@livedesk/hub 0.1.34 → 0.1.36

package/package.json

@@ -1,32 +1,32 @@
-{
-  "name": "@livedesk/hub",
-  "version": "0.1.34",
-  "description": "LiveDesk local Hub API and browser frame bridge",
-  "type": "module",
-  "main": "src/server.js",
-  "files": [
-    "src/",
-    "README.md"
-  ],
-  "scripts": {
-    "dev": "node src/server.js",
-    "start": "node src/server.js",
-    "check": "node --check src/server.js && node --check src/remote-hub.js",
-    "prepublishOnly": "node ../../scripts/livedesk-release-git-gate.mjs"
-  },
-  "dependencies": {
-    "@ffmpeg-installer/ffmpeg": "^1.1.0",
-    "@livedesk/runtime-core": "0.1.4",
-    "@openai/codex-sdk": "0.145.0",
-    "cors": "^2.8.5",
-    "express": "^4.21.2",
-    "path-to-regexp": "0.1.13",
-    "ws": "^8.18.3"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "@livedesk/hub",
+  "version": "0.1.36",
+  "description": "LiveDesk local Hub API and browser frame bridge",
+  "type": "module",
+  "main": "src/server.js",
+  "files": [
+    "src/",
+    "README.md"
+  ],
+  "scripts": {
+    "dev": "node src/server.js",
+    "start": "node src/server.js",
+    "check": "node --check src/server.js && node --check src/remote-hub.js",
+    "prepublishOnly": "node ../../scripts/livedesk-release-git-gate.mjs"
+  },
+  "dependencies": {
+    "@ffmpeg-installer/ffmpeg": "^1.1.0",
+    "@livedesk/runtime-core": "0.1.4",
+    "@openai/codex-sdk": "0.145.0",
+    "cors": "^2.8.5",
+    "express": "^4.21.2",
+    "path-to-regexp": "0.1.13",
+    "ws": "^8.18.3"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/server.js

@@ -647,6 +647,36 @@ async function getRuntimeAccessToken() {
   }
 }
 
+async function restorePersistedHubSessionAtStartup() {
+  if (runtimeRole !== 'hub' || runtimeManager.getSnapshot().authenticated) {
+    return { ok: true, skipped: true, reason: 'not-required' };
+  }
+  const persisted = readPersistedRuntimeSession();
+  const normalized = normalizeRuntimeAuthSession(persisted, { requireRefreshToken: true });
+  const userId = String(normalized.ok ? normalized.session?.user?.id || '' : '').trim();
+  if (!normalized.ok || !userId) {
+    return { ok: false, skipped: true, reason: normalized.ok ? 'saved-user-missing' : normalized.error };
+  }
+  runtimeSessionGeneration += 1;
+  runtimeRefreshPromise = null;
+  runtimeAccessToken = String(normalized.session.access_token || '').trim();
+  runtimeRefreshToken = String(normalized.session.refresh_token || '').trim();
+  runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(normalized.session.expires_at);
+  const accessToken = await getRuntimeAccessToken();
+  if (!accessToken) throw new Error('saved-hub-session-access-token-unavailable');
+  runtimeManager.setAuthenticated(true, userId);
+  persistRuntimeSession({
+    access_token: runtimeAccessToken,
+    refresh_token: runtimeRefreshToken,
+    expires_at: Math.floor(runtimeAccessTokenExpiresAt / 1000),
+    user: normalized.session.user
+  });
+  const hostTarget = await publishHubHostTargetWithPendingRoleTakeover('saved-session-restored');
+  startHubHostTargetLeaseRenewal();
+  console.log(`[LiveDesk Hub] Saved sign-in restored locally; host target publication ${hostTarget?.ok === false ? 'will retry' : 'is active'}.`);
+  return { ok: true, skipped: false, hostTarget };
+}
+
 function isLoopbackBindHost(value) {
   const host = String(value || '').trim().toLowerCase().replace(/^\[|\]$/g, '');
   return host === '127.0.0.1' || host === 'localhost' || host === '::1';
@@ -6471,6 +6501,9 @@ httpServer.listen(httpPort, httpHost, () => {
   console.log(`[LiveDesk Hub] Version ${managerVersion}`);
   console.log(`[LiveDesk Hub] HTTP API http://${httpHost}:${httpPort}`);
   console.log(`[LiveDesk Hub] Client endpoint ${status.agentEndpoint} pair=${status.pairTokenPreview}`);
+  void restorePersistedHubSessionAtStartup().catch(error => {
+    console.warn(`[LiveDesk Hub] Saved sign-in startup restore deferred to the Hub page: ${error?.message || error}`);
+  });
 });
 
 const roleWatchTimer = runtimeRole === 'hub'

