@livedesk/hub 0.1.35 → 0.1.37

package/src/remote-hub.js

@@ -1,10 +1,7 @@
 import net from 'net';
 import os from 'os';
 import crypto from 'crypto';
-import { isSecureHandshakeStart } from '@livedesk/runtime-core';
-import { createDeviceCredentialAuthority } from './security/device-credential-authority.js';
-import { createHubRelayControl, createSecureHubRelayControl } from './transport/relay-hub-control.js';
-import { createSecureDirectAcceptor } from './transport/secure-direct-acceptor.js';
+import { createHubRelayControl } from './transport/relay-hub-control.js';
 import { parseExactLiveStreamMonitorIndex } from './live-stream-monitor-contract.js';
 import {
     BoundedSegmentedBuffer,
@@ -38,7 +35,6 @@ const MAX_AGENT_WEBSOCKET_MESSAGE_BYTES = 4
 const MAX_AGENT_SOCKET_ACCUMULATOR_BYTES = MAX_LINE_CHARS
     + MAX_AGENT_TCP_BINARY_PACKET_BYTES
     + (256 * 1024);
-const MAX_AGENT_MESSAGES_PER_SECOND = 240;
 const HTTP_HEADER_TERMINATOR = Buffer.from('\r\n\r\n', 'ascii');
 const MAX_AGENT_TASK_CHARS = 4000;
 const MAX_AGENT_TASK_RESULT_CHARS = 3000;
@@ -47,7 +43,7 @@ const RECENT_TASK_LIMIT = 12;
 const RECENT_TASK_BATCH_LIMIT = 16;
 const RECENT_FRAME_CACHE_TTL_MS = 4000;
 const RECENT_THUMBNAIL_FRAME_CACHE_LIMIT = 2;
-const RECENT_LIVE_FRAME_CACHE_LIMIT = 2;
+const RECENT_LIVE_FRAME_CACHE_LIMIT = 1;
 const RECENT_THUMBNAIL_FRAME_CACHE_MAX_BYTES = 2 * 1024 * 1024;
 const RECENT_LIVE_FRAME_CACHE_MAX_BYTES = 8 * 1024 * 1024;
 const LIVE_STREAM_PENDING_REUSE_MS = 5000;
@@ -837,53 +833,6 @@ function isPrivateNetworkAddress(value) {
         || address.startsWith('fd');
 }
 
-export function createRemoteMessageRateGate({
-    limit = MAX_AGENT_MESSAGES_PER_SECOND,
-    windowMs = 1_000,
-    now = () => Date.now()
-} = {}) {
-    const boundedLimit = Math.max(1, Math.min(10_000, Math.floor(Number(limit) || MAX_AGENT_MESSAGES_PER_SECOND)));
-    const boundedWindowMs = Math.max(100, Math.min(60_000, Math.floor(Number(windowMs) || 1_000)));
-    let windowStartedAt = Number(now());
-    let count = 0;
-    return Object.freeze({
-        consume() {
-            const current = Number(now());
-            if (!Number.isFinite(current) || current - windowStartedAt >= boundedWindowMs || current < windowStartedAt) {
-                windowStartedAt = current;
-                count = 0;
-            }
-            count += 1;
-            return count <= boundedLimit;
-        },
-        getStatus: () => ({ count, limit: boundedLimit, windowMs: boundedWindowMs, windowStartedAt })
-    });
-}
-
-export function evaluateRemoteConnectionPolicy({
-    remoteAddress = '',
-    relayConnection = false,
-    encrypted = false,
-    allowLegacyPlaintextForTests = false,
-    policy = {}
-} = {}) {
-    const address = String(remoteAddress || '').replace(/^::ffff:/i, '').trim().toLowerCase();
-    if (policy.requireEncryptedConnections === true
-        && encrypted !== true
-        && allowLegacyPlaintextForTests !== true) {
-        return 'encrypted-connection-required';
-    }
-    if (relayConnection === true || !isPrivateNetworkAddress(address)) {
-        return policy.allowInternetConnections === false
-            ? 'internet-connections-blocked-by-settings'
-            : '';
-    }
-    if (!isLoopbackHost(address) && policy.allowLanConnections === false) {
-        return 'lan-connections-blocked-by-settings';
-    }
-    return '';
-}
-
 function readCpuTimes() {
     let idle = 0;
     let total = 0;
@@ -1213,24 +1162,21 @@ const SUPPORTED_AGENT_OPERATIONS = new Set([
     'process.list',
     'service.status',
     'diagnostics.collect',
-    'file.read',
-    'file.list',
-    'network.status',
-    'logs.collect'
-]);
-
-const RETIRED_AGENT_MUTATING_OPERATIONS = new Set([
     'process.control',
     'service.control',
     'application.launch',
     'application.close',
+    'file.read',
     'file.write',
     'file.delete',
+    'file.list',
     'command.run',
     'script.run',
     'software.install',
+    'network.status',
     'system.power',
-    'system.configure'
+    'system.configure',
+    'logs.collect'
 ]);
 
 function normalizeAgentOperation(value) {
@@ -1402,7 +1348,7 @@ function buildRemoteFramePath(deviceId, frameKind, frame) {
     return `/api/remote/devices/${encodeURIComponent(deviceId)}/${endpoint}?${params.toString()}`;
 }
 
-function serializeRemoteFrame(frame, deviceId, frameKind, options = {}) {
+function serializeRemoteFrame(frame, deviceId, frameKind, options = {}) {
     if (!frame) {
         return null;
     }
@@ -1424,27 +1370,27 @@ function serializeRemoteFrame(frame, deviceId, frameKind, options = {}) {
         serialized.dataUrl = dataUrl || buildFrameDataUrl(payload, '', publicFrame.mimeType || publicFrame.format || 'image/jpeg');
     }
 
-    return serialized;
-}
-
-function serializeActiveLiveStream(activeLiveStream, deviceId) {
-    if (!activeLiveStream) {
-        return null;
-    }
-
-    return {
-        ...activeLiveStream,
-        // The active descriptor is status metadata. Keep its internal frame
-        // owner intact for immediate delivery, but never duplicate encoded
-        // bytes or its bearer token into React/status snapshots.
-        latestFrame: serializeRemoteFrame(
-            activeLiveStream.latestFrame,
-            deviceId,
-            'live',
-            { includeDataUrl: false }
-        )
-    };
-}
+    return serialized;
+}
+
+function serializeActiveLiveStream(activeLiveStream, deviceId) {
+    if (!activeLiveStream) {
+        return null;
+    }
+
+    return {
+        ...activeLiveStream,
+        // The active descriptor is status metadata. Preserve the Hub's exact
+        // internal frame owner for delivery, but never copy encoded bytes or
+        // its access token into a browser status snapshot.
+        latestFrame: serializeRemoteFrame(
+            activeLiveStream.latestFrame,
+            deviceId,
+            'live',
+            { includeDataUrl: false }
+        )
+    };
+}
 
 function getRecentFrameCache(device, frameKind) {
     if (!device) {
@@ -1478,7 +1424,7 @@ function getRecentFrameCacheMaxBytes(frameKind) {
         : RECENT_LIVE_FRAME_CACHE_MAX_BYTES;
 }
 
-export function pruneRecentFrameCache(cache, frameKind, nowMs = Date.now()) {
+function pruneRecentFrameCache(cache, frameKind, nowMs = Date.now()) {
     if (!Array.isArray(cache)) {
         return;
     }
@@ -1499,20 +1445,6 @@ export function pruneRecentFrameCache(cache, frameKind, nowMs = Date.now()) {
         }
     }
 
-    if (frameKind !== 'thumbnail' && cache.length > 1) {
-        // Keep the newest frame plus the newest independently decodable key
-        // frame. A browser can subscribe after capture has already started;
-        // retaining only the latest 30 fps delta makes that browser wait for a
-        // future GOP even though the Hub accepted a current key frame moments
-        // earlier. Exact stream-owner matching below prevents stale replay.
-        const latest = cache[0];
-        const keyFrame = cache.find(entry =>
-            entry !== latest
-            && (entry?.frame?.isKeyFrame === true
-                || safeString(entry?.frame?.chunkType, 20).toLowerCase() === 'key'));
-        cache.splice(0, cache.length, ...[latest, keyFrame].filter(Boolean));
-    }
-
     for (let index = 0; index < cache.length; index += 1) {
         const entry = cache[index];
         const byteLength = Number(entry?.byteLength || entry?.frame?.payload?.length || 0) || 0;
@@ -1524,7 +1456,7 @@ export function pruneRecentFrameCache(cache, frameKind, nowMs = Date.now()) {
     }
 }
 
-export function rememberRecentFramePayload(device, frameKind, frame) {
+function rememberRecentFramePayload(device, frameKind, frame) {
     if (!device || !frame || !Buffer.isBuffer(frame.payload)) {
         return;
     }
@@ -1560,7 +1492,7 @@ export function rememberRecentFramePayload(device, frameKind, frame) {
     pruneRecentFrameCache(cache, kind, nowMs);
 }
 
-export function isFramePayloadRequestMatch(frame, options = {}) {
+function isFramePayloadRequestMatch(frame, options = {}) {
     if (!frame || !Buffer.isBuffer(frame.payload)) {
         return false;
     }
@@ -1579,37 +1511,10 @@ export function isFramePayloadRequestMatch(frame, options = {}) {
         return false;
     }
 
-    if (options.requireKeyFrame === true
-        && frame.isKeyFrame !== true
-        && safeString(frame.chunkType, 20).toLowerCase() !== 'key') {
-        return false;
-    }
-
-    for (const key of ['streamId', 'sessionId', 'commandId', 'streamPurpose']) {
-        const expected = safeString(options[key], 160);
-        if (expected && safeString(frame[key], 160) !== expected) {
-            return false;
-        }
-    }
-
-    const requestedCaptureGeneration = Number(options.captureGeneration);
-    if (Number.isFinite(requestedCaptureGeneration)
-        && requestedCaptureGeneration > 0
-        && Number(frame.captureGeneration || 0) !== requestedCaptureGeneration) {
-        return false;
-    }
-
-    const requestedMonitorIndex = Number(options.monitorIndex);
-    if (Number.isFinite(requestedMonitorIndex)
-        && requestedMonitorIndex >= 0
-        && Number(frame.monitorIndex ?? -1) !== requestedMonitorIndex) {
-        return false;
-    }
-
     return true;
 }
 
-export function findRecentFramePayload(device, frameKind, options = {}) {
+function findRecentFramePayload(device, frameKind, options = {}) {
     const kind = frameKind === 'thumbnail' ? 'thumbnail' : 'live';
     const latest = kind === 'thumbnail'
         ? device?.latestThumbnail
@@ -1620,14 +1525,7 @@ export function findRecentFramePayload(device, frameKind, options = {}) {
 
     const token = safeString(options.token, 128);
     const requestedSeq = Number(options.frameSeq);
-    const ownerQuery = options.requireKeyFrame === true
-        || ['streamId', 'sessionId', 'commandId', 'streamPurpose']
-            .some(key => safeString(options[key], 160))
-        || (Number.isFinite(Number(options.captureGeneration))
-            && Number(options.captureGeneration) > 0)
-        || (Number.isFinite(Number(options.monitorIndex))
-            && Number(options.monitorIndex) >= 0);
-    if (!token && !Number.isFinite(requestedSeq) && !ownerQuery) {
+    if (!token && !Number.isFinite(requestedSeq)) {
         return null;
     }
 
@@ -1683,7 +1581,7 @@ function serializeDevice(device, options = {}) {
         },
         latestThumbnail: serializeRemoteFrame(device.latestThumbnail, device.deviceId, 'thumbnail', options),
         latestLiveFrame: serializeRemoteFrame(device.latestLiveFrame, device.deviceId, 'live', options),
-        activeLiveStream: serializeActiveLiveStream(device.activeLiveStream, device.deviceId),
+        activeLiveStream: serializeActiveLiveStream(device.activeLiveStream, device.deviceId),
         liveCapturePause: device.liveCapturePause
             ? {
                 token: device.liveCapturePause.token,
@@ -2301,16 +2199,6 @@ export function createRemoteHub(options = {}) {
         }
     }
 
-    function connectionPolicyError(socket, policy = {}) {
-        return evaluateRemoteConnectionPolicy({
-            remoteAddress: socket?.remoteAddress || '',
-            relayConnection: socket?.__liveDeskRelayControl === true,
-            encrypted: socket?.__liveDeskSecurityContext?.encrypted === true,
-            allowLegacyPlaintextForTests,
-            policy
-        });
-    }
-
     function policyError(device, permission = '', command = '') {
         const policy = getDevicePolicy(device);
         const commandName = safeString(command, 80);
@@ -2359,83 +2247,22 @@ export function createRemoteHub(options = {}) {
     const hostInstanceId = safeString(options.hostInstanceId ?? env.LIVEDESK_HUB_INSTANCE_ID ?? env.MINDEXEC_BRIDGE_INSTANCE_ID ?? crypto.randomUUID(), 128) || crypto.randomUUID();
     const publicEndpoint = safeString(env.LIVEDESK_REMOTE_PUBLIC_ENDPOINT || env.MINDEXEC_REMOTE_PUBLIC_ENDPOINT || env.REMOTE_HUB_PUBLIC_ENDPOINT, 256);
     const publicHost = safeString(env.LIVEDESK_REMOTE_PUBLIC_HOST || env.MINDEXEC_REMOTE_PUBLIC_HOST || env.REMOTE_HUB_PUBLIC_HOST, 128);
-    const configuredEnrollmentToken = safeString(
-        options.pairToken || env.REMOTE_HUB_PAIR_TOKEN || env.LIVEDESK_CLIENT_PAIR_TOKEN || env.MINDEXEC_REMOTE_PAIR_TOKEN,
+    const pairToken = safeString(
+        options.pairToken || env.REMOTE_HUB_PAIR_TOKEN || env.LIVEDESK_CLIENT_PAIR_TOKEN || env.MINDEXEC_REMOTE_PAIR_TOKEN || crypto.randomBytes(6).toString('hex'),
         256);
-    const allowLegacyPlaintextForTests = options.allowLegacyPlaintextForTests === true
-        || isEnabledValue(env.LIVEDESK_TEST_ALLOW_LEGACY_PLAINTEXT, false)
-        || env.LIVEDESK_TEST_MODE === '1';
-    const canonicalEnrollmentToken = /^[A-Za-z0-9_-]{43}$/.test(configuredEnrollmentToken)
-        && Buffer.from(configuredEnrollmentToken, 'base64url').length === 32
-        && Buffer.from(configuredEnrollmentToken, 'base64url').toString('base64url') === configuredEnrollmentToken
-        ? configuredEnrollmentToken
-        : '';
-    let pairToken = allowLegacyPlaintextForTests && configuredEnrollmentToken
-        ? configuredEnrollmentToken
-        : canonicalEnrollmentToken || crypto.randomBytes(32).toString('base64url');
-    const deviceCredentialAuthority = options.deviceCredentialAuthority || createDeviceCredentialAuthority({
-        dataDir: options.dataDir || env.LIVEDESK_DATA_DIR || undefined
-    });
-    const getSecurityIdentity = typeof options.getSecurityIdentity === 'function'
-        ? options.getSecurityIdentity
-        : () => ({ accountId: safeString(options.accountId || env.LIVEDESK_ACCOUNT_ID, 128) });
-    udpTransport?.setRendezvousProofIssuer?.(({ roomId, deviceId, role, ttlMs }) => {
-        const identity = getSecurityIdentity() || {};
-        return deviceCredentialAuthority.issueRendezvousProof({
-            roomId,
-            deviceId,
-            role,
-            ttlMs,
-            accountId: safeString(identity.accountId, 128)
+    const relayControl = options.relayControl && typeof options.relayControl === 'object'
+        ? options.relayControl
+        : createHubRelayControl({
+            env,
+            pairToken,
+            logEvent,
+            logWarn,
+            onPeerSocket: socket => handleTcpAgentSocket(socket)
         });
-    });
     let pairingPin = /^\d{6}$/.test(String(options.pairingPin || env.LIVEDESK_PAIRING_PIN || '').trim())
         ? String(options.pairingPin || env.LIVEDESK_PAIRING_PIN).trim()
         : generatePairingPin();
     let pairingPinUpdatedAt = new Date().toISOString();
-    const consumeEnrollmentToken = expected => {
-        if (!timingSafeStringEqual(expected, pairToken)) return false;
-        pairToken = crypto.randomBytes(32).toString('base64url');
-        pairingPin = generatePairingPin();
-        pairingPinUpdatedAt = new Date().toISOString();
-        emitRemoteEvent('RemoteEnrollmentTokenRotated', null, {
-            pairingPinUpdatedAt,
-            hubId: deviceCredentialAuthority.hubId
-        });
-        return true;
-    };
-    const relayControl = options.relayControl && typeof options.relayControl === 'object'
-        ? options.relayControl
-        : allowLegacyPlaintextForTests
-            ? createHubRelayControl({
-                env,
-                pairToken,
-                logEvent,
-                logWarn,
-                onPeerSocket: socket => handleTcpAgentSocket(socket)
-            })
-            : createSecureHubRelayControl({
-                env,
-                authority: deviceCredentialAuthority,
-                getIdentity: () => getSecurityIdentity() || {},
-                getEnrollmentToken: () => pairToken,
-                consumeEnrollmentToken,
-                logEvent,
-                logWarn,
-                onPeerSocket: socket => handleTcpAgentSocket(socket)
-            });
-    const secureDirectAcceptor = createSecureDirectAcceptor({
-        authority: deviceCredentialAuthority,
-        getIdentity: () => getSecurityIdentity() || {},
-        getEnrollmentToken: () => pairToken,
-        consumeEnrollmentToken,
-        onSecureSocket: socket => handleTcpAgentSocket(socket),
-        onAudit: audit => emitEvent('RemoteSecurityHandshakeAudit', {
-            ...audit,
-            remoteHub: getStatus({ includeSecrets: false })
-        }),
-        logWarn
-    });
     const duplicateDeviceLogThrottleMs = clampNumber(
         env.MINDEXEC_REMOTE_DUPLICATE_DEVICE_LOG_MS || env.REMOTE_HUB_DUPLICATE_DEVICE_LOG_MS,
         5000,
@@ -2461,7 +2288,6 @@ export function createRemoteHub(options = {}) {
     const transportDiagnosticStartingDevices = new Set();
     const duplicateDeviceLogAt = new Map();
     let server = null;
-    let controlIdleSweepTimer = null;
     let started = false;
     let boundPort = requestedPort;
     let lastError = '';
@@ -2783,7 +2609,7 @@ export function createRemoteHub(options = {}) {
             host,
             agentHost: routeInfo.host || getAnnouncedHost(),
             port: boundPort || requestedPort,
-            protocol: 'secure-record-v1',
+            protocol: 'tcp-jsonl',
             protocolVersion: REMOTE_PROTOCOL_VERSION,
             agentProtocol: REMOTE_AGENT_PROTOCOL,
             frameProtocol: buildRemoteFrameProtocolDescriptor(),
@@ -2803,15 +2629,6 @@ export function createRemoteHub(options = {}) {
             pairTokenPreview: maskToken(pairToken),
             pairingPin: includeSecrets ? pairingPin : '',
             pairingPinUpdatedAt,
-            security: {
-                direct: secureDirectAcceptor.getStatus(),
-                hubId: deviceCredentialAuthority.hubId,
-                hubPublicKeyFingerprint: crypto.createHash('sha256')
-                    .update(Buffer.from(deviceCredentialAuthority.hubPublicKey, 'base64url'))
-                    .digest('hex'),
-                enrolledDeviceCount: deviceCredentialAuthority.listDevices().filter(item => !item.revokedAt).length,
-                legacyPlaintextForTests: allowLegacyPlaintextForTests
-            },
             deviceCount: devices.size,
             connectedDeviceCount: connectedDevices,
             canvasDeviceListMode: 'all-devices',
@@ -4078,14 +3895,6 @@ export function createRemoteHub(options = {}) {
         }
 
