@livedesk/hub 0.1.36 → 0.1.37

package/src/live-desk-update.js

@@ -1,317 +1,273 @@
-import { randomUUID } from 'node:crypto';
-import { fetchSignedUpdateManifest } from '@livedesk/runtime-core/signed-update-manifest';
-
-export const LIVE_DESK_UPDATE_COMMAND = 'livedesk.client-update';
-// 0.1.172 delegates to the exact-version, identity-preserving package
-// supervisor. 0.1.171 still lacks bounded handoff cancellation, so it must
-// use the Hub-owned compatibility bridge too.
-// Older dedicated handlers can spawn the new package but cannot prove that the
-// same device returned, so the Hub-owned compatibility bridge upgrades them.
-export const LIVE_DESK_DEDICATED_CLIENT_UPDATE_MIN_VERSION = '0.1.172';
-export const LIVE_DESK_UPDATE_CLIENT_BATCH_SIZE = 5;
-export const LIVE_DESK_UPDATE_TARGET_TIMEOUT_MS = 480_000;
-export const LIVE_DESK_UPDATE_TIMEOUT_MS = 90 * 60_000;
-export const LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS = 60_000;
-export const LIVE_DESK_UPDATE_CHECK_INTERVAL_MS = 60_000;
-export const LIVE_DESK_LEGACY_COMMAND_MAX_LENGTH = 3900;
-
-function cleanVersion(value) {
-  return String(value || '').trim().replace(/^v/i, '');
-}
-
-function parseVersion(value) {
-  const cleaned = cleanVersion(value);
-  const match = cleaned.match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/);
-  if (!match) return null;
-  return {
-    core: [Number(match[1]), Number(match[2]), Number(match[3])],
-    prerelease: match[4] ? match[4].split('.') : []
-  };
-}
-
-function comparePrerelease(left, right) {
-  if (left.length === 0 && right.length === 0) return 0;
-  if (left.length === 0) return 1;
-  if (right.length === 0) return -1;
-  const length = Math.max(left.length, right.length);
-  for (let index = 0; index < length; index += 1) {
-    if (left[index] === undefined) return -1;
-    if (right[index] === undefined) return 1;
-    const leftNumeric = /^\d+$/.test(left[index]);
-    const rightNumeric = /^\d+$/.test(right[index]);
-    if (leftNumeric && rightNumeric) {
-      const difference = Number(left[index]) - Number(right[index]);
-      if (difference !== 0) return difference;
-      continue;
-    }
-    if (leftNumeric !== rightNumeric) return leftNumeric ? -1 : 1;
-    const difference = left[index].localeCompare(right[index], 'en');
-    if (difference !== 0) return difference;
-  }
-  return 0;
-}
-
-export function compareVersions(left, right) {
-  const a = parseVersion(left);
-  const b = parseVersion(right);
-  if (!a || !b) return cleanVersion(left).localeCompare(cleanVersion(right), 'en');
-  for (let index = 0; index < 3; index += 1) {
-    const difference = a.core[index] - b.core[index];
-    if (difference !== 0) return difference;
-  }
-  return comparePrerelease(a.prerelease, b.prerelease);
+import { randomUUID } from 'node:crypto';
+
+export const LIVE_DESK_UPDATE_COMMAND = 'livedesk.client-update';
+// 0.1.172 delegates to the exact-version, identity-preserving package
+// supervisor. 0.1.171 still lacks bounded handoff cancellation, so it must
+// use the Hub-owned compatibility bridge too.
+// Older dedicated handlers can spawn the new package but cannot prove that the
+// same device returned, so the Hub-owned compatibility bridge upgrades them.
+export const LIVE_DESK_DEDICATED_CLIENT_UPDATE_MIN_VERSION = '0.1.172';
+export const LIVE_DESK_UPDATE_CLIENT_BATCH_SIZE = 5;
+export const LIVE_DESK_UPDATE_TARGET_TIMEOUT_MS = 480_000;
+export const LIVE_DESK_UPDATE_TIMEOUT_MS = 90 * 60_000;
+export const LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS = 60_000;
+export const LIVE_DESK_UPDATE_CHECK_INTERVAL_MS = 60_000;
+export const LIVE_DESK_LEGACY_COMMAND_MAX_LENGTH = 3900;
+
+function cleanVersion(value) {
+  return String(value || '').trim().replace(/^v/i, '');
+}
+
+function parseVersion(value) {
+  const cleaned = cleanVersion(value);
+  const match = cleaned.match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/);
+  if (!match) return null;
+  return {
+    core: [Number(match[1]), Number(match[2]), Number(match[3])],
+    prerelease: match[4] ? match[4].split('.') : []
+  };
+}
+
+function comparePrerelease(left, right) {
+  if (left.length === 0 && right.length === 0) return 0;
+  if (left.length === 0) return 1;
+  if (right.length === 0) return -1;
+  const length = Math.max(left.length, right.length);
+  for (let index = 0; index < length; index += 1) {
+    if (left[index] === undefined) return -1;
+    if (right[index] === undefined) return 1;
+    const leftNumeric = /^\d+$/.test(left[index]);
+    const rightNumeric = /^\d+$/.test(right[index]);
+    if (leftNumeric && rightNumeric) {
+      const difference = Number(left[index]) - Number(right[index]);
+      if (difference !== 0) return difference;
+      continue;
+    }
+    if (leftNumeric !== rightNumeric) return leftNumeric ? -1 : 1;
+    const difference = left[index].localeCompare(right[index], 'en');
+    if (difference !== 0) return difference;
+  }
+  return 0;
+}
+
+export function compareVersions(left, right) {
+  const a = parseVersion(left);
+  const b = parseVersion(right);
+  if (!a || !b) return cleanVersion(left).localeCompare(cleanVersion(right), 'en');
+  for (let index = 0; index < 3; index += 1) {
+    const difference = a.core[index] - b.core[index];
+    if (difference !== 0) return difference;
+  }
+  return comparePrerelease(a.prerelease, b.prerelease);
 }
 
 export function isVersionAtLeast(candidate, required) {
   return !!cleanVersion(candidate) && !!cleanVersion(required) && compareVersions(candidate, required) >= 0;
 }
 
-function encodePowerShell(value) {
-  return Buffer.from(String(value || ''), 'utf16le').toString('base64');
-}
-
-function buildLegacyPackageSupervisorStarterSource() {
-  const source = [
-    "const{spawn}=require('node:child_process'),f=require('node:fs'),p=require('node:path'),c=JSON.parse(Buffer.from(process.env.C,'base64')),e={...process.env,LIVEDESK_UPDATE_STARTER_PID:String(process.pid),LIVEDESK_UPDATE_ORIGINAL_CWD:process.cwd()},w=p.join(require('node:os').tmpdir(),'livedesk-update-cwd','client-'+c[0]),u=e.LIVEDESK_NPX_EXECUTABLE,s=process.platform,j=process.execPath,n=u||(s==='win32'?'npx.cmd':'npx'),x=[e.LIVEDESK_NPX_CLI_PATH,e.npm_execpath&&p.join(p.dirname(e.npm_execpath),'npx-cli.js'),u&&p.join(p.dirname(u),'node_modules/npm/bin/npx-cli.js'),p.join(p.dirname(j),'node_modules/npm/bin/npx-cli.js')].find(v=>v&&f.existsSync(v)),a=['-y','--prefer-online','--prefix',w,'--workspaces=false','livedesk@'+c[6],'--internal-legacy-client-update'],z=String.fromCharCode(32),q=v=>'\"'+String(v).replaceAll('\"','\"\"')+'\"';if(!(+c[7]>0))process.exit(1);c[7]=String(Date.now()+Number(c[7]));e.C=Buffer.from(JSON.stringify(c)).toString('base64');f.mkdirSync(w,{recursive:true});if(f.readdirSync(w)[0])process.exit(1);Object.keys(e).forEach(k=>/^(INIT_CWD|npm_config_(local_prefix|workspaces?|include_workspace_root))$/i.test(k)&&Reflect.deleteProperty(e,k));Object.assign(e,{INIT_CWD:w,npm_config_local_prefix:w,npm_config_workspaces:'false',npm_config_include_workspace_root:'false',LIVEDESK_UPDATE_NEUTRAL_CWD:w});e.i=x?{c:j,a:[x,...a]}:s==='win32'?{c:e.ComSpec||'cmd.exe',a:['/d','/s','/c','call'+z+q(n)+z+a.map(q).join(z)]}:{c:n,a};e.r=spawn(e.i.c,e.i.a,{cwd:w,env:e,detached:true,stdio:'ignore',windowsHide:true});",
-    "e.r.on('error',()=>process.exit(1));e.r.unref();"
-  ].join('');
-  if (source.includes(' ')) throw new Error('LiveDesk legacy starter source must not contain spaces.');
-  return source;
-}
-
-function assertLegacyCommandLength(command, platform) {
-  if (command.length > LIVE_DESK_LEGACY_COMMAND_MAX_LENGTH) {
-    throw new Error(
-      `LiveDesk legacy ${platform} update command is ${command.length} characters; `
-      + `the compatibility limit is ${LIVE_DESK_LEGACY_COMMAND_MAX_LENGTH}.`
-    );
-  }
-  return command;
-}
-
-function buildLegacyPlatformCommand(platform, payload) {
-  const environment = [
-    String(payload.operationId || ''),
-    String(payload.deviceId || ''),
-    String(Number(payload.agentPid) || 0),
-    cleanVersion(payload.currentProductVersion),
-    cleanVersion(payload.currentAgentVersion),
-    cleanVersion(payload.targetVersion),
-    cleanVersion(payload.targetProductVersion),
-    String(Math.floor(Number(payload.updateTimeoutMs) || 0))
-  ];
-  const configBase64 = Buffer.from(JSON.stringify(environment), 'utf8').toString('base64');
-  const starter = buildLegacyPackageSupervisorStarterSource();
-  const starterBase64 = Buffer.from(starter, 'utf8').toString('base64');
-  const windows = ['win32', 'windows'].includes(String(platform || '').toLowerCase());
-  const powerShellStarter = [
-    "$ErrorActionPreference='Stop'",
-    '$n=[string]$env:LIVEDESK_NODE_EXECUTABLE',
-    'if(-not $n){$n=(Get-Command node.exe -ErrorAction SilentlyContinue).Source}',
-    "if(-not $n){throw 'LiveDesk node executable was not found.'}",
-    "$j=\"eval(Buffer.from(process.env.S,'base64').toString('utf8'))\"",
-    "$p=Start-Process -FilePath $n -ArgumentList @('-e',$j) -WindowStyle Hidden -PassThru",
-    "if(-not $p){throw 'LiveDesk update starter failed.'}"
-  ].join(';');
-  const command = windows
-    ? `set C=${configBase64}&set S=${starterBase64}&powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encodePowerShell(powerShellStarter)}`
-    : `C='${configBase64}' S='${starterBase64}' "${'${LIVEDESK_NODE_EXECUTABLE:-node}'}" -e 'eval(Buffer.from(process.env.S,"base64").toString("utf8"))'`;
-  return assertLegacyCommandLength(command, windows ? 'Windows' : 'Unix');
-}
-
-function buildLegacyUpdateCommand(
-  device,
-  operationId,
-  targetVersion,
-  targetProductVersion,
-  updateTimeoutMs
-) {
-  const payload = {
-    operationId,
-    deviceId: device.deviceId || '',
-    agentPid: device.pid || 0,
-    currentProductVersion: device.productVersion || '',
-    currentAgentVersion: device.agentVersion || '',
-    targetVersion,
-    targetProductVersion,
-    updateTimeoutMs
-  };
-  return buildLegacyPlatformCommand(device.platform, payload);
-}
-
-async function fetchPackageMetadata(packageName, version, fetchImpl) {
-  const encodedName = packageName.startsWith('@') ? packageName.replace('/', '%2F') : packageName;
-  const encodedVersion = encodeURIComponent(String(version || 'latest'));
-  const response = await fetchImpl(`https://registry.npmjs.org/${encodedName}/${encodedVersion}`, {
+function encodePowerShell(value) {
+  return Buffer.from(String(value || ''), 'utf16le').toString('base64');
+}
+
+function buildLegacyPackageSupervisorStarterSource() {
+  const source = [
+    "const{spawn}=require('node:child_process'),f=require('node:fs'),p=require('node:path'),c=JSON.parse(Buffer.from(process.env.C,'base64')),e={...process.env,LIVEDESK_UPDATE_STARTER_PID:String(process.pid),LIVEDESK_UPDATE_ORIGINAL_CWD:process.cwd()},w=p.join(require('node:os').tmpdir(),'livedesk-update-cwd','client-'+c[0]),u=e.LIVEDESK_NPX_EXECUTABLE,s=process.platform,j=process.execPath,n=u||(s==='win32'?'npx.cmd':'npx'),x=[e.LIVEDESK_NPX_CLI_PATH,e.npm_execpath&&p.join(p.dirname(e.npm_execpath),'npx-cli.js'),u&&p.join(p.dirname(u),'node_modules/npm/bin/npx-cli.js'),p.join(p.dirname(j),'node_modules/npm/bin/npx-cli.js')].find(v=>v&&f.existsSync(v)),a=['-y','--prefer-online','--prefix',w,'--workspaces=false','livedesk@'+c[6],'--internal-legacy-client-update'],z=String.fromCharCode(32),q=v=>'\"'+String(v).replaceAll('\"','\"\"')+'\"';if(!(+c[7]>0))process.exit(1);c[7]=String(Date.now()+Number(c[7]));e.C=Buffer.from(JSON.stringify(c)).toString('base64');f.mkdirSync(w,{recursive:true});if(f.readdirSync(w)[0])process.exit(1);Object.keys(e).forEach(k=>/^(INIT_CWD|npm_config_(local_prefix|workspaces?|include_workspace_root))$/i.test(k)&&Reflect.deleteProperty(e,k));Object.assign(e,{INIT_CWD:w,npm_config_local_prefix:w,npm_config_workspaces:'false',npm_config_include_workspace_root:'false',LIVEDESK_UPDATE_NEUTRAL_CWD:w});e.i=x?{c:j,a:[x,...a]}:s==='win32'?{c:e.ComSpec||'cmd.exe',a:['/d','/s','/c','call'+z+q(n)+z+a.map(q).join(z)]}:{c:n,a};e.r=spawn(e.i.c,e.i.a,{cwd:w,env:e,detached:true,stdio:'ignore',windowsHide:true});",
+    "e.r.on('error',()=>process.exit(1));e.r.unref();"
+  ].join('');
+  if (source.includes(' ')) throw new Error('LiveDesk legacy starter source must not contain spaces.');
+  return source;
+}
+
+function assertLegacyCommandLength(command, platform) {
+  if (command.length > LIVE_DESK_LEGACY_COMMAND_MAX_LENGTH) {
+    throw new Error(
+      `LiveDesk legacy ${platform} update command is ${command.length} characters; `
+      + `the compatibility limit is ${LIVE_DESK_LEGACY_COMMAND_MAX_LENGTH}.`
+    );
+  }
+  return command;
+}
+
+function buildLegacyPlatformCommand(platform, payload) {
+  const environment = [
+    String(payload.operationId || ''),
+    String(payload.deviceId || ''),
+    String(Number(payload.agentPid) || 0),
+    cleanVersion(payload.currentProductVersion),
+    cleanVersion(payload.currentAgentVersion),
+    cleanVersion(payload.targetVersion),
+    cleanVersion(payload.targetProductVersion),
+    String(Math.floor(Number(payload.updateTimeoutMs) || 0))
+  ];
+  const configBase64 = Buffer.from(JSON.stringify(environment), 'utf8').toString('base64');
+  const starter = buildLegacyPackageSupervisorStarterSource();
+  const starterBase64 = Buffer.from(starter, 'utf8').toString('base64');
+  const windows = ['win32', 'windows'].includes(String(platform || '').toLowerCase());
+  const powerShellStarter = [
+    "$ErrorActionPreference='Stop'",
+    '$n=[string]$env:LIVEDESK_NODE_EXECUTABLE',
+    'if(-not $n){$n=(Get-Command node.exe -ErrorAction SilentlyContinue).Source}',
+    "if(-not $n){throw 'LiveDesk node executable was not found.'}",
+    "$j=\"eval(Buffer.from(process.env.S,'base64').toString('utf8'))\"",
+    "$p=Start-Process -FilePath $n -ArgumentList @('-e',$j) -WindowStyle Hidden -PassThru",
+    "if(-not $p){throw 'LiveDesk update starter failed.'}"
+  ].join(';');
+  const command = windows
+    ? `set C=${configBase64}&set S=${starterBase64}&powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ${encodePowerShell(powerShellStarter)}`
+    : `C='${configBase64}' S='${starterBase64}' "${'${LIVEDESK_NODE_EXECUTABLE:-node}'}" -e 'eval(Buffer.from(process.env.S,"base64").toString("utf8"))'`;
+  return assertLegacyCommandLength(command, windows ? 'Windows' : 'Unix');
+}
+
+function buildLegacyUpdateCommand(
+  device,
+  operationId,
+  targetVersion,
+  targetProductVersion,
+  updateTimeoutMs
+) {
+  const payload = {
+    operationId,
+    deviceId: device.deviceId || '',
+    agentPid: device.pid || 0,
+    currentProductVersion: device.productVersion || '',
+    currentAgentVersion: device.agentVersion || '',
+    targetVersion,
+    targetProductVersion,
+    updateTimeoutMs
+  };
+  return buildLegacyPlatformCommand(device.platform, payload);
+}
+
+async function fetchLatestPackage(packageName, fetchImpl) {
+  const encodedName = packageName.startsWith('@') ? packageName.replace('/', '%2F') : packageName;
+  const response = await fetchImpl(`https://registry.npmjs.org/${encodedName}/latest`, {
     headers: { Accept: 'application/json' },
     signal: AbortSignal.timeout(12_000)
   });
   if (!response.ok) {
-    throw new Error(`npm registry returned HTTP ${response.status} for ${packageName}@${version}.`);
+    throw new Error(`npm registry returned HTTP ${response.status} for ${packageName}.`);
   }
   const payload = await response.json();
-  const resolvedVersion = cleanVersion(payload?.version);
-  if (!resolvedVersion) throw new Error(`npm registry returned no version for ${packageName}@${version}.`);
-  return { version: resolvedVersion, package: payload };
-}
-
-async function fetchUnsignedRegistryReleaseForTests(fetchImpl) {
-  const [manager, client] = await Promise.all([
-    fetchPackageMetadata('livedesk', 'latest', fetchImpl),
-    fetchPackageMetadata('@livedesk/client', 'latest', fetchImpl)
-  ]);
-  const bundledClientVersion = cleanVersion(manager.package?.livedeskClientVersion);
-  if (!bundledClientVersion) {
-    throw new Error(`livedesk@${manager.version} is missing required livedeskClientVersion release metadata.`);
-  }
-  return {
-    latestManagerVersion: manager.version,
-    latestClientVersion: bundledClientVersion,
-    registryClientVersion: client.version,
-    releaseSkew: compareVersions(client.version, bundledClientVersion) === 0
-      ? ''
-      : `livedesk@${manager.version} bundles Client ${bundledClientVersion}, while @livedesk/client latest is ${client.version}.`,
-    managerPackage: manager.package,
-    clientPackage: client.package,
-    checkedAt: new Date().toISOString(),
-    manifestVerified: false,
-    blockedVersions: { manager: [], client: [], desktop: [] }
-  };
-}
-
-export async function fetchLatestLiveDeskRelease(fetchImpl = globalThis.fetch, {
-  manifestUrl = '',
-  publicKey = '',
-  now = () => Date.now(),
-  allowUnsignedRegistryForTests = false
-} = {}) {
-  if (typeof fetchImpl !== 'function') throw new Error('fetch is unavailable for LiveDesk update checks.');
-  if (allowUnsignedRegistryForTests === true) return fetchUnsignedRegistryReleaseForTests(fetchImpl);
-  const manifest = await fetchSignedUpdateManifest({ fetchImpl, url: manifestUrl, publicKey, now });
-  const managerRelease = manifest.release.manager;
-  const clientRelease = manifest.release.client;
-  const [manager, client] = await Promise.all([
-    fetchPackageMetadata('livedesk', managerRelease.version, fetchImpl),
-    fetchPackageMetadata('@livedesk/client', clientRelease.version, fetchImpl)
-  ]);
-  const bundledClientVersion = cleanVersion(manager.package?.livedeskClientVersion);
-  if (manager.version !== managerRelease.version
-    || client.version !== clientRelease.version
-    || manager.package?.dist?.integrity !== managerRelease.integrity
-    || client.package?.dist?.integrity !== clientRelease.integrity
-    || bundledClientVersion !== clientRelease.version) {
-    throw new Error('signed-update-registry-binding-invalid');
-  }
-  return {
-    latestManagerVersion: managerRelease.version,
-    latestClientVersion: clientRelease.version,
-    registryClientVersion: client.version,
-    releaseSkew: '',
-    managerPackage: manager.package,
-    clientPackage: client.package,
-    checkedAt: new Date(now()).toISOString(),
-    manifestVerified: true,
-    manifestGeneratedAt: manifest.generatedAt,
-    manifestExpiresAt: manifest.expiresAt,
-    blockedVersions: manifest.blockedVersions
-  };
-}
-
-function statusForRun(run) {
-  if (!run) return null;
-  const completedCount = run.targets.filter(target => target.state === 'completed').length;
-  const failedCount = run.targets.filter(target => target.state === 'failed').length;
-  const queuedCount = run.targets.filter(target => target.state === 'queued').length;
-  const pendingOfflineCount = run.targets.filter(target => target.state === 'pending-offline').length;
-  const activeCount = run.targets.filter(target => target.state === 'waiting').length;
-  return {
-    operationId: run.operationId,
-    state: run.state,
-    startedAt: run.startedAt,
-    updatedAt: run.updatedAt,
-    targetCount: run.targets.length,
-    completedCount,
-    waitingCount: run.targets.length - completedCount - failedCount,
-    activeCount,
-    queuedCount,
-    pendingOfflineCount,
-    failedCount,
-    batchSize: run.batchSize,
-    clientRestartStabilityMs: run.clientRestartStabilityMs,
-    latestManagerVersion: run.latestManagerVersion,
-    latestClientVersion: run.latestClientVersion,
-    error: run.error || '',
-    targets: run.targets.map(target => ({ ...target }))
-  };
-}
-
-function connectedDevices(remoteHub) {
+  const version = cleanVersion(payload?.version);
+  if (!version) throw new Error(`npm registry returned no version for ${packageName}.`);
+  return { version, package: payload };
+}
+
+export async function fetchLatestLiveDeskRelease(fetchImpl = globalThis.fetch) {
+  if (typeof fetchImpl !== 'function') throw new Error('fetch is unavailable for LiveDesk update checks.');
+  const [manager, client] = await Promise.all([
+    fetchLatestPackage('livedesk', fetchImpl),
+    fetchLatestPackage('@livedesk/client', fetchImpl)
+  ]);
+  const bundledClientVersion = cleanVersion(manager.package?.livedeskClientVersion);
+  if (!bundledClientVersion) {
+    throw new Error(`livedesk@${manager.version} is missing required livedeskClientVersion release metadata.`);
+  }
+  return {
+    latestManagerVersion: manager.version,
+    latestClientVersion: bundledClientVersion,
+    registryClientVersion: client.version,
+    releaseSkew: compareVersions(client.version, bundledClientVersion) === 0
+      ? ''
+      : `livedesk@${manager.version} bundles Client ${bundledClientVersion}, while @livedesk/client latest is ${client.version}.`,
+    managerPackage: manager.package,
+    clientPackage: client.package,
+    checkedAt: new Date().toISOString()
+  };
+}
+
+function statusForRun(run) {
+  if (!run) return null;
+  const completedCount = run.targets.filter(target => target.state === 'completed').length;
+  const failedCount = run.targets.filter(target => target.state === 'failed').length;
+  const queuedCount = run.targets.filter(target => target.state === 'queued').length;
+  const pendingOfflineCount = run.targets.filter(target => target.state === 'pending-offline').length;
+  const activeCount = run.targets.filter(target => target.state === 'waiting').length;
+  return {
+    operationId: run.operationId,
+    state: run.state,
+    startedAt: run.startedAt,
+    updatedAt: run.updatedAt,
+    targetCount: run.targets.length,
+    completedCount,
+    waitingCount: run.targets.length - completedCount - failedCount,
+    activeCount,
+    queuedCount,
+    pendingOfflineCount,
+    failedCount,
+    batchSize: run.batchSize,
+    clientRestartStabilityMs: run.clientRestartStabilityMs,
+    latestManagerVersion: run.latestManagerVersion,
+    latestClientVersion: run.latestClientVersion,
+    error: run.error || '',
+    targets: run.targets.map(target => ({ ...target }))
+  };
+}
+
+function connectedDevices(remoteHub) {
   return remoteHub.listDevices({ includeDataUrl: false })
     .filter(device => device.connected === true && device.synthetic !== true)
     .slice(0, 500);
-}
-
-function knownOfflineDevices(remoteHub) {
-  return remoteHub.listDevices({ includeDataUrl: false })
-    .filter(device => device.connected !== true && device.synthetic !== true)
-    .slice(0, 500);
-}
-
-function deviceNeedsUpdate(device, latestManagerVersion, latestClientVersion) {
-  return !isVersionAtLeast(device?.productVersion, latestManagerVersion)
-    || !isVersionAtLeast(device?.agentVersion, latestClientVersion);
-}
-
-function resetReconnectCandidate(target) {
-  target.candidateSessionId = '';
-  target.candidatePid = 0;
-  target.candidateConnectedAt = '';
-  target.candidateProductVersion = '';
-  target.candidateAgentVersion = '';
-  target.candidateSince = '';
-  target.stabilityDeadlineAt = '';
-}
-
-export function createLiveDeskUpdateManager({
+}
+
+function knownOfflineDevices(remoteHub) {
+  return remoteHub.listDevices({ includeDataUrl: false })
+    .filter(device => device.connected !== true && device.synthetic !== true)
+    .slice(0, 500);
+}
+
+function deviceNeedsUpdate(device, latestManagerVersion, latestClientVersion) {
+  return !isVersionAtLeast(device?.productVersion, latestManagerVersion)
+    || !isVersionAtLeast(device?.agentVersion, latestClientVersion);
+}
+
+function resetReconnectCandidate(target) {
+  target.candidateSessionId = '';
+  target.candidatePid = 0;
+  target.candidateConnectedAt = '';
+  target.candidateProductVersion = '';
+  target.candidateAgentVersion = '';
+  target.candidateSince = '';
+  target.stabilityDeadlineAt = '';
+}
+
+export function createLiveDeskUpdateManager({
   remoteHub,
   currentManagerVersion,
-  currentClientVersion,
-  restartSupported = false,
-  requestHubRestart,
-  fetchImpl = globalThis.fetch,
-  now = () => Date.now(),
-  updateManifestUrl = '',
-  updatePublicKey = '',
-  allowUnsignedRegistryForTests = false,
-  clientBatchSize = LIVE_DESK_UPDATE_CLIENT_BATCH_SIZE,
-  targetTimeoutMs = LIVE_DESK_UPDATE_TARGET_TIMEOUT_MS,
-  operationTimeoutMs = LIVE_DESK_UPDATE_TIMEOUT_MS,
-  clientRestartStabilityMs = LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS
-}) {
+  currentClientVersion,
+  restartSupported = false,
+  requestHubRestart,
+  fetchImpl = globalThis.fetch,
+  now = () => Date.now(),
+  clientBatchSize = LIVE_DESK_UPDATE_CLIENT_BATCH_SIZE,
+  targetTimeoutMs = LIVE_DESK_UPDATE_TARGET_TIMEOUT_MS,
+  operationTimeoutMs = LIVE_DESK_UPDATE_TIMEOUT_MS,
+  clientRestartStabilityMs = LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS
+}) {
   let latestRelease = null;
   let checkError = '';
   let checkPromise = null;
-  let run = null;
-  let checkTimer = null;
-  let runTimer = null;
-  const effectiveClientBatchSize = Math.max(
-    1,
-    Math.min(50, Math.floor(Number(clientBatchSize) || LIVE_DESK_UPDATE_CLIENT_BATCH_SIZE))
-  );
-  const effectiveTargetTimeoutMs = Math.max(
-    10_000,
-    Number(targetTimeoutMs) || LIVE_DESK_UPDATE_TARGET_TIMEOUT_MS
-  );
-  const effectiveOperationTimeoutMs = Math.max(
-    effectiveTargetTimeoutMs,
-    Number(operationTimeoutMs) || LIVE_DESK_UPDATE_TIMEOUT_MS
-  );
-  const effectiveClientRestartStabilityMs = Math.max(
-    0,
-    Number.isFinite(Number(clientRestartStabilityMs))
-      ? Number(clientRestartStabilityMs)
-      : LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS
-  );
+  let run = null;
+  let checkTimer = null;
+  let runTimer = null;
+  const effectiveClientBatchSize = Math.max(
+    1,
+    Math.min(50, Math.floor(Number(clientBatchSize) || LIVE_DESK_UPDATE_CLIENT_BATCH_SIZE))
+  );
+  const effectiveTargetTimeoutMs = Math.max(
+    10_000,
+    Number(targetTimeoutMs) || LIVE_DESK_UPDATE_TARGET_TIMEOUT_MS
+  );
+  const effectiveOperationTimeoutMs = Math.max(
+    effectiveTargetTimeoutMs,
+    Number(operationTimeoutMs) || LIVE_DESK_UPDATE_TIMEOUT_MS
+  );
+  const effectiveClientRestartStabilityMs = Math.max(
+    0,
+    Number.isFinite(Number(clientRestartStabilityMs))
+      ? Number(clientRestartStabilityMs)
+      : LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS
+  );
 
   const touch = () => {
     if (run) run.updatedAt = new Date(now()).toISOString();
@@ -319,30 +275,9 @@ export function createLiveDeskUpdateManager({
 
   const checkLatest = async () => {
     if (checkPromise) return checkPromise;
-    checkPromise = fetchLatestLiveDeskRelease(fetchImpl, {
-      manifestUrl: updateManifestUrl,
-      publicKey: updatePublicKey,
-      now,
-      allowUnsignedRegistryForTests
-    })
-      .then(release => {
-        if (cleanVersion(currentManagerVersion)
-          && compareVersions(release.latestManagerVersion, currentManagerVersion) < 0) {
-          throw new Error('signed-update-manager-downgrade-rejected');
-        }
-        if (cleanVersion(currentClientVersion)
-          && compareVersions(release.latestClientVersion, currentClientVersion) < 0) {
-          throw new Error('signed-update-client-downgrade-rejected');
-        }
-        if (release.blockedVersions?.manager?.includes(cleanVersion(currentManagerVersion))
-          && compareVersions(release.latestManagerVersion, currentManagerVersion) <= 0) {
-          throw new Error('signed-update-blocked-manager-without-safe-upgrade');
-        }
-        if (release.blockedVersions?.client?.includes(cleanVersion(currentClientVersion))
-          && compareVersions(release.latestClientVersion, currentClientVersion) <= 0) {
-          throw new Error('signed-update-blocked-client-without-safe-upgrade');
-        }
-        latestRelease = release;
+    checkPromise = fetchLatestLiveDeskRelease(fetchImpl)
+      .then(release => {
+        latestRelease = release;
         checkError = '';
         return release;
       })
@@ -357,127 +292,124 @@ export function createLiveDeskUpdateManager({
   };
 
   const getStatus = () => {
-    const managerUpdateAvailable = !!latestRelease
-      && compareVersions(latestRelease.latestManagerVersion, currentManagerVersion) > 0;
-    const clientDevices = connectedDevices(remoteHub);
-    const outdatedClientDevices = latestRelease
-      ? clientDevices.filter(device => deviceNeedsUpdate(
-        device,
-        latestRelease.latestManagerVersion,
-        latestRelease.latestClientVersion
-      ))
-      : [];
-    const pendingOfflineClientCount = latestRelease
-      ? knownOfflineDevices(remoteHub).filter(device => deviceNeedsUpdate(
-        device,
-        latestRelease.latestManagerVersion,
-        latestRelease.latestClientVersion
-      )).length
-      : 0;
-    const clientPackageUpdateAvailable = !!latestRelease
-      && compareVersions(latestRelease.latestClientVersion, currentClientVersion) > 0;
+    const managerUpdateAvailable = !!latestRelease
+      && compareVersions(latestRelease.latestManagerVersion, currentManagerVersion) > 0;
+    const clientDevices = connectedDevices(remoteHub);
+    const outdatedClientDevices = latestRelease
+      ? clientDevices.filter(device => deviceNeedsUpdate(
+        device,
+        latestRelease.latestManagerVersion,
+        latestRelease.latestClientVersion
+      ))
+      : [];
+    const pendingOfflineClientCount = latestRelease
+      ? knownOfflineDevices(remoteHub).filter(device => deviceNeedsUpdate(
+        device,
+        latestRelease.latestManagerVersion,
+        latestRelease.latestClientVersion
+      )).length
+      : 0;
+    const clientPackageUpdateAvailable = !!latestRelease
+      && compareVersions(latestRelease.latestClientVersion, currentClientVersion) > 0;
     const clientUpdateAvailable = clientPackageUpdateAvailable || outdatedClientDevices.length > 0;
     const updateAvailable = managerUpdateAvailable || clientUpdateAvailable;
     const activeRun = statusForRun(run);
     return {
       currentVersion: String(currentManagerVersion || ''),
       currentClientVersion: String(currentClientVersion || ''),
-      latestVersion: latestRelease?.latestManagerVersion || '',
-      latestClientVersion: latestRelease?.latestClientVersion || '',
-      registryClientVersion: latestRelease?.registryClientVersion || '',
-      releaseSkew: latestRelease?.releaseSkew || '',
-      manifestVerified: latestRelease?.manifestVerified === true,
-      manifestGeneratedAt: latestRelease?.manifestGeneratedAt || '',
-      manifestExpiresAt: latestRelease?.manifestExpiresAt || '',
-      updateAvailable,
+      latestVersion: latestRelease?.latestManagerVersion || '',
+      latestClientVersion: latestRelease?.latestClientVersion || '',
+      registryClientVersion: latestRelease?.registryClientVersion || '',
+      releaseSkew: latestRelease?.releaseSkew || '',
+      updateAvailable,
       managerUpdateAvailable,
       clientUpdateAvailable,
-      clientPackageUpdateAvailable,
-      outdatedClientCount: outdatedClientDevices.length,
-      pendingOfflineClientCount,
-      checkedAt: latestRelease?.checkedAt || '',
+      clientPackageUpdateAvailable,
+      outdatedClientCount: outdatedClientDevices.length,
+      pendingOfflineClientCount,
+      checkedAt: latestRelease?.checkedAt || '',
       checkError,
       restartSupported: !!restartSupported,
       canApply: updateAvailable && (!managerUpdateAvailable && !clientPackageUpdateAvailable || !!restartSupported),
-      ...(activeRun || {
-        state: 'idle',
-        operationId: '',
-        targetCount: 0,
-        completedCount: 0,
-        waitingCount: 0,
-        activeCount: 0,
-        queuedCount: 0,
-        pendingOfflineCount: 0,
-        failedCount: 0,
-        batchSize: effectiveClientBatchSize,
-        clientRestartStabilityMs: effectiveClientRestartStabilityMs,
-        targets: []
-      })
+      ...(activeRun || {
+        state: 'idle',
+        operationId: '',
+        targetCount: 0,
+        completedCount: 0,
+        waitingCount: 0,
+        activeCount: 0,
+        queuedCount: 0,
+        pendingOfflineCount: 0,
+        failedCount: 0,
+        batchSize: effectiveClientBatchSize,
+        clientRestartStabilityMs: effectiveClientRestartStabilityMs,
+        targets: []
+      })
     };
   };
 
-  const failRun = (message) => {
-    if (!run) return;
-    run.state = 'failed';
-    run.error = String(message || 'LiveDesk update failed.');
-    for (const target of run.targets) {
-      if (target.state === 'completed') continue;
-      target.state = 'failed';
-      if (!target.error) {
-        target.error = `Rollout stopped: ${run.error}`;
-      }
-    }
-    touch();
-    if (runTimer) {
-      clearInterval(runTimer);
-      runTimer = null;
-    }
-  };
-
-  const reconcileHubRestartResult = (restartResult) => {
-    if (!run || run.state !== 'hub-restart-requested') return false;
-    const operationId = String(restartResult?.operationId || '').trim();
-    if (!operationId || operationId !== run.operationId) return false;
-    const stage = String(restartResult?.stage || '').trim();
-    const outcome = String(restartResult?.outcome || '').trim();
-    if (outcome !== 'failed' || !['failed', 'preflight-failed'].includes(stage)) return false;
-    failRun(
-      restartResult?.error
-      || (stage === 'preflight-failed'
-        ? 'Hub update restart preflight failed before shutdown.'
-        : 'Hub update restart failed.')
-    );
-    return true;
-  };
-
-  const retrySettlingTargets = () => {
-    if (!run || run.state !== 'failed') return [];
-    const currentTime = now();
-    const devices = new Map(
-      remoteHub.listDevices({ includeDataUrl: false })
-        .map(device => [String(device.deviceId), device])
-    );
-    return run.targets.filter(target => {
-      if (target.state !== 'failed' || !target.dispatchedAt) return false;
-      const deadline = Date.parse(target.deadlineAt || '');
-      if (!(deadline > currentTime)) return false;
-      return devices.get(target.deviceId)?.connected !== true;
-    });
-  };
+  const failRun = (message) => {
+    if (!run) return;
+    run.state = 'failed';
+    run.error = String(message || 'LiveDesk update failed.');
+    for (const target of run.targets) {
+      if (target.state === 'completed') continue;
+      target.state = 'failed';
+      if (!target.error) {
+        target.error = `Rollout stopped: ${run.error}`;
+      }
+    }
+    touch();
+    if (runTimer) {
+      clearInterval(runTimer);
+      runTimer = null;
+    }
+  };
+
+  const reconcileHubRestartResult = (restartResult) => {
+    if (!run || run.state !== 'hub-restart-requested') return false;
+    const operationId = String(restartResult?.operationId || '').trim();
+    if (!operationId || operationId !== run.operationId) return false;
+    const stage = String(restartResult?.stage || '').trim();
+    const outcome = String(restartResult?.outcome || '').trim();
+    if (outcome !== 'failed' || !['failed', 'preflight-failed'].includes(stage)) return false;
+    failRun(
+      restartResult?.error
+      || (stage === 'preflight-failed'
+        ? 'Hub update restart preflight failed before shutdown.'
+        : 'Hub update restart failed.')
+    );
+    return true;
+  };
+
+  const retrySettlingTargets = () => {
+    if (!run || run.state !== 'failed') return [];
+    const currentTime = now();
+    const devices = new Map(
+      remoteHub.listDevices({ includeDataUrl: false })
+        .map(device => [String(device.deviceId), device])
+    );
+    return run.targets.filter(target => {
+      if (target.state !== 'failed' || !target.dispatchedAt) return false;
+      const deadline = Date.parse(target.deadlineAt || '');
+      if (!(deadline > currentTime)) return false;
+      return devices.get(target.deviceId)?.connected !== true;
+    });
+  };
 
   const requestRestart = () => {
     if (!restartSupported) {
       failRun('Hub launcher restart is unavailable. Start LiveDesk through npx livedesk@latest.');
       return false;
     }
-    const result = requestHubRestart?.({
-      operationId: run?.operationId || '',
-      latestVersion: run?.latestManagerVersion || latestRelease?.latestManagerVersion || '',
-      latestClientVersion: run?.latestClientVersion || latestRelease?.latestClientVersion || '',
-      // Current versions update every connected Client before the Hub exits.
-      // Older Hub versions did the reverse and set this flag themselves; the
-      // new server still supports that one-time migration path.
-      continueClientUpdate: false
+    const result = requestHubRestart?.({
+      operationId: run?.operationId || '',
+      latestVersion: run?.latestManagerVersion || latestRelease?.latestManagerVersion || '',
+      latestClientVersion: run?.latestClientVersion || latestRelease?.latestClientVersion || '',
+      // Current versions update every connected Client before the Hub exits.
+      // Older Hub versions did the reverse and set this flag themselves; the
+      // new server still supports that one-time migration path.
+      continueClientUpdate: false
     });
     if (result?.ok !== true) {
       failRun(result?.error || 'Hub launcher restart request failed.');
@@ -490,214 +422,214 @@ export function createLiveDeskUpdateManager({
     return true;
   };
 
-  const dispatchTarget = (target, device) => {
-    const dispatchedAtEpochMs = now();
-    const updateDeadlineEpochMs = dispatchedAtEpochMs + effectiveTargetTimeoutMs;
-    const dispatchedSessionId = String(device?.sessionId || '').trim();
-    if (!dispatchedSessionId) {
-      target.state = 'failed';
-      target.error = 'client-update-session-unavailable';
-      return false;
-    }
-    target.dispatchedSessionId = dispatchedSessionId;
-    target.dispatchedPid = Math.max(0, Math.floor(Number(device?.pid) || 0));
-    resetReconnectCandidate(target);
-    const supportsDedicated = device.capabilities?.clientUpdate === true
-      && isVersionAtLeast(device.agentVersion, LIVE_DESK_DEDICATED_CLIENT_UPDATE_MIN_VERSION);
-    const payload = {
-      targetVersion: run.latestClientVersion,
-      targetProductVersion: run.latestManagerVersion,
-      managerVersion: run.latestManagerVersion,
-      operationId: run.operationId,
-      updateTimeoutMs: effectiveTargetTimeoutMs
-    };
-    const result = supportsDedicated
-      ? remoteHub.sendCommand(device.deviceId, { command: LIVE_DESK_UPDATE_COMMAND, payload })
-      : remoteHub.sendLegacyClientUpdate(device.deviceId, {
-        command: buildLegacyUpdateCommand(
-          device,
-          run.operationId,
-          run.latestClientVersion,
-          run.latestManagerVersion,
-          effectiveTargetTimeoutMs
-        ),
-        timeoutMs: 30_000
-      });
-    if (result?.ok !== true) {
-      const dispatchError = String(result?.error || 'client-update-dispatch-failed');
-      if (['device-not-connected', 'device-not-found'].includes(dispatchError)) {
-        target.state = 'pending-offline';
-        target.method = '';
-        target.commandId = '';
-        target.dispatchedAt = '';
-        target.deadlineAt = '';
-        target.dispatchedSessionId = '';
-        target.dispatchedPid = 0;
-        resetReconnectCandidate(target);
-        target.error = '';
-        return 'pending-offline';
-      }
-      target.state = 'failed';
-      target.error = dispatchError;
-      return false;
+  const dispatchTarget = (target, device) => {
+    const dispatchedAtEpochMs = now();
+    const updateDeadlineEpochMs = dispatchedAtEpochMs + effectiveTargetTimeoutMs;
+    const dispatchedSessionId = String(device?.sessionId || '').trim();
+    if (!dispatchedSessionId) {
+      target.state = 'failed';
+      target.error = 'client-update-session-unavailable';
+      return false;
+    }
+    target.dispatchedSessionId = dispatchedSessionId;
+    target.dispatchedPid = Math.max(0, Math.floor(Number(device?.pid) || 0));
+    resetReconnectCandidate(target);
+    const supportsDedicated = device.capabilities?.clientUpdate === true
+      && isVersionAtLeast(device.agentVersion, LIVE_DESK_DEDICATED_CLIENT_UPDATE_MIN_VERSION);
+    const payload = {
+      targetVersion: run.latestClientVersion,
+      targetProductVersion: run.latestManagerVersion,
+      managerVersion: run.latestManagerVersion,
+      operationId: run.operationId,
+      updateTimeoutMs: effectiveTargetTimeoutMs
+    };
+    const result = supportsDedicated
+      ? remoteHub.sendCommand(device.deviceId, { command: LIVE_DESK_UPDATE_COMMAND, payload })
+      : remoteHub.sendLegacyClientUpdate(device.deviceId, {
+        command: buildLegacyUpdateCommand(
+          device,
+          run.operationId,
+          run.latestClientVersion,
+          run.latestManagerVersion,
+          effectiveTargetTimeoutMs
+        ),
+        timeoutMs: 30_000
+      });
+    if (result?.ok !== true) {
+      const dispatchError = String(result?.error || 'client-update-dispatch-failed');
+      if (['device-not-connected', 'device-not-found'].includes(dispatchError)) {
+        target.state = 'pending-offline';
+        target.method = '';
+        target.commandId = '';
+        target.dispatchedAt = '';
+        target.deadlineAt = '';
+        target.dispatchedSessionId = '';
+        target.dispatchedPid = 0;
+        resetReconnectCandidate(target);
+        target.error = '';
+        return 'pending-offline';
+      }
+      target.state = 'failed';
+      target.error = dispatchError;
+      return false;
+    }
+    target.state = 'waiting';
+    target.method = supportsDedicated ? 'dedicated' : 'legacy-command-run';
+    target.commandId = String(result.commandId || result.taskId || '');
+    target.dispatchedAt = new Date(dispatchedAtEpochMs).toISOString();
+    target.deadlineAt = new Date(updateDeadlineEpochMs).toISOString();
+    return true;
+  };
+
+  const dispatchQueuedTargets = () => {
+    if (!run || run.state !== 'waiting-for-clients') return true;
+    const activeCount = run.targets.filter(target => target.state === 'waiting').length;
+    let availableSlots = Math.max(0, run.batchSize - activeCount);
+    if (availableSlots <= 0) return true;
+    const devices = new Map(connectedDevices(remoteHub).map(device => [String(device.deviceId), device]));
+    for (const target of run.targets) {
+      if (availableSlots <= 0) break;
+      if (!['queued', 'pending-offline'].includes(target.state)) continue;
+      const device = devices.get(target.deviceId);
+      if (!device?.connected) {
+        target.state = 'pending-offline';
+        continue;
+      }
+      target.state = 'queued';
+      let dispatchResult;
+      try {
+        dispatchResult = dispatchTarget(target, device);
+      } catch (error) {
+        target.state = 'failed';
+        target.error = String(error?.message || error || 'client-update-command-build-failed').slice(0, 500);
+        failRun(`Client ${target.deviceName || target.deviceId} could not be scheduled: ${target.error}`);
+        return false;
+      }
+      if (dispatchResult === false) {
+        failRun(`Client ${target.deviceName || target.deviceId} could not be scheduled: ${target.error}`);
+        return false;
+      }
+      if (dispatchResult === true) {
+        availableSlots -= 1;
+      }
     }
-    target.state = 'waiting';
-    target.method = supportsDedicated ? 'dedicated' : 'legacy-command-run';
-    target.commandId = String(result.commandId || result.taskId || '');
-    target.dispatchedAt = new Date(dispatchedAtEpochMs).toISOString();
-    target.deadlineAt = new Date(updateDeadlineEpochMs).toISOString();
-    return true;
-  };
-
-  const dispatchQueuedTargets = () => {
-    if (!run || run.state !== 'waiting-for-clients') return true;
-    const activeCount = run.targets.filter(target => target.state === 'waiting').length;
-    let availableSlots = Math.max(0, run.batchSize - activeCount);
-    if (availableSlots <= 0) return true;
-    const devices = new Map(connectedDevices(remoteHub).map(device => [String(device.deviceId), device]));
-    for (const target of run.targets) {
-      if (availableSlots <= 0) break;
-      if (!['queued', 'pending-offline'].includes(target.state)) continue;
-      const device = devices.get(target.deviceId);
-      if (!device?.connected) {
-        target.state = 'pending-offline';
-        continue;
-      }
-      target.state = 'queued';
-      let dispatchResult;
-      try {
-        dispatchResult = dispatchTarget(target, device);
-      } catch (error) {
-        target.state = 'failed';
-        target.error = String(error?.message || error || 'client-update-command-build-failed').slice(0, 500);
-        failRun(`Client ${target.deviceName || target.deviceId} could not be scheduled: ${target.error}`);
-        return false;
-      }
-      if (dispatchResult === false) {
-        failRun(`Client ${target.deviceName || target.deviceId} could not be scheduled: ${target.error}`);
-        return false;
-      }
-      if (dispatchResult === true) {
-        availableSlots -= 1;
-      }
-    }
-    touch();
-    return true;
-  };
-
-  const verifyTargets = () => {
-    if (!run || run.state !== 'waiting-for-clients') return;
-    const currentTime = now();
-    if (currentTime - Date.parse(run.startedAt) >= effectiveOperationTimeoutMs) {
-      const unfinishedCount = run.targets.filter(target => target.state !== 'completed').length;
-      failRun(`Timed out waiting for ${unfinishedCount} client(s) to finish the rollout.`);
-      return;
-    }
-    const devices = new Map(connectedDevices(remoteHub).map(device => [String(device.deviceId), device]));
-    for (const target of run.targets) {
-      if (target.state === 'failed' || target.state === 'completed') continue;
-      const device = devices.get(target.deviceId);
-      if (target.state === 'waiting') {
-        const sessionId = String(device?.sessionId || '').trim();
-        const connectedAt = String(device?.connectedAt || '');
-        const connectedAtEpochMs = Date.parse(connectedAt);
-        const dispatchedAtEpochMs = Date.parse(target.dispatchedAt || '');
-        const candidatePid = Math.max(0, Math.floor(Number(device?.pid) || 0));
-        const candidateProductVersion = String(device?.productVersion || '');
-        const candidateAgentVersion = String(device?.agentVersion || '');
-        const qualifiesForStability = device?.connected === true
-          && !!sessionId
-          && candidatePid > 1
-          && sessionId !== target.dispatchedSessionId
-          && connectedAtEpochMs >= dispatchedAtEpochMs
-          && !deviceNeedsUpdate(device, run.latestManagerVersion, run.latestClientVersion);
-        const sameCandidate = qualifiesForStability
-          && target.candidateSessionId === sessionId
-          && target.candidatePid === candidatePid
-          && target.candidateConnectedAt === connectedAt
-          && target.candidateProductVersion === candidateProductVersion
-          && target.candidateAgentVersion === candidateAgentVersion;
-
-        if (!qualifiesForStability) {
-          resetReconnectCandidate(target);
-        } else if (!sameCandidate) {
-          target.candidateSessionId = sessionId;
-          target.candidatePid = candidatePid;
-          target.candidateConnectedAt = connectedAt;
-          target.candidateProductVersion = candidateProductVersion;
-          target.candidateAgentVersion = candidateAgentVersion;
-          target.candidateSince = new Date(currentTime).toISOString();
-          target.stabilityDeadlineAt = new Date(
-            currentTime + run.clientRestartStabilityMs
-          ).toISOString();
-        }
-
-        if (qualifiesForStability
-          && target.candidateSessionId === sessionId
-          && currentTime >= Date.parse(target.stabilityDeadlineAt || '')) {
-          target.state = 'completed';
-          target.currentVersion = String(device.agentVersion || '');
-          target.currentProductVersion = String(device.productVersion || '');
-          target.completedAt = new Date(currentTime).toISOString();
-          continue;
-        }
-      }
-      if (target.state === 'waiting'
-        && Date.parse(target.deadlineAt || '') > 0
-        && currentTime >= Date.parse(target.deadlineAt)) {
-        target.state = 'failed';
-        target.error = `Timed out waiting for product ${run.latestManagerVersion} / Client ${run.latestClientVersion}.`;
-        failRun(`Client ${target.deviceName || target.deviceId} did not restart on the requested versions within ${Math.round(effectiveTargetTimeoutMs / 1000)} seconds.`);
-        return;
-      }
-      if (target.state === 'pending-offline' && device?.connected === true) {
-        target.state = 'queued';
-      }
-    }
-    if (!dispatchQueuedTargets()) return;
-    touch();
-    if (run.targets.every(target => target.state === 'completed')) {
-      if (runTimer) {
-        clearInterval(runTimer);
-        runTimer = null;
-      }
-      if (run.needsHubRestart) {
-        requestRestart();
-      } else {
-        run.state = 'clients-updated';
-        touch();
-      }
-      return;
-    }
-  };
-
-  const startUpdate = async () => {
-    if (run && ['dispatching', 'waiting-for-clients', 'hub-restart-requested'].includes(run.state)) {
-      return { ok: true, ...getStatus() };
-    }
-    const settlingTargets = retrySettlingTargets();
-    if (settlingTargets.length > 0) {
-      const names = settlingTargets
-        .slice(0, 3)
-        .map(target => target.deviceName || target.deviceId)
-        .join(', ');
-      const remaining = settlingTargets.length > 3 ? ` and ${settlingTargets.length - 3} more` : '';
-      return {
-        ...getStatus(),
-        ok: false,
-        error: `The previous rollout is still settling for offline Client(s): ${names}${remaining}. Retry after they reconnect or their restart deadline passes.`
-      };
-    }
-    const release = latestRelease || await checkLatest();
+    touch();
+    return true;
+  };
+
+  const verifyTargets = () => {
+    if (!run || run.state !== 'waiting-for-clients') return;
+    const currentTime = now();
+    if (currentTime - Date.parse(run.startedAt) >= effectiveOperationTimeoutMs) {
+      const unfinishedCount = run.targets.filter(target => target.state !== 'completed').length;
+      failRun(`Timed out waiting for ${unfinishedCount} client(s) to finish the rollout.`);
+      return;
+    }
+    const devices = new Map(connectedDevices(remoteHub).map(device => [String(device.deviceId), device]));
+    for (const target of run.targets) {
+      if (target.state === 'failed' || target.state === 'completed') continue;
+      const device = devices.get(target.deviceId);
+      if (target.state === 'waiting') {
+        const sessionId = String(device?.sessionId || '').trim();
+        const connectedAt = String(device?.connectedAt || '');
+        const connectedAtEpochMs = Date.parse(connectedAt);
+        const dispatchedAtEpochMs = Date.parse(target.dispatchedAt || '');
+        const candidatePid = Math.max(0, Math.floor(Number(device?.pid) || 0));
+        const candidateProductVersion = String(device?.productVersion || '');
+        const candidateAgentVersion = String(device?.agentVersion || '');
+        const qualifiesForStability = device?.connected === true
+          && !!sessionId
+          && candidatePid > 1
+          && sessionId !== target.dispatchedSessionId
+          && connectedAtEpochMs >= dispatchedAtEpochMs
+          && !deviceNeedsUpdate(device, run.latestManagerVersion, run.latestClientVersion);
+        const sameCandidate = qualifiesForStability
+          && target.candidateSessionId === sessionId
+          && target.candidatePid === candidatePid
+          && target.candidateConnectedAt === connectedAt
+          && target.candidateProductVersion === candidateProductVersion
+          && target.candidateAgentVersion === candidateAgentVersion;
+
+        if (!qualifiesForStability) {
+          resetReconnectCandidate(target);
+        } else if (!sameCandidate) {
+          target.candidateSessionId = sessionId;
+          target.candidatePid = candidatePid;
+          target.candidateConnectedAt = connectedAt;
+          target.candidateProductVersion = candidateProductVersion;
+          target.candidateAgentVersion = candidateAgentVersion;
+          target.candidateSince = new Date(currentTime).toISOString();
+          target.stabilityDeadlineAt = new Date(
+            currentTime + run.clientRestartStabilityMs
+          ).toISOString();
+        }
+
+        if (qualifiesForStability
+          && target.candidateSessionId === sessionId
+          && currentTime >= Date.parse(target.stabilityDeadlineAt || '')) {
+          target.state = 'completed';
+          target.currentVersion = String(device.agentVersion || '');
+          target.currentProductVersion = String(device.productVersion || '');
+          target.completedAt = new Date(currentTime).toISOString();
+          continue;
+        }
+      }
+      if (target.state === 'waiting'
+        && Date.parse(target.deadlineAt || '') > 0
+        && currentTime >= Date.parse(target.deadlineAt)) {
+        target.state = 'failed';
+        target.error = `Timed out waiting for product ${run.latestManagerVersion} / Client ${run.latestClientVersion}.`;
+        failRun(`Client ${target.deviceName || target.deviceId} did not restart on the requested versions within ${Math.round(effectiveTargetTimeoutMs / 1000)} seconds.`);
+        return;
+      }
+      if (target.state === 'pending-offline' && device?.connected === true) {
+        target.state = 'queued';
+      }
+    }
+    if (!dispatchQueuedTargets()) return;
+    touch();
+    if (run.targets.every(target => target.state === 'completed')) {
+      if (runTimer) {
+        clearInterval(runTimer);
+        runTimer = null;
+      }
+      if (run.needsHubRestart) {
+        requestRestart();
+      } else {
+        run.state = 'clients-updated';
+        touch();
+      }
+      return;
+    }
+  };
+
+  const startUpdate = async () => {
+    if (run && ['dispatching', 'waiting-for-clients', 'hub-restart-requested'].includes(run.state)) {
+      return { ok: true, ...getStatus() };
+    }
+    const settlingTargets = retrySettlingTargets();
+    if (settlingTargets.length > 0) {
+      const names = settlingTargets
+        .slice(0, 3)
+        .map(target => target.deviceName || target.deviceId)
+        .join(', ');
+      const remaining = settlingTargets.length > 3 ? ` and ${settlingTargets.length - 3} more` : '';
+      return {
+        ...getStatus(),
+        ok: false,
+        error: `The previous rollout is still settling for offline Client(s): ${names}${remaining}. Retry after they reconnect or their restart deadline passes.`
+      };
+    }
+    const release = latestRelease || await checkLatest();
     if (!release) return { ok: false, error: checkError || 'LiveDesk update check failed.', ...getStatus() };
     const managerNeedsUpdate = compareVersions(release.latestManagerVersion, currentManagerVersion) > 0;
     const clientPackageNeedsUpdate = compareVersions(release.latestClientVersion, currentClientVersion) > 0;
     const connected = connectedDevices(remoteHub);
-    const outdatedClients = connected.filter(device => deviceNeedsUpdate(
-      device,
-      release.latestManagerVersion,
-      release.latestClientVersion
-    ));
+    const outdatedClients = connected.filter(device => deviceNeedsUpdate(
+      device,
+      release.latestManagerVersion,
+      release.latestClientVersion
+    ));
     const needsHubRestart = managerNeedsUpdate || clientPackageNeedsUpdate;
     if (!managerNeedsUpdate && !clientPackageNeedsUpdate && outdatedClients.length === 0) {
       return { ok: true, state: 'clients-updated', ...getStatus() };
@@ -705,78 +637,78 @@ export function createLiveDeskUpdateManager({
     if (needsHubRestart && !restartSupported) {
       return { ok: false, error: 'Hub launcher restart is unavailable. Start LiveDesk through npx livedesk@latest.', ...getStatus() };
     }
-    const targets = outdatedClients;
-    run = {
+    const targets = outdatedClients;
+    run = {
       operationId: randomUUID(),
       state: 'dispatching',
       startedAt: new Date(now()).toISOString(),
       updatedAt: new Date(now()).toISOString(),
       latestManagerVersion: release.latestManagerVersion,
-      latestClientVersion: release.latestClientVersion,
-      needsHubRestart,
-      batchSize: effectiveClientBatchSize,
-      clientRestartStabilityMs: effectiveClientRestartStabilityMs,
-      error: '',
-      targets: targets.map(device => ({
+      latestClientVersion: release.latestClientVersion,
+      needsHubRestart,
+      batchSize: effectiveClientBatchSize,
+      clientRestartStabilityMs: effectiveClientRestartStabilityMs,
+      error: '',
+      targets: targets.map(device => ({
         deviceId: String(device.deviceId || ''),
-        deviceName: String(device.deviceName || device.hostname || device.deviceId || ''),
-        oldVersion: String(device.agentVersion || ''),
-        oldProductVersion: String(device.productVersion || ''),
-        currentVersion: '',
-        currentProductVersion: '',
-        state: 'queued',
-        method: '',
-        commandId: '',
-        dispatchedAt: '',
-        deadlineAt: '',
-        dispatchedSessionId: '',
-        dispatchedPid: 0,
-        candidateSessionId: '',
-        candidatePid: 0,
-        candidateConnectedAt: '',
-        candidateProductVersion: '',
-        candidateAgentVersion: '',
-        candidateSince: '',
-        stabilityDeadlineAt: '',
-        completedAt: '',
-        error: ''
-      }))
-    };
-    touch();
-    if (run.targets.length === 0) {
-      if (run.needsHubRestart) {
-        if (!requestRestart()) {
-          return { ok: false, error: run.error, ...getStatus() };
-        }
-      } else {
+        deviceName: String(device.deviceName || device.hostname || device.deviceId || ''),
+        oldVersion: String(device.agentVersion || ''),
+        oldProductVersion: String(device.productVersion || ''),
+        currentVersion: '',
+        currentProductVersion: '',
+        state: 'queued',
+        method: '',
+        commandId: '',
+        dispatchedAt: '',
+        deadlineAt: '',
+        dispatchedSessionId: '',
+        dispatchedPid: 0,
+        candidateSessionId: '',
+        candidatePid: 0,
+        candidateConnectedAt: '',
+        candidateProductVersion: '',
+        candidateAgentVersion: '',
+        candidateSince: '',
+        stabilityDeadlineAt: '',
+        completedAt: '',
+        error: ''
+      }))
+    };
+    touch();
+    if (run.targets.length === 0) {
+      if (run.needsHubRestart) {
+        if (!requestRestart()) {
+          return { ok: false, error: run.error, ...getStatus() };
+        }
+      } else {
         run.state = 'clients-updated';
         touch();
       }
       return { ok: true, ...getStatus() };
-    }
-    run.state = 'waiting-for-clients';
-    if (!dispatchQueuedTargets()) {
-      return { ok: false, error: run.error, ...getStatus() };
-    }
-    runTimer = setInterval(verifyTargets, 1000);
+    }
+    run.state = 'waiting-for-clients';
+    if (!dispatchQueuedTargets()) {
+      return { ok: false, error: run.error, ...getStatus() };
+    }
+    runTimer = setInterval(verifyTargets, 1000);
     runTimer.unref?.();
     verifyTargets();
     return { ok: true, ...getStatus() };
-  };
-
-  const handleRemoteEvent = (type, event) => {
-    if (!run || run.state !== 'waiting-for-clients') return;
-    if (type === 'RemoteDeviceConnected' || type === 'RemoteDeviceDisconnected') {
-      verifyTargets();
-      return;
-    }
-    if (type !== 'RemoteCommandResult') return;
+  };
+
+  const handleRemoteEvent = (type, event) => {
+    if (!run || run.state !== 'waiting-for-clients') return;
+    if (type === 'RemoteDeviceConnected' || type === 'RemoteDeviceDisconnected') {
+      verifyTargets();
+      return;
+    }
+    if (type !== 'RemoteCommandResult') return;
     const deviceId = String(event?.device?.deviceId || '');
     const commandId = String(event?.commandId || '');
     const target = run.targets.find(item => item.deviceId === deviceId && item.commandId === commandId);
-    if (!target
-      || target.state !== 'waiting'
-      || !['dedicated', 'legacy-command-run'].includes(target.method)) return;
+    if (!target
+      || target.state !== 'waiting'
+      || !['dedicated', 'legacy-command-run'].includes(target.method)) return;
     const result = event?.result;
     if (event?.error || result?.ok === false || result?.status === 'failed' || result?.status === 'rejected') {
       target.state = 'failed';
@@ -794,11 +726,11 @@ export function createLiveDeskUpdateManager({
 
   return {
     checkLatest,
-    getStatus,
-    startUpdate,
-    handleRemoteEvent,
-    reconcileHubRestartResult,
-    close() {
+    getStatus,
+    startUpdate,
+    handleRemoteEvent,
+    reconcileHubRestartResult,
+    close() {
       if (checkTimer) clearInterval(checkTimer);
       if (runTimer) clearInterval(runTimer);
       checkTimer = null;