@livedesk/hub 0.1.33 → 0.1.35

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "description": "LiveDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",

package/src/remote-hub.js

@@ -47,7 +47,7 @@ const RECENT_TASK_LIMIT = 12;
 const RECENT_TASK_BATCH_LIMIT = 16;
 const RECENT_FRAME_CACHE_TTL_MS = 4000;
 const RECENT_THUMBNAIL_FRAME_CACHE_LIMIT = 2;
-const RECENT_LIVE_FRAME_CACHE_LIMIT = 1;
+const RECENT_LIVE_FRAME_CACHE_LIMIT = 2;
 const RECENT_THUMBNAIL_FRAME_CACHE_MAX_BYTES = 2 * 1024 * 1024;
 const RECENT_LIVE_FRAME_CACHE_MAX_BYTES = 8 * 1024 * 1024;
 const LIVE_STREAM_PENDING_REUSE_MS = 5000;
@@ -1478,7 +1478,7 @@ function getRecentFrameCacheMaxBytes(frameKind) {
         : RECENT_LIVE_FRAME_CACHE_MAX_BYTES;
 }
 
-function pruneRecentFrameCache(cache, frameKind, nowMs = Date.now()) {
+export function pruneRecentFrameCache(cache, frameKind, nowMs = Date.now()) {
     if (!Array.isArray(cache)) {
         return;
     }
@@ -1499,6 +1499,20 @@ function pruneRecentFrameCache(cache, frameKind, nowMs = Date.now()) {
         }
     }
 
+    if (frameKind !== 'thumbnail' && cache.length > 1) {
+        // Keep the newest frame plus the newest independently decodable key
+        // frame. A browser can subscribe after capture has already started;
+        // retaining only the latest 30 fps delta makes that browser wait for a
+        // future GOP even though the Hub accepted a current key frame moments
+        // earlier. Exact stream-owner matching below prevents stale replay.
+        const latest = cache[0];
+        const keyFrame = cache.find(entry =>
+            entry !== latest
+            && (entry?.frame?.isKeyFrame === true
+                || safeString(entry?.frame?.chunkType, 20).toLowerCase() === 'key'));
+        cache.splice(0, cache.length, ...[latest, keyFrame].filter(Boolean));
+    }
+
     for (let index = 0; index < cache.length; index += 1) {
         const entry = cache[index];
         const byteLength = Number(entry?.byteLength || entry?.frame?.payload?.length || 0) || 0;
@@ -1510,7 +1524,7 @@ function pruneRecentFrameCache(cache, frameKind, nowMs = Date.now()) {
     }
 }
 
-function rememberRecentFramePayload(device, frameKind, frame) {
+export function rememberRecentFramePayload(device, frameKind, frame) {
     if (!device || !frame || !Buffer.isBuffer(frame.payload)) {
         return;
     }
@@ -1546,7 +1560,7 @@ function rememberRecentFramePayload(device, frameKind, frame) {
     pruneRecentFrameCache(cache, kind, nowMs);
 }
 
-function isFramePayloadRequestMatch(frame, options = {}) {
+export function isFramePayloadRequestMatch(frame, options = {}) {
     if (!frame || !Buffer.isBuffer(frame.payload)) {
         return false;
     }
@@ -1565,10 +1579,37 @@ function isFramePayloadRequestMatch(frame, options = {}) {
         return false;
     }
 
+    if (options.requireKeyFrame === true
+        && frame.isKeyFrame !== true
+        && safeString(frame.chunkType, 20).toLowerCase() !== 'key') {
+        return false;
+    }
+
+    for (const key of ['streamId', 'sessionId', 'commandId', 'streamPurpose']) {
+        const expected = safeString(options[key], 160);
+        if (expected && safeString(frame[key], 160) !== expected) {
+            return false;
+        }
+    }
+
+    const requestedCaptureGeneration = Number(options.captureGeneration);
+    if (Number.isFinite(requestedCaptureGeneration)
+        && requestedCaptureGeneration > 0
+        && Number(frame.captureGeneration || 0) !== requestedCaptureGeneration) {
+        return false;
+    }
+
+    const requestedMonitorIndex = Number(options.monitorIndex);
+    if (Number.isFinite(requestedMonitorIndex)
+        && requestedMonitorIndex >= 0
+        && Number(frame.monitorIndex ?? -1) !== requestedMonitorIndex) {
+        return false;
+    }
+
     return true;
 }
 
