@livedesk/hub 0.1.46 → 0.1.48

package/src/server.js

@@ -7,9 +7,14 @@ import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, wri
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import os from 'node:os';
-import { WebSocketServer } from 'ws';
+import { WebSocketServer } from 'ws';
 import { createRemoteHub } from './remote-hub.js';
-import { createHubConsoleRelay } from './console-relay.js';
+import {
+  REMOTE_CLIPBOARD_INPUT_ACTIONS,
+  RemoteClipboardContractError,
+  normalizeRemoteClipboardRequest
+} from './remote-clipboard-contract.mjs';
+import { createHubConsoleRelay } from './console-relay.js';
 import {
   buildImmutableRemoteFramePacket,
   createRemoteFramePacketMetrics,
@@ -40,9 +45,9 @@ import { createAgentDeviceScope, resolveAgentTargetIds } from './agents/agent-de
 import { AgentRuntimeError } from './agents/agent-runtime-error.js';
 import { AGENT_PERMISSION_MODES, createAgentPermissionPolicy, evaluateAgentToolPermission, hashAgentPermissionPolicy } from './agents/agent-permissions.js';
 import { createAgentPermissionStore } from './agents/agent-permission-store.js';
-import { createAgentAuditStore } from './agents/agent-audit-store.js';
-import { getAgentToolDefinition } from './agents/agent-tool-registry.js';
-import { enrichAgentTaskResults } from './agents/agent-result-enrichment.js';
+import { createAgentAuditStore } from './agents/agent-audit-store.js';
+import { getAgentToolDefinition } from './agents/agent-tool-registry.js';
+import { enrichAgentTaskResults } from './agents/agent-result-enrichment.js';
 import { LiveDeskSettingsStore, SettingsConflictError } from './settings/settings-store.js';
 import { effectiveDevicePolicy } from './settings/settings-schema.js';
 import { buildEffectiveDevicePolicy } from './settings/effective-device-policy.js';
@@ -204,22 +209,22 @@ let verifiedLicense = {
 let frameClientSeq = 0;
 let inputClientSeq = 0;
 let audioClientSeq = 0;
-let liveDeskUpdateManager = null;
-let hubTransferJobs = null;
-let hubConsoleRelay = null;
+let liveDeskUpdateManager = null;
+let hubTransferJobs = null;
+let hubConsoleRelay = null;
 const HUB_HOST_TARGET_LEASE_MS = Math.max(5000, readPositiveIntegerEnv('LIVEDESK_HOST_TARGET_LEASE_MS', 60_000));
 const HUB_HOST_TARGET_RENEW_MS = Math.max(1000, Math.min(
   readPositiveIntegerEnv('LIVEDESK_HOST_TARGET_RENEW_MS', 20_000),
   Math.max(1000, HUB_HOST_TARGET_LEASE_MS - 1000)
 ));
-const HUB_ACCESS_TOKEN_REFRESH_SKEW_MS = 90_000;
-const hubWakeBaseUrl = String(process.env.LIVEDESK_WAKE_URL || 'https://livedesk-wake.lovecrdm.workers.dev').trim();
-const hubConsoleRelayBaseUrl = String(
-  process.env.LIVEDESK_CONSOLE_RELAY_URL
-  || (process.env.LIVEDESK_TEST_MODE === '1' || process.env.LIVEDESK_AUTH_TEST_MODE === '1'
-    ? 'off'
-    : 'https://livedesk-wake.lovecrdm.workers.dev')
-).trim();
+const HUB_ACCESS_TOKEN_REFRESH_SKEW_MS = 90_000;
+const hubWakeBaseUrl = String(process.env.LIVEDESK_WAKE_URL || 'https://livedesk-wake.lovecrdm.workers.dev').trim();
+const hubConsoleRelayBaseUrl = String(
+  process.env.LIVEDESK_CONSOLE_RELAY_URL
+  || (process.env.LIVEDESK_TEST_MODE === '1' || process.env.LIVEDESK_AUTH_TEST_MODE === '1'
+    ? 'off'
+    : 'https://livedesk-wake.lovecrdm.workers.dev')
+).trim();
 const HUB_WAKE_NOTIFY_RETRY_MS = 60_000;
 let hubHostTargetRenewTimer = null;
 let hubHostTargetRenewInFlight = false;
@@ -513,19 +518,19 @@ async function getRuntimeAccessToken() {
   const accessToken = String(runtimeAccessToken || '').trim();
   const expiresSoon = runtimeAccessTokenExpiresAt > 0
     && runtimeAccessTokenExpiresAt <= Date.now() + HUB_ACCESS_TOKEN_REFRESH_SKEW_MS;
-  if (accessToken && !expiresSoon) {
-    return accessToken;
-  }
-
-  // The packaged Electron main process owns the encrypted refresh token and
-  // proactively sends each rotation to this child runtime. A second refresh
-  // owner here could consume the one-time token first and make the desktop
-  // shell appear signed out after sleep.
-  if (desktopMainAuthConfig) {
-    return accessToken;
-  }
-
-  const refreshToken = String(runtimeRefreshToken || '').trim();
+  if (accessToken && !expiresSoon) {
+    return accessToken;
+  }
+
+  // The packaged Electron main process owns the encrypted refresh token and
+  // proactively sends each rotation to this child runtime. A second refresh
+  // owner here could consume the one-time token first and make the desktop
+  // shell appear signed out after sleep.
+  if (desktopMainAuthConfig) {
+    return accessToken;
+  }
+
+  const refreshToken = String(runtimeRefreshToken || '').trim();
   if (!refreshToken) {
     return accessToken;
   }
@@ -629,9 +634,9 @@ async function queryAuthoritativeRuntimeRole() {
     },
     SUPABASE_AUTH_TIMEOUT_MS
   );
-  if (response.status === 401 || response.status === 403) {
-    if (!desktopMainAuthConfig) clearRuntimeSession();
-    throw new Error(`hub-role-query-not-authenticated:${response.status}`);
+  if (response.status === 401 || response.status === 403) {
+    if (!desktopMainAuthConfig) clearRuntimeSession();
+    throw new Error(`hub-role-query-not-authenticated:${response.status}`);
   }
   if (!response.ok) {
     throw new Error(`hub-role-query-failed:${response.status}`);
@@ -813,12 +818,12 @@ function getLiveDeskUpdateStatus() {
 }
 
 if (process.env.LIVEDESK_DESKTOP_HOST !== '1') {
-  liveDeskUpdateManager = createLiveDeskUpdateManager({
-    remoteHub,
-    currentManagerVersion: process.env.LIVEDESK_MANAGER_VERSION || packageInfo.version,
-    currentClientVersion: process.env.LIVEDESK_CLIENT_PACKAGE_VERSION || '',
-    excludedDeviceIds: [runtimeDeviceId],
-    restartSupported: !!String(process.env.LIVEDESK_HUB_UPDATE_REQUEST_PATH || '').trim(),
+  liveDeskUpdateManager = createLiveDeskUpdateManager({
+    remoteHub,
+    currentManagerVersion: process.env.LIVEDESK_MANAGER_VERSION || packageInfo.version,
+    currentClientVersion: process.env.LIVEDESK_CLIENT_PACKAGE_VERSION || '',
+    excludedDeviceIds: [runtimeDeviceId],
+    restartSupported: !!String(process.env.LIVEDESK_HUB_UPDATE_REQUEST_PATH || '').trim(),
     requestHubRestart
   });
 }
@@ -1278,16 +1283,16 @@ async function dispatchAgentMcpTool(session, name, args = {}) {
       remoteHub.cancelTaskBatch(result.batchId);
       return { ok: false, error: 'cancelled-by-user', batchId: result.batchId };
     }
-    const batch = remoteHub.getTaskBatch(result.batchId);
-    if (!batch) return { ok: false, error: 'task-not-found', batchId: result.batchId };
-    if (!['queued', 'running'].includes(batch.status)) {
-      const taskResults = enrichAgentTaskResults({
-        operation,
-        results: batch.results,
-        devices: remoteHub.listDevices({ includeDataUrl: false })
-          .filter(device => targetIds.includes(device.deviceId))
-      });
-      return {
+    const batch = remoteHub.getTaskBatch(result.batchId);
+    if (!batch) return { ok: false, error: 'task-not-found', batchId: result.batchId };
+    if (!['queued', 'running'].includes(batch.status)) {
+      const taskResults = enrichAgentTaskResults({
+        operation,
+        results: batch.results,
+        devices: remoteHub.listDevices({ includeDataUrl: false })
+          .filter(device => targetIds.includes(device.deviceId))
+      });
+      return {
         ok: true,
         batchId: result.batchId,
         operation,
@@ -1295,8 +1300,8 @@ async function dispatchAgentMcpTool(session, name, args = {}) {
         total: batch.total,
         completed: batch.completed,
         failed: batch.failed,
-        results: taskResults.map(item => ({ deviceId: item.deviceId, deviceName: item.deviceName, status: item.status, stage: item.stage, result: String(item.result || '').slice(0, 3000), data: item.data, error: String(item.error || '').slice(0, 500) }))
-      };
+        results: taskResults.map(item => ({ deviceId: item.deviceId, deviceName: item.deviceName, status: item.status, stage: item.stage, result: String(item.result || '').slice(0, 3000), data: item.data, error: String(item.error || '').slice(0, 500) }))
+      };
     }
     await delayAgentMcp(200);
   }
@@ -1356,16 +1361,16 @@ const hubSharedFolders = createHubSharedFolders({
   dataDir: agentDataDir
 });
 
-const app = express();
-const httpServer = createServer(app);
-hubConsoleRelay = createHubConsoleRelay({
-  url: runtimeRole === 'hub' ? hubConsoleRelayBaseUrl : 'off',
-  deviceId: runtimeDeviceId,
-  httpBaseUrl: `http://127.0.0.1:${httpPort}`,
-  getAccessToken: () => getRuntimeAccessToken(),
-  logger: console
-});
-const httpConnections = new Set();
+const app = express();
+const httpServer = createServer(app);
+hubConsoleRelay = createHubConsoleRelay({
+  url: runtimeRole === 'hub' ? hubConsoleRelayBaseUrl : 'off',
+  deviceId: runtimeDeviceId,
+  httpBaseUrl: `http://127.0.0.1:${httpPort}`,
+  getAccessToken: () => getRuntimeAccessToken(),
+  logger: console
+});
+const httpConnections = new Set();
 const frameWss = new WebSocketServer({ noServer: true, perMessageDeflate: false });
 const atlasWss = new WebSocketServer({ noServer: true, perMessageDeflate: false });
 const inputWss = new WebSocketServer({ noServer: true, perMessageDeflate: false });
@@ -1754,12 +1759,40 @@ function normalizeLiveOptions(payload = {}) {
   };
 }
 
-function sendJson(ws, payload) {
+function sendJson(ws, payload) {
   if (!ws || ws.readyState !== 1) {
     return false;
   }
   return safeWebSocketSend(ws, JSON.stringify(payload));
-}
+}
+
+function findLiveRemoteInputClient(hubConnectionId) {
+  const requestedId = String(hubConnectionId || '').trim();
+  if (!requestedId) {
+    return null;
+  }
+  for (const ws of inputClients) {
+    if (ws.readyState === 1 && ws.liveDeskInputClientId === requestedId) {
+      return ws;
+    }
+  }
+  return null;
+}
+
+function clipboardHttpStatus(error) {
+  const code = String(error || '');
+  if (code.includes('blocked-by-settings') || code === 'remote-access-blocked-by-settings') return 403;
+  if (code.includes('too-large')) return 413;
+  if (code.includes('unavailable') || code === 'device-not-connected') return 503;
+  if (code.startsWith('STALE_')
+    || code.includes('owner')
+    || code.includes('not-ready')
+    || code.includes('not-found')
+    || code.includes('already-exists')
+    || code.includes('busy')
+    || code.includes('capacity')) return 409;
+  return 400;
+}
 
 function forgetWebSocketClient(ws) {
   unregisterFrameClient(ws);
@@ -1846,6 +1879,26 @@ function hasOtherFrameStreamOwner(ws, deviceId, streamId, streamPurpose = '') {
   return false;
 }
 
+function hasOtherFrameStreamDemand(ws, deviceId, streamPurpose = '') {
+  const normalizedPurpