@livedesk/hub 0.1.36 → 0.1.38

package/src/server.js

@@ -40,8 +40,7 @@ import { AgentRuntimeError } from './agents/agent-runtime-error.js';
 import { AGENT_PERMISSION_MODES, createAgentPermissionPolicy, evaluateAgentToolPermission, hashAgentPermissionPolicy } from './agents/agent-permissions.js';
 import { createAgentPermissionStore } from './agents/agent-permission-store.js';
 import { createAgentAuditStore } from './agents/agent-audit-store.js';
-import { createSecurityAuditStore } from './security/security-audit-store.js';
-import { getAgentToolDefinition, isRetiredAgentMutatingToolName } from './agents/agent-tool-registry.js';
+import { getAgentToolDefinition } from './agents/agent-tool-registry.js';
 import { LiveDeskSettingsStore, SettingsConflictError } from './settings/settings-store.js';
 import { effectiveDevicePolicy } from './settings/settings-schema.js';
 import { buildEffectiveDevicePolicy } from './settings/effective-device-policy.js';
@@ -49,7 +48,6 @@ import { CaptureStore } from './captures/capture-store.js';
 import { createLiveDeskUpdateManager } from './live-desk-update.js';
 import { createHubUdpTransport } from './transport/udp-hub-transport.js';
 import { normalizeRuntimeAuthSession, runtimeRoleError } from '../../runtime-core/src/index.js';
-import { createOsSecretStore, OS_SECRET_REFERENCE } from '../../runtime-core/src/os-secret-store.js';
 import { fetchAuthResponse, AUTH_REQUEST_TIMEOUT_MS } from '../../runtime-core/src/auth-http.js';
 import { PRODUCTION_SUPABASE_PUBLISHABLE_KEY, PRODUCTION_SUPABASE_URL } from '../../runtime-core/src/auth-config.js';
 import { createHubRuntime } from './runtime/hub-runtime.js';
@@ -67,18 +65,6 @@ const webIndexPath = resolve(webDistPath, 'index.html');
 const packageInfo = JSON.parse(readFileSync(resolve(__dirname, '..', 'package.json'), 'utf8'));
 const httpHost = process.env.LIVEDESK_HUB_HTTP_HOST || '127.0.0.1';
 const httpPort = Number(process.env.LIVEDESK_HUB_HTTP_PORT || process.env.PORT || 5179);
-if (!isLoopbackBindHost(httpHost) && process.env.LIVEDESK_TEST_MODE !== '1') {
-  throw new Error('hub-http-lan-bind-requires-tls-authenticated-proxy');
-}
-const localAdminSessionToken = crypto.randomBytes(32).toString('base64url');
-const localAdminCsrfToken = crypto.randomBytes(32).toString('base64url');
-const localAdminSessionId = crypto.randomUUID();
-const launcherShutdownToken = /^[A-Za-z0-9_-]{43}$/.test(
-  String(process.env.LIVEDESK_LAUNCHER_SHUTDOWN_TOKEN || '').trim()
-)
-  ? String(process.env.LIVEDESK_LAUNCHER_SHUTDOWN_TOKEN).trim()
-  : '';
-const enforceLocalAdminAuth = process.env.LIVEDESK_TEST_MODE !== '1';
 const runtimeRole = String(process.env.LIVEDESK_RUNTIME_ROLE || 'hub').trim().toLowerCase() === 'client' ? 'client' : 'hub';
 const runtimeDeviceId = String(process.env.LIVEDESK_DEVICE_ID || '').trim();
 const runtimeDeviceName = String(process.env.LIVEDESK_DEVICE_NAME || os.hostname()).trim() || os.hostname();
@@ -182,18 +168,10 @@ const CLIENT_AUTH_STORAGE_KEY = 'livedesk.client.supabase.auth';
 const runtimeAuthStatePath = process.env.LIVEDESK_DESKTOP_HOST === '1'
   ? ''
   : String(process.env.LIVEDESK_AUTH_STATE_PATH || '').trim();
-const runtimeRefreshSecretStore = createOsSecretStore({
-  service: 'LiveDesk',
-  account: 'client-refresh-token',
-  dataDir: process.env.LIVEDESK_STATE_DIR || (runtimeAuthStatePath ? dirname(runtimeAuthStatePath) : undefined)
-});
 const testLicensePlan = process.env.LIVEDESK_TEST_MODE === '1'
   && ['ltd', 'pro'].includes(String(process.env.LIVEDESK_TEST_LICENSE_PLAN || '').toLowerCase())
   ? String(process.env.LIVEDESK_TEST_LICENSE_PLAN).toLowerCase()
   : '';
-const testSecurityAccountId = process.env.LIVEDESK_TEST_MODE === '1'
-  ? String(process.env.LIVEDESK_ACCOUNT_ID || '').trim().slice(0, 128)
-  : '';
 const persistentSessionGcEnabled =
   process.env.LIVEDESK_TEST_MODE === '1'
   && process.env.LIVEDESK_PERSISTENT_SESSION_TEST_GC === '1';
@@ -207,8 +185,6 @@ let connectedDeviceCount = 0;
 let runtimeAccessToken = '';
 let runtimeRefreshToken = '';
 let runtimeAccessTokenExpiresAt = 0;
-let runtimeSessionGeneration = 0;
-let runtimeRefreshPromise = null;
 let roleWatchInFlight = false;
 let verifiedLicense = {
   userId: '',
@@ -222,8 +198,6 @@ let inputClientSeq = 0;
 let audioClientSeq = 0;
 let liveDeskUpdateManager = null;
 let hubTransferJobs = null;
-let securityAuditStore = null;
-let securityAuditHealthy = true;
 const HUB_HOST_TARGET_LEASE_MS = Math.max(5000, readPositiveIntegerEnv('LIVEDESK_HOST_TARGET_LEASE_MS', 60_000));
 const HUB_HOST_TARGET_RENEW_MS = Math.max(1000, Math.min(
   readPositiveIntegerEnv('LIVEDESK_HOST_TARGET_RENEW_MS', 20_000),
@@ -270,39 +244,6 @@ function secureExactTestTokenMatches(actual, expected) {
 function handleRemoteHubEvent(type, event) {
   liveDeskUpdateManager?.handleRemoteEvent(type, event);
   hubTransferJobs?.handleRemoteEvent(type, event);
-  const auditedRemoteActions = {
-    RemoteSecurityHandshakeAudit: event?.action || 'remote.handshake',
-    RemoteSecurityPolicyAudit: 'remote.connection-policy',
-    RemoteAbuseDefense: 'remote.abuse-defense',
-    RemoteDeviceConnected: 'remote.device.connected',
-    RemoteDeviceDisconnected: 'remote.device.disconnected',
-    RemoteInputSocketConnected: 'remote.control.channel-started',
-    RemoteInputSocketDisconnected: 'remote.control.channel-ended',
-    RemoteControlSessionStarted: 'remote.control.session-started',
-    RemoteControlSessionEnded: 'remote.control.session-ended',
-    RemoteFileSocketConnected: 'remote.file.channel-started',
-    RemoteFileSocketDisconnected: 'remote.file.channel-ended',
-    RemoteEnrollmentTokenRotated: 'remote.enrollment-token.rotated'
-  };
-  if (auditedRemoteActions[type]) {
-    const device = event?.device || {};
-    recordSecurityAudit({
-      action: auditedRemoteActions[type],
-      phase: /Disconnected|ended|rotated/i.test(`${type}:${auditedRemoteActions[type]}`) ? 'complete' : 'start',
-      result: event?.result || (event?.reason && /RemoteSecurity(?:Handshake|Policy)Audit|RemoteAbuseDefense/.test(type) ? 'rejected' : 'success'),
-      reason: event?.reason || '',
-      actorAccountId: event?.accountId || '',
-      hubId: event?.hubId || event?.remoteHub?.hostInstanceId || '',
-      deviceId: event?.deviceId || device.deviceId || '',
-      sessionId: event?.sessionId || device.sessionId || '',
-      authMethod: /RemoteSecurity(?:Handshake|Policy)Audit|RemoteAbuseDefense/.test(type) ? 'device-credential-p256' : 'authenticated-device-session',
-      details: {
-        transport: event?.transport || device.transport || '',
-        channel: event?.channel || '',
-        credentialSerial: event?.credentialSerial || ''
-      }
-    });
-  }
   if (traceRemoteTestEventsEnabled
     && (type === 'RemoteFrameDropped' || type === 'RemoteFrameTransportProofAccepted')) {
     console.warn(`[LiveDesk Hub Test Event] ${type} ${JSON.stringify({
@@ -352,12 +293,6 @@ function handleRemoteHubEvent(type, event) {
   if (type === 'RemoteDeviceConnected' || type === 'RemoteDeviceDisconnected') {
     connectedDeviceCount = Number(remoteHub.getStatus({ includeSecrets: false }).connectedDeviceCount || 0);
   }
-  if (type === 'RemoteEnrollmentTokenRotated') {
-    void publishHubHostTargetWithPendingRoleTakeover('enrollment-token-rotated').catch(error => {
-      console.warn(`[LiveDesk Hub] Enrollment token publication failed: ${error?.message || error}`);
-    });
-    return;
-  }
   if (type !== 'RemoteDeviceConnected') {
     return;
   }
@@ -494,19 +429,7 @@ function readPersistedRuntimeSession(state = readRuntimeAuthState()) {
   try {
     const raw = state?.[CLIENT_AUTH_STORAGE_KEY];
     const session = typeof raw === 'string' ? JSON.parse(raw) : raw;
-    if (!session || typeof session !== 'object') return null;
-    const plaintextRefreshToken = String(session.refresh_token || '').trim();
-    const refreshToken = plaintextRefreshToken || (session.refresh_token_ref === OS_SECRET_REFERENCE
-      ? runtimeRefreshSecretStore.read()
-      : '');
-    if (plaintextRefreshToken) {
-      if (!runtimeRefreshSecretStore.write(plaintextRefreshToken)) return null;
-      const migrated = { ...session, refresh_token_ref: OS_SECRET_REFERENCE };
-      delete migrated.refresh_token;
-      state[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(migrated);
-      writePrivateRuntimeAuthState(state);
-    }
-    return { ...session, refresh_token: refreshToken };
+    return session && typeof session === 'object' ? session : null;
   } catch {
     return null;
   }
@@ -550,10 +473,7 @@ function persistRuntimeSession(session) {
     }
   }, { requireRefreshToken: true });
   if (!normalized.ok) return false;
-  if (!runtimeRefreshSecretStore.write(normalized.session.refresh_token)) return false;
-  const persisted = { ...normalized.session, refresh_token_ref: OS_SECRET_REFERENCE };
-  delete persisted.refresh_token;
-  state[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(persisted);
+  state[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(normalized.session);
   writePrivateRuntimeAuthState(state);
   return true;
 }
@@ -562,13 +482,10 @@ function clearPersistedRuntimeSession() {
   if (!runtimeAuthStatePath) return false;
   const state = readRuntimeAuthState();
   delete state[CLIENT_AUTH_STORAGE_KEY];
-  runtimeRefreshSecretStore.clear();
   return writePrivateRuntimeAuthState(state);
 }
 
 function clearRuntimeSession() {
-  runtimeSessionGeneration += 1;
-  runtimeRefreshPromise = null;
   runtimeAccessToken = '';
   runtimeRefreshToken = '';
   runtimeAccessTokenExpiresAt = 0;
@@ -589,137 +506,46 @@ async function getRuntimeAccessToken() {
     return accessToken;
   }
 
-  if (runtimeRefreshPromise) return runtimeRefreshPromise;
-
-  const ownerGeneration = runtimeSessionGeneration;
-  const refreshOperation = (async () => {
-    const response = await fetchAuthResponse(
-      fetch,
-      `${supabaseUrl}/auth/v1/token?grant_type=refresh_token`,
-      {
-        method: 'POST',
-        headers: {
-          apikey: supabasePublishableKey,
-          'Content-Type': 'application/json',
-          Accept: 'application/json'
-        },
-        body: JSON.stringify({ refresh_token: refreshToken })
+  const response = await fetchAuthResponse(
+    fetch,
+    `${supabaseUrl}/auth/v1/token?grant_type=refresh_token`,
+    {
+      method: 'POST',
+      headers: {
+        apikey: supabasePublishableKey,
+        'Content-Type': 'application/json',
+        Accept: 'application/json'
       },
-      SUPABASE_AUTH_TIMEOUT_MS
-    );
-    if (!response.ok) {
-      if (response.status === 400 || response.status === 401 || response.status === 403) {
-        if (runtimeSessionGeneration === ownerGeneration && runtimeRefreshToken === refreshToken) {
-          clearRuntimeSession();
-        }
-        throw new Error(`hub-session-refresh-failed:${response.status}`);
-      }
-      throw new Error(`hub-session-refresh-provider-failed:${response.status}`);
-    }
-    const refreshed = await response.json().catch(() => null);
-    const nextAccessToken = String(refreshed?.access_token || '').trim();
-    if (!nextAccessToken) {
-      throw new Error('hub-session-refresh-missing-access-token');
-    }
-    if (runtimeSessionGeneration !== ownerGeneration || runtimeRefreshToken !== refreshToken) {
-      throw new Error('hub-session-refresh-owner-retired');
-    }
-    runtimeAccessToken = nextAccessToken;
-    runtimeRefreshToken = String(refreshed?.refresh_token || refreshToken).trim();
-    runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(refreshed?.expires_at)
-      || (Number(refreshed?.expires_in) > 0 ? Date.now() + Number(refreshed.expires_in) * 1000 : 0);
-    try {
-      persistRuntimeSession({
-        access_token: runtimeAccessToken,
-        refresh_token: runtimeRefreshToken,
-        expires_at: Math.floor(runtimeAccessTokenExpiresAt / 1000)
-      });
-    } catch (error) {
-      console.warn(`[LiveDesk Hub] Refreshed session persistence failed: ${error?.message || error}`);
+      body: JSON.stringify({ refresh_token: refreshToken })
+    },
+    SUPABASE_AUTH_TIMEOUT_MS
+  );
+  if (!response.ok) {
+    if (response.status === 400 || response.status === 401 || response.status === 403) {
+      clearRuntimeSession();
+      throw new Error(`hub-session-refresh-failed:${response.status}`);
     }
-    return runtimeAccessToken;
-  })();
-  runtimeRefreshPromise = refreshOperation;
-  try {
-    return await refreshOperation;
-  } finally {
-    if (runtimeRefreshPromise === refreshOperation) runtimeRefreshPromise = null;
-  }
-}
-
-async function restorePersistedHubSessionAtStartup() {
-  if (runtimeRole !== 'hub' || runtimeManager.getSnapshot().authenticated) {
-    return { ok: true, skipped: true, reason: 'not-required' };
+    throw new Error(`hub-session-refresh-provider-failed:${response.status}`);
   }
-  const persisted = readPersistedRuntimeSession();
-  const normalized = normalizeRuntimeAuthSession(persisted, { requireRefreshToken: true });
-  const userId = String(normalized.ok ? normalized.session?.user?.id || '' : '').trim();
-  if (!normalized.ok || !userId) {
-    return { ok: false, skipped: true, reason: normalized.ok ? 'saved-user-missing' : normalized.error };
-  }
-  runtimeSessionGeneration += 1;
-  runtimeRefreshPromise = null;
-  runtimeAccessToken = String(normalized.session.access_token || '').trim();
-  runtimeRefreshToken = String(normalized.session.refresh_token || '').trim();
-  runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(normalized.session.expires_at);
-  const accessToken = await getRuntimeAccessToken();
-  if (!accessToken) throw new Error('saved-hub-session-access-token-unavailable');
-  runtimeManager.setAuthenticated(true, userId);
-  persistRuntimeSession({
-    access_token: runtimeAccessToken,
-    refresh_token: runtimeRefreshToken,
-    expires_at: Math.floor(runtimeAccessTokenExpiresAt / 1000),
-    user: normalized.session.user
-  });
-  const hostTarget = await publishHubHostTargetWithPendingRoleTakeover('saved-session-restored');
-  startHubHostTargetLeaseRenewal();
-  console.log(`[LiveDesk Hub] Saved sign-in restored locally; host target publication ${hostTarget?.ok === false ? 'will retry' : 'is active'}.`);
-  return { ok: true, skipped: false, hostTarget };
-}
-
-function isLoopbackBindHost(value) {
-  const host = String(value || '').trim().toLowerCase().replace(/^\[|\]$/g, '');
-  return host === '127.0.0.1' || host === 'localhost' || host === '::1';
-}
-
-async function revokeRuntimeProviderSession() {
-  const hasRuntimeSession = Boolean(runtimeAccessToken || runtimeRefreshToken);
-  if (!hasRuntimeSession) return { ok: true, skipped: true, reason: 'no-runtime-session' };
-
-  let accessToken = String(runtimeAccessToken || '').trim();
-  try {
-    accessToken = await getRuntimeAccessToken() || accessToken;
-  } catch (error) {
-    const message = String(error?.message || error);
-    if (/^hub-session-refresh-failed:(?:400|401|403)$/.test(message)) {
-      return { ok: true, alreadyInvalid: true };
-    }
-    return { ok: false, error: message };
+  const refreshed = await response.json().catch(() => null);
+  const nextAccessToken = String(refreshed?.access_token || '').trim();
+  if (!nextAccessToken) {
+    throw new Error('hub-session-refresh-missing-access-token');
   }
-  if (!accessToken) return { ok: false, error: 'provider-session-token-unavailable' };
-
+  runtimeAccessToken = nextAccessToken;
+  runtimeRefreshToken = String(refreshed?.refresh_token || refreshToken).trim();
+  runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(refreshed?.expires_at)
+    || (Number(refreshed?.expires_in) > 0 ? Date.now() + Number(refreshed.expires_in) * 1000 : 0);
   try {
-    const response = await fetchAuthResponse(
-      fetch,
-      `${supabaseUrl}/auth/v1/logout?scope=local`,
-      {
-        method: 'POST',
-        headers: {
-          apikey: supabasePublishableKey,
-          Authorization: `Bearer ${accessToken}`,
-          Accept: 'application/json'
-        }
-      },
-      SUPABASE_AUTH_TIMEOUT_MS
-    );
-    if (response.ok) return { ok: true, revoked: true };
-    if ([401, 403, 404].includes(response.status)) {
-      return { ok: true, alreadyInvalid: true, status: response.status };
-    }
-    return { ok: false, error: `provider-session-revoke-failed:${response.status}` };
+    persistRuntimeSession({
+      access_token: runtimeAccessToken,
+      refresh_token: runtimeRefreshToken,
+      expires_at: Math.floor(runtimeAccessTokenExpiresAt / 1000)
+    });
   } catch (error) {
-    return { ok: false, error: String(error?.message || error) };
+    console.warn(`[LiveDesk Hub] Refreshed session persistence failed: ${error?.message || error}`);
   }
+  return runtimeAccessToken;
 }
 