-function findRecentFramePayload(device, frameKind, options = {}) {
+export function findRecentFramePayload(device, frameKind, options = {}) {
     const kind = frameKind === 'thumbnail' ? 'thumbnail' : 'live';
     const latest = kind === 'thumbnail'
         ? device?.latestThumbnail
@@ -1579,7 +1620,14 @@ function findRecentFramePayload(device, frameKind, options = {}) {
 
     const token = safeString(options.token, 128);
     const requestedSeq = Number(options.frameSeq);
-    if (!token && !Number.isFinite(requestedSeq)) {
+    const ownerQuery = options.requireKeyFrame === true
+        || ['streamId', 'sessionId', 'commandId', 'streamPurpose']
+            .some(key => safeString(options[key], 160))
+        || (Number.isFinite(Number(options.captureGeneration))
+            && Number(options.captureGeneration) > 0)
+        || (Number.isFinite(Number(options.monitorIndex))
+            && Number(options.monitorIndex) >= 0);
+    if (!token && !Number.isFinite(requestedSeq) && !ownerQuery) {
         return null;
     }
 

package/src/server.js

@@ -2738,6 +2738,11 @@ function replaceExpectedFrameBindingForClient(ws, deviceId, expectedBinding = nu
     && bindingIdentity === frameLaneBindingIdentity(currentExpectedBinding)) {
     expectedBinding.readySent = currentExpectedBinding?.readySent === true
       || expectedBinding.readySent === true;
+    expectedBinding.replayedKeyFrameSeq = Math.max(
+      0,
+      Number(currentExpectedBinding?.replayedKeyFrameSeq || 0),
+      Number(expectedBinding.replayedKeyFrameSeq || 0)
+    );
     ws.liveDeskExpectedStreamBindingsByDeviceId.set(normalizedDeviceId, expectedBinding);
     if (!lane.bindingEpochsByDeviceId.has(normalizedDeviceId)) {
       lane.bindingEpochsByDeviceId.set(normalizedDeviceId, 1);
@@ -2776,6 +2781,50 @@ function replaceExpectedFrameBindingForClient(ws, deviceId, expectedBinding = nu
   return bindingIdentity;
 }
 
