENCE };
-      delete migrated.refresh_token;
-      state[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(migrated);
-      writePrivateRuntimeAuthState(state);
-    }
-    return { ...session, refresh_token: refreshToken };
+    if (!session || typeof session !== 'object') return null;
+    const plaintextRefreshToken = String(session.refresh_token || '').trim();
+    const refreshToken = plaintextRefreshToken || (session.refresh_token_ref === OS_SECRET_REFERENCE
+      ? runtimeRefreshSecretStore.read()
+      : '');
+    if (plaintextRefreshToken) {
+      if (!runtimeRefreshSecretStore.write(plaintextRefreshToken)) return null;
+      const migrated = { ...session, refresh_token_ref: OS_SECRET_REFERENCE };
+      delete migrated.refresh_token;
+      state[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(migrated);
+      writePrivateRuntimeAuthState(state);
+    }
+    return { ...session, refresh_token: refreshToken };
   } catch {
     return null;
   }
@@ -549,34 +549,34 @@ function persistRuntimeSession(session) {
       ...(session?.user && typeof session.user === 'object' ? session.user : {})
     }
   }, { requireRefreshToken: true });
-  if (!normalized.ok) return false;
-  if (!runtimeRefreshSecretStore.write(normalized.session.refresh_token)) return false;
-  const persisted = { ...normalized.session, refresh_token_ref: OS_SECRET_REFERENCE };
-  delete persisted.refresh_token;
-  state[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(persisted);
+  if (!normalized.ok) return false;
+  if (!runtimeRefreshSecretStore.write(normalized.session.refresh_token)) return false;
+  const persisted = { ...normalized.session, refresh_token_ref: OS_SECRET_REFERENCE };
+  delete persisted.refresh_token;
+  state[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(persisted);
   writePrivateRuntimeAuthState(state);
   return true;
 }
 
-function clearPersistedRuntimeSession() {
+function clearPersistedRuntimeSession() {
   if (!runtimeAuthStatePath) return false;
   const state = readRuntimeAuthState();
-  delete state[CLIENT_AUTH_STORAGE_KEY];
-  runtimeRefreshSecretStore.clear();
+  delete state[CLIENT_AUTH_STORAGE_KEY];
+  runtimeRefreshSecretStore.clear();
   return writePrivateRuntimeAuthState(state);
 }
 
-function clearRuntimeSession() {
-  runtimeSessionGeneration += 1;
-  runtimeRefreshPromise = null;
-  runtimeAccessToken = '';
-  runtimeRefreshToken = '';
+function clearRuntimeSession() {
+  runtimeSessionGeneration += 1;
+  runtimeRefreshPromise = null;
+  runtimeAccessToken = '';
+  runtimeRefreshToken = '';
   runtimeAccessTokenExpiresAt = 0;
   runtimeManager.setAuthenticated(false);
   try { clearPersistedRuntimeSession(); } catch { /* runtime auth is already invalid */ }
 }
 
-async function getRuntimeAccessToken() {
+async function getRuntimeAccessToken() {
   const accessToken = String(runtimeAccessToken || '').trim();
   const expiresSoon = runtimeAccessTokenExpiresAt > 0
     && runtimeAccessTokenExpiresAt <= Date.now() + HUB_ACCESS_TOKEN_REFRESH_SKEW_MS;
@@ -585,112 +585,112 @@ async function getRuntimeAccessToken() {
   }
 
   const refreshToken = String(runtimeRefreshToken || '').trim();
-  if (!refreshToken) {
-    return accessToken;
-  }
-
-  if (runtimeRefreshPromise) return runtimeRefreshPromise;
-
-  const ownerGeneration = runtimeSessionGeneration;
-  const refreshOperation = (async () => {
-    const response = await fetchAuthResponse(
-      fetch,
-      `${supabaseUrl}/auth/v1/token?grant_type=refresh_token`,
-      {
-        method: 'POST',
-        headers: {
-          apikey: supabasePublishableKey,
-          'Content-Type': 'application/json',
-          Accept: 'application/json'
-        },
-        body: JSON.stringify({ refresh_token: refreshToken })
-      },
-      SUPABASE_AUTH_TIMEOUT_MS
-    );
-    if (!response.ok) {
-      if (response.status === 400 || response.status === 401 || response.status === 403) {
-        if (runtimeSessionGeneration === ownerGeneration && runtimeRefreshToken === refreshToken) {
-          clearRuntimeSession();
-        }
-        throw new Error(`hub-session-refresh-failed:${response.status}`);
-      }
-      throw new Error(`hub-session-refresh-provider-failed:${response.status}`);
-    }
-    const refreshed = await response.json().catch(() => null);
-    const nextAccessToken = String(refreshed?.access_token || '').trim();
-    if (!nextAccessToken) {
-      throw new Error('hub-session-refresh-missing-access-token');
-    }
-    if (runtimeSessionGeneration !== ownerGeneration || runtimeRefreshToken !== refreshToken) {
-      throw new Error('hub-session-refresh-owner-retired');
-    }
-    runtimeAccessToken = nextAccessToken;
-    runtimeRefreshToken = String(refreshed?.refresh_token || refreshToken).trim();
-    runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(refreshed?.expires_at)
-      || (Number(refreshed?.expires_in) > 0 ? Date.now() + Number(refreshed.expires_in) * 1000 : 0);
-    try {
-      persistRuntimeSession({
-        access_token: runtimeAccessToken,
-        refresh_token: runtimeRefreshToken,
-        expires_at: Math.floor(runtimeAccessTokenExpiresAt / 1000)
-      });
-    } catch (error) {
-      console.warn(`[LiveDesk Hub] Refreshed session persistence failed: ${error?.message || error}`);
-    }
-    return runtimeAccessToken;
-  })();
-  runtimeRefreshPromise = refreshOperation;
-  try {
-    return await refreshOperation;
-  } finally {
-    if (runtimeRefreshPromise === refreshOperation) runtimeRefreshPromise = null;
-  }
-}
-
-function isLoopbackBindHost(value) {
-  const host = String(value || '').trim().toLowerCase().replace(/^\[|\]$/g, '');
-  return host === '127.0.0.1' || host === 'localhost' || host === '::1';
-}
-
-async function revokeRuntimeProviderSession() {
-  const hasRuntimeSession = Boolean(runtimeAccessToken || runtimeRefreshToken);
-  if (!hasRuntimeSession) return { ok: true, skipped: true, reason: 'no-runtime-session' };
-
-  let accessToken = String(runtimeAccessToken || '').trim();
-  try {
-    accessToken = await getRuntimeAccessToken() || accessToken;
-  } catch (error) {
-    const message = String(error?.message || error);
-    if (/^hub-session-refresh-failed:(?:400|401|403)$/.test(message)) {
-      return { ok: true, alreadyInvalid: true };
-    }
-    return { ok: false, error: message };
-  }
-  if (!accessToken) return { ok: false, error: 'provider-session-token-unavailable' };
-
-  try {
-    const response = await fetchAuthResponse(
-      fetch,
-      `${supabaseUrl}/auth/v1/logout?scope=local`,
-      {
-        method: 'POST',
-        headers: {
-          apikey: supabasePublishableKey,
-          Authorization: `Bearer ${accessToken}`,
-          Accept: 'application/json'
-        }
-      },
-      SUPABASE_AUTH_TIMEOUT_MS
-    );
-    if (response.ok) return { ok: true, revoked: true };
-    if ([401, 403, 404].includes(response.status)) {
-      return { ok: true, alreadyInvalid: true, status: response.status };
-    }
-    return { ok: false, error: `provider-session-revoke-failed:${response.status}` };
-  } catch (error) {
-    return { ok: false, error: String(error?.message || error) };
-  }
-}
+  if (!refreshToken) {
+    return accessToken;
+  }
+
+  if (runtimeRefreshPromise) return runtimeRefreshPromise;
+
+  const ownerGeneration = runtimeSessionGeneration;
+  const refreshOperation = (async () => {
+    const response = await fetchAuthResponse(
+      fetch,
+      `${supabaseUrl}/auth/v1/token?grant_type=refresh_token`,
+      {
+        method: 'POST',
+        headers: {
+          apikey: supabasePublishableKey,
+          'Content-Type': 'application/json',
+          Accept: 'application/json'
+        },
+        body: JSON.stringify({ refresh_token: refreshToken })
+      },
+      SUPABASE_AUTH_TIMEOUT_MS
+    );
+    if (!response.ok) {
+      if (response.status === 400 || response.status === 401 || response.status === 403) {
+        if (runtimeSessionGeneration === ownerGeneration && runtimeRefreshToken === refreshToken) {
+          clearRuntimeSession();
+        }
+        throw new Error(`hub-session-refresh-failed:${response.status}`);
+      }
+      throw new Error(`hub-session-refresh-provider-failed:${response.status}`);
+    }
+    const refreshed = await response.json().catch(() => null);
+    const nextAccessToken = String(refreshed?.access_token || '').trim();
+    if (!nextAccessToken) {
+      throw new Error('hub-session-refresh-missing-access-token');
+    }
+    if (runtimeSessionGeneration !== ownerGeneration || runtimeRefreshToken !== refreshToken) {
+      throw new Error('hub-session-refresh-owner-retired');
+    }
+    runtimeAccessToken = nextAccessToken;
+    runtimeRefreshToken = String(refreshed?.refresh_token || refreshToken).trim();
+    runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(refreshed?.expires_at)
+      || (Number(refreshed?.expires_in) > 0 ? Date.now() + Number(refreshed.expires_in) * 1000 : 0);
+    try {
+      persistRuntimeSession({
+        access_token: runtimeAccessToken,
+        refresh_token: runtimeRefreshToken,
+        expires_at: Math.floor(runtimeAccessTokenExpiresAt / 1000)
+      });
+    } catch (error) {
+      console.warn(`[LiveDesk Hub] Refreshed session persistence failed: ${error?.message || error}`);
+    }
+    return runtimeAccessToken;
+  })();
+  runtimeRefreshPromise = refreshOperation;
+  try {
+    return await refreshOperation;
+  } finally {
+    if (runtimeRefreshPromise === refreshOperation) runtimeRefreshPromise = null;
+  }
+}
+
+function isLoopbackBindHost(value) {
+  const host = String(value || '').trim().toLowerCase().replace(/^\[|\]$/g, '');
+  return host === '127.0.0.1' || host === 'localhost' || host === '::1';
+}
+
+async function revokeRuntimeProviderSession() {
+  const hasRuntimeSession = Boolean(runtimeAccessToken || runtimeRefreshToken);
+  if (!hasRuntimeSession) return { ok: true, skipped: true, reason: 'no-runtime-session' };
+
+  let accessToken = String(runtimeAccessToken || '').trim();
+  try {
+    accessToken = await getRuntimeAccessToken() || accessToken;
+  } catch (error) {
+    const message = String(error?.message || error);
+    if (/^hub-session-refresh-failed:(?:400|401|403)$/.test(message)) {
+      return { ok: true, alreadyInvalid: true };
+    }
+    return { ok: false, error: message };
+  }
+  if (!accessToken) return { ok: false, error: 'provider-session-token-unavailable' };
+
+  try {
+    const response = await fetchAuthResponse(
+      fetch,
+      `${supabaseUrl}/auth/v1/logout?scope=local`,
+      {
+        method: 'POST',
+        headers: {
+          apikey: supabasePublishableKey,
+          Authorization: `Bearer ${accessToken}`,
+          Accept: 'application/json'
+        }
+      },
+      SUPABASE_AUTH_TIMEOUT_MS
+    );
+    if (response.ok) return { ok: true, revoked: true };
+    if ([401, 403, 404].includes(response.status)) {
+      return { ok: true, alreadyInvalid: true, status: response.status };
+    }
+    return { ok: false, error: `provider-session-revoke-failed:${response.status}` };
+  } catch (error) {
+    return { ok: false, error: String(error?.message || error) };
+  }
+}
 
 async function verifySupabaseUser(accessToken) {
   const token = String(accessToken || '').trim();
@@ -803,81 +803,81 @@ function requireHubFeatureAccess(_req, res, next) {
   res.status(402).json({ ok: false, error: 'livedesk-plan-device-limit', license: licenseSnapshot() });
 }
 
-const agentDataDir = process.env.LIVEDESK_DATA_DIR || undefined;
-securityAuditStore = createSecurityAuditStore({ dataDir: agentDataDir });
-
-function requestAuditHash(value) {
-  try {
-    return crypto.createHash('sha256').update(JSON.stringify(value ?? {}), 'utf8').digest('base64url');
-  } catch {
-    return crypto.createHash('sha256').update('[unserializable]', 'utf8').digest('base64url');
-  }
-}
-
-function securityAuditEvent(event = {}) {
-  const runtime = runtimeManager.getSnapshot();
-  return {
-    actorAccountId: event.actorAccountId || runtime.userId || '',
-    actorUserId: event.actorUserId || runtime.userId || '',
-    hubId: event.hubId || runtime.deviceId || '',
-    ...event
-  };
-}
-
-function markSecurityAuditFailed(error) {
-  if (securityAuditHealthy) {
-    securityAuditHealthy = false;
-    console.error(`[LiveDesk Hub] SECURITY AUDIT FAILURE: ${error?.message || error}`);
-  }
-}
-
-async function recordSecurityAuditRequired(event = {}) {
-  if (!securityAuditStore || !securityAuditHealthy) {
-    const error = new Error('security-audit-unavailable');
-    error.code = 'security-audit-unavailable';
-    throw error;
-  }
-  try {
-    return await securityAuditStore.record(securityAuditEvent(event));
-  } catch (error) {
-    markSecurityAuditFailed(error);
-    throw error;
-  }
-}
-
-function recordSecurityAudit(event = {}) {
-  void recordSecurityAuditRequired(event).catch(() => {
-    // Required mutation paths await recordSecurityAuditRequired directly.
-    // Best-effort lifecycle telemetry still marks the global audit gate failed.
-  });
-}
-
-const liveDeskSettingsStore = new LiveDeskSettingsStore({ dataDir: agentDataDir });
-const captureStore = new CaptureStore({
-  dataDir: agentDataDir,
-  getRetentionPolicy: () => liveDeskSettingsStore.getCached()?.filesAudio?.captureAutoDelete || 'never',
-  onRetentionDelete: result => recordSecurityAudit({
-    action: 'privacy.capture.retention-delete',
-    phase: 'complete',
-    result: 'success',
-    authMethod: 'settings-retention-policy',
-    details: result
-  })
-});
-void captureStore.initialize().catch(error => {
-  console.warn(`[LiveDesk Hub] capture store initialization failed: ${error instanceof Error ? error.message : String(error)}`);
-});
-void liveDeskSettingsStore.getRecord()
-  .then(() => captureStore.enforceRetention())
-  .catch(error => {
-    console.warn(`[LiveDesk Hub] settings or capture retention load failed: ${error instanceof Error ? error.message : String(error)}`);
-  });
-const captureRetentionTimer = setInterval(() => {
-  void captureStore.enforceRetention().catch(error => {
-    console.warn(`[LiveDesk Hub] capture retention failed: ${error instanceof Error ? error.message : String(error)}`);
-  });
-}, 60 * 60_000);
-captureRetentionTimer.unref?.();
+const agentDataDir = process.env.LIVEDESK_DATA_DIR || undefined;
+securityAuditStore = createSecurityAuditStore({ dataDir: agentDataDir });
+
+function requestAuditHash(value) {
+  try {
+    return crypto.createHash('sha256').update(JSON.stringify(value ?? {}), 'utf8').digest('base64url');
+  } catch {
+    return crypto.createHash('sha256').update('[unserializable]', 'utf8').digest('base64url');
+  }
+}
+
+function securityAuditEvent(event = {}) {
+  const runtime = runtimeManager.getSnapshot();
+  return {
+    actorAccountId: event.actorAccountId || runtime.userId || '',
+    actorUserId: event.actorUserId || runtime.userId || '',
+    hubId: event.hubId || runtime.deviceId || '',
+    ...event
+  };
+}
+
+function markSecurityAuditFailed(error) {
+  if (securityAuditHealthy) {
+    securityAuditHealthy = false;
+    console.error(`[LiveDesk Hub] SECURITY AUDIT FAILURE: ${error?.message || error}`);
+  }
+}
+
+async function recordSecurityAuditRequired(event = {}) {
+  if (!securityAuditStore || !securityAuditHealthy) {
+    const error = new Error('security-audit-unavailable');
+    error.code = 'security-audit-unavailable';
+    throw error;
+  }
+  try {
+    return await securityAuditStore.record(securityAuditEvent(event));
+  } catch (error) {
+    markSecurityAuditFailed(error);
+    throw error;
+  }
+}
+
+function recordSecurityAudit(event = {}) {
+  void recordSecurityAuditRequired(event).catch(() => {
+    // Required mutation paths await recordSecurityAuditRequired directly.
+    // Best-effort lifecycle telemetry still marks the global audit gate failed.
+  });
+}
+
+const liveDeskSettingsStore = new LiveDeskSettingsStore({ dataDir: agentDataDir });
+const captureStore = new CaptureStore({
+  dataDir: agentDataDir,
+  getRetentionPolicy: () => liveDeskSettingsStore.getCached()?.filesAudio?.captureAutoDelete || 'never',
+  onRetentionDelete: result => recordSecurityAudit({
+    action: 'privacy.capture.retention-delete',
+    phase: 'complete',
+    result: 'success',
+    authMethod: 'settings-retention-policy',
+    details: result
+  })
+});
+void captureStore.initialize().catch(error => {
+  console.warn(`[LiveDesk Hub] capture store initialization failed: ${error instanceof Error ? error.message : String(error)}`);
+});
+void liveDeskSettingsStore.getRecord()
+  .then(() => captureStore.enforceRetention())
+  .catch(error => {
+    console.warn(`[LiveDesk Hub] settings or capture retention load failed: ${error instanceof Error ? error.message : String(error)}`);
+  });
+const captureRetentionTimer = setInterval(() => {
+  void captureStore.enforceRetention().catch(error => {
+    console.warn(`[LiveDesk Hub] capture retention failed: ${error instanceof Error ? error.message : String(error)}`);
+  });
+}, 60 * 60_000);
+captureRetentionTimer.unref?.();
 
 const udpTransport = createHubUdpTransport({
   env: process.env,
@@ -885,10 +885,10 @@ const udpTransport = createHubUdpTransport({
   logWarn: (_scope, message) => console.warn(`[LiveDesk Hub] ${message}`)
 });
 
-const remoteHub = createRemoteHub({
-  managerPackage: '@livedesk/hub',
-  managerVersion: packageInfo.version,
-  dataDir: agentDataDir,
+const remoteHub = createRemoteHub({
+  managerPackage: '@livedesk/hub',
+  managerVersion: packageInfo.version,
+  dataDir: agentDataDir,
   env: {
     ...process.env,
     MINDEXEC_MANAGER_PACKAGE: '@livedesk/hub',
@@ -899,11 +899,11 @@ const remoteHub = createRemoteHub({
   logWarn: (_scope, message) => console.warn(`[LiveDesk Hub] ${message}`),
   emitEvent: handleRemoteHubEvent,
   emitFrame: broadcastRemoteBinaryFrame,
-  emitAudio: broadcastRemoteBinaryAudio,
-  getSecurityIdentity: () => ({
-    accountId: runtimeManager.getSnapshot().userId || testSecurityAccountId,
-    hubId: remoteHub?.getSecurityStatus?.().hubId || ''
-  }),
+  emitAudio: broadcastRemoteBinaryAudio,
+  getSecurityIdentity: () => ({
+    accountId: runtimeManager.getSnapshot().userId || testSecurityAccountId,
+    hubId: remoteHub?.getSecurityStatus?.().hubId || ''
+  }),
   getEffectiveDevicePolicy: ({ deviceId, capabilities }) => buildEffectiveDevicePolicy(liveDeskSettingsStore.getCached(), { deviceId, capabilities }),
   getWelcomeDevicePolicy: ({ deviceId, capabilities }) => {
     const policy = buildEffectiveDevicePolicy(liveDeskSettingsStore.getCached(), { deviceId, capabilities });
@@ -1006,11 +1006,11 @@ function getLiveDeskUpdateStatus() {
 if (process.env.LIVEDESK_DESKTOP_HOST !== '1') {
   liveDeskUpdateManager = createLiveDeskUpdateManager({
     remoteHub,
-    currentManagerVersion: process.env.LIVEDESK_MANAGER_VERSION || packageInfo.version,
-    currentClientVersion: process.env.LIVEDESK_CLIENT_PACKAGE_VERSION || '',
-    updateManifestUrl: process.env.LIVEDESK_UPDATE_MANIFEST_URL || '',
-    updatePublicKey: process.env.LIVEDESK_UPDATE_PUBLIC_KEY || '',
-    restartSupported: !!String(process.env.LIVEDESK_HUB_UPDATE_REQUEST_PATH || '').trim(),
+    currentManagerVersion: process.env.LIVEDESK_MANAGER_VERSION || packageInfo.version,
+    currentClientVersion: process.env.LIVEDESK_CLIENT_PACKAGE_VERSION || '',
+    updateManifestUrl: process.env.LIVEDESK_UPDATE_MANIFEST_URL || '',
+    updatePublicKey: process.env.LIVEDESK_UPDATE_PUBLIC_KEY || '',
+    restartSupported: !!String(process.env.LIVEDESK_HUB_UPDATE_REQUEST_PATH || '').trim(),
     requestHubRestart
   });
 }
@@ -1328,7 +1328,7 @@ function validateAgentMcpArguments(name, args) {
   return '';
 }
 
-async function dispatchAgentMcpTool(session, name, args = {}) {
+async function dispatchAgentMcpTool(session, name, args = {}) {
   if (session.cancelled || session.signal?.aborted) return { ok: false, error: 'cancelled-by-user' };
   // This check runs synchronously before the first await, so concurrent Node
   // requests cannot pass the same remaining budget and queue extra Client work.
@@ -1336,23 +1336,23 @@ async function dispatchAgentMcpTool(session, name, args = {}) {
     session.toolLimitReached = true;
     return { ok: false, error: 'codex-tool-limit-reached' };
   }
-  session.toolCallCount += 1;
-  if (isRetiredAgentMutatingToolName(name)) {
-    recordAgentAudit({
-      event: 'tool-rejected',
-      runId: session.runId,
-      deviceIds: [],
-      toolName: name,
-      category: 'mutation',
-      decision: 'deny',
-      status: 'rejected',
-      permissionMode: session.permissionPolicy?.mode,
-      policyHash: session.permissionPolicyHash,
-      details: { reason: 'agent-mutating-tool-disabled' }
-    });
-    return { ok: false, error: 'agent-mutating-tool-disabled' };
-  }
-  const tool = getAgentToolDefinition(name);
+  session.toolCallCount += 1;
+  if (isRetiredAgentMutatingToolName(name)) {
+    recordAgentAudit({
+      event: 'tool-rejected',
+      runId: session.runId,
+      deviceIds: [],
+      toolName: name,
+      category: 'mutation',
+      decision: 'deny',
+      status: 'rejected',
+      permissionMode: session.permissionPolicy?.mode,
+      policyHash: session.permissionPolicyHash,
+      details: { reason: 'agent-mutating-tool-disabled' }
+    });
+    return { ok: false, error: 'agent-mutating-tool-disabled' };
+  }
+  const tool = getAgentToolDefinition(name);
   if (!tool) return { ok: false, error: 'codex-tool-not-allowed' };
   const validationError = validateAgentMcpArguments(name, args);
   if (validationError) return { ok: false, error: validationError };
@@ -1543,20 +1543,20 @@ async function synchronizeAgentEnablement() {
   return enabled;
 }
 
-const hubFilesystem = createHubFilesystem();
-const fileTransferCommandAckTimeoutMs = readPositiveIntegerEnv(
-  'LIVEDESK_FILE_CHUNK_ACK_TIMEOUT_MS',
-  30_000
-);
-hubTransferJobs = createHubTransferJobs({
-  filesystem: hubFilesystem,
-  remoteHub,
-  maxConcurrent: Number(process.env.LIVEDESK_MAX_FILE_JOBS || 2),
-  commandResultTimeoutMs: fileTransferCommandAckTimeoutMs,
-  getMaxFileSizeBytes: () => Number(
-    liveDeskSettingsStore.getCached()?.filesAudio?.maxFileSizeBytes
-    || 1024 * 1024 * 1024)
-});
+const hubFilesystem = createHubFilesystem();
+const fileTransferCommandAckTimeoutMs = readPositiveIntegerEnv(
+  'LIVEDESK_FILE_CHUNK_ACK_TIMEOUT_MS',
+  30_000
+);
+hubTransferJobs = createHubTransferJobs({
+  filesystem: hubFilesystem,
+  remoteHub,
+  maxConcurrent: Number(process.env.LIVEDESK_MAX_FILE_JOBS || 2),
+  commandResultTimeoutMs: fileTransferCommandAckTimeoutMs,
+  getMaxFileSizeBytes: () => Number(
+    liveDeskSettingsStore.getCached()?.filesAudio?.maxFileSizeBytes
+    || 1024 * 1024 * 1024)
+});
 const hubSharedFolders = createHubSharedFolders({
   filesystem: hubFilesystem,
   transferJobs: hubTransferJobs,
@@ -1676,125 +1676,152 @@ app.use((req, res, next) => {
     res.setHeader('Access-Control-Allow-Origin', origin);
     res.setHeader('Access-Control-Allow-Private-Network', 'true');
     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-LiveDesk-Admin-Session, X-LiveDesk-Admin-CSRF, X-LiveDesk-CSRF');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-LiveDesk-Admin-Session, X-LiveDesk-Admin-CSRF, X-LiveDesk-CSRF');
     res.setHeader('Vary', 'Origin, Access-Control-Request-Headers, Access-Control-Request-Private-Network');
   }
   if (req.method === 'OPTIONS') {
     res.status(204).end();
     return;
   }
-  next();
-});
-app.use((req, res, next) => {
-  if (!enforceLocalAdminAuth || req.path === '/api/security/session' || req.method === 'OPTIONS') {
-    next();
-    return;
-  }
-  const authorizedLauncherShutdown = req.method === 'POST'
-    && req.path === '/api/runtime/shutdown'
-    && isLoopbackAddress(req.socket?.remoteAddress)
-    && launcherShutdownToken
-    && secureExactTestTokenMatches(
-      String(req.headers['x-livedesk-launcher-shutdown'] || ''),
-      launcherShutdownToken
-    );
-  if (authorizedLauncherShutdown) {
-    req.liveDeskLauncherShutdown = true;
-    next();
-    return;
-  }
-  const mutating = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method);
-  const sensitiveRead = req.method === 'GET'
-    && ['/api/security/audit', '/api/security/rendezvous-issuer', '/api/privacy/inventory'].includes(req.path);
-  if (!mutating && !sensitiveRead) {
-    next();
-    return;
-  }
-  const adminToken = String(req.headers['x-livedesk-admin-session'] || '');
-  const csrfToken = String(req.headers['x-livedesk-admin-csrf'] || '');
-  if (!secureExactTestTokenMatches(adminToken, localAdminSessionToken)) {
-    recordSecurityAudit({
-      action: 'local-admin.request',
-      phase: 'complete',
-      result: 'rejected',
-      reason: 'admin-session-required',
-      requestHash: requestAuditHash({ method: req.method, path: req.path }),
-      authMethod: 'local-admin-session'
-    });
-    res.status(401).json({ ok: false, error: 'local-admin-session-required' });
-    return;
-  }
-  if (mutating && !secureExactTestTokenMatches(csrfToken, localAdminCsrfToken)) {
-    recordSecurityAudit({
-      action: 'local-admin.request',
-      phase: 'complete',
-      result: 'rejected',
-      reason: 'csrf-token-required',
-      requestHash: requestAuditHash({ method: req.method, path: req.path }),
-      authMethod: 'local-admin-session'
-    });
-    res.status(403).json({ ok: false, error: 'csrf-token-required' });
-    return;
-  }
-  if (!securityAuditHealthy) {
-    res.status(503).json({ ok: false, error: 'security-audit-unavailable' });
-    return;
-  }
-  req.liveDeskAdminSessionId = localAdminSessionId;
-  if (!mutating) {
-    next();
-    return;
-  }
-
-  const mutationRequestHash = requestAuditHash({ method: req.method, path: req.path });
-  void recordSecurityAuditRequired({
-    action: 'local-admin.mutation',
-    phase: 'accepted',
-    result: 'accepted',
-    sessionId: localAdminSessionId,
-    requestHash: mutationRequestHash,
-    authMethod: 'local-admin-session',
-    details: { method: req.method, path: req.path }
-  }).then(() => {
-    const originalEnd = res.end.bind(res);
-    let completionStarted = false;
-    res.end = (...args) => {
-      if (completionStarted) return res;
-      completionStarted = true;
-      const statusCode = Number(res.statusCode || 200);
-      void recordSecurityAuditRequired({
-        action: 'local-admin.mutation',
-        phase: 'complete',
-        result: statusCode >= 200 && statusCode < 400 ? 'success' : 'rejected',
-        reason: statusCode >= 400 ? `http-${statusCode}` : '',
-        sessionId: localAdminSessionId,
-        requestHash: mutationRequestHash,
-        authMethod: 'local-admin-session',
-        details: { method: req.method, path: req.path, statusCode }
-      }).then(() => {
-        originalEnd(...args);
-      }).catch(error => {
-        if (res.headersSent) {
-          res.destroy(error);
-          return;
-        }
-        const callback = [...args].reverse().find(value => typeof value === 'function');
-        const body = JSON.stringify({ ok: false, error: 'security-audit-unavailable' });
-        res.statusCode = 503;
-        res.removeHeader('Content-Length');
-        res.removeHeader('Transfer-Encoding');
-        res.setHeader('Content-Type', 'application/json; charset=utf-8');
-        res.setHeader('Content-Length', Buffer.byteLength(body));
-        originalEnd(body, 'utf8', callback);
-      });
-      return res;
-    };
-    next();
-  }).catch(() => {
-    res.status(503).json({ ok: false, error: 'security-audit-unavailable' });
-  });
-});
-app.use(express.json({ limit: '32mb' }));
+  next();
+});
+const parseHubJsonBody = express.json({ limit: '32mb' });
+function parseHubJsonRequest(req, res, next, onParsed = next) {
+  parseHubJsonBody(req, res, error => {
+    if (!error) {
+      onParsed();
+      return;
+    }
+    const type = String(error?.type || '');
+    const code = String(error?.code || '');
+    const bodyError = type === 'entity.parse.failed'
+      ? { status: 400, error: 'invalid-json' }
+      : type === 'entity.too.large'
+        ? { status: 413, error: 'request-too-large' }
+        : type === 'request.aborted' || type === 'stream.not.readable' || code === 'ECONNABORTED'
+          ? { status: 400, error: 'request-body-unavailable' }
+          : null;
+    if (!bodyError) {
+      next(error);
+      return;
+    }
+    if (res.headersSent || res.destroyed || req.destroyed) return;
+    res.status(bodyError.status).json({ ok: false, error: bodyError.error });
+  });
+}
+app.use((req, res, next) => {
+  const mutating = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method);
+  if (!enforceLocalAdminAuth || req.path === '/api/security/session' || req.method === 'OPTIONS') {
+    if (mutating) parseHubJsonRequest(req, res, next);
+    else next();
+    return;
+  }
+  const authorizedLauncherShutdown = req.method === 'POST'
+    && req.path === '/api/runtime/shutdown'
+    && isLoopbackAddress(req.socket?.remoteAddress)
+    && launcherShutdownToken
+    && secureExactTestTokenMatches(
+      String(req.headers['x-livedesk-launcher-shutdown'] || ''),
+      launcherShutdownToken
+    );
+  if (authorizedLauncherShutdown) {
+    req.liveDeskLauncherShutdown = true;
+    parseHubJsonRequest(req, res, next);
+    return;
+  }
+  const sensitiveRead = req.method === 'GET'
+    && ['/api/security/audit', '/api/security/rendezvous-issuer', '/api/privacy/inventory'].includes(req.path);
+  if (!mutating && !sensitiveRead) {
+    next();
+    return;
+  }
+  const adminToken = String(req.headers['x-livedesk-admin-session'] || '');
+  const csrfToken = String(req.headers['x-livedesk-admin-csrf'] || '');
+  if (!secureExactTestTokenMatches(adminToken, localAdminSessionToken)) {
+    recordSecurityAudit({
+      action: 'local-admin.request',
+      phase: 'complete',
+      result: 'rejected',
+      reason: 'admin-session-required',
+      requestHash: requestAuditHash({ method: req.method, path: req.path }),
+      authMethod: 'local-admin-session'
+    });
+    res.status(401).json({ ok: false, error: 'local-admin-session-required' });
+    return;
+  }
+  if (mutating && !secureExactTestTokenMatches(csrfToken, localAdminCsrfToken)) {
+    recordSecurityAudit({
+      action: 'local-admin.request',
+      phase: 'complete',
+      result: 'rejected',
+      reason: 'csrf-token-required',
+      requestHash: requestAuditHash({ method: req.method, path: req.path }),
+      authMethod: 'local-admin-session'
+    });
+    res.status(403).json({ ok: false, error: 'csrf-token-required' });
+    return;
+  }
+  if (!securityAuditHealthy) {
+    res.status(503).json({ ok: false, error: 'security-audit-unavailable' });
+    return;
+  }
+  req.liveDeskAdminSessionId = localAdminSessionId;
+  if (!mutating) {
+    next();
+    return;
+  }
+
+  const beginMutationAudit = () => {
+    const mutationRequestHash = requestAuditHash({ method: req.method, path: req.path });
+    void recordSecurityAuditRequired({
+    action: 'local-admin.mutation',
+    phase: 'accepted',
+    result: 'accepted',
+    sessionId: localAdminSessionId,
+    requestHash: mutationRequestHash,
+    authMethod: 'local-admin-session',
+    details: { method: req.method, path: req.path }
+  }).then(() => {
+    const originalEnd = res.end.bind(res);
+    let completionStarted = false;
+    res.end = (...args) => {
+      if (completionStarted) return res;
+      completionStarted = true;
+      const statusCode = Number(res.statusCode || 200);
+      void recordSecurityAuditRequired({
+        action: 'local-admin.mutation',
+        phase: 'complete',
+        result: statusCode >= 200 && statusCode < 400 ? 'success' : 'rejected',
+        reason: statusCode >= 400 ? `http-${statusCode}` : '',
+        sessionId: localAdminSessionId,
+        requestHash: mutationRequestHash,
+        authMethod: 'local-admin-session',
+        details: { method: req.method, path: req.path, statusCode }
+      }).then(() => {
+        originalEnd(...args);
+      }).catch(error => {
+        if (res.headersSent) {
+          res.destroy(error);
+          return;
+        }
+        const callback = [...args].reverse().find(value => typeof value === 'function');
+        const body = JSON.stringify({ ok: false, error: 'security-audit-unavailable' });
+        res.statusCode = 503;
+        res.removeHeader('Content-Length');
+        res.removeHeader('Transfer-Encoding');
+        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+        res.setHeader('Content-Length', Buffer.byteLength(body));
+        originalEnd(body, 'utf8', callback);
+      });
+      return res;
+    };
+    next();
+    }).catch(() => {
+      res.status(503).json({ ok: false, error: 'security-audit-unavailable' });
+    });
+  };
+  parseHubJsonRequest(req, res, next, beginMutationAudit);
+});
 app.use((req, res, next) => {
   if (runtimeRole === 'client' && req.path.startsWith('/api/remote')) {
     res.status(403).json(roleGuardResponse(runtimeRole, 'hub'));
@@ -1945,12 +1972,12 @@ function normalizeTransferFiles(value) {
     if (totalBytes > MAX_FILE_TRANSFER_BYTES) {
       return { ok: false, error: 'file-transfer-too-large', files: [], totalBytes };
     }
-    files.push({
-      name,
-      relativePath,
-      size: byteLength,
-      sha256: crypto.createHash('sha256').update(Buffer.from(dataBase64, 'base64')).digest('hex'),
-      mimeType: String(entry?.type || entry?.mimeType || '').slice(0, 160),
+    files.push({
+      name,
+      relativePath,
+      size: byteLength,
+      sha256: crypto.createHash('sha256').update(Buffer.from(dataBase64, 'base64')).digest('hex'),
+      mimeType: String(entry?.type || entry?.mimeType || '').slice(0, 160),
       lastModified: Number(entry?.lastModified || 0) || 0,
       dataBase64
     });
@@ -1961,39 +1988,39 @@ function normalizeTransferFiles(value) {
   return { ok: true, files, totalBytes };
 }
 
-function normalizeTransferChunk(body = {}) {
+function normalizeTransferChunk(body = {}) {
   const dataBase64 = String(body.dataBase64 || '').replace(/^data:[^,]*,/i, '').trim();
   const name = String(body.name || '').replace(/[\r\n\t\0]/g, ' ').trim().slice(0, 240);
   const relativePath = String(body.relativePath || name).replace(/[\r\n\t\0]/g, ' ').trim().slice(0, 600);
   const offset = Math.max(0, Math.floor(Number(body.offset) || 0));
   const totalBytes = Math.max(0, Math.floor(Number(body.totalBytes) || 0));
-  const byteLength = dataBase64 ? Buffer.byteLength(dataBase64, 'base64') : 0;
-  const final = body.final === true;
-  const maxFileSizeBytes = Math.max(1, Number(
-    liveDeskSettingsStore.getCached()?.filesAudio?.maxFileSizeBytes
-    || 1024 * 1024 * 1024));
-
-  if (!name || !relativePath || offset > totalBytes || offset + byteLength > totalBytes) {
-    return { ok: false, error: 'invalid-file-transfer-chunk' };
-  }
-  if (totalBytes > maxFileSizeBytes) {
-    return { ok: false, error: 'file-transfer-file-too-large', totalBytes };
-  }
+  const byteLength = dataBase64 ? Buffer.byteLength(dataBase64, 'base64') : 0;
+  const final = body.final === true;
+  const maxFileSizeBytes = Math.max(1, Number(
+    liveDeskSettingsStore.getCached()?.filesAudio?.maxFileSizeBytes
+    || 1024 * 1024 * 1024));
+
+  if (!name || !relativePath || offset > totalBytes || offset + byteLength > totalBytes) {
+    return { ok: false, error: 'invalid-file-transfer-chunk' };
+  }
+  if (totalBytes > maxFileSizeBytes) {
+    return { ok: false, error: 'file-transfer-file-too-large', totalBytes };
+  }
   if (byteLength > MAX_FILE_TRANSFER_CHUNK_BYTES) {
     return { ok: false, error: 'file-transfer-chunk-too-large', byteLength };
   }
-  if (byteLength === 0 && !(final && totalBytes === 0 && offset === 0)) {
-    return { ok: false, error: 'empty-file-transfer-chunk' };
-  }
-  const suppliedSha256 = String(body.sha256 || '').trim().toLowerCase();
-  const sha256 = /^[a-f0-9]{64}$/.test(suppliedSha256)
-    ? suppliedSha256
-    : final && offset === 0 && totalBytes === byteLength
-      ? crypto.createHash('sha256').update(Buffer.from(dataBase64, 'base64')).digest('hex')
-      : '';
-  if (final && !sha256) {
-    return { ok: false, error: 'file-transfer-sha256-required', byteLength };
-  }
+  if (byteLength === 0 && !(final && totalBytes === 0 && offset === 0)) {
+    return { ok: false, error: 'empty-file-transfer-chunk' };
+  }
+  const suppliedSha256 = String(body.sha256 || '').trim().toLowerCase();
+  const sha256 = /^[a-f0-9]{64}$/.test(suppliedSha256)
+    ? suppliedSha256
+    : final && offset === 0 && totalBytes === byteLength
+      ? crypto.createHash('sha256').update(Buffer.from(dataBase64, 'base64')).digest('hex')
+      : '';
+  if (final && !sha256) {
+    return { ok: false, error: 'file-transfer-sha256-required', byteLength };
+  }
 
   return {
     ok: true,
@@ -2003,9 +2030,9 @@ function normalizeTransferChunk(body = {}) {
       offset,
       totalBytes,
       byteLength,
-      dataBase64,
-      final,
-      sha256,
+      dataBase64,
+      final,
+      sha256,
       mimeType: String(body.type || body.mimeType || '').slice(0, 160),
       lastModified: Number(body.lastModified || 0) || 0
     }
@@ -2711,6 +2738,11 @@ function replaceExpectedFrameBindingForClient(ws, deviceId, expectedBinding = nu
     && bindingIdentity === frameLaneBindingIdentity(currentExpectedBinding)) {
     expectedBinding.readySent = currentExpectedBinding?.readySent === true
       || expectedBinding.readySent === true;
+    expectedBinding.replayedKeyFrameSeq = Math.max(
+      0,
+      Number(currentExpectedBinding?.replayedKeyFrameSeq || 0),
+      Number(expectedBinding.replayedKeyFrameSeq || 0)
+    );
     ws.liveDeskExpectedStreamBindingsByDeviceId.set(normalizedDeviceId, expectedBinding);
     if (!lane.bindingEpochsByDeviceId.has(normalizedDeviceId)) {
       lane.bindingEpochsByDeviceId.set(normalizedDeviceId, 1);
@@ -2749,6 +2781,50 @@ function replaceExpectedFrameBindingForClient(ws, deviceId, expectedBinding = nu
   return bindingIdentity;
 }
 
+function replayExpectedBindingKeyFrame(ws, expectedBinding) {
+  if (!ws || ws.readyState !== ws.OPEN || !expectedBinding) {
+    return false;
+  }
+  const deviceId = String(expectedBinding.deviceId || '').trim();
+  const currentBinding = ws.liveDeskExpectedStreamBindingsByDeviceId instanceof Map
+    ? ws.liveDeskExpectedStreamBindingsByDeviceId.get(deviceId)
+    : null;
+  const bindingIdentity = frameLaneBindingIdentity(expectedBinding);
+  if (!deviceId
+    || !bindingIdentity
+    || bindingIdentity !== frameLaneBindingIdentity(currentBinding)) {
+    return false;
+  }
+  const cached = remoteHub.getFramePayload(deviceId, 'live', {
+    requireKeyFrame: true,
+    streamId: expectedBinding.streamId,
+    sessionId: expectedBinding.sessionId,
+    commandId: expectedBinding.commandId,
+    captureGeneration: expectedBinding.captureGeneration,
+    streamPurpose: expectedBinding.streamPurpose,
+    monitorIndex: expectedBinding.monitorIndex
+  });
+  const frameSeq = Number(cached?.frame?.frameSeq || 0);
+  if (!cached
+    || cached.frame?.isKeyFrame !== true
+    || !Number.isSafeInteger(frameSeq)
+    || frameSeq <= 0
+    || Number(currentBinding?.replayedKeyFrameSeq || 0) === frameSeq) {
+    return false;
+  }
+  currentBinding.replayedKeyFrameSeq = frameSeq;
+  broadcastRemoteBinaryFrame({
+    kind: 'live',
+    deviceId,
+    frame: cached.frame,
+    payload: cached.payload,
+    mimeType: cached.mimeType,
+    byteLength: cached.byteLength,
+    replayedForBinding: true
+  });
+  return true;
+}
+
 function dropQueuedFrameAtForLane(lane, dropIndex) {
   const droppedBefore = lane.dropped;
   const droppedItem = removeFrameLaneQueueItem(lane, dropIndex);
@@ -3242,6 +3318,7 @@ function startFrameSubscriptionLive(
         continue;
       }
       cancelPendingFrameStreamStop(deviceId, result.streamId, String(liveOptions.streamPurpose || 'wall'));
+      const replayedKeyFrame = replayExpectedBindingKeyFrame(ws, expectedBinding);
       started.push({
         deviceId: expectedBinding.deviceId,
         sessionId: expectedBinding.sessionId,
@@ -3250,7 +3327,8 @@ function startFrameSubscriptionLive(
         commandId: expectedBinding.commandId,
         captureGeneration: expectedBinding.captureGeneration,
         monitorIndex: expectedBinding.monitorIndex,
-        ready: reusedFrameReady,
+        ready: expectedBinding.readySent === true,
+        replayedKeyFrame,
         fps: result.fps,
         reused: result.reused === true
       });
@@ -4073,26 +4151,26 @@ function buildHubHealthPayload({
   };
 }
 
-app.get('/api/health', (_req, res) => {
-  noStore(res);
-  res.json(buildHubHealthPayload());
-});
-
-app.get('/api/security/session', (req, res) => {
-  noStore(res);
-  if (!isLoopbackAddress(req.socket?.remoteAddress) || !isLoopbackHostname(requestHostname(req))) {
-    res.status(403).json({ ok: false, error: 'local-admin-session-loopback-only' });
-    return;
-  }
-  res.json({
-    ok: true,
-    sessionId: localAdminSessionId,
-    adminToken: localAdminSessionToken,
-    csrfToken: localAdminCsrfToken,
-    issuedAt: new Date().toISOString(),
-    expiresOnProcessExit: true
-  });
-});
+app.get('/api/health', (_req, res) => {
+  noStore(res);
+  res.json(buildHubHealthPayload());
+});
+
+app.get('/api/security/session', (req, res) => {
+  noStore(res);
+  if (!isLoopbackAddress(req.socket?.remoteAddress) || !isLoopbackHostname(requestHostname(req))) {
+    res.status(403).json({ ok: false, error: 'local-admin-session-loopback-only' });
+    return;
+  }
+  res.json({
+    ok: true,
+    sessionId: localAdminSessionId,
+    adminToken: localAdminSessionToken,
+    csrfToken: localAdminCsrfToken,
+    issuedAt: new Date().toISOString(),
+    expiresOnProcessExit: true
+  });
+});
 
 if (persistentSessionGcEnabled) {
   app.post('/api/test/persistent-session/gc', (req, res) => {
@@ -4145,18 +4223,18 @@ app.patch('/api/settings', async (req, res) => {
     const record = await liveDeskSettingsStore.update(patch, revision);
     if (patch.agent && Object.prototype.hasOwnProperty.call(patch.agent, 'enabled')) {
       await agentSettingsStore.update({ enabled: record.settings.agent?.enabled === true });
-    }
-    remoteHub.refreshDevicePolicies();
-    void captureStore.enforceRetention().catch(() => undefined);
-    recordSecurityAudit({
-      action: 'settings.security-policy.updated',
-      phase: 'complete',
-      result: 'success',
-      requestHash: requestAuditHash(patch),
-      authMethod: 'local-admin-session',
-      details: { revision: record.revision, sections: Object.keys(patch) }
-    });
-    res.json({ ok: true, revision: record.revision, updatedAt: record.updatedAt, settings: record.settings });
+    }
+    remoteHub.refreshDevicePolicies();
+    void captureStore.enforceRetention().catch(() => undefined);
+    recordSecurityAudit({
+      action: 'settings.security-policy.updated',
+      phase: 'complete',
+      result: 'success',
+      requestHash: requestAuditHash(patch),
+      authMethod: 'local-admin-session',
+      details: { revision: record.revision, sections: Object.keys(patch) }
+    });
+    res.json({ ok: true, revision: record.revision, updatedAt: record.updatedAt, settings: record.settings });
   } catch (error) {
     if (error instanceof SettingsConflictError) {
       res.status(409).json({ ok: false, error: error.code, revision: error.settings.revision, updatedAt: error.settings.updatedAt, settings: error.settings.settings });
@@ -4311,7 +4389,7 @@ app.get('/api/settings/capabilities', async (_req, res) => {
   });
 });
 
-app.get('/api/security/trusted-devices', (_req, res) => {
+app.get('/api/security/trusted-devices', (_req, res) => {
   noStore(res);
   const devices = remoteHub.listDevices({ includeDataUrl: false }).map(device => ({
     deviceId: device.deviceId,
@@ -4323,141 +4401,141 @@ app.get('/api/security/trusted-devices', (_req, res) => {
     lastSeenAt: device.lastSeenAt || '',
     ipRange: String(device.remoteAddress || '').replace(/^::ffff:/, '').split(':')[0]
   }));
-  res.json({ ok: true, devices });
-});
-
-app.get('/api/security/rendezvous-issuer', (_req, res) => {
-  noStore(res);
-  const security = remoteHub.getSecurityStatus();
-  res.json({
-    ok: true,
-    hubId: security.hubId,
-    issuerKeyId: security.hubIssuerKeyId,
-    publicKey: security.hubPublicKey,
-    algorithm: 'P-256/SHA-256',
-    environmentVariable: 'LIVEDESK_UDP_RENDEZVOUS_TRUSTED_ISSUER_PUBLIC_KEYS'
-  });
-});
-
-app.get('/api/security/audit', async (req, res) => {
-  noStore(res);
-  try {
-    res.json({
-      ok: true,
-      healthy: securityAuditHealthy,
-      verification: await securityAuditStore.verify(),
-      audit: await securityAuditStore.list({ limit: req.query?.limit, action: req.query?.action })
-    });
-  } catch (error) {
-    securityAuditHealthy = false;
-    res.status(503).json({ ok: false, error: error?.code || 'security-audit-unavailable' });
-  }
-});
-
-app.get('/api/privacy/inventory', async (_req, res) => {
-  noStore(res);
-  try {
-    const [captures, sharedFolders, verification] = await Promise.all([
-      captureStore.list(),
-      hubSharedFolders.list(),
-      securityAuditStore.verify()
-    ]);
-    res.json({
-      ok: true,
-      inventory: {
-        authenticated: runtimeManager.getSnapshot().authenticated === true,
-        captures: captures.length,
-        sharedFolderDefinitions: sharedFolders.length,
-        trustedDeviceCredentials: remoteHub.getSecurityStatus().devices.length,
-        securityAuditRecords: verification.records,
-        agentAuditRetained: (await agentAuditStore.list({ limit: 500 })).length
-      }
-    });
-  } catch (error) {
-    res.status(503).json({ ok: false, error: String(error?.code || error?.message || 'privacy-inventory-unavailable').slice(0, 120) });
-  }
-});
-
-app.delete('/api/privacy/local-data', async (req, res) => {
-  noStore(res);
-  if (String(req.body?.confirmation || '') !== 'DELETE-LIVEDESK-LOCAL-DATA') {
-    res.status(400).json({ ok: false, error: 'privacy-delete-confirmation-required' });
-    return;
-  }
-  try {
-    const providerLogout = await revokeRuntimeProviderSession();
-    const hostTarget = runtimeRole === 'hub'
-      ? await clearHubHostTarget('privacy-delete')
-      : { ok: true, active: false };
-    clearRuntimeSession();
-    for (const device of remoteHub.getSecurityStatus().devices) {
-      remoteHub.disconnectDevice(device.deviceId, 'privacy-local-data-delete');
-    }
-    const trustedDeviceCredentials = remoteHub.clearDeviceCredentials();
-    const transferJobs = hubTransferJobs.clear();
-    const captures = await captureStore.removeAll();
-    const sharedFolders = await hubSharedFolders.clear();
-    await agentAuditStore.clear();
-    await securityAuditStore.reset();
-    securityAuditHealthy = true;
-    await securityAuditStore.record({
-      action: 'privacy.local-data.deleted',
-      phase: 'complete',
-      result: 'success',
-      authMethod: 'local-admin-session',
-      details: {
-        capturesRemoved: captures.removed,
-        captureBytesRemoved: captures.removedBytes,
-        sharedFolderDefinitionsRemoved: sharedFolders.removed,
-        trustedDeviceCredentialsRemoved: trustedDeviceCredentials,
-        transferJobRecordsRemoved: transferJobs.removed,
-        providerSessionRevoked: providerLogout.revoked === true
-      }
-    });
-    res.json({
-      ok: true,
-      localDeleted: true,
-      providerLogout,
-      hostTarget,
-      captures,
-      sharedFolders,
-      trustedDeviceCredentials,
-      transferJobs,
-      preserved: ['settings-preferences', 'hub-device-identity', 'application-binaries']
-    });
-  } catch (error) {
-    securityAuditHealthy = false;
-    res.status(503).json({ ok: false, error: String(error?.code || error?.message || 'privacy-delete-failed').slice(0, 120) });
-  }
-});
-
-app.delete('/api/security/trusted-devices/:deviceId', (req, res) => {
-  noStore(res);
-  const disconnected = remoteHub.disconnectDevice(req.params.deviceId, 'trusted-device-revoked');
-  const credentialRevoked = remoteHub.revokeDeviceCredential(req.params.deviceId, 'trusted-device-revoked');
-  const revoked = disconnected === true || credentialRevoked === true;
-  recordSecurityAudit({
-    action: 'security.device.revoked',
-    phase: 'complete',
-    result: revoked ? 'success' : 'not-found',
-    deviceId: req.params.deviceId,
-    authMethod: 'local-admin-session'
-  });
-  res.json({ ok: revoked, revoked, deviceId: req.params.deviceId });
-});
+  res.json({ ok: true, devices });
+});
+
+app.get('/api/security/rendezvous-issuer', (_req, res) => {
+  noStore(res);
+  const security = remoteHub.getSecurityStatus();
+  res.json({
+    ok: true,
+    hubId: security.hubId,
+    issuerKeyId: security.hubIssuerKeyId,
+    publicKey: security.hubPublicKey,
+    algorithm: 'P-256/SHA-256',
+    environmentVariable: 'LIVEDESK_UDP_RENDEZVOUS_TRUSTED_ISSUER_PUBLIC_KEYS'
+  });
+});
+
+app.get('/api/security/audit', async (req, res) => {
+  noStore(res);
+  try {
+    res.json({
+      ok: true,
+      healthy: securityAuditHealthy,
+      verification: await securityAuditStore.verify(),
+      audit: await securityAuditStore.list({ limit: req.query?.limit, action: req.query?.action })
+    });
+  } catch (error) {
+    securityAuditHealthy = false;
+    res.status(503).json({ ok: false, error: error?.code || 'security-audit-unavailable' });
+  }
+});
+
+app.get('/api/privacy/inventory', async (_req, res) => {
+  noStore(res);
+  try {
+    const [captures, sharedFolders, verification] = await Promise.all([
+      captureStore.list(),
+      hubSharedFolders.list(),
+      securityAuditStore.verify()
+    ]);
+    res.json({
+      ok: true,
+      inventory: {
+        authenticated: runtimeManager.getSnapshot().authenticated === true,
+        captures: captures.length,
+        sharedFolderDefinitions: sharedFolders.length,
+        trustedDeviceCredentials: remoteHub.getSecurityStatus().devices.length,
+        securityAuditRecords: verification.records,
+        agentAuditRetained: (await agentAuditStore.list({ limit: 500 })).length
+      }
+    });
+  } catch (error) {
+    res.status(503).json({ ok: false, error: String(error?.code || error?.message || 'privacy-inventory-unavailable').slice(0, 120) });
+  }
+});
+
+app.delete('/api/privacy/local-data', async (req, res) => {
+  noStore(res);
+  if (String(req.body?.confirmation || '') !== 'DELETE-LIVEDESK-LOCAL-DATA') {
+    res.status(400).json({ ok: false, error: 'privacy-delete-confirmation-required' });
+    return;
+  }
+  try {
+    const providerLogout = await revokeRuntimeProviderSession();
+    const hostTarget = runtimeRole === 'hub'
+      ? await clearHubHostTarget('privacy-delete')
+      : { ok: true, active: false };
+    clearRuntimeSession();
+    for (const device of remoteHub.getSecurityStatus().devices) {
+      remoteHub.disconnectDevice(device.deviceId, 'privacy-local-data-delete');
+    }
+    const trustedDeviceCredentials = remoteHub.clearDeviceCredentials();
+    const transferJobs = hubTransferJobs.clear();
+    const captures = await captureStore.removeAll();
+    const sharedFolders = await hubSharedFolders.clear();
+    await agentAuditStore.clear();
+    await securityAuditStore.reset();
+    securityAuditHealthy = true;
+    await securityAuditStore.record({
+      action: 'privacy.local-data.deleted',
+      phase: 'complete',
+      result: 'success',
+      authMethod: 'local-admin-session',
+      details: {
+        capturesRemoved: captures.removed,
+        captureBytesRemoved: captures.removedBytes,
+        sharedFolderDefinitionsRemoved: sharedFolders.removed,
+        trustedDeviceCredentialsRemoved: trustedDeviceCredentials,
+        transferJobRecordsRemoved: transferJobs.removed,
+        providerSessionRevoked: providerLogout.revoked === true
+      }
+    });
+    res.json({
+      ok: true,
+      localDeleted: true,
+      providerLogout,
+      hostTarget,
+      captures,
+      sharedFolders,
+      trustedDeviceCredentials,
+      transferJobs,
+      preserved: ['settings-preferences', 'hub-device-identity', 'application-binaries']
+    });
+  } catch (error) {
+    securityAuditHealthy = false;
+    res.status(503).json({ ok: false, error: String(error?.code || error?.message || 'privacy-delete-failed').slice(0, 120) });
+  }
+});
+
+app.delete('/api/security/trusted-devices/:deviceId', (req, res) => {
+  noStore(res);
+  const disconnected = remoteHub.disconnectDevice(req.params.deviceId, 'trusted-device-revoked');
+  const credentialRevoked = remoteHub.revokeDeviceCredential(req.params.deviceId, 'trusted-device-revoked');
+  const revoked = disconnected === true || credentialRevoked === true;
+  recordSecurityAudit({
+    action: 'security.device.revoked',
+    phase: 'complete',
+    result: revoked ? 'success' : 'not-found',
+    deviceId: req.params.deviceId,
+    authMethod: 'local-admin-session'
+  });
+  res.json({ ok: revoked, revoked, deviceId: req.params.deviceId });
+});
 
 app.post('/api/security/revoke-all', (_req, res) => {
   noStore(res);
-  const devices = remoteHub.listDevices({ includeDataUrl: false });
-  let revoked = 0;
-  for (const device of devices) {
-    const disconnected = device.connected && remoteHub.disconnectDevice(device.deviceId, 'trusted-devices-revoked');
-    const credentialRevoked = remoteHub.revokeDeviceCredential(device.deviceId, 'trusted-devices-revoked');
-    if (disconnected || credentialRevoked) revoked += 1;
-  }
-  recordSecurityAudit({ action: 'security.devices.revoke-all', phase: 'complete', result: 'success', authMethod: 'local-admin-session', details: { revoked } });
-  res.json({ ok: true, revoked });
-});
+  const devices = remoteHub.listDevices({ includeDataUrl: false });
+  let revoked = 0;
+  for (const device of devices) {
+    const disconnected = device.connected && remoteHub.disconnectDevice(device.deviceId, 'trusted-devices-revoked');
+    const credentialRevoked = remoteHub.revokeDeviceCredential(device.deviceId, 'trusted-devices-revoked');
+    if (disconnected || credentialRevoked) revoked += 1;
+  }
+  recordSecurityAudit({ action: 'security.devices.revoke-all', phase: 'complete', result: 'success', authMethod: 'local-admin-session', details: { revoked } });
+  res.json({ ok: true, revoked });
+});
 
 app.get('/api/settings/agent', async (_req, res) => {
   noStore(res);
@@ -4819,17 +4897,17 @@ app.post('/api/runtime/restart', (_req, res) => {
   }, 150);
 });
 
-app.post('/api/runtime/shutdown', (req, res) => {
-  noStore(res);
-  recordSecurityAudit({
-    action: 'runtime.shutdown',
-    phase: 'requested',
-    result: 'accepted',
-    authMethod: req.liveDeskLauncherShutdown === true
-      ? 'launcher-internal-shutdown-token'
-      : 'local-admin-session'
-  });
-  runtimeManager.emit('runtime.shutdown.requested', { role: runtimeRole });
+app.post('/api/runtime/shutdown', (req, res) => {
+  noStore(res);
+  recordSecurityAudit({
+    action: 'runtime.shutdown',
+    phase: 'requested',
+    result: 'accepted',
+    authMethod: req.liveDeskLauncherShutdown === true
+      ? 'launcher-internal-shutdown-token'
+      : 'local-admin-session'
+  });
+  runtimeManager.emit('runtime.shutdown.requested', { role: runtimeRole });
   res.json({ ok: true, shuttingDown: true, role: runtimeRole });
   setTimeout(() => {
     void shutdownHub('API_SHUTDOWN')
@@ -4866,10 +4944,10 @@ app.post('/api/auth/session', async (req, res) => {
   }
   const { access_token: accessToken, refresh_token: refreshToken, expires_at: expiresAt } = normalized.session;
   try {
-    const user = await verifySupabaseUser(accessToken);
-    runtimeSessionGeneration += 1;
-    runtimeRefreshPromise = null;
-    runtimeAccessToken = accessToken;
+    const user = await verifySupabaseUser(accessToken);
+    runtimeSessionGeneration += 1;
+    runtimeRefreshPromise = null;
+    runtimeAccessToken = accessToken;
     runtimeRefreshToken = refreshToken;
     runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(expiresAt);
     runtimeManager.setAuthenticated(true, user.id);
@@ -4882,29 +4960,29 @@ app.post('/api/auth/session', async (req, res) => {
     const hostTarget = runtimeRole === 'hub'
       ? await publishHubHostTargetWithPendingRoleTakeover('session-received')
       : { ok: true, active: false };
-    if (runtimeRole === 'hub') {
-      startHubHostTargetLeaseRenewal();
-    }
-    recordSecurityAudit({
-      action: 'auth.session.established',
-      phase: 'complete',
-      result: 'success',
-      actorAccountId: user.id,
-      actorUserId: user.id,
-      authMethod: 'supabase-access-refresh',
-      requestHash: requestAuditHash({ userId: user.id, expiresAt })
-    });
-    res.json({ ok: true, authenticated: true, persisted, userId: user.id, role: runtimeRole, hostTarget });
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    recordSecurityAudit({
-      action: 'auth.session.establish',
-      phase: 'complete',
-      result: 'rejected',
-      reason: message,
-      authMethod: 'supabase-access-refresh',
-      requestHash: requestAuditHash({ hasAccessToken: Boolean(req.body?.accessToken || req.body?.access_token), hasRefreshToken: Boolean(req.body?.refreshToken || req.body?.refresh_token) })
-    });
+    if (runtimeRole === 'hub') {
+      startHubHostTargetLeaseRenewal();
+    }
+    recordSecurityAudit({
+      action: 'auth.session.established',
+      phase: 'complete',
+      result: 'success',
+      actorAccountId: user.id,
+      actorUserId: user.id,
+      authMethod: 'supabase-access-refresh',
+      requestHash: requestAuditHash({ userId: user.id, expiresAt })
+    });
+    res.json({ ok: true, authenticated: true, persisted, userId: user.id, role: runtimeRole, hostTarget });
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    recordSecurityAudit({
+      action: 'auth.session.establish',
+      phase: 'complete',
+      result: 'rejected',
+      reason: message,
+      authMethod: 'supabase-access-refresh',
+      requestHash: requestAuditHash({ hasAccessToken: Boolean(req.body?.accessToken || req.body?.access_token), hasRefreshToken: Boolean(req.body?.refreshToken || req.body?.refresh_token) })
+    });
     const status = authVerificationHttpStatus(message);
     res.status(status).json({ ok: false, error: message });
   }
@@ -5198,33 +5276,33 @@ function startHubHostTargetLeaseRenewal() {
   hubHostTargetRenewTimer.unref?.();
 }
 
-app.delete('/api/auth/session', async (_req, res) => {
-  noStore(res);
-  const actorUserId = runtimeManager.getSnapshot().userId || '';
-  const hostTarget = runtimeRole === 'hub'
-    ? await clearHubHostTarget('logout')
-    : { ok: true, active: false };
-  const providerLogout = await revokeRuntimeProviderSession();
-  clearRuntimeSession();
-  recordSecurityAudit({
-    action: 'auth.session.revoked',
-    phase: 'complete',
-    result: providerLogout.ok ? 'success' : 'provider-error',
-    actorAccountId: actorUserId,
-    actorUserId,
-    reason: providerLogout.error || '',
-    authMethod: 'supabase-local-signout',
-    details: { localCleared: true, providerRevoked: providerLogout.revoked === true, alreadyInvalid: providerLogout.alreadyInvalid === true }
-  });
-  res.status(providerLogout.ok ? 200 : 502).json({
-    ok: providerLogout.ok,
-    authenticated: false,
-    localCleared: true,
-    role: runtimeRole,
-    hostTarget,
-    providerLogout
-  });
-});
+app.delete('/api/auth/session', async (_req, res) => {
+  noStore(res);
+  const actorUserId = runtimeManager.getSnapshot().userId || '';
+  const hostTarget = runtimeRole === 'hub'
+    ? await clearHubHostTarget('logout')
+    : { ok: true, active: false };
+  const providerLogout = await revokeRuntimeProviderSession();
+  clearRuntimeSession();
+  recordSecurityAudit({
+    action: 'auth.session.revoked',
+    phase: 'complete',
+    result: providerLogout.ok ? 'success' : 'provider-error',
+    actorAccountId: actorUserId,
+    actorUserId,
+    reason: providerLogout.error || '',
+    authMethod: 'supabase-local-signout',
+    details: { localCleared: true, providerRevoked: providerLogout.revoked === true, alreadyInvalid: providerLogout.alreadyInvalid === true }
+  });
+  res.status(providerLogout.ok ? 200 : 502).json({
+    ok: providerLogout.ok,
+    authenticated: false,
+    localCleared: true,
+    role: runtimeRole,
+    hostTarget,
+    providerLogout
+  });
+});
 
 app.get('/api/hub/status', (_req, res) => {
   noStore(res);
@@ -5571,37 +5649,37 @@ app.post('/api/remote/files/from-hub', requireHubFeatureAccess, (req, res) => {
       res.status(400).json({ ok: false, error: 'no-filesystem-items-selected' });
       return;
     }
-    const job = hubTransferJobs.create({
-      itemIds,
-      deviceIds,
-      remoteDirectory: req.body?.remoteDirectory,
-      onComplete: async ({ completed, job: completedJob }) => {
-        await recordSecurityAuditRequired({
-          action: 'remote.file.job',
-          phase: 'complete',
-          result: completed ? 'success' : 'failed',
-          reason: completed ? '' : completedJob?.error || 'file-transfer-failed',
-          deviceIds,
-          sessionId: completedJob?.jobId || '',
-          requestHash: requestAuditHash({
-            jobId: completedJob?.jobId || '',
-            deviceIds,
-            remoteDirectory: req.body?.remoteDirectory || ''
-          }),
-          authMethod: 'local-admin-session',
-          details: {
-            state: completedJob?.state || '',
-            totalFiles: Number(completedJob?.totalFiles || 0),
-            completedFiles: Number(completedJob?.completedFiles || 0),
-            totalBytes: Number(completedJob?.totalBytes || 0),
-            sentBytes: Number(completedJob?.sentBytes || 0),
-            failedTargets: Array.isArray(completedJob?.failedTargets)
-              ? completedJob.failedTargets.length
-              : 0
-          }
-        });
-      }
-    });
+    const job = hubTransferJobs.create({
+      itemIds,
+      deviceIds,
+      remoteDirectory: req.body?.remoteDirectory,
+      onComplete: async ({ completed, job: completedJob }) => {
+        await recordSecurityAuditRequired({
+          action: 'remote.file.job',
+          phase: 'complete',
+          result: completed ? 'success' : 'failed',
+          reason: completed ? '' : completedJob?.error || 'file-transfer-failed',
+          deviceIds,
+          sessionId: completedJob?.jobId || '',
+          requestHash: requestAuditHash({
+            jobId: completedJob?.jobId || '',
+            deviceIds,
+            remoteDirectory: req.body?.remoteDirectory || ''
+          }),
+          authMethod: 'local-admin-session',
+          details: {
+            state: completedJob?.state || '',
+            totalFiles: Number(completedJob?.totalFiles || 0),
+            completedFiles: Number(completedJob?.completedFiles || 0),
+            totalBytes: Number(completedJob?.totalBytes || 0),
+            sentBytes: Number(completedJob?.sentBytes || 0),
+            failedTargets: Array.isArray(completedJob?.failedTargets)
+              ? completedJob.failedTargets.length
+              : 0
+          }
+        });
+      }
+    });
     res.status(202).json({ ok: true, jobId: job.jobId, state: job.state });
   } catch (error) {
     sendFilesystemError(res, error);
@@ -5682,80 +5760,80 @@ app.post('/api/remote/filesystem/shared-folders/:folderId/sync', requireHubFeatu
   }
 });
 
-app.post('/api/remote/files/transfer', requireHubFeatureAccess, async (req, res) => {
+app.post('/api/remote/files/transfer', requireHubFeatureAccess, async (req, res) => {
   noStore(res);
   const deviceIds = normalizeDeviceIds(req.body?.deviceIds);
-  if (deviceIds.length === 0) {
-    recordSecurityAudit({ action: 'remote.file.transfer', phase: 'complete', result: 'rejected', reason: 'no-target-devices', authMethod: 'local-admin-session' });
-    res.status(400).json({ ok: false, error: 'no-target-devices' });
+  if (deviceIds.length === 0) {
+    recordSecurityAudit({ action: 'remote.file.transfer', phase: 'complete', result: 'rejected', reason: 'no-target-devices', authMethod: 'local-admin-session' });
+    res.status(400).json({ ok: false, error: 'no-target-devices' });
     return;
   }
   const normalized = normalizeTransferFiles(req.body?.files);
-  if (!normalized.ok) {
-    recordSecurityAudit({ action: 'remote.file.transfer', phase: 'complete', result: 'rejected', reason: normalized.error, deviceIds, authMethod: 'local-admin-session' });
+  if (!normalized.ok) {
+    recordSecurityAudit({ action: 'remote.file.transfer', phase: 'complete', result: 'rejected', reason: normalized.error, deviceIds, authMethod: 'local-admin-session' });
     res.status(400).json({ ok: false, error: normalized.error, totalBytes: normalized.totalBytes || 0 });
     return;
   }
   const transferId = String(req.body?.transferId || crypto.randomUUID()).replace(/[^a-zA-Z0-9_.:-]/g, '-').slice(0, 128);
   const remoteDirectory = String(req.body?.remoteDirectory || '').replace(/[\0\r\n\t]/g, ' ').trim().slice(0, 600);
   const queuedAt = new Date().toISOString();
-  try {
-    const results = await Promise.all(deviceIds.map(async deviceId => ({
-      deviceId,
-      ...await remoteHub.sendCommandAwaitResult(deviceId, {
-        command: 'file.transfer',
-        payload: {
-          transferId,
-          remoteDirectory,
-          files: normalized.files,
-          totalBytes: normalized.totalBytes,
-          requestedAt: queuedAt
-        }
-      }, { timeoutMs: fileTransferCommandAckTimeoutMs })
-    })));
-    const queued = results.filter(result => result.queued).length;
-    const acknowledged = results.filter(result => result.acknowledged).length;
-    const success = acknowledged === deviceIds.length;
-    const partial = acknowledged > 0 && !success;
-    const error = success ? undefined : partial ? 'partial-transfer-failed' : 'no-transfer-acknowledged';
-    await recordSecurityAuditRequired({
-      action: 'remote.file.transfer',
-      phase: 'complete',
-      result: success ? 'success' : partial ? 'partial' : 'rejected',
-      reason: error || '',
-      deviceIds,
-      sessionId: transferId,
-      requestHash: requestAuditHash({ transferId, remoteDirectory, files: normalized.files.map(file => ({ name: file.name, relativePath: file.relativePath, byteLength: file.size })), totalBytes: normalized.totalBytes }),
-      authMethod: 'local-admin-session',
-      details: { queued, acknowledged, total: deviceIds.length, totalBytes: normalized.totalBytes, files: normalized.files.length }
-    });
-    res.json({
-      ok: success,
-      transferId,
-      queued,
-      acknowledged,
-      total: deviceIds.length,
-      totalBytes: normalized.totalBytes,
-      files: normalized.files.length,
-      results,
-      error
-    });
-  } catch (error) {
-    res.status(503).json({ ok: false, error: error?.code || 'security-audit-unavailable' });
-  }
-});
-
-app.post('/api/remote/files/chunk', requireHubFeatureAccess, async (req, res) => {
+  try {
+    const results = await Promise.all(deviceIds.map(async deviceId => ({
+      deviceId,
+      ...await remoteHub.sendCommandAwaitResult(deviceId, {
+        command: 'file.transfer',
+        payload: {
+          transferId,
+          remoteDirectory,
+          files: normalized.files,
+          totalBytes: normalized.totalBytes,
+          requestedAt: queuedAt
+        }
+      }, { timeoutMs: fileTransferCommandAckTimeoutMs })
+    })));
+    const queued = results.filter(result => result.queued).length;
+    const acknowledged = results.filter(result => result.acknowledged).length;
+    const success = acknowledged === deviceIds.length;
+    const partial = acknowledged > 0 && !success;
+    const error = success ? undefined : partial ? 'partial-transfer-failed' : 'no-transfer-acknowledged';
+    await recordSecurityAuditRequired({
+      action: 'remote.file.transfer',
+      phase: 'complete',
+      result: success ? 'success' : partial ? 'partial' : 'rejected',
+      reason: error || '',
+      deviceIds,
+      sessionId: transferId,
+      requestHash: requestAuditHash({ transferId, remoteDirectory, files: normalized.files.map(file => ({ name: file.name, relativePath: file.relativePath, byteLength: file.size })), totalBytes: normalized.totalBytes }),
+      authMethod: 'local-admin-session',
+      details: { queued, acknowledged, total: deviceIds.length, totalBytes: normalized.totalBytes, files: normalized.files.length }
+    });
+    res.json({
+      ok: success,
+      transferId,
+      queued,
+      acknowledged,
+      total: deviceIds.length,
+      totalBytes: normalized.totalBytes,
+      files: normalized.files.length,
+      results,
+      error
+    });
+  } catch (error) {
+    res.status(503).json({ ok: false, error: error?.code || 'security-audit-unavailable' });
+  }
+});
+
+app.post('/api/remote/files/chunk', requireHubFeatureAccess, async (req, res) => {
   noStore(res);
   const deviceIds = normalizeDeviceIds(req.body?.deviceIds);
-  if (deviceIds.length === 0) {
-    recordSecurityAudit({ action: 'remote.file.chunk', phase: 'complete', result: 'rejected', reason: 'no-target-devices', authMethod: 'local-admin-session' });
+  if (deviceIds.length === 0) {
+    recordSecurityAudit({ action: 'remote.file.chunk', phase: 'complete', result: 'rejected', reason: 'no-target-devices', authMethod: 'local-admin-session' });
     res.status(400).json({ ok: false, error: 'no-target-devices' });
     return;
   }
   const normalized = normalizeTransferChunk(req.body || {});
-  if (!normalized.ok) {
-    recordSecurityAudit({ action: 'remote.file.chunk', phase: 'complete', result: 'rejected', reason: normalized.error, deviceIds, authMethod: 'local-admin-session' });
+  if (!normalized.ok) {
+    recordSecurityAudit({ action: 'remote.file.chunk', phase: 'complete', result: 'rejected', reason: normalized.error, deviceIds, authMethod: 'local-admin-session' });
     res.status(400).json({ ok: false, error: normalized.error, byteLength: normalized.byteLength || 0 });
     return;
   }
@@ -5763,51 +5841,51 @@ app.post('/api/remote/files/chunk', requireHubFeatureAccess, async (req, res) =>
   const transferId = String(req.body?.transferId || crypto.randomUUID()).replace(/[^a-zA-Z0-9_.:-]/g, '-').slice(0, 128);
   const remoteDirectory = String(req.body?.remoteDirectory || '').replace(/[\0\r\n\t]/g, ' ').trim().slice(0, 600);
   const queuedAt = new Date().toISOString();
-  try {
-    const results = await Promise.all(deviceIds.map(async deviceId => ({
-      deviceId,
-      ...await remoteHub.sendCommandAwaitResult(deviceId, {
-        command: 'file.transfer.chunk',
-        payload: {
-          transferId,
-          remoteDirectory,
-          ...normalized.chunk,
-          requestedAt: queuedAt
-        }
-      }, { timeoutMs: fileTransferCommandAckTimeoutMs })
-    })));
-    const queued = results.filter(result => result.queued).length;
-    const acknowledged = results.filter(result => result.acknowledged).length;
-    const success = acknowledged === deviceIds.length;
-    const partial = acknowledged > 0 && !success;
-    const error = success ? undefined : partial ? 'partial-transfer-failed' : 'no-transfer-acknowledged';
-    await recordSecurityAuditRequired({
-      action: 'remote.file.chunk',
-      phase: normalized.chunk.final ? 'complete' : 'progress',
-      result: success ? 'success' : partial ? 'partial' : 'rejected',
-      reason: error || '',
-      deviceIds,
-      sessionId: transferId,
-      requestHash: requestAuditHash({ transferId, remoteDirectory, offset: normalized.chunk.offset, byteLength: normalized.chunk.byteLength, final: normalized.chunk.final }),
-      authMethod: 'local-admin-session',
-      details: { queued, acknowledged, total: deviceIds.length, byteLength: normalized.chunk.byteLength, offset: normalized.chunk.offset, final: normalized.chunk.final }
-    });
-    res.json({
-      ok: success,
-      transferId,
-      queued,
-      acknowledged,
-      total: deviceIds.length,
-      byteLength: normalized.chunk.byteLength,
-      offset: normalized.chunk.offset,
-      final: normalized.chunk.final,
-      results,
-      error
-    });
-  } catch (error) {
-    res.status(503).json({ ok: false, error: error?.code || 'security-audit-unavailable' });
-  }
-});
+  try {
+    const results = await Promise.all(deviceIds.map(async deviceId => ({
+      deviceId,
+      ...await remoteHub.sendCommandAwaitResult(deviceId, {
+        command: 'file.transfer.chunk',
+        payload: {
+          transferId,
+          remoteDirectory,
+          ...normalized.chunk,
+          requestedAt: queuedAt
+        }
+      }, { timeoutMs: fileTransferCommandAckTimeoutMs })
+    })));
+    const queued = results.filter(result => result.queued).length;
+    const acknowledged = results.filter(result => result.acknowledged).length;
+    const success = acknowledged === deviceIds.length;
+    const partial = acknowledged > 0 && !success;
+    const error = success ? undefined : partial ? 'partial-transfer-failed' : 'no-transfer-acknowledged';
+    await recordSecurityAuditRequired({
+      action: 'remote.file.chunk',
+      phase: normalized.chunk.final ? 'complete' : 'progress',
+      result: success ? 'success' : partial ? 'partial' : 'rejected',
+      reason: error || '',
+      deviceIds,
+      sessionId: transferId,
+      requestHash: requestAuditHash({ transferId, remoteDirectory, offset: normalized.chunk.offset, byteLength: normalized.chunk.byteLength, final: normalized.chunk.final }),
+      authMethod: 'local-admin-session',
+      details: { queued, acknowledged, total: deviceIds.length, byteLength: normalized.chunk.byteLength, offset: normalized.chunk.offset, final: normalized.chunk.final }
+    });
+    res.json({
+      ok: success,
+      transferId,
+      queued,
+      acknowledged,
+      total: deviceIds.length,
+      byteLength: normalized.chunk.byteLength,
+      offset: normalized.chunk.offset,
+      final: normalized.chunk.final,
+      results,
+      error
+    });
+  } catch (error) {
+    res.status(503).json({ ok: false, error: error?.code || 'security-audit-unavailable' });
+  }
+});
 
 const MANUAL_POWER_ACTIONS = new Set(['lock', 'sleep', 'restart', 'shutdown']);
 
@@ -6080,7 +6158,7 @@ app.post('/api/remote/devices/:deviceId/audio/stop', async (req, res, next) => {
   }
 });
 
-if (existsSync(webIndexPath)) {
+if (existsSync(webIndexPath)) {
   app.use(express.static(webDistPath, {
     etag: true,
     index: false,
@@ -6093,70 +6171,70 @@ if (existsSync(webIndexPath)) {
     }
     res.sendFile(webIndexPath);
   });
-}
-
-function isAuthorizedAdminWebSocket(req) {
-  if (!enforceLocalAdminAuth) return true;
-  const protocols = String(req.headers['sec-websocket-protocol'] || '')
-    .split(',')
-    .map(value => value.trim())
-    .filter(Boolean);
-  const adminToken = protocols.find(value => value.startsWith('livedesk-admin-'))?.slice('livedesk-admin-'.length) || '';
-  const csrfToken = protocols.find(value => value.startsWith('livedesk-admin-csrf-'))?.slice('livedesk-admin-csrf-'.length) || '';
-  return secureExactTestTokenMatches(adminToken, localAdminSessionToken)
-    && secureExactTestTokenMatches(csrfToken, localAdminCsrfToken);
-}
-
-httpServer.on('upgrade', (req, socket, head) => {
-  if (!isTrustedBrowserRequest(req)) {
+}
+
+function isAuthorizedAdminWebSocket(req) {
+  if (!enforceLocalAdminAuth) return true;
+  const protocols = String(req.headers['sec-websocket-protocol'] || '')
+    .split(',')
+    .map(value => value.trim())
+    .filter(Boolean);
+  const adminToken = protocols.find(value => value.startsWith('livedesk-admin-'))?.slice('livedesk-admin-'.length) || '';
+  const csrfToken = protocols.find(value => value.startsWith('livedesk-admin-csrf-'))?.slice('livedesk-admin-csrf-'.length) || '';
+  return secureExactTestTokenMatches(adminToken, localAdminSessionToken)
+    && secureExactTestTokenMatches(csrfToken, localAdminCsrfToken);
+}
+
+httpServer.on('upgrade', (req, socket, head) => {
+  if (!isTrustedBrowserRequest(req)) {
     socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
     socket.destroy();
-    return;
-  }
-  if (!isAuthorizedAdminWebSocket(req)) {
-    recordSecurityAudit({
-      action: 'local-admin.websocket',
-      phase: 'complete',
-      result: 'rejected',
-      reason: 'admin-session-required',
-      requestHash: requestAuditHash({ path: req.url || '' }),
-      authMethod: 'local-admin-websocket'
-    });
-    socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
-    socket.destroy();
-    return;
-  }
-  let parsed;
-  try {
-    parsed = new URL(req.url || '/', `http://${req.headers.host || '127.0.0.1'}`);
-  } catch {
-    socket.write('HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n');
-    socket.destroy();
-    return;
-  }
-  const websocketPath = parsed.pathname;
-  if (![
-    '/api/remote/frames/ws',
-    '/api/remote/atlas/ws',
-    '/api/remote/input/ws',
-    '/api/remote/audio/ws'
-  ].includes(websocketPath)) {
-    socket.write('HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n');
-    socket.destroy();
-    return;
-  }
-  void recordSecurityAuditRequired({
-    action: 'local-admin.websocket',
-    phase: 'accepted',
-    result: 'accepted',
-    sessionId: localAdminSessionId,
-    requestHash: requestAuditHash({ path: websocketPath }),
-    authMethod: 'local-admin-websocket',
-    details: { path: websocketPath }
-  }).then(() => {
-    if (parsed.pathname === '/api/remote/frames/ws') {
-      frameWss.handleUpgrade(req, socket, head, ws => frameWss.emit('connection', ws, req));
-      return;
+    return;
+  }
+  if (!isAuthorizedAdminWebSocket(req)) {
+    recordSecurityAudit({
+      action: 'local-admin.websocket',
+      phase: 'complete',
+      result: 'rejected',
+      reason: 'admin-session-required',
+      requestHash: requestAuditHash({ path: req.url || '' }),
+      authMethod: 'local-admin-websocket'
+    });
+    socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
+    socket.destroy();
+    return;
+  }
+  let parsed;
+  try {
+    parsed = new URL(req.url || '/', `http://${req.headers.host || '127.0.0.1'}`);
+  } catch {
+    socket.write('HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n');
+    socket.destroy();
+    return;
+  }
+  const websocketPath = parsed.pathname;
+  if (![
+    '/api/remote/frames/ws',
+    '/api/remote/atlas/ws',
+    '/api/remote/input/ws',
+    '/api/remote/audio/ws'
+  ].includes(websocketPath)) {
+    socket.write('HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n');
+    socket.destroy();
+    return;
+  }
+  void recordSecurityAuditRequired({
+    action: 'local-admin.websocket',
+    phase: 'accepted',
+    result: 'accepted',
+    sessionId: localAdminSessionId,
+    requestHash: requestAuditHash({ path: websocketPath }),
+    authMethod: 'local-admin-websocket',
+    details: { path: websocketPath }
+  }).then(() => {
+    if (parsed.pathname === '/api/remote/frames/ws') {
+      frameWss.handleUpgrade(req, socket, head, ws => frameWss.emit('connection', ws, req));
+      return;
     }
     if (parsed.pathname === '/api/remote/atlas/ws') {
       atlasWss.handleUpgrade(req, socket, head, ws => atlasWss.emit('connection', ws, req));
@@ -6167,14 +6245,14 @@ httpServer.on('upgrade', (req, socket, head) => {
       return;
     }
     if (parsed.pathname === '/api/remote/audio/ws') {
-      audioWss.handleUpgrade(req, socket, head, ws => audioWss.emit('connection', ws, req));
-      return;
-    }
-  }).catch(() => {
-    socket.write('HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\n\r\n');
-    socket.destroy();
-  });
-});
+      audioWss.handleUpgrade(req, socket, head, ws => audioWss.emit('connection', ws, req));
+      return;
+    }
+  }).catch(() => {
+    socket.write('HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\n\r\n');
+    socket.destroy();
+  });
+});
 
 frameWss.on('connection', (ws, req) => {
   frameClients.add(ws);
@@ -6286,22 +6364,22 @@ audioWss.on('connection', (ws, req) => {
   });
 });
 
-inputWss.on('connection', ws => {
-  inputClients.add(ws);
-  ws.liveDeskInputClientId = `riws-${++inputClientSeq}`;
-  ws.liveDeskInputDeviceIds = new Set();
-  ws.liveDeskInputAuditReady = false;
+inputWss.on('connection', ws => {
+  inputClients.add(ws);
+  ws.liveDeskInputClientId = `riws-${++inputClientSeq}`;
+  ws.liveDeskInputDeviceIds = new Set();
+  ws.liveDeskInputAuditReady = false;
   try {
     ws._socket?.setNoDelay?.(true);
   } catch {
     // Best-effort latency hint for browser input sockets.
-  }
-  ws.on('message', data => {
-    if (ws.liveDeskInputAuditReady !== true) {
-      sendJson(ws, { type: 'RemoteInputError', error: 'security-audit-pending' });
-      return;
-    }
-    let payload;
+  }
+  ws.on('message', data => {
+    if (ws.liveDeskInputAuditReady !== true) {
+      sendJson(ws, { type: 'RemoteInputError', error: 'security-audit-pending' });
+      return;
+    }
+    let payload;
     try {
       payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));
     } catch {
@@ -6340,46 +6418,46 @@ inputWss.on('connection', ws => {
       timestamp: new Date().toISOString()
     });
   });
-  const releaseBrowserInputOwner = reason => {
-    if (ws.liveDeskInputReleased) return;
-    ws.liveDeskInputReleased = true;
-    inputClients.delete(ws);
-    for (const deviceId of ws.liveDeskInputDeviceIds || []) {
-      remoteHub.releaseInputOwner(deviceId, ws.liveDeskInputClientId, reason);
-    }
-    void recordSecurityAuditRequired({
-      action: 'remote.control.browser-session',
-      phase: 'complete',
-      result: 'success',
-      reason,
-      deviceIds: [...(ws.liveDeskInputDeviceIds || [])],
-      sessionId: ws.liveDeskInputClientId,
-      authMethod: 'local-admin-websocket'
-    }).catch(() => {
-      // The global fail-closed gate is marked by recordSecurityAuditRequired.
-    });
-    ws.liveDeskInputDeviceIds?.clear?.();
-  };
-  ws.on('close', () => releaseBrowserInputOwner('browser-input-websocket-closed'));
-  ws.on('error', () => releaseBrowserInputOwner('browser-input-websocket-error'));
-  void recordSecurityAuditRequired({
-    action: 'remote.control.browser-session',
-    phase: 'start',
-    result: 'success',
-    sessionId: ws.liveDeskInputClientId,
-    authMethod: 'local-admin-websocket'
-  }).then(() => {
-    ws.liveDeskInputAuditReady = true;
-    sendJson(ws, {
-      type: 'RemoteInputSocketReady',
-      protocol: 'livedesk.remote.input.json.v1',
-      clientId: ws.liveDeskInputClientId,
-      timestamp: new Date().toISOString()
-    });
-  }).catch(() => {
-    ws.close(1011, 'security-audit-unavailable');
-  });
-});
+  const releaseBrowserInputOwner = reason => {
+    if (ws.liveDeskInputReleased) return;
+    ws.liveDeskInputReleased = true;
+    inputClients.delete(ws);
+    for (const deviceId of ws.liveDeskInputDeviceIds || []) {
+      remoteHub.releaseInputOwner(deviceId, ws.liveDeskInputClientId, reason);
+    }
+    void recordSecurityAuditRequired({
+      action: 'remote.control.browser-session',
+      phase: 'complete',
+      result: 'success',
+      reason,
+      deviceIds: [...(ws.liveDeskInputDeviceIds || [])],
+      sessionId: ws.liveDeskInputClientId,
+      authMethod: 'local-admin-websocket'
+    }).catch(() => {
+      // The global fail-closed gate is marked by recordSecurityAuditRequired.
+    });
+    ws.liveDeskInputDeviceIds?.clear?.();
+  };
+  ws.on('close', () => releaseBrowserInputOwner('browser-input-websocket-closed'));
+  ws.on('error', () => releaseBrowserInputOwner('browser-input-websocket-error'));
+  void recordSecurityAuditRequired({
+    action: 'remote.control.browser-session',
+    phase: 'start',
+    result: 'success',
+    sessionId: ws.liveDeskInputClientId,
+    authMethod: 'local-admin-websocket'
+  }).then(() => {
+    ws.liveDeskInputAuditReady = true;
+    sendJson(ws, {
+      type: 'RemoteInputSocketReady',
+      protocol: 'livedesk.remote.input.json.v1',
+      clientId: ws.liveDeskInputClientId,
+      timestamp: new Date().toISOString()
+    });
+  }).catch(() => {
+    ws.close(1011, 'security-audit-unavailable');
+  });
+});
 
 await remoteHub.start();
 connectedDeviceCount = Number(remoteHub.getStatus({ includeSecrets: false }).connectedDeviceCount || 0);
@@ -6473,8 +6551,8 @@ function shutdownHub(signal) {
   hubShutdownPromise = (async () => {
     const startedAt = Date.now();
     console.log(`[LiveDesk Hub] Shutdown started signal=${signal} grace=${hubShutdownGraceMs}ms timeout=${hubShutdownTimeoutMs}ms.`);
-    if (roleWatchTimer) clearInterval(roleWatchTimer);
-    clearInterval(captureRetentionTimer);
+    if (roleWatchTimer) clearInterval(roleWatchTimer);
+    clearInterval(captureRetentionTimer);
     clearInterval(browserWebSocketHeartbeatTimer);
     runSynchronousShutdownStep('update manager close', () => liveDeskUpdateManager?.close());
     atlasClients.clear();