         const writeOwner = device.inputWriteOwner;
-        if (device.controlOwnerConnectionId) {
-            endControlSession(
-                device,
-                device.controlOwnerConnectionId,
-                reason,
-                writeOwner,
-                writeOwner?.getBindingKey?.() || '');
-        }
         device.inputSocket = null;
         device.inputWriteOwner = null;
         device.inputSocketConnectionId = '';
@@ -4118,14 +3927,6 @@ export function createRemoteHub(options = {}) {
         }
 
         const writeOwner = device.inputWriteOwner;
-        if (device.controlOwnerConnectionId) {
-            endControlSession(
-                device,
-                device.controlOwnerConnectionId,
-                reason,
-                null,
-                '');
-        }
         device.inputSocket = null;
         device.inputWriteOwner = null;
         device.inputSocketConnectionId = '';
@@ -4559,10 +4360,6 @@ export function createRemoteHub(options = {}) {
             inputSocketConnectionId: '',
             inputOwnerConnectionId: '',
             inputOwnerBindingKey: '',
-            controlOwnerSessionId: '',
-            controlOwnerConnectionId: '',
-            controlOwnerStartedAtMs: 0,
-            controlOwnerLastInputAtMs: 0,
             frameSocket: null,
             audioSocket: null,
             fileSocket: null,
@@ -7484,12 +7281,6 @@ export function createRemoteHub(options = {}) {
         }
 
         if (!state.authenticated) {
-            const securityContext = socket.__liveDeskSecurityContext;
-            const secureDeviceAuthenticated = securityContext?.authenticated === true
-                && securityContext?.encrypted === true
-                && safeString(securityContext.accountId, 128)
-                && safeString(securityContext.hubId, 128)
-                && safeString(securityContext.deviceId, 128);
             if (message.type === 'hello' && socket.__liveDeskRelayControl === true) {
                 message = {
                     ...message,
@@ -7502,9 +7293,8 @@ export function createRemoteHub(options = {}) {
                 };
             }
             if (message.type === 'slot.assign') {
-                if (!secureDeviceAuthenticated
-                    || safeString(message.deviceId || message.DeviceId, 128) !== securityContext.deviceId) {
-                    writeJsonLine(socket, { type: 'slot.assignment', ok: false, error: 'authenticated-device-credential-required' });
+                if (!timingSafeStringEqual(message.pairToken, pairToken)) {
+                    writeJsonLine(socket, { type: 'slot.assignment', ok: false, error: 'invalid-pair-token' });
                     socket.end();
                     return;
                 }
@@ -7521,52 +7311,8 @@ export function createRemoteHub(options = {}) {
                 return;
             }
 
-            if (secureDeviceAuthenticated) {
-                if (safeString(message.deviceId || message.DeviceId, 128) !== securityContext.deviceId) {
-                    writeJsonLine(socket, { type: 'error', error: 'device-credential-binding-invalid' });
-                    socket.destroy();
-                    return;
-                }
-                const helloChannel = safeString(message.channel || message.Channel || 'control', 40).toLowerCase() || 'control';
-                if (helloChannel !== securityContext.channel) {
-                    writeJsonLine(socket, { type: 'error', error: 'secure-channel-binding-invalid' });
-                    socket.destroy();
-                    return;
-                }
-            } else {
-                const legacyAllowed = socket.__liveDeskRelayControl === true
-                    || socket.__liveDeskLegacyPlaintext === true && allowLegacyPlaintextForTests;
-                if (!legacyAllowed || !timingSafeStringEqual(message.pairToken, pairToken)) {
-                    writeJsonLine(socket, { type: 'error', error: 'authenticated-device-credential-required' });
-                    socket.destroy();
-                    return;
-                }
-            }
-
-            const incomingDeviceId = safeString(message.deviceId || message.DeviceId, 128);
-            const incomingCapabilities = message.capabilities && typeof message.capabilities === 'object'
-                ? message.capabilities
-                : {};
-            const incomingPolicy = getWelcomeDevicePolicy({
-                deviceId: incomingDeviceId,
-                capabilities: incomingCapabilities
-            }) || {};
-            const connectionDenied = connectionPolicyError(socket, incomingPolicy);
-            if (connectionDenied) {
-                const deniedTransport = socket.__liveDeskRelayControl === true ? 'relay' : 'direct-tcp';
-                const deniedRemoteAddress = safeString(socket.remoteAddress, 256) || 'unknown';
-                logWarn('security', 'Remote connection rejected reason=' + connectionDenied + ' transport=' + deniedTransport + ' remote=' + deniedRemoteAddress);
-                writeJsonLine(socket, { type: 'error', error: connectionDenied });
-                emitEvent('RemoteSecurityPolicyAudit', {
-                    result: 'rejected',
-                    reason: connectionDenied,
-                    deviceId: incomingDeviceId,
-                    sessionId: safeString(socket.__liveDeskSecurityContext?.sessionId, 160),
-                    accountId: safeString(socket.__liveDeskSecurityContext?.accountId, 128),
-                    hubId: safeString(socket.__liveDeskSecurityContext?.hubId, 128),
-                    transport: socket.__liveDeskRelayControl === true ? 'relay' : 'direct-tcp',
-                    remoteAddress: safeString(socket.remoteAddress, 256)
-                });
+            if (!timingSafeStringEqual(message.pairToken, pairToken)) {
+                writeJsonLine(socket, { type: 'error', error: 'invalid-pair-token' });
                 socket.destroy();
                 return;
             }
@@ -7738,26 +7484,6 @@ export function createRemoteHub(options = {}) {
         }
     }
 
-    function enforceAgentMessageRate(socket, state, channel = 'control') {
-        if (state.messageRateGate.consume()) return true;
-        const device = state.device;
-        emitEvent('RemoteAbuseDefense', {
-            result: 'rejected',
-            reason: 'authenticated-message-rate-exceeded',
-            deviceId: device?.deviceId || '',
-            sessionId: device?.sessionId || '',
-            accountId: socket.__liveDeskSecurityContext?.accountId || '',
-            hubId: socket.__liveDeskSecurityContext?.hubId || '',
-            transport: socket.__liveDeskRelayControl === true ? 'relay' : 'direct-tcp',
-            channel,
-            remoteAddress: safeString(socket.remoteAddress, 256),
-            rate: state.messageRateGate.getStatus()
-        });
-        writeJsonLine(socket, { type: 'error', error: 'message-rate-exceeded' });
-        socket.destroy();
-        return false;
-    }
-
     function handleWebSocketAgentSocket(socket) {
         allSockets.add(socket);
         socket.setNoDelay(true);
@@ -7775,7 +7501,6 @@ export function createRemoteHub(options = {}) {
             binaryIngress: null,
             binaryQueueDrops: 0,
             binaryQueueEpoch: crypto.randomUUID(),
-            messageRateGate: createRemoteMessageRateGate(),
             closed: false
         };
         attachAgentBinaryIngress(socket, state);
@@ -7788,7 +7513,6 @@ export function createRemoteHub(options = {}) {
         }, 10000);
 
         socket.onTextMessage = text => {
-            if (!enforceAgentMessageRate(socket, state, 'websocket-text')) return;
             try {
                 handleAgentMessage(socket, state, parseJsonLine(String(text || '')));
             } catch (err) {
@@ -7798,7 +7522,6 @@ export function createRemoteHub(options = {}) {
         };
 
         socket.onBinaryMessage = payload => {
-            if (!enforceAgentMessageRate(socket, state, 'websocket-binary')) return;
             try {
                 const packet = parseRemoteHubWebSocketBinaryFrame(payload);
                 if (!packet?.header || !Buffer.isBuffer(packet.payload)) {
@@ -7957,7 +7680,6 @@ export function createRemoteHub(options = {}) {
             binaryIngress: null,
             binaryQueueDrops: 0,
             binaryQueueEpoch: crypto.randomUUID(),
-            messageRateGate: createRemoteMessageRateGate(),
             closed: false
         };
         attachAgentBinaryIngress(socket, state);
@@ -8075,15 +7797,6 @@ export function createRemoteHub(options = {}) {
 
                 try {
                     const message = parseJsonLine(lineBuffer.toString('utf8'));
-                    if (!enforceAgentMessageRate(socket, state, state.frameOnly
-                        ? 'frame'
-                        : state.audioOnly
-                            ? 'audio'
-                            : state.inputOnly
-                                ? 'input'
-                                : state.fileOnly ? 'file' : 'control')) {
-                        return;
-                    }
                     if (message?.type === 'frame.binary') {
                         const frameKind = safeString(message.frameKind || message.kind || message.frameType, 40).toLowerCase();
                         const maxBytes = frameKind === 'thumbnail'
@@ -8139,32 +7852,13 @@ export function createRemoteHub(options = {}) {
     }
 
     function handleSocket(socket) {
-        if (!allowLegacyPlaintextForTests) {
-            secureDirectAcceptor.accept(socket);
-            return;
-        }
         socket.once('data', chunk => {
             const firstChunk = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-            if (isSecureHandshakeStart(firstChunk)) {
-                secureDirectAcceptor.accept(socket, firstChunk);
-                return;
-            }
             if (isRemoteHubWebSocketUpgradeStart(firstChunk)) {
-                if (!allowLegacyPlaintextForTests) {
-                    socket.write('HTTP/1.1 426 Upgrade Required\r\nConnection: close\r\n\r\n');
-                    socket.destroy();
-                    return;
-                }
-                socket.__liveDeskLegacyPlaintext = true;
                 handleWebSocketUpgradeSocket(socket, firstChunk);
                 return;
             }
-            if (!allowLegacyPlaintextForTests) {
-                writeJsonLine(socket, { type: 'error', error: 'secure-direct-required' });
-                socket.destroy();
-                return;
-            }
-            socket.__liveDeskLegacyPlaintext = true;
+
             handleTcpAgentSocket(socket, firstChunk);
         });
 