+function replayExpectedBindingKeyFrame(ws, expectedBinding) {
+  if (!ws || ws.readyState !== ws.OPEN || !expectedBinding) {
+    return false;
+  }
+  const deviceId = String(expectedBinding.deviceId || '').trim();
+  const currentBinding = ws.liveDeskExpectedStreamBindingsByDeviceId instanceof Map
+    ? ws.liveDeskExpectedStreamBindingsByDeviceId.get(deviceId)
+    : null;
+  const bindingIdentity = frameLaneBindingIdentity(expectedBinding);
+  if (!deviceId
+    || !bindingIdentity
+    || bindingIdentity !== frameLaneBindingIdentity(currentBinding)) {
+    return false;
+  }
+  const cached = remoteHub.getFramePayload(deviceId, 'live', {
+    requireKeyFrame: true,
+    streamId: expectedBinding.streamId,
+    sessionId: expectedBinding.sessionId,
+    commandId: expectedBinding.commandId,
+    captureGeneration: expectedBinding.captureGeneration,
+    streamPurpose: expectedBinding.streamPurpose,
+    monitorIndex: expectedBinding.monitorIndex
+  });
+  const frameSeq = Number(cached?.frame?.frameSeq || 0);
+  if (!cached
+    || cached.frame?.isKeyFrame !== true
+    || !Number.isSafeInteger(frameSeq)
+    || frameSeq <= 0
+    || Number(currentBinding?.replayedKeyFrameSeq || 0) === frameSeq) {
+    return false;
+  }
+  currentBinding.replayedKeyFrameSeq = frameSeq;
+  broadcastRemoteBinaryFrame({
+    kind: 'live',
+    deviceId,
+    frame: cached.frame,
+    payload: cached.payload,
+    mimeType: cached.mimeType,
+    byteLength: cached.byteLength,
+    replayedForBinding: true
+  });
+  return true;
+}
+
 function dropQueuedFrameAtForLane(lane, dropIndex) {
   const droppedBefore = lane.dropped;
   const droppedItem = removeFrameLaneQueueItem(lane, dropIndex);
@@ -3269,6 +3318,7 @@ function startFrameSubscriptionLive(
         continue;
       }
       cancelPendingFrameStreamStop(deviceId, result.streamId, String(liveOptions.streamPurpose || 'wall'));
+      const replayedKeyFrame = replayExpectedBindingKeyFrame(ws, expectedBinding);
       started.push({
         deviceId: expectedBinding.deviceId,
         sessionId: expectedBinding.sessionId,
@@ -3277,7 +3327,8 @@ function startFrameSubscriptionLive(
         commandId: expectedBinding.commandId,
         captureGeneration: expectedBinding.captureGeneration,
         monitorIndex: expectedBinding.monitorIndex,
-        ready: reusedFrameReady,
+        ready: expectedBinding.readySent === true,
+        replayedKeyFrame,
         fps: result.fps,
         reused: result.reused === true
       });

package/src/transport/secure-direct-acceptor.js

@@ -17,10 +17,18 @@ const HANDSHAKE_TIMEOUT_MS = 5_000;
 const REPLAY_TTL_MS = 2 * 60 * 1000;
 const MAX_REPLAY_ENTRIES = 8192;
 const DEFAULT_MAX_PENDING_HANDSHAKES = 128;
-const DEFAULT_MAX_CONNECTIONS_PER_IP_PER_MINUTE = 60;
+// One Client can open control, frame, input, file, and audio channels.
+// A 200-computer site behind one NAT can therefore legitimately create
+// more than 1,000 authenticated handshakes during a coordinated restart.
+// Keep a generous raw-IP burst ceiling; actual abuse blocking below is
+// failure-scoped by device whenever a stable device id is available.
+const DEFAULT_MAX_CONNECTIONS_PER_IP_PER_MINUTE = 2400;
 const DEFAULT_MAX_CONSECUTIVE_FAILURES = 8;
 const DEFAULT_IP_BLOCK_MS = 60_000;
 const MAX_TRACKED_IPS = 4096;
+const MAX_TRACKED_DEVICE_FAILURES = 16384;
+const BLOCKED_IP_RECOVERY_PROBE_MS = 2_000;
+const IP_SCOPED_FAILURES = new Set(['secure-handshake-json-invalid', 'secure-handshake-too-large']);
 
 function directError(code) {
   const error = new Error(code);
@@ -60,6 +68,26 @@ function safeHandshakeError(error) {
   const code = clean(error?.code || error?.message, 100).toLowerCase();
   return /^[-a-z0-9]+$/.test(code) ? code : 'secure-handshake-rejected';
 }
+function normalizeIpAddress(value) {
+  return clean(value, 100).replace(/^::ffff:/, '').toLowerCase() || 'unknown';
+}
+
+function isPrivateNetworkAddress(value) {
+  const address = normalizeIpAddress(value);
+  if (address === '127.0.0.1' || address === '::1' || address === 'localhost') return true;
+  if (address.startsWith('fe80:') || address.startsWith('fc') || address.startsWith('fd')) return true;
+  const parts = address.split('.').map(part => Number(part));
+  return parts.length === 4
+    && parts.every(part => Number.isInteger(part) && part >= 0 && part <= 255)
+    && (parts[0] === 10
+      || (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31)
+      || (parts[0] === 192 && parts[1] === 168));
+}
+
+function failureOwnerKey(ip, deviceId) {
+  const normalizedDeviceId = clean(deviceId, 128);
+  return normalizedDeviceId ? `${normalizeIpAddress(ip)}|${normalizedDeviceId}` : '';
+}
 