 async function verifySupabaseUser(accessToken) {
@@ -834,80 +660,14 @@ function requireHubFeatureAccess(_req, res, next) {
 }
 
 const agentDataDir = process.env.LIVEDESK_DATA_DIR || undefined;
-securityAuditStore = createSecurityAuditStore({ dataDir: agentDataDir });
-
-function requestAuditHash(value) {
-  try {
-    return crypto.createHash('sha256').update(JSON.stringify(value ?? {}), 'utf8').digest('base64url');
-  } catch {
-    return crypto.createHash('sha256').update('[unserializable]', 'utf8').digest('base64url');
-  }
-}
-
-function securityAuditEvent(event = {}) {
-  const runtime = runtimeManager.getSnapshot();
-  return {
-    actorAccountId: event.actorAccountId || runtime.userId || '',
-    actorUserId: event.actorUserId || runtime.userId || '',
-    hubId: event.hubId || runtime.deviceId || '',
-    ...event
-  };
-}
-
-function markSecurityAuditFailed(error) {
-  if (securityAuditHealthy) {
-    securityAuditHealthy = false;
-    console.error(`[LiveDesk Hub] SECURITY AUDIT FAILURE: ${error?.message || error}`);
-  }
-}
-
-async function recordSecurityAuditRequired(event = {}) {
-  if (!securityAuditStore || !securityAuditHealthy) {
-    const error = new Error('security-audit-unavailable');
-    error.code = 'security-audit-unavailable';
-    throw error;
-  }
-  try {
-    return await securityAuditStore.record(securityAuditEvent(event));
-  } catch (error) {
-    markSecurityAuditFailed(error);
-    throw error;
-  }
-}
-
-function recordSecurityAudit(event = {}) {
-  void recordSecurityAuditRequired(event).catch(() => {
-    // Required mutation paths await recordSecurityAuditRequired directly.
-    // Best-effort lifecycle telemetry still marks the global audit gate failed.
-  });
-}
-
 const liveDeskSettingsStore = new LiveDeskSettingsStore({ dataDir: agentDataDir });
-const captureStore = new CaptureStore({
-  dataDir: agentDataDir,
-  getRetentionPolicy: () => liveDeskSettingsStore.getCached()?.filesAudio?.captureAutoDelete || 'never',
-  onRetentionDelete: result => recordSecurityAudit({
-    action: 'privacy.capture.retention-delete',
-    phase: 'complete',
-    result: 'success',
-    authMethod: 'settings-retention-policy',
-    details: result
-  })
-});
+const captureStore = new CaptureStore({ dataDir: agentDataDir });
 void captureStore.initialize().catch(error => {
   console.warn(`[LiveDesk Hub] capture store initialization failed: ${error instanceof Error ? error.message : String(error)}`);
 });
-void liveDeskSettingsStore.getRecord()
-  .then(() => captureStore.enforceRetention())
-  .catch(error => {
-    console.warn(`[LiveDesk Hub] settings or capture retention load failed: ${error instanceof Error ? error.message : String(error)}`);
-  });
-const captureRetentionTimer = setInterval(() => {
-  void captureStore.enforceRetention().catch(error => {
-    console.warn(`[LiveDesk Hub] capture retention failed: ${error instanceof Error ? error.message : String(error)}`);
-  });
-}, 60 * 60_000);
-captureRetentionTimer.unref?.();
+void liveDeskSettingsStore.getRecord().catch(error => {
+  console.warn(`[LiveDesk Hub] settings load failed: ${error instanceof Error ? error.message : String(error)}`);
+});
 
 const udpTransport = createHubUdpTransport({
   env: process.env,
@@ -918,7 +678,6 @@ const udpTransport = createHubUdpTransport({
 const remoteHub = createRemoteHub({
   managerPackage: '@livedesk/hub',
   managerVersion: packageInfo.version,
-  dataDir: agentDataDir,
   env: {
     ...process.env,
     MINDEXEC_MANAGER_PACKAGE: '@livedesk/hub',
@@ -930,10 +689,6 @@ const remoteHub = createRemoteHub({
   emitEvent: handleRemoteHubEvent,
   emitFrame: broadcastRemoteBinaryFrame,
   emitAudio: broadcastRemoteBinaryAudio,
-  getSecurityIdentity: () => ({
-    accountId: runtimeManager.getSnapshot().userId || testSecurityAccountId,
-    hubId: remoteHub?.getSecurityStatus?.().hubId || ''
-  }),
   getEffectiveDevicePolicy: ({ deviceId, capabilities }) => buildEffectiveDevicePolicy(liveDeskSettingsStore.getCached(), { deviceId, capabilities }),
   getWelcomeDevicePolicy: ({ deviceId, capabilities }) => {
     const policy = buildEffectiveDevicePolicy(liveDeskSettingsStore.getCached(), { deviceId, capabilities });
@@ -1038,8 +793,6 @@ if (process.env.LIVEDESK_DESKTOP_HOST !== '1') {
     remoteHub,
     currentManagerVersion: process.env.LIVEDESK_MANAGER_VERSION || packageInfo.version,
     currentClientVersion: process.env.LIVEDESK_CLIENT_PACKAGE_VERSION || '',
-    updateManifestUrl: process.env.LIVEDESK_UPDATE_MANIFEST_URL || '',
-    updatePublicKey: process.env.LIVEDESK_UPDATE_PUBLIC_KEY || '',
     restartSupported: !!String(process.env.LIVEDESK_HUB_UPDATE_REQUEST_PATH || '').trim(),
     requestHubRestart
   });
@@ -1367,21 +1120,6 @@ async function dispatchAgentMcpTool(session, name, args = {}) {
     return { ok: false, error: 'codex-tool-limit-reached' };
   }
   session.toolCallCount += 1;
-  if (isRetiredAgentMutatingToolName(name)) {
-    recordAgentAudit({
-      event: 'tool-rejected',
-      runId: session.runId,
-      deviceIds: [],
-      toolName: name,
-      category: 'mutation',
-      decision: 'deny',
-      status: 'rejected',
-      permissionMode: session.permissionPolicy?.mode,
-      policyHash: session.permissionPolicyHash,
-      details: { reason: 'agent-mutating-tool-disabled' }
-    });
-    return { ok: false, error: 'agent-mutating-tool-disabled' };
-  }
   const tool = getAgentToolDefinition(name);
   if (!tool) return { ok: false, error: 'codex-tool-not-allowed' };
   const validationError = validateAgentMcpArguments(name, args);
@@ -1574,18 +1312,11 @@ async function synchronizeAgentEnablement() {
 }
 
 const hubFilesystem = createHubFilesystem();
-const fileTransferCommandAckTimeoutMs = readPositiveIntegerEnv(
-  'LIVEDESK_FILE_CHUNK_ACK_TIMEOUT_MS',
-  30_000
-);
 hubTransferJobs = createHubTransferJobs({
   filesystem: hubFilesystem,
   remoteHub,
   maxConcurrent: Number(process.env.LIVEDESK_MAX_FILE_JOBS || 2),
-  commandResultTimeoutMs: fileTransferCommandAckTimeoutMs,
-  getMaxFileSizeBytes: () => Number(
-    liveDeskSettingsStore.getCached()?.filesAudio?.maxFileSizeBytes
-    || 1024 * 1024 * 1024)
+  commandResultTimeoutMs: readPositiveIntegerEnv('LIVEDESK_FILE_CHUNK_ACK_TIMEOUT_MS', 30_000)
 });
 const hubSharedFolders = createHubSharedFolders({
   filesystem: hubFilesystem,
@@ -1706,7 +1437,7 @@ app.use((req, res, next) => {
     res.setHeader('Access-Control-Allow-Origin', origin);
     res.setHeader('Access-Control-Allow-Private-Network', 'true');
     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-LiveDesk-Admin-Session, X-LiveDesk-Admin-CSRF, X-LiveDesk-CSRF');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
     res.setHeader('Vary', 'Origin, Access-Control-Request-Headers, Access-Control-Request-Private-Network');
   }
   if (req.method === 'OPTIONS') {
@@ -1715,143 +1446,7 @@ app.use((req, res, next) => {
   }
   next();
 });
-const parseHubJsonBody = express.json({ limit: '32mb' });
-function parseHubJsonRequest(req, res, next, onParsed = next) {
-  parseHubJsonBody(req, res, error => {
-    if (!error) {
-      onParsed();
-      return;
-    }
-    const type = String(error?.type || '');
-    const code = String(error?.code || '');
-    const bodyError = type === 'entity.parse.failed'
-      ? { status: 400, error: 'invalid-json' }
-      : type === 'entity.too.large'
-        ? { status: 413, error: 'request-too-large' }
-        : type === 'request.aborted' || type === 'stream.not.readable' || code === 'ECONNABORTED'
-          ? { status: 400, error: 'request-body-unavailable' }
-          : null;
-    if (!bodyError) {
-      next(error);
-      return;
-    }
-    if (res.headersSent || res.destroyed || req.destroyed) return;
-    res.status(bodyError.status).json({ ok: false, error: bodyError.error });
-  });
-}
-app.use((req, res, next) => {
-  const mutating = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method);
-  if (!enforceLocalAdminAuth || req.path === '/api/security/session' || req.method === 'OPTIONS') {
-    if (mutating) parseHubJsonRequest(req, res, next);
-    else next();
-    return;
-  }
-  const authorizedLauncherShutdown = req.method === 'POST'
-    && req.path === '/api/runtime/shutdown'
-    && isLoopbackAddress(req.socket?.remoteAddress)
-    && launcherShutdownToken
-    && secureExactTestTokenMatches(
-      String(req.headers['x-livedesk-launcher-shutdown'] || ''),
-      launcherShutdownToken
-    );
-  if (authorizedLauncherShutdown) {
-    req.liveDeskLauncherShutdown = true;
-    parseHubJsonRequest(req, res, next);
-    return;
-  }
-  const sensitiveRead = req.method === 'GET'
-    && ['/api/security/audit', '/api/security/rendezvous-issuer', '/api/privacy/inventory'].includes(req.path);
-  if (!mutating && !sensitiveRead) {
-    next();
-    return;
-  }
-  const adminToken = String(req.headers['x-livedesk-admin-session'] || '');
-  const csrfToken = String(req.headers['x-livedesk-admin-csrf'] || '');
-  if (!secureExactTestTokenMatches(adminToken, localAdminSessionToken)) {
-    recordSecurityAudit({
-      action: 'local-admin.request',
-      phase: 'complete',
-      result: 'rejected',
-      reason: 'admin-session-required',
-      requestHash: requestAuditHash({ method: req.method, path: req.path }),
-      authMethod: 'local-admin-session'
-    });
-    res.status(401).json({ ok: false, error: 'local-admin-session-required' });
-    return;
-  }
-  if (mutating && !secureExactTestTokenMatches(csrfToken, localAdminCsrfToken)) {
-    recordSecurityAudit({
-      action: 'local-admin.request',
-      phase: 'complete',
-      result: 'rejected',
-      reason: 'csrf-token-required',
-      requestHash: requestAuditHash({ method: req.method, path: req.path }),
-      authMethod: 'local-admin-session'
-    });
-    res.status(403).json({ ok: false, error: 'csrf-token-required' });
-    return;
-  }
-  if (!securityAuditHealthy) {
-    res.status(503).json({ ok: false, error: 'security-audit-unavailable' });
-    return;
-  }
-  req.liveDeskAdminSessionId = localAdminSessionId;
-  if (!mutating) {
-    next();
-    return;
-  }
-
-  const beginMutationAudit = () => {
-    const mutationRequestHash = requestAuditHash({ method: req.method, path: req.path });
-    void recordSecurityAuditRequired({
-    action: 'local-admin.mutation',
-    phase: 'accepted',
-    result: 'accepted',
-    sessionId: localAdminSessionId,
-    requestHash: mutationRequestHash,
-    authMethod: 'local-admin-session',
-    details: { method: req.method, path: req.path }
-  }).then(() => {
-    const originalEnd = res.end.bind(res);
-    let completionStarted = false;
-    res.end = (...args) => {
-      if (completionStarted) return res;
-      completionStarted = true;
-      const statusCode = Number(res.statusCode || 200);
-      void recordSecurityAuditRequired({
-        action: 'local-admin.mutation',
-        phase: 'complete',
-        result: statusCode >= 200 && statusCode < 400 ? 'success' : 'rejected',
-        reason: statusCode >= 400 ? `http-${statusCode}` : '',
-        sessionId: localAdminSessionId,
-        requestHash: mutationRequestHash,
-        authMethod: 'local-admin-session',
-        details: { method: req.method, path: req.path, statusCode }
-      }).then(() => {
-        originalEnd(...args);
-      }).catch(error => {
-        if (res.headersSent) {
-          res.destroy(error);
-          return;
-        }
-        const callback = [...args].reverse().find(value => typeof value === 'function');
-        const body = JSON.stringify({ ok: false, error: 'security-audit-unavailable' });
-        res.statusCode = 503;
-        res.removeHeader('Content-Length');
-        res.removeHeader('Transfer-Encoding');
-        res.setHeader('Content-Type', 'application/json; charset=utf-8');
-        res.setHeader('Content-Length', Buffer.byteLength(body));
-        originalEnd(body, 'utf8', callback);
-      });
-      return res;
-    };
-    next();
-    }).catch(() => {
-      res.status(503).json({ ok: false, error: 'security-audit-unavailable' });
-    });
-  };
-  parseHubJsonRequest(req, res, next, beginMutationAudit);
-});
+app.use(express.json({ limit: '32mb' }));
 app.use((req, res, next) => {
   if (runtimeRole === 'client' && req.path.startsWith('/api/remote')) {
     res.status(403).json(roleGuardResponse(runtimeRole, 'hub'));
@@ -2006,7 +1601,6 @@ function normalizeTransferFiles(value) {
       name,
       relativePath,
       size: byteLength,
-      sha256: crypto.createHash('sha256').update(Buffer.from(dataBase64, 'base64')).digest('hex'),
       mimeType: String(entry?.type || entry?.mimeType || '').slice(0, 160),
       lastModified: Number(entry?.lastModified || 0) || 0,
       dataBase64
@@ -2026,31 +1620,16 @@ function normalizeTransferChunk(body = {}) {
   const totalBytes = Math.max(0, Math.floor(Number(body.totalBytes) || 0));
   const byteLength = dataBase64 ? Buffer.byteLength(dataBase64, 'base64') : 0;
   const final = body.final === true;
-  const maxFileSizeBytes = Math.max(1, Number(
-    liveDeskSettingsStore.getCached()?.filesAudio?.maxFileSizeBytes
-    || 1024 * 1024 * 1024));
 
   if (!name || !relativePath || offset > totalBytes || offset + byteLength > totalBytes) {
     return { ok: false, error: 'invalid-file-transfer-chunk' };
   }
-  if (totalBytes > maxFileSizeBytes) {
-    return { ok: false, error: 'file-transfer-file-too-large', totalBytes };
-  }
   if (byteLength > MAX_FILE_TRANSFER_CHUNK_BYTES) {
     return { ok: false, error: 'file-transfer-chunk-too-large', byteLength };
   }
   if (byteLength === 0 && !(final && totalBytes === 0 && offset === 0)) {
     return { ok: false, error: 'empty-file-transfer-chunk' };
   }
-  const suppliedSha256 = String(body.sha256 || '').trim().toLowerCase();
-  const sha256 = /^[a-f0-9]{64}$/.test(suppliedSha256)
-    ? suppliedSha256
-    : final && offset === 0 && totalBytes === byteLength
-      ? crypto.createHash('sha256').update(Buffer.from(dataBase64, 'base64')).digest('hex')
-      : '';
-  if (final && !sha256) {
-    return { ok: false, error: 'file-transfer-sha256-required', byteLength };
-  }
 
   return {
     ok: true,
@@ -2062,7 +1641,6 @@ function normalizeTransferChunk(body = {}) {
       byteLength,
       dataBase64,
       final,
-      sha256,
       mimeType: String(body.type || body.mimeType || '').slice(0, 160),
       lastModified: Number(body.lastModified || 0) || 0
     }
@@ -2768,11 +2346,6 @@ function replaceExpectedFrameBindingForClient(ws, deviceId, expectedBinding = nu
     && bindingIdentity === frameLaneBindingIdentity(currentExpectedBinding)) {
     expectedBinding.readySent = currentExpectedBinding?.readySent === true
       || expectedBinding.readySent === true;
-    expectedBinding.replayedKeyFrameSeq = Math.max(
-      0,
-      Number(currentExpectedBinding?.replayedKeyFrameSeq || 0),
-      Number(expectedBinding.replayedKeyFrameSeq || 0)
-    );
     ws.liveDeskExpectedStreamBindingsByDeviceId.set(normalizedDeviceId, expectedBinding);
     if (!lane.bindingEpochsByDeviceId.has(normalizedDeviceId)) {
       lane.bindingEpochsByDeviceId.set(normalizedDeviceId, 1);
@@ -2811,50 +2384,6 @@ function replaceExpectedFrameBindingForClient(ws, deviceId, expectedBinding = nu
   return bindingIdentity;
 }
 
-function replayExpectedBindingKeyFrame(ws, expectedBinding) {
-  if (!ws || ws.readyState !== ws.OPEN || !expectedBinding) {
-    return false;
-  }
-  const deviceId = String(expectedBinding.deviceId || '').trim();
-  const currentBinding = ws.liveDeskExpectedStreamBindingsByDeviceId instanceof Map
-    ? ws.liveDeskExpectedStreamBindingsByDeviceId.get(deviceId)
-    : null;
-  const bindingIdentity = frameLaneBindingIdentity(expectedBinding);
-  if (!deviceId
-    || !bindingIdentity
-    || bindingIdentity !== frameLaneBindingIdentity(currentBinding)) {
-    return false;
-  }
-  const cached = remoteHub.getFramePayload(deviceId, 'live', {
-    requireKeyFrame: true,
-    streamId: expectedBinding.streamId,
-    sessionId: expectedBinding.sessionId,
-    commandId: expectedBinding.commandId,
-    captureGeneration: expectedBinding.captureGeneration,
-    streamPurpose: expectedBinding.streamPurpose,
-    monitorIndex: expectedBinding.monitorIndex
-  });
-  const frameSeq = Number(cached?.frame?.frameSeq || 0);
-  if (!cached
-    || cached.frame?.isKeyFrame !== true
-    || !Number.isSafeInteger(frameSeq)
-    || frameSeq <= 0
-    || Number(currentBinding?.replayedKeyFrameSeq || 0) === frameSeq) {
-    return false;
-  }
-  currentBinding.replayedKeyFrameSeq = frameSeq;
-  broadcastRemoteBinaryFrame({
-    kind: 'live',
-    deviceId,
-    frame: cached.frame,
-    payload: cached.payload,
-    mimeType: cached.mimeType,
-    byteLength: cached.byteLength,
-    replayedForBinding: true
-  });
-  return true;
-}
-
 function dropQueuedFrameAtForLane(lane, dropIndex) {
   const droppedBefore = lane.dropped;
   const droppedItem = removeFrameLaneQueueItem(lane, dropIndex);
@@ -3181,7 +2710,7 @@ function enqueueFramePacketForClient(ws, packetOwner, meta) {
 }
 // FRAME_LANE_GENERATION_CONTRACT_END
 
-function updateFrameSubscription(ws, payload = {}) {
+function updateFrameSubscription(ws, payload = {}) {
   const previousDeviceIds = ws.liveDeskDeviceIds instanceof Set
     ? new Set(ws.liveDeskDeviceIds)
     : new Set();
@@ -3214,41 +2743,43 @@ function updateFrameSubscription(ws, payload = {}) {
   const targetIds = newlySubscribedIds.length > 0 ? newlySubscribedIds : deviceIds;
   for (const deviceId of targetIds.slice(0, 80)) {
     startFrameSubscriptionLive(ws, 'subscribe', deviceId, { reuseExisting: true });
-  }
-}
-
-function refreshFrameSubscriptionLive(ws, payload = {}) {
-  if (!ws || ws.readyState !== 1) {
-    return;
-  }
-  const requestedIds = normalizeDeviceIds(payload.deviceIds ?? payload.devices ?? payload.deviceId);
-  const subscribedIds = [...(ws.liveDeskDeviceIds || [])];
-  const targetIds = requestedIds.length > 0
-    ? requestedIds.filter(deviceId => ws.liveDeskDeviceIds?.has?.(deviceId))
-    : subscribedIds;
-  if (targetIds.length === 0) {
-    return;
-  }
-  ws.liveDeskAutoStart = /^(1|true|yes|on|live)$/i.test(String(
-    payload.autoStartLive ?? payload.startLive ?? ws.liveDeskAutoStart ?? ''
-  ));
-  ws.liveDeskLiveOptions = normalizeLiveOptions({
-    ...(ws.liveDeskLiveOptions || {}),
-    ...payload,
-    monitorSelections: {
-      ...(ws.liveDeskLiveOptions?.monitorSelections || {}),
-      ...(payload.monitorSelections || {})
-    }
-  });
-  for (const deviceId of targetIds.slice(0, 80)) {
-    startFrameSubscriptionLive(ws, 'watchdog', deviceId, {
-      ...ws.liveDeskLiveOptions,
-      reuseExisting: true
-    });
-  }
-}
-
-function startFrameSubscriptionLive(
+  }
+}
+
+function refreshFrameSubscriptionLive(ws, payload = {}) {
+  if (!ws || ws.readyState !== 1) {
+    return;
+  }
+  const requestedIds = normalizeDeviceIds(payload.deviceIds ?? payload.devices ?? payload.deviceId);
+  const subscribedIds = [...(ws.liveDeskDeviceIds || [])];
+  const targetIds = requestedIds.length > 0
+    ? requestedIds.filter(deviceId => ws.liveDeskDeviceIds?.has?.(deviceId))
+    : subscribedIds;
+  if (targetIds.length === 0) {
+    return;
+  }
+  ws.liveDeskAutoStart = /^(1|true|yes|on|live)$/i.test(String(
+    payload.autoStartLive ?? payload.startLive ?? ws.liveDeskAutoStart ?? ''
+  ));
+  ws.liveDeskLiveOptions = normalizeLiveOptions({
+    ...(ws.liveDeskLiveOptions || {}),
+    ...payload,
+    forceRestart: false,
+    reuseExisting: true,
+    monitorSelections: {
+      ...(ws.liveDeskLiveOptions?.monitorSelections || {}),
+      ...(payload.monitorSelections || {})
+    }
+  });
+  for (const deviceId of targetIds.slice(0, 80)) {
+    startFrameSubscriptionLive(ws, 'watchdog', deviceId, {
+      ...ws.liveDeskLiveOptions,
+      reuseExisting: true
+    });
+  }
+}
+
+function startFrameSubscriptionLive(
   ws,
   reason = 'subscribe',
   onlyDeviceId = '',
@@ -3348,7 +2879,6 @@ function startFrameSubscriptionLive(
         continue;
       }
       cancelPendingFrameStreamStop(deviceId, result.streamId, String(liveOptions.streamPurpose || 'wall'));
-      const replayedKeyFrame = replayExpectedBindingKeyFrame(ws, expectedBinding);
       started.push({
         deviceId: expectedBinding.deviceId,
         sessionId: expectedBinding.sessionId,
@@ -3357,8 +2887,7 @@ function startFrameSubscriptionLive(
         commandId: expectedBinding.commandId,
         captureGeneration: expectedBinding.captureGeneration,
         monitorIndex: expectedBinding.monitorIndex,
-        ready: expectedBinding.readySent === true,
-        replayedKeyFrame,
+        ready: reusedFrameReady,
         fps: result.fps,
         reused: result.reused === true
       });
@@ -4186,22 +3715,6 @@ app.get('/api/health', (_req, res) => {
   res.json(buildHubHealthPayload());
 });
 
-app.get('/api/security/session', (req, res) => {
-  noStore(res);
-  if (!isLoopbackAddress(req.socket?.remoteAddress) || !isLoopbackHostname(requestHostname(req))) {
-    res.status(403).json({ ok: false, error: 'local-admin-session-loopback-only' });
-    return;
-  }
-  res.json({
-    ok: true,
-    sessionId: localAdminSessionId,
-    adminToken: localAdminSessionToken,
-    csrfToken: localAdminCsrfToken,
-    issuedAt: new Date().toISOString(),
-    expiresOnProcessExit: true
-  });
-});
-
 if (persistentSessionGcEnabled) {
   app.post('/api/test/persistent-session/gc', (req, res) => {
     noStore(res);
@@ -4255,15 +3768,6 @@ app.patch('/api/settings', async (req, res) => {
       await agentSettingsStore.update({ enabled: record.settings.agent?.enabled === true });
     }
     remoteHub.refreshDevicePolicies();
-    void captureStore.enforceRetention().catch(() => undefined);
-    recordSecurityAudit({
-      action: 'settings.security-policy.updated',
-      phase: 'complete',
-      result: 'success',
-      requestHash: requestAuditHash(patch),
-      authMethod: 'local-admin-session',
-      details: { revision: record.revision, sections: Object.keys(patch) }
-    });
     res.json({ ok: true, revision: record.revision, updatedAt: record.updatedAt, settings: record.settings });
   } catch (error) {
     if (error instanceof SettingsConflictError) {
@@ -4434,124 +3938,10 @@ app.get('/api/security/trusted-devices', (_req, res) => {
   res.json({ ok: true, devices });
 });
 
-app.get('/api/security/rendezvous-issuer', (_req, res) => {
-  noStore(res);
-  const security = remoteHub.getSecurityStatus();
-  res.json({
-    ok: true,
-    hubId: security.hubId,
-    issuerKeyId: security.hubIssuerKeyId,
-    publicKey: security.hubPublicKey,
-    algorithm: 'P-256/SHA-256',
-    environmentVariable: 'LIVEDESK_UDP_RENDEZVOUS_TRUSTED_ISSUER_PUBLIC_KEYS'
-  });
-});
-
-app.get('/api/security/audit', async (req, res) => {
-  noStore(res);
-  try {
-    res.json({
-      ok: true,
-      healthy: securityAuditHealthy,
-      verification: await securityAuditStore.verify(),
-      audit: await securityAuditStore.list({ limit: req.query?.limit, action: req.query?.action })
-    });
-  } catch (error) {
-    securityAuditHealthy = false;
-    res.status(503).json({ ok: false, error: error?.code || 'security-audit-unavailable' });
-  }
-});
-
-app.get('/api/privacy/inventory', async (_req, res) => {
-  noStore(res);
-  try {
-    const [captures, sharedFolders, verification] = await Promise.all([
-      captureStore.list(),
-      hubSharedFolders.list(),
-      securityAuditStore.verify()
-    ]);
-    res.json({
-      ok: true,
-      inventory: {
-        authenticated: runtimeManager.getSnapshot().authenticated === true,
-        captures: captures.length,
-        sharedFolderDefinitions: sharedFolders.length,
-        trustedDeviceCredentials: remoteHub.getSecurityStatus().devices.length,
-        securityAuditRecords: verification.records,
-        agentAuditRetained: (await agentAuditStore.list({ limit: 500 })).length
-      }
-    });
-  } catch (error) {
-    res.status(503).json({ ok: false, error: String(error?.code || error?.message || 'privacy-inventory-unavailable').slice(0, 120) });
-  }
-});
-
-app.delete('/api/privacy/local-data', async (req, res) => {
-  noStore(res);
-  if (String(req.body?.confirmation || '') !== 'DELETE-LIVEDESK-LOCAL-DATA') {
-    res.status(400).json({ ok: false, error: 'privacy-delete-confirmation-required' });
-    return;
-  }
-  try {
-    const providerLogout = await revokeRuntimeProviderSession();
-    const hostTarget = runtimeRole === 'hub'
-      ? await clearHubHostTarget('privacy-delete')
-      : { ok: true, active: false };
-    clearRuntimeSession();
-    for (const device of remoteHub.getSecurityStatus().devices) {
-      remoteHub.disconnectDevice(device.deviceId, 'privacy-local-data-delete');
-    }
-    const trustedDeviceCredentials = remoteHub.clearDeviceCredentials();
-    const transferJobs = hubTransferJobs.clear();
-    const captures = await captureStore.removeAll();
-    const sharedFolders = await hubSharedFolders.clear();
-    await agentAuditStore.clear();
-    await securityAuditStore.reset();
-    securityAuditHealthy = true;
-    await securityAuditStore.record({
-      action: 'privacy.local-data.deleted',
-      phase: 'complete',
-      result: 'success',
-      authMethod: 'local-admin-session',
-      details: {
-        capturesRemoved: captures.removed,
-        captureBytesRemoved: captures.removedBytes,
-        sharedFolderDefinitionsRemoved: sharedFolders.removed,
-        trustedDeviceCredentialsRemoved: trustedDeviceCredentials,
-        transferJobRecordsRemoved: transferJobs.removed,
-        providerSessionRevoked: providerLogout.revoked === true
-      }
-    });
-    res.json({
-      ok: true,
-      localDeleted: true,
-      providerLogout,
-      hostTarget,
-      captures,
-      sharedFolders,
-      trustedDeviceCredentials,
-      transferJobs,
-      preserved: ['settings-preferences', 'hub-device-identity', 'application-binaries']
-    });
-  } catch (error) {
-    securityAuditHealthy = false;
-    res.status(503).json({ ok: false, error: String(error?.code || error?.message || 'privacy-delete-failed').slice(0, 120) });
-  }
-});
-
 app.delete('/api/security/trusted-devices/:deviceId', (req, res) => {
   noStore(res);
-  const disconnected = remoteHub.disconnectDevice(req.params.deviceId, 'trusted-device-revoked');
-  const credentialRevoked = remoteHub.revokeDeviceCredential(req.params.deviceId, 'trusted-device-revoked');
-  const revoked = disconnected === true || credentialRevoked === true;
-  recordSecurityAudit({
-    action: 'security.device.revoked',
-    phase: 'complete',
-    result: revoked ? 'success' : 'not-found',
-    deviceId: req.params.deviceId,
-    authMethod: 'local-admin-session'
-  });
-  res.json({ ok: revoked, revoked, deviceId: req.params.deviceId });
+  const result = remoteHub.disconnectDevice(req.params.deviceId, 'trusted-device-revoked');
+  res.json({ ok: result === true, revoked: result === true, deviceId: req.params.deviceId });
 });
 
 app.post('/api/security/revoke-all', (_req, res) => {
@@ -4559,11 +3949,8 @@ app.post('/api/security/revoke-all', (_req, res) => {
   const devices = remoteHub.listDevices({ includeDataUrl: false });
   let revoked = 0;
   for (const device of devices) {
-    const disconnected = device.connected && remoteHub.disconnectDevice(device.deviceId, 'trusted-devices-revoked');
-    const credentialRevoked = remoteHub.revokeDeviceCredential(device.deviceId, 'trusted-devices-revoked');
-    if (disconnected || credentialRevoked) revoked += 1;
+    if (device.connected && remoteHub.disconnectDevice(device.deviceId, 'trusted-devices-revoked')) revoked += 1;
   }
-  recordSecurityAudit({ action: 'security.devices.revoke-all', phase: 'complete', result: 'success', authMethod: 'local-admin-session', details: { revoked } });
   res.json({ ok: true, revoked });
 });
 
@@ -4927,16 +4314,8 @@ app.post('/api/runtime/restart', (_req, res) => {
   }, 150);
 });
 
-app.post('/api/runtime/shutdown', (req, res) => {
+app.post('/api/runtime/shutdown', (_req, res) => {
   noStore(res);
-  recordSecurityAudit({
-    action: 'runtime.shutdown',
-    phase: 'requested',
-    result: 'accepted',
-    authMethod: req.liveDeskLauncherShutdown === true
-      ? 'launcher-internal-shutdown-token'
-      : 'local-admin-session'
-  });
   runtimeManager.emit('runtime.shutdown.requested', { role: runtimeRole });
   res.json({ ok: true, shuttingDown: true, role: runtimeRole });
   setTimeout(() => {
@@ -4975,8 +4354,6 @@ app.post('/api/auth/session', async (req, res) => {
   const { access_token: accessToken, refresh_token: refreshToken, expires_at: expiresAt } = normalized.session;
   try {
     const user = await verifySupabaseUser(accessToken);
-    runtimeSessionGeneration += 1;
-    runtimeRefreshPromise = null;
     runtimeAccessToken = accessToken;
     runtimeRefreshToken = refreshToken;
     runtimeAccessTokenExpiresAt = normalizeSessionExpiryMs(expiresAt);
@@ -4993,26 +4370,9 @@ app.post('/api/auth/session', async (req, res) => {
     if (runtimeRole === 'hub') {
       startHubHostTargetLeaseRenewal();
     }
-    recordSecurityAudit({
-      action: 'auth.session.established',
-      phase: 'complete',
-      result: 'success',
-      actorAccountId: user.id,
-      actorUserId: user.id,
-      authMethod: 'supabase-access-refresh',
-      requestHash: requestAuditHash({ userId: user.id, expiresAt })
-    });
     res.json({ ok: true, authenticated: true, persisted, userId: user.id, role: runtimeRole, hostTarget });
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    recordSecurityAudit({
-      action: 'auth.session.establish',
-      phase: 'complete',
-      result: 'rejected',
-      reason: message,
-      authMethod: 'supabase-access-refresh',
-      requestHash: requestAuditHash({ hasAccessToken: Boolean(req.body?.accessToken || req.body?.access_token), hasRefreshToken: Boolean(req.body?.refreshToken || req.body?.refresh_token) })
-    });
     const status = authVerificationHttpStatus(message);
     res.status(status).json({ ok: false, error: message });
   }
@@ -5308,30 +4668,11 @@ function startHubHostTargetLeaseRenewal() {
 
 app.delete('/api/auth/session', async (_req, res) => {
   noStore(res);
-  const actorUserId = runtimeManager.getSnapshot().userId || '';
   const hostTarget = runtimeRole === 'hub'
     ? await clearHubHostTarget('logout')
     : { ok: true, active: false };
-  const providerLogout = await revokeRuntimeProviderSession();
   clearRuntimeSession();
-  recordSecurityAudit({
-    action: 'auth.session.revoked',
-    phase: 'complete',
-    result: providerLogout.ok ? 'success' : 'provider-error',
-    actorAccountId: actorUserId,
-    actorUserId,
-    reason: providerLogout.error || '',
-    authMethod: 'supabase-local-signout',
-    details: { localCleared: true, providerRevoked: providerLogout.revoked === true, alreadyInvalid: providerLogout.alreadyInvalid === true }
-  });
-  res.status(providerLogout.ok ? 200 : 502).json({
-    ok: providerLogout.ok,
-    authenticated: false,
-    localCleared: true,
-    role: runtimeRole,
-    hostTarget,
-    providerLogout
-  });
+  res.json({ ok: true, authenticated: false, role: runtimeRole, hostTarget });
 });
 
 app.get('/api/hub/status', (_req, res) => {
@@ -5682,33 +5023,7 @@ app.post('/api/remote/files/from-hub', requireHubFeatureAccess, (req, res) => {
     const job = hubTransferJobs.create({
       itemIds,
       deviceIds,
-      remoteDirectory: req.body?.remoteDirectory,
-      onComplete: async ({ completed, job: completedJob }) => {
-        await recordSecurityAuditRequired({
-          action: 'remote.file.job',
-          phase: 'complete',
-          result: completed ? 'success' : 'failed',
-          reason: completed ? '' : completedJob?.error || 'file-transfer-failed',
-          deviceIds,
-          sessionId: completedJob?.jobId || '',
-          requestHash: requestAuditHash({
-            jobId: completedJob?.jobId || '',
-            deviceIds,
-            remoteDirectory: req.body?.remoteDirectory || ''
-          }),
-          authMethod: 'local-admin-session',
-          details: {
-            state: completedJob?.state || '',
-            totalFiles: Number(completedJob?.totalFiles || 0),
-            completedFiles: Number(completedJob?.completedFiles || 0),
-            totalBytes: Number(completedJob?.totalBytes || 0),
-            sentBytes: Number(completedJob?.sentBytes || 0),
-            failedTargets: Array.isArray(completedJob?.failedTargets)
-              ? completedJob.failedTargets.length
-              : 0
-          }
-        });
-      }
+      remoteDirectory: req.body?.remoteDirectory
     });
     res.status(202).json({ ok: true, jobId: job.jobId, state: job.state });
   } catch (error) {
@@ -5790,80 +5105,56 @@ app.post('/api/remote/filesystem/shared-folders/:folderId/sync', requireHubFeatu
   }
 });
 
-app.post('/api/remote/files/transfer', requireHubFeatureAccess, async (req, res) => {
+app.post('/api/remote/files/transfer', requireHubFeatureAccess, (req, res) => {
   noStore(res);
   const deviceIds = normalizeDeviceIds(req.body?.deviceIds);
   if (deviceIds.length === 0) {
-    recordSecurityAudit({ action: 'remote.file.transfer', phase: 'complete', result: 'rejected', reason: 'no-target-devices', authMethod: 'local-admin-session' });
     res.status(400).json({ ok: false, error: 'no-target-devices' });
     return;
   }
   const normalized = normalizeTransferFiles(req.body?.files);
   if (!normalized.ok) {
-    recordSecurityAudit({ action: 'remote.file.transfer', phase: 'complete', result: 'rejected', reason: normalized.error, deviceIds, authMethod: 'local-admin-session' });
     res.status(400).json({ ok: false, error: normalized.error, totalBytes: normalized.totalBytes || 0 });
     return;
   }
   const transferId = String(req.body?.transferId || crypto.randomUUID()).replace(/[^a-zA-Z0-9_.:-]/g, '-').slice(0, 128);
   const remoteDirectory = String(req.body?.remoteDirectory || '').replace(/[\0\r\n\t]/g, ' ').trim().slice(0, 600);
   const queuedAt = new Date().toISOString();
-  try {
-    const results = await Promise.all(deviceIds.map(async deviceId => ({
-      deviceId,
-      ...await remoteHub.sendCommandAwaitResult(deviceId, {
-        command: 'file.transfer',
-        payload: {
-          transferId,
-          remoteDirectory,
-          files: normalized.files,
-          totalBytes: normalized.totalBytes,
-          requestedAt: queuedAt
-        }
-      }, { timeoutMs: fileTransferCommandAckTimeoutMs })
-    })));
-    const queued = results.filter(result => result.queued).length;
-    const acknowledged = results.filter(result => result.acknowledged).length;
-    const success = acknowledged === deviceIds.length;
-    const partial = acknowledged > 0 && !success;
-    const error = success ? undefined : partial ? 'partial-transfer-failed' : 'no-transfer-acknowledged';
-    await recordSecurityAuditRequired({
-      action: 'remote.file.transfer',
-      phase: 'complete',
-      result: success ? 'success' : partial ? 'partial' : 'rejected',
-      reason: error || '',
-      deviceIds,
-      sessionId: transferId,
-      requestHash: requestAuditHash({ transferId, remoteDirectory, files: normalized.files.map(file => ({ name: file.name, relativePath: file.relativePath, byteLength: file.size })), totalBytes: normalized.totalBytes }),
-      authMethod: 'local-admin-session',
-      details: { queued, acknowledged, total: deviceIds.length, totalBytes: normalized.totalBytes, files: normalized.files.length }
-    });
-    res.json({
-      ok: success,
-      transferId,
-      queued,
-      acknowledged,
-      total: deviceIds.length,
-      totalBytes: normalized.totalBytes,
-      files: normalized.files.length,
-      results,
-      error
-    });
-  } catch (error) {
-    res.status(503).json({ ok: false, error: error?.code || 'security-audit-unavailable' });
-  }
+  const results = deviceIds.map(deviceId => ({
+    deviceId,
+    ...remoteHub.sendCommand(deviceId, {
+      command: 'file.transfer',
+      payload: {
+        transferId,
+        remoteDirectory,
+        files: normalized.files,
+        totalBytes: normalized.totalBytes,
+        requestedAt: queuedAt
+      }
+    })
+  }));
+  const queued = results.filter(result => result.ok).length;
+  res.json({
+    ok: queued > 0,
+    transferId,
+    queued,
+    total: deviceIds.length,
+    totalBytes: normalized.totalBytes,
+    files: normalized.files.length,
+    results,
+    error: queued > 0 ? undefined : 'no-transfer-queued'
+  });
 });
 
-app.post('/api/remote/files/chunk', requireHubFeatureAccess, async (req, res) => {
+app.post('/api/remote/files/chunk', requireHubFeatureAccess, (req, res) => {
   noStore(res);
   const deviceIds = normalizeDeviceIds(req.body?.deviceIds);
   if (deviceIds.length === 0) {
-    recordSecurityAudit({ action: 'remote.file.chunk', phase: 'complete', result: 'rejected', reason: 'no-target-devices', authMethod: 'local-admin-session' });
     res.status(400).json({ ok: false, error: 'no-target-devices' });
     return;
   }
   const normalized = normalizeTransferChunk(req.body || {});
   if (!normalized.ok) {
-    recordSecurityAudit({ action: 'remote.file.chunk', phase: 'complete', result: 'rejected', reason: normalized.error, deviceIds, authMethod: 'local-admin-session' });
     res.status(400).json({ ok: false, error: normalized.error, byteLength: normalized.byteLength || 0 });
     return;
   }
@@ -5871,50 +5162,30 @@ app.post('/api/remote/files/chunk', requireHubFeatureAccess, async (req, res) =>
   const transferId = String(req.body?.transferId || crypto.randomUUID()).replace(/[^a-zA-Z0-9_.:-]/g, '-').slice(0, 128);
   const remoteDirectory = String(req.body?.remoteDirectory || '').replace(/[\0\r\n\t]/g, ' ').trim().slice(0, 600);
   const queuedAt = new Date().toISOString();
-  try {
-    const results = await Promise.all(deviceIds.map(async deviceId => ({
-      deviceId,
-      ...await remoteHub.sendCommandAwaitResult(deviceId, {
-        command: 'file.transfer.chunk',
-        payload: {
-          transferId,
-          remoteDirectory,
-          ...normalized.chunk,
-          requestedAt: queuedAt
-        }
-      }, { timeoutMs: fileTransferCommandAckTimeoutMs })
-    })));
-    const queued = results.filter(result => result.queued).length;
-    const acknowledged = results.filter(result => result.acknowledged).length;
-    const success = acknowledged === deviceIds.length;
-    const partial = acknowledged > 0 && !success;
-    const error = success ? undefined : partial ? 'partial-transfer-failed' : 'no-transfer-acknowledged';
-    await recordSecurityAuditRequired({
-      action: 'remote.file.chunk',
-      phase: normalized.chunk.final ? 'complete' : 'progress',
-      result: success ? 'success' : partial ? 'partial' : 'rejected',
-      reason: error || '',
-      deviceIds,
-      sessionId: transferId,
-      requestHash: requestAuditHash({ transferId, remoteDirectory, offset: normalized.chunk.offset, byteLength: normalized.chunk.byteLength, final: normalized.chunk.final }),
-      authMethod: 'local-admin-session',
-      details: { queued, acknowledged, total: deviceIds.length, byteLength: normalized.chunk.byteLength, offset: normalized.chunk.offset, final: normalized.chunk.final }
-    });
-    res.json({
-      ok: success,
-      transferId,
-      queued,
-      acknowledged,
-      total: deviceIds.length,
-      byteLength: normalized.chunk.byteLength,
-      offset: normalized.chunk.offset,
-      final: normalized.chunk.final,
-      results,
-      error
-    });
-  } catch (error) {
-    res.status(503).json({ ok: false, error: error?.code || 'security-audit-unavailable' });
-  }
+  const results = deviceIds.map(deviceId => ({
+    deviceId,
+    ...remoteHub.sendCommand(deviceId, {
+      command: 'file.transfer.chunk',
+      payload: {
+        transferId,
+        remoteDirectory,
+        ...normalized.chunk,
+        requestedAt: queuedAt
+      }
+    })
+  }));
+  const queued = results.filter(result => result.ok).length;
+  res.json({
+    ok: queued > 0,
+    transferId,
+    queued,
+    total: deviceIds.length,
+    byteLength: normalized.chunk.byteLength,
+    offset: normalized.chunk.offset,
+    final: normalized.chunk.final,
+    results,
+    error: queued > 0 ? undefined : 'no-transfer-queued'
+  });
 });
 
 const MANUAL_POWER_ACTIONS = new Set(['lock', 'sleep', 'restart', 'shutdown']);
@@ -6203,65 +5474,14 @@ if (existsSync(webIndexPath)) {
   });
 }
 
-function isAuthorizedAdminWebSocket(req) {
-  if (!enforceLocalAdminAuth) return true;
-  const protocols = String(req.headers['sec-websocket-protocol'] || '')
-    .split(',')
-    .map(value => value.trim())
-    .filter(Boolean);
-  const adminToken = protocols.find(value => value.startsWith('livedesk-admin-'))?.slice('livedesk-admin-'.length) || '';
-  const csrfToken = protocols.find(value => value.startsWith('livedesk-admin-csrf-'))?.slice('livedesk-admin-csrf-'.length) || '';
-  return secureExactTestTokenMatches(adminToken, localAdminSessionToken)
-    && secureExactTestTokenMatches(csrfToken, localAdminCsrfToken);
-}
-
 httpServer.on('upgrade', (req, socket, head) => {
   if (!isTrustedBrowserRequest(req)) {
     socket.write('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
     socket.destroy();
     return;
   }
-  if (!isAuthorizedAdminWebSocket(req)) {
-    recordSecurityAudit({
-      action: 'local-admin.websocket',
-      phase: 'complete',
-      result: 'rejected',
-      reason: 'admin-session-required',
-      requestHash: requestAuditHash({ path: req.url || '' }),
-      authMethod: 'local-admin-websocket'
-    });
-    socket.write('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\n\r\n');
-    socket.destroy();
-    return;
-  }
-  let parsed;
   try {
-    parsed = new URL(req.url || '/', `http://${req.headers.host || '127.0.0.1'}`);
-  } catch {
-    socket.write('HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n');
-    socket.destroy();
-    return;
-  }
-  const websocketPath = parsed.pathname;
-  if (![
-    '/api/remote/frames/ws',
-    '/api/remote/atlas/ws',
-    '/api/remote/input/ws',
-    '/api/remote/audio/ws'
-  ].includes(websocketPath)) {
-    socket.write('HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n');
-    socket.destroy();
-    return;
-  }
-  void recordSecurityAuditRequired({
-    action: 'local-admin.websocket',
-    phase: 'accepted',
-    result: 'accepted',
-    sessionId: localAdminSessionId,
-    requestHash: requestAuditHash({ path: websocketPath }),
-    authMethod: 'local-admin-websocket',
-    details: { path: websocketPath }
-  }).then(() => {
+    const parsed = new URL(req.url || '/', `http://${req.headers.host || '127.0.0.1'}`);
     if (parsed.pathname === '/api/remote/frames/ws') {
       frameWss.handleUpgrade(req, socket, head, ws => frameWss.emit('connection', ws, req));
       return;
@@ -6278,10 +5498,12 @@ httpServer.on('upgrade', (req, socket, head) => {
       audioWss.handleUpgrade(req, socket, head, ws => audioWss.emit('connection', ws, req));
       return;
     }
-  }).catch(() => {
-    socket.write('HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\n\r\n');
+    socket.write('HTTP/1.1 404 Not Found\r\n\r\n');
     socket.destroy();
-  });
+  } catch {
+    socket.write('HTTP/1.1 400 Bad Request\r\n\r\n');
+    socket.destroy();
+  }
 });
 
 frameWss.on('connection', (ws, req) => {
@@ -6305,11 +5527,11 @@ frameWss.on('connection', (ws, req) => {
   ws.on('message', data => {
     try {
       const payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));
-      if (payload?.type === 'subscribe') {
-        updateFrameSubscription(ws, payload);
-      } else if (payload?.type === 'refresh-live') {
-        refreshFrameSubscriptionLive(ws, payload);
-      } else if (payload?.type === 'restart-live') {
+      if (payload?.type === 'subscribe') {
+        updateFrameSubscription(ws, payload);
+      } else if (payload?.type === 'refresh-live') {
+        refreshFrameSubscriptionLive(ws, payload);
+      } else if (payload?.type === 'restart-live') {
         restartFrameSubscriptionLive(ws, payload);
       }
     } catch {
@@ -6398,17 +5620,12 @@ inputWss.on('connection', ws => {
   inputClients.add(ws);
   ws.liveDeskInputClientId = `riws-${++inputClientSeq}`;
   ws.liveDeskInputDeviceIds = new Set();
-  ws.liveDeskInputAuditReady = false;
   try {
     ws._socket?.setNoDelay?.(true);
   } catch {
     // Best-effort latency hint for browser input sockets.
   }
   ws.on('message', data => {
-    if (ws.liveDeskInputAuditReady !== true) {
-      sendJson(ws, { type: 'RemoteInputError', error: 'security-audit-pending' });
-      return;
-    }
     let payload;
     try {
       payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));
@@ -6449,43 +5666,19 @@ inputWss.on('connection', ws => {
     });
   });
   const releaseBrowserInputOwner = reason => {
-    if (ws.liveDeskInputReleased) return;
-    ws.liveDeskInputReleased = true;
     inputClients.delete(ws);
     for (const deviceId of ws.liveDeskInputDeviceIds || []) {
       remoteHub.releaseInputOwner(deviceId, ws.liveDeskInputClientId, reason);
     }
-    void recordSecurityAuditRequired({
-      action: 'remote.control.browser-session',
-      phase: 'complete',
-      result: 'success',
-      reason,
-      deviceIds: [...(ws.liveDeskInputDeviceIds || [])],
-      sessionId: ws.liveDeskInputClientId,
-      authMethod: 'local-admin-websocket'
-    }).catch(() => {
-      // The global fail-closed gate is marked by recordSecurityAuditRequired.
-    });
     ws.liveDeskInputDeviceIds?.clear?.();
   };
   ws.on('close', () => releaseBrowserInputOwner('browser-input-websocket-closed'));
   ws.on('error', () => releaseBrowserInputOwner('browser-input-websocket-error'));
-  void recordSecurityAuditRequired({
-    action: 'remote.control.browser-session',
-    phase: 'start',
-    result: 'success',
-    sessionId: ws.liveDeskInputClientId,
-    authMethod: 'local-admin-websocket'
-  }).then(() => {
-    ws.liveDeskInputAuditReady = true;
-    sendJson(ws, {
-      type: 'RemoteInputSocketReady',
-      protocol: 'livedesk.remote.input.json.v1',
-      clientId: ws.liveDeskInputClientId,
-      timestamp: new Date().toISOString()
-    });
-  }).catch(() => {
-    ws.close(1011, 'security-audit-unavailable');
+  sendJson(ws, {
+    type: 'RemoteInputSocketReady',
+    protocol: 'livedesk.remote.input.json.v1',
+    clientId: ws.liveDeskInputClientId,
+    timestamp: new Date().toISOString()
   });
 });
 
@@ -6501,9 +5694,6 @@ httpServer.listen(httpPort, httpHost, () => {
   console.log(`[LiveDesk Hub] Version ${managerVersion}`);
   console.log(`[LiveDesk Hub] HTTP API http://${httpHost}:${httpPort}`);
   console.log(`[LiveDesk Hub] Client endpoint ${status.agentEndpoint} pair=${status.pairTokenPreview}`);
-  void restorePersistedHubSessionAtStartup().catch(error => {
-    console.warn(`[LiveDesk Hub] Saved sign-in startup restore deferred to the Hub page: ${error?.message || error}`);
-  });
 });
 
 const roleWatchTimer = runtimeRole === 'hub'
@@ -6585,7 +5775,6 @@ function shutdownHub(signal) {
     const startedAt = Date.now();
     console.log(`[LiveDesk Hub] Shutdown started signal=${signal} grace=${hubShutdownGraceMs}ms timeout=${hubShutdownTimeoutMs}ms.`);
     if (roleWatchTimer) clearInterval(roleWatchTimer);
-    clearInterval(captureRetentionTimer);
     clearInterval(browserWebSocketHeartbeatTimer);
     runSynchronousShutdownStep('update manager close', () => liveDeskUpdateManager?.close());
     atlasClients.clear();