@@ -8188,9 +7882,9 @@ export function createRemoteHub(options = {}) {
                 started = true;
                 boundPort = candidateServer.address()?.port || port;
                 lastError = '';
-                logEvent('remote', `LiveDesk Hub client endpoint listening with authenticated encryption on tcp://${host}:${boundPort}`, 'success');
+                logEvent('remote', `LiveDesk Hub client endpoint listening on tcp://${host}:${boundPort}`, 'success');
                 if (host === '0.0.0.0' || host === '::') {
-                    logWarn('remote', 'LiveDesk Hub client endpoint is externally reachable; Secure Direct device credentials are required.');
+                    logWarn('remote', 'LiveDesk Hub client endpoint is externally reachable. Use a strong pairing token and trusted network.');
                 }
                 emitRemoteEvent('RemoteHubStarted', null);
                 resolve();
@@ -8206,10 +7900,6 @@ export function createRemoteHub(options = {}) {
         try {
             await udpTransport?.start?.();
             await listenOnPort(requestedPort);
-            if (!controlIdleSweepTimer) {
-                controlIdleSweepTimer = setInterval(sweepIdleControlSessions, 1_000);
-                controlIdleSweepTimer.unref?.();
-            }
             try {
                 await relayControl?.start?.();
             } catch {
@@ -8232,10 +7922,6 @@ export function createRemoteHub(options = {}) {
     }
 
     async function close() {
-        if (controlIdleSweepTimer) {
-            clearInterval(controlIdleSweepTimer);
-            controlIdleSweepTimer = null;
-        }
         for (const state of [...agentBinaryIngressStates]) {
             closeAgentBinaryIngress(state, 'hub-shutdown');
         }
@@ -8442,60 +8128,6 @@ export function createRemoteHub(options = {}) {
         return { ok: true, commandId };
     }
 
-    async function sendCommandAwaitResult(deviceId, command, options = {}) {
-        const normalizedDeviceId = safeString(deviceId, 160);
-        const device = devices.get(normalizedDeviceId);
-        const commandId = safeString(command?.commandId, 128) || crypto.randomUUID();
-        const commandWithId = { ...(command || {}), commandId };
-
-        if (device?.synthetic === true && device.connected) {
-            const sent = sendCommand(normalizedDeviceId, commandWithId);
-            return {
-                ...sent,
-                queued: sent.ok === true,
-                acknowledged: sent.ok === true,
-                acknowledgement: sent.ok === true
-                    ? { ok: true, commandId, result: { ok: true, synthetic: true }, error: '' }
-                    : { ok: false, commandId, result: null, error: sent.error || 'command-not-sent' }
-            };
-        }
-
-        if (!device?.socket || device.socket.destroyed || !device.connected) {
-            const sent = sendCommand(normalizedDeviceId, commandWithId);
-            return {
-                ...sent,
-                queued: false,
-                acknowledged: false,
-                acknowledgement: {
-                    ok: false,
-                    commandId,
-                    result: null,
-                    error: sent.error || 'device-not-connected'
-                }
-            };
-        }
-
-        const timeoutMs = clampNumber(options.timeoutMs, 1000, 120_000, 30_000);
-        // Register before writing: a loopback Agent can return command.result in
-        // the same event-loop turn as the command write.
-        const acknowledgementPromise = waitForCommandResult(device, commandId, timeoutMs);
-        const sent = sendCommand(normalizedDeviceId, commandWithId);
-        if (!sent.ok) {
-            failPendingCommandResultWaiter(device, commandId, sent.error || 'command-not-sent');
-        }
-        const acknowledgement = await acknowledgementPromise;
-        return {
-            ...sent,
-            ok: sent.ok === true && acknowledgement.ok === true,
-            queued: sent.ok === true,
-            acknowledged: acknowledgement.ok === true,
-            acknowledgement,
-            error: acknowledgement.ok === true
-                ? undefined
-                : acknowledgement.error || sent.error || 'command-result-failed'
-        };
-    }
-
     function refreshDevicePolicies(deviceIds = undefined) {
         const requestedIds = Array.isArray(deviceIds) && deviceIds.length > 0
             ? new Set(deviceIds.map(deviceId => safeString(deviceId, 160)).filter(Boolean))
@@ -8507,31 +8139,6 @@ export function createRemoteHub(options = {}) {
             if (!device?.socket || device.socket.destroyed || !device.connected) continue;
             total += 1;
             const effectivePolicy = getDevicePolicy(device);
-            const connectionDenied = connectionPolicyError(device.socket, effectivePolicy);
-            if (connectionDenied) {
-                const deniedTransport = device.controlTransport || 'direct-tcp';
-                const deniedRemoteAddress = safeString(device.remoteAddress, 256) || 'unknown';
-                logWarn('security', 'Connected device rejected by refreshed policy reason=' + connectionDenied + ' transport=' + deniedTransport + ' remote=' + deniedRemoteAddress + ' device=' + device.deviceId);
-                emitEvent('RemoteSecurityPolicyAudit', {
-                    result: 'rejected',
-                    reason: connectionDenied,
-                    deviceId: device.deviceId,
-                    sessionId: device.sessionId,
-                    transport: device.controlTransport,
-                    remoteAddress: device.remoteAddress
-                });
-                disconnectDevice(device.deviceId, connectionDenied);
-                continue;
-            }
-            if (effectivePolicy.allowControl !== true && device.controlOwnerConnectionId) {
-                releaseInputOwner(
-                    device.deviceId,
-                    device.controlOwnerConnectionId,
-                    'control-disabled-by-policy');
-            }
-            if (effectivePolicy.allowRemoteAudio !== true && device.activeAudioStream) {
-                stopAudioStream(device.deviceId, { reason: 'remote-audio-disabled-by-policy' });
-            }
             if (writeJsonLine(device.socket, {
                 type: 'policy.update',
                 effectivePolicy,
@@ -8636,112 +8243,6 @@ export function createRemoteHub(options = {}) {
         };
     }
 
-    function controlSessionMessage(device, ownerConnectionId, type, reason = '') {
-        const policy = getDevicePolicy(device);
-        return {
-            type,
-            payload: {
-                controlOwnerSessionId: safeString(device?.controlOwnerSessionId, 160),
-                hubConnectionId: safeString(ownerConnectionId, 128),
-                deviceId: safeString(device?.deviceId, 160),
-                visibleIndicator: true,
-                lockOnEnd: type === 'control.session.stop' && policy.lockOnControlEnd === true,
-                idleControlMinutes: clampNumber(policy.idleControlMinutes, 5, 1440, 30),
-                reason: safeString(reason, 160),
-                issuedAt: new Date().toISOString()
-            }
-        };
-    }
-
-    function sendControlSessionMessage(device, ownerConnectionId, type, reason, inputWriteOwner, bindingKey) {
-        const message = controlSessionMessage(device, ownerConnectionId, type, reason);
-        if (inputWriteOwner && bindingKey) {
-            return inputWriteOwner.enqueue(message, bindingKey);
-        }
-        if (!device?.socket || device.socket.destroyed) {
-            return { ok: false, error: 'device-not-connected' };
-        }
-        const sent = writeJsonLine(device.socket, {
-            type: 'command',
-            commandId: crypto.randomUUID(),
-            command: type,
-            payload: message.payload,
-            issuedAt: new Date().toISOString()
-        });
-        return sent ? { ok: true, inputSocket: false } : { ok: false, error: 'device-not-connected' };
-    }
-
-    function beginControlSession(device, ownerConnectionId, inputWriteOwner, bindingKey) {
-        const owner = safeString(ownerConnectionId, 128);
-        if (!device || !owner) return { ok: false, error: 'control-owner-required' };
-        if (device.controlOwnerConnectionId === owner && device.controlOwnerSessionId) {
-            return { ok: true, alreadyActive: true };
-        }
-        device.controlOwnerSessionId = crypto.randomUUID();
-        device.controlOwnerConnectionId = owner;
-        device.controlOwnerStartedAtMs = Date.now();
-        device.controlOwnerLastInputAtMs = Date.now();
-        const sent = sendControlSessionMessage(
-            device,
-            owner,
-            'control.session.start',
-            'browser-control-owner-active',
-            inputWriteOwner,
-            bindingKey);
-        if (!sent.ok) {
-            device.controlOwnerSessionId = '';
-            device.controlOwnerConnectionId = '';
-            device.controlOwnerStartedAtMs = 0;
-            device.controlOwnerLastInputAtMs = 0;
-            return sent;
-        }
-        emitRemoteEvent('RemoteControlSessionStarted', device, {
-            controlOwnerSessionId: device.controlOwnerSessionId,
-            hubConnectionId: owner
-        });
-        return sent;
-    }
-
-    function endControlSession(device, ownerConnectionId, reason, inputWriteOwner, bindingKey) {
-        const owner = safeString(ownerConnectionId, 128);
-        if (!device?.controlOwnerSessionId
-            || !owner
-            || device.controlOwnerConnectionId !== owner) {
-            return { ok: false, error: 'control-owner-not-current' };
-        }
-        const controlOwnerSessionId = device.controlOwnerSessionId;
-        const sent = sendControlSessionMessage(
-            device,
-            owner,
-            'control.session.stop',
-            reason,
-            inputWriteOwner,
-            bindingKey);
-        device.controlOwnerSessionId = '';
-        device.controlOwnerConnectionId = '';
-        device.controlOwnerStartedAtMs = 0;
-        device.controlOwnerLastInputAtMs = 0;
-        emitRemoteEvent('RemoteControlSessionEnded', device, {
-            controlOwnerSessionId,
-            hubConnectionId: owner,
-            reason,
-            delivered: sent.ok === true
-        });
-        return sent;
-    }
-
-    function sweepIdleControlSessions() {
-        const nowMs = Date.now();
-        for (const device of devices.values()) {
-            if (!device?.connected || !device.controlOwnerConnectionId) continue;
-            const policy = getDevicePolicy(device);
-            if (policy.disconnectIdleControlSessions !== true) continue;
-            const idleMs = clampNumber(policy.idleControlMinutes, 5, 1440, 30) * 60 * 1000;
-            if (nowMs - Number(device.controlOwnerLastInputAtMs || 0) < idleMs) continue;
-            releaseInputOwner(device.deviceId, device.controlOwnerConnectionId, 'control-idle-timeout');
-        }
-    }
-
     function getCurrentInputWriteOwner(device) {
         if (!device?.inputSocket
             || device.inputSocket.destroyed
@@ -8889,9 +8390,6 @@ export function createRemoteHub(options = {}) {
             const bindingChanged = previousInputBindingKey
                 && previousInputBindingKey !== activeInputBindingKey;
             const writeBindingChanged = inputWriteOwner.getBindingKey() !== activeInputBindingKey;
-            const startingControlOwner = !!normalized.hubConnectionId
-                && (!device.controlOwnerConnectionId
-                    || device.controlOwnerConnectionId !== normalized.hubConnectionId);
             if (ownerChanged || bindingChanged || writeBindingChanged) {
                 const resetSent = inputWriteOwner.replaceBinding(
                     activeInputBindingKey,
@@ -8909,25 +8407,6 @@ export function createRemoteHub(options = {}) {
                     closeInputSocket(device, resetSent.error || 'input-owner-reset-write-failed');
                     return { ok: false, error: 'INPUT_CHANNEL_RECONNECTING' };
                 }
-                if (startingControlOwner) {
-                    if (device.controlOwnerConnectionId) {
-                        endControlSession(
-                            device,
-                            device.controlOwnerConnectionId,
-                            'browser-input-owner-changed',
-                            inputWriteOwner,
-                            activeInputBindingKey);
-                    }
-                    const started = beginControlSession(
-                        device,
-                        normalized.hubConnectionId,
-                        inputWriteOwner,
-                        activeInputBindingKey);
-                    if (!started.ok) {
-                        closeInputSocket(device, started.error || 'control-session-indicator-start-failed');
-                        return { ok: false, error: 'INPUT_CHANNEL_RECONNECTING' };
-                    }
-                }
             }
             const sent = inputWriteOwner.enqueue({
                 type: 'input.control',
@@ -8942,7 +8421,6 @@ export function createRemoteHub(options = {}) {
                     device.inputOwnerConnectionId = normalized.hubConnectionId;
                 }
                 device.inputOwnerBindingKey = activeInputBindingKey;
-                device.controlOwnerLastInputAtMs = Date.now();
                 device.counters.commandsSent += 1;
                 device.inputLastSeenAt = new Date().toISOString();
                 return {
@@ -8972,25 +8450,6 @@ export function createRemoteHub(options = {}) {
         }
 