 export function createSecureDirectAcceptor({
   authority,
@@ -77,6 +105,7 @@ export function createSecureDirectAcceptor({
   }
   const replayCache = new Map();
   const ipStates = new Map();
+  const deviceFailureStates = new Map();
   const maxPendingHandshakes = Math.max(1, Number(abuseLimits.maxPendingHandshakes)
     || DEFAULT_MAX_PENDING_HANDSHAKES);
   const maxConnectionsPerIpPerMinute = Math.max(1, Number(abuseLimits.maxConnectionsPerIpPerMinute)
@@ -93,10 +122,13 @@ export function createSecureDirectAcceptor({
   let capacityRejections = 0;
   let rateLimitRejections = 0;
   let blockedIpRejections = 0;
+  let blockedDeviceRejections = 0;
+  let compatibilityRejections = 0;
+  let recoveryProbeAdmissions = 0;
   let probeClosures = 0;
 
   function remoteAddress(rawSocket) {
-    return clean(rawSocket?.remoteAddress, 100).replace(/^::ffff:/, '') || 'unknown';
+    return normalizeIpAddress(rawSocket?.remoteAddress);
   }
 
   function pruneIpStates(current) {
@@ -121,6 +153,7 @@ export function createSecureDirectAcceptor({
         connectionCount: 0,
         consecutiveFailures: 0,
         blockedUntil: 0,
+        nextRecoveryProbeAt: 0,
         lastSeenAt: current
       };
       ipStates.set(ip, state);
@@ -133,11 +166,51 @@ export function createSecureDirectAcceptor({
     return state;
   }
 
+  function pruneDeviceFailureStates(current) {
+    for (const [key, state] of deviceFailureStates) {
+      if (current - state.lastSeenAt >= Math.max(ipBlockMs * 2, 5 * 60_000)) {
+        deviceFailureStates.delete(key);
+      }
+    }
+    while (deviceFailureStates.size > MAX_TRACKED_DEVICE_FAILURES) {
+      const oldest = deviceFailureStates.keys().next().value;
+      if (!oldest) break;
+      deviceFailureStates.delete(oldest);
+    }
+  }
+
+  function getDeviceFailureState(ip, deviceId, current) {
+    const key = failureOwnerKey(ip, deviceId);
+    if (!key) return null;
+    pruneDeviceFailureStates(current);
+    let state = deviceFailureStates.get(key);
+    if (!state) {
+      state = { consecutiveFailures: 0, blockedUntil: 0, lastSeenAt: current };
+      deviceFailureStates.set(key, state);
+    }
+    state.lastSeenAt = current;
+    return state;
+  }
+
+  function deviceAdmissionError(ip, deviceId, current) {
+    const state = getDeviceFailureState(ip, deviceId, current);
+    if (state?.blockedUntil > current) {
+      blockedDeviceRejections += 1;
+      return 'secure-device-temporarily-blocked';
+    }
+    return '';
+  }
+
   function admissionError(ip, current) {
     const state = getIpState(ip, current);
     if (state.blockedUntil > current) {
-      blockedIpRejections += 1;
-      return 'secure-ip-temporarily-blocked';
+      if (state.nextRecoveryProbeAt <= current) {
+        state.nextRecoveryProbeAt = current + BLOCKED_IP_RECOVERY_PROBE_MS;
+        recoveryProbeAdmissions += 1;
+      } else {
+        blockedIpRejections += 1;
+        return 'secure-ip-temporarily-blocked';
+      }
     }
     if (pendingHandshakes >= maxPendingHandshakes) {
       capacityRejections += 1;
@@ -151,18 +224,39 @@ export function createSecureDirectAcceptor({
     return '';
   }
 
-  function recordFailure(ip, current) {
+  function recordFailure(ip, deviceId, code, current) {
+    if (code === 'secure-client-hello-required' && isPrivateNetworkAddress(ip)) {
+      compatibilityRejections += 1;
+      return;
+    }
+    const deviceState = !IP_SCOPED_FAILURES.has(code)
+      ? getDeviceFailureState(ip, deviceId, current)
+      : null;
+    if (deviceState) {
+      deviceState.consecutiveFailures += 1;
+      if (deviceState.consecutiveFailures >= maxConsecutiveFailures) {
+        deviceState.blockedUntil = Math.max(deviceState.blockedUntil, current + ipBlockMs);
+      }
+      return;
+    }
     const state = getIpState(ip, current);
     state.consecutiveFailures += 1;
     if (state.consecutiveFailures >= maxConsecutiveFailures) {
       state.blockedUntil = Math.max(state.blockedUntil, current + ipBlockMs);
+      state.nextRecoveryProbeAt = current + BLOCKED_IP_RECOVERY_PROBE_MS;
     }
   }
 
-  function recordSuccess(ip, current) {
+  function recordSuccess(ip, deviceId, current) {
     const state = getIpState(ip, current);
     state.consecutiveFailures = 0;
     state.blockedUntil = 0;
+    state.nextRecoveryProbeAt = 0;
+    const deviceState = getDeviceFailureState(ip, deviceId, current);
+    if (deviceState) {
+      deviceState.consecutiveFailures = 0;
+      deviceState.blockedUntil = 0;
+    }
   }
 
   function rejectSocket(rawSocket, code, ip, observedDeviceId = '') {
@@ -360,12 +454,12 @@ export function createSecureDirectAcceptor({
       settled = true;
       cleanup();
       const code = safeHandshakeError(error);
-      if (code === 'secure-handshake-closed' && bytes === 0) {
+      if ((code === 'secure-handshake-closed' || code === 'secure-handshake-timeout') && bytes === 0) {
         probeClosures += 1;
         try { rawSocket.destroy(); } catch {}
         return;
       }
-      recordFailure(ip, Math.floor(now()));
+      recordFailure(ip, observedDeviceId, code, Math.floor(now()));
       rejectSocket(rawSocket, code, ip, observedDeviceId);
     };
 
@@ -390,7 +484,12 @@ export function createSecureDirectAcceptor({
       let hello;
       try {
         hello = JSON.parse(combined.subarray(0, newline).toString('utf8'));
-        observedDeviceId = clean(hello?.deviceId, 128);
+        observedDeviceId = clean(hello?.deviceId, 128);        const deviceDenied = deviceAdmissionError(ip, observedDeviceId, Math.floor(now()));
+        if (deviceDenied) {
+          settled = false;
+          fail(directError(deviceDenied));
+          return;
+        }
       } catch {
         settled = false;
         fail(directError('secure-handshake-json-invalid'));
@@ -398,7 +497,7 @@ export function createSecureDirectAcceptor({
       }
       try {
         handleHello(rawSocket, hello, combined.subarray(newline + 1));
-        recordSuccess(ip, Math.floor(now()));
+        recordSuccess(ip, observedDeviceId, Math.floor(now()));
       } catch (error) {
         // settled is reset only for the common failure path so it can emit the
         // bounded rejection response and release the raw socket.
@@ -424,9 +523,13 @@ export function createSecureDirectAcceptor({
       replayRejections,
       pendingHandshakes,
       trackedIpCount: ipStates.size,
+      trackedDeviceFailureCount: deviceFailureStates.size,
       capacityRejections,
       rateLimitRejections,
       blockedIpRejections,
+      blockedDeviceRejections,
+      compatibilityRejections,
+      recoveryProbeAdmissions,
       probeClosures,
       limits: {
         maxPendingHandshakes,