package/src/transport/secure-direct-acceptor.js

@@ -17,10 +17,18 @@ const HANDSHAKE_TIMEOUT_MS = 5_000;
 const REPLAY_TTL_MS = 2 * 60 * 1000;
 const MAX_REPLAY_ENTRIES = 8192;
 const DEFAULT_MAX_PENDING_HANDSHAKES = 128;
-const DEFAULT_MAX_CONNECTIONS_PER_IP_PER_MINUTE = 60;
+// One Client can open control, frame, input, file, and audio channels.
+// A 200-computer site behind one NAT can therefore legitimately create
+// more than 1,000 authenticated handshakes during a coordinated restart.
+// Keep a generous raw-IP burst ceiling; actual abuse blocking below is
+// failure-scoped by device whenever a stable device id is available.
+const DEFAULT_MAX_CONNECTIONS_PER_IP_PER_MINUTE = 2400;
 const DEFAULT_MAX_CONSECUTIVE_FAILURES = 8;
 const DEFAULT_IP_BLOCK_MS = 60_000;
 const MAX_TRACKED_IPS = 4096;
+const MAX_TRACKED_DEVICE_FAILURES = 16384;
+const BLOCKED_IP_RECOVERY_PROBE_MS = 2_000;
+const IP_SCOPED_FAILURES = new Set(['secure-handshake-json-invalid', 'secure-handshake-too-large']);
 
 function directError(code) {
   const error = new Error(code);
@@ -60,6 +68,26 @@ function safeHandshakeError(error) {
   const code = clean(error?.code || error?.message, 100).toLowerCase();
   return /^[-a-z0-9]+$/.test(code) ? code : 'secure-handshake-rejected';
 }
+function normalizeIpAddress(value) {
+  return clean(value, 100).replace(/^::ffff:/, '').toLowerCase() || 'unknown';
+}
+
+function isPrivateNetworkAddress(value) {
+  const address = normalizeIpAddress(value);
+  if (address === '127.0.0.1' || address === '::1' || address === 'localhost') return true;
+  if (address.startsWith('fe80:') || address.startsWith('fc') || address.startsWith('fd')) return true;
+  const parts = address.split('.').map(part => Number(part));
+  return parts.length === 4
+    && parts.every(part => Number.isInteger(part) && part >= 0 && part <= 255)
+    && (parts[0] === 10
+      || (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31)
+      || (parts[0] === 192 && parts[1] === 168));
+}
+
+function failureOwnerKey(ip, deviceId) {
+  const normalizedDeviceId = clean(deviceId, 128);
+  return normalizedDeviceId ? `${normalizeIpAddress(ip)}|${normalizedDeviceId}` : '';
+}
 
 export function createSecureDirectAcceptor({
   authority,
@@ -77,6 +105,7 @@ export function createSecureDirectAcceptor({
   }
   const replayCache = new Map();
   const ipStates = new Map();
+  const deviceFailureStates = new Map();
   const maxPendingHandshakes = Math.max(1, Number(abuseLimits.maxPendingHandshakes)
     || DEFAULT_MAX_PENDING_HANDSHAKES);
   const maxConnectionsPerIpPerMinute = Math.max(1, Number(abuseLimits.maxConnectionsPerIpPerMinute)
@@ -93,10 +122,13 @@ export function createSecureDirectAcceptor({
   let capacityRejections = 0;
   let rateLimitRejections = 0;
   let blockedIpRejections = 0;
+  let blockedDeviceRejections = 0;
+  let compatibilityRejections = 0;
+  let recoveryProbeAdmissions = 0;
   let probeClosures = 0;
 
   function remoteAddress(rawSocket) {
-    return clean(rawSocket?.remoteAddress, 100).replace(/^::ffff:/, '') || 'unknown';
+    return normalizeIpAddress(rawSocket?.remoteAddress);
   }
 
   function pruneIpStates(current) {
@@ -121,6 +153,7 @@ export function createSecureDirectAcceptor({
         connectionCount: 0,
         consecutiveFailures: 0,
         blockedUntil: 0,
+        nextRecoveryProbeAt: 0,
         lastSeenAt: current
       };
       ipStates.set(ip, state);
@@ -133,11 +166,51 @@ export function createSecureDirectAcceptor({
     return state;
   }
 
+  function pruneDeviceFailureStates(current) {
+    for (const [key, state] of deviceFailureStates) {
+      if (current - state.lastSeenAt >= Math.max(ipBlockMs * 2, 5 * 60_000)) {
+        deviceFailureStates.delete(key);
+      }
+    }
+    while (deviceFailureStates.size > MAX_TRACKED_DEVICE_FAILURES) {
+      const oldest = deviceFailureStates.keys().next().value;
+      if (!oldest) break;
+      deviceFailureStates.delete(oldest);
+    }
+  }
+
+  function getDeviceFailureState(ip, deviceId, current) {
+    const key = failureOwnerKey(ip, deviceId);
+    if (!key) return null;
+    pruneDeviceFailureStates(current);
+    let state = deviceFailureStates.get(key);
+    if (!state) {
+      state = { consecutiveFailures: 0, blockedUntil: 0, lastSeenAt: current };
+      deviceFailureStates.set(key, state);
+    }
+    state.lastSeenAt = current;
+    return state;
+  }
+
+  function deviceAdmissionError(ip, deviceId, current) {
+    const state = getDeviceFailureState(ip, deviceId, current);
+    if (state?.blockedUntil > current) {
+      blockedDeviceRejections += 1;
+      return 'secure-device-temporarily-blocked';
+    }
+    return '';
+  }
+
   function admissionError(ip, current) {
     const state = getIpState(ip, current);
     if (state.blockedUntil > current) {
-      blockedIpRejections += 1;
-      return 'secure-ip-temporarily-blocked';
+      if (state.nextRecoveryProbeAt <= current) {
+        state.nextRecoveryProbeAt = current + BLOCKED_IP_RECOVERY_PROBE_MS;
+        recoveryProbeAdmissions += 1;
+      } else {
+        blockedIpRejections += 1;
+        return 'secure-ip-temporarily-blocked';
+      }
     }
     if (pendingHandshakes >= maxPendingHandshakes) {
       capacityRejections += 1;
@@ -151,18 +224,39 @@ export function createSecureDirectAcceptor({
     return '';
   }
 
-  function recordFailure(ip, current) {
+  function recordFailure(ip, deviceId, code, current) {
+    if (code === 'secure-client-hello-required' && isPrivateNetworkAddress(ip)) {
+      compatibilityRejections += 1;
+      return;
+    }
+    const deviceState = !IP_SCOPED_FAILURES.has(code)
+      ? getDeviceFailureState(ip, deviceId, current)
+      : null;
+    if (deviceState) {
+      deviceState.consecutiveFailures += 1;
+      if (deviceState.consecutiveFailures >= maxConsecutiveFailures) {
+        deviceState.blockedUntil = Math.max(deviceState.blockedUntil, current + ipBlockMs);
+      }
+      return;
+    }
     const state = getIpState(ip, current);
     state.consecutiveFailures += 1;
     if (state.consecutiveFailures >= maxConsecutiveFailures) {
       state.blockedUntil = Math.max(state.blockedUntil, current + ipBlockMs);
+      state.nextRecoveryProbeAt = current + BLOCKED_IP_RECOVERY_PROBE_MS;
     }
   }
 
-  function recordSuccess(ip, current) {
+  function recordSuccess(ip, deviceId, current) {
     const state = getIpState(ip, current);
     state.consecutiveFailures = 0;
     state.blockedUntil = 0;
+    state.nextRecoveryProbeAt = 0;
+    const deviceState = getDeviceFailureState(ip, deviceId, current);
+    if (deviceState) {
+      deviceState.consecutiveFailures = 0;
+      deviceState.blockedUntil = 0;
+    }
   }
 
   function rejectSocket(rawSocket, code, ip, observedDeviceId = '') {
@@ -360,12 +454,12 @@ export function createSecureDirectAcceptor({
       settled = true;
       cleanup();
       const code = safeHandshakeError(error);
-      if (code === 'secure-handshake-closed' && bytes === 0) {
+      if ((code === 'secure-handshake-closed' || code === 'secure-handshake-timeout') && bytes === 0) {
         probeClosures += 1;
         try { rawSocket.destroy(); } catch {}
         return;
       }
-      recordFailure(ip, Math.floor(now()));
+      recordFailure(ip, observedDeviceId, code, Math.floor(now()));
       rejectSocket(rawSocket, code, ip, observedDeviceId);
     };
 
@@ -390,7 +484,12 @@ export function createSecureDirectAcceptor({
       let hello;
       try {
         hello = JSON.parse(combined.subarray(0, newline).toString('utf8'));
-        observedDeviceId = clean(hello?.deviceId, 128);
+        observedDeviceId = clean(hello?.deviceId, 128);        const deviceDenied = deviceAdmissionError(ip, observedDeviceId, Math.floor(now()));
+        if (deviceDenied) {
+          settled = false;
+          fail(directError(deviceDenied));
+          return;
+        }
       } catch {
         settled = false;
         fail(directError('secure-handshake-json-invalid'));
@@ -398,7 +497,7 @@ export function createSecureDirectAcceptor({
       }
       try {
         handleHello(rawSocket, hello, combined.subarray(newline + 1));
-        recordSuccess(ip, Math.floor(now()));
+        recordSuccess(ip, observedDeviceId, Math.floor(now()));
       } catch (error) {
         // settled is reset only for the common failure path so it can emit the
         // bounded rejection response and release the raw socket.
@@ -424,9 +523,13 @@ export function createSecureDirectAcceptor({
       replayRejections,
       pendingHandshakes,
       trackedIpCount: ipStates.size,
+      trackedDeviceFailureCount: deviceFailureStates.size,
       capacityRejections,
       rateLimitRejections,
       blockedIpRejections,
+      blockedDeviceRejections,
+      compatibilityRejections,
+      recoveryProbeAdmissions,
       probeClosures,
       limits: {
         maxPendingHandshakes,