         const hubForwardedAtEpochMs = Date.now();
-        const startingFallbackOwner = !!normalized.hubConnectionId
-            && (!device.controlOwnerConnectionId
-                || device.controlOwnerConnectionId !== normalized.hubConnectionId);
-        if (startingFallbackOwner) {
-            if (device.controlOwnerConnectionId) {
-                endControlSession(
-                    device,
-                    device.controlOwnerConnectionId,
-                    'browser-input-owner-changed',
-                    null,
-                    '');
-            }
-            const started = beginControlSession(
-                device,
-                normalized.hubConnectionId,
-                null,
-                '');
-            if (!started.ok) return started;
-        }
         const fallback = sendCommand(deviceId, {
             command: 'input.control',
             payload: {
@@ -9014,22 +8473,6 @@ export function createRemoteHub(options = {}) {
                 timeoutTimer: null
             });
         }
-        if (fallback.ok) {
-            device.inputOwnerConnectionId = normalized.hubConnectionId;
-            device.inputOwnerBindingKey = buildRemoteInputBindingKey(
-                device,
-                controlStream,
-                normalized,
-                activeMonitorIndex);
-            device.controlOwnerLastInputAtMs = Date.now();
-        } else if (startingFallbackOwner) {
-            endControlSession(
-                device,
-                normalized.hubConnectionId,
-                'input-control-delivery-failed',
-                null,
-                '');
-        }
         return fallback.ok
             ? {
                 ...fallback,
@@ -9056,17 +8499,12 @@ export function createRemoteHub(options = {}) {
             return { ok: false, error: 'input-owner-not-current' };
         }
 
+        device.inputOwnerConnectionId = '';
+        device.inputOwnerBindingKey = '';
         const inputSocket = device.inputSocket;
         const inputWriteOwner = getCurrentInputWriteOwner(device);
         if (!inputSocket || !inputWriteOwner) {
-            const ended = endControlSession(device, owner, reason, null, '');
-            device.inputOwnerConnectionId = '';
-            device.inputOwnerBindingKey = '';
-            return {
-                ok: ended.ok !== false,
-                queued: false,
-                controlSessionEnded: ended.ok === true
-            };
+            return { ok: true, queued: false };
         }
         const controlStream = getActiveControlStream(device);
         const releaseBindingKey = buildRemoteInputReleaseBindingKey(device, owner);
@@ -9082,19 +8520,10 @@ export function createRemoteHub(options = {}) {
             closeInputSocket(device, sent.error || 'input-owner-release-write-failed');
             return { ok: false, error: 'INPUT_CHANNEL_RECONNECTING' };
         }
-        const ended = endControlSession(
-            device,
-            owner,
-            reason,
-            inputWriteOwner,
-            releaseBindingKey);
-        device.inputOwnerConnectionId = '';
-        device.inputOwnerBindingKey = '';
         return {
-            ok: ended.ok !== false,
+            ok: true,
             queued: true,
-            backpressured: sent.backpressured === true || ended.backpressured === true,
-            controlSessionEnded: ended.ok === true
+            backpressured: sent.backpressured === true
         };
     }
 
@@ -9137,9 +8566,6 @@ export function createRemoteHub(options = {}) {
         }
         const device = devices.get(String(deviceId || ''));
         const requestedOperation = safeString(options.operation, 80);
-        if (RETIRED_AGENT_MUTATING_OPERATIONS.has(requestedOperation.toLowerCase())) {
-            return { ok: false, error: 'agent-mutating-tool-disabled' };
-        }
         const operation = normalizeAgentOperation(requestedOperation);
         if (requestedOperation && !operation) {
             return { ok: false, error: 'unsupported-agent-operation' };
@@ -11388,7 +10814,6 @@ export function createRemoteHub(options = {}) {
         disconnectDevice,
         assignDeviceSlot,
         sendCommand,
-        sendCommandAwaitResult,
         refreshDevicePolicies,
         sendLegacyClientUpdate,
         sendInputControl,
@@ -11417,16 +10842,7 @@ export function createRemoteHub(options = {}) {
         seedSyntheticFleet,
         clearSyntheticFleet,
         getPairToken: () => pairToken,
-        getPairingPin: () => pairingPin,
-        getSecurityStatus: () => ({
-            hubId: deviceCredentialAuthority.hubId,
-            hubPublicKey: deviceCredentialAuthority.hubPublicKey,
-            hubIssuerKeyId: deviceCredentialAuthority.hubIssuerKeyId,
-            direct: secureDirectAcceptor.getStatus(),
-            devices: deviceCredentialAuthority.listDevices()
-        }),
-        revokeDeviceCredential: (deviceId, reason) => deviceCredentialAuthority.revokeDevice(deviceId, reason),
-        clearDeviceCredentials: () => deviceCredentialAuthority.clearDevices()
+        getPairingPin: () => pairingPin
     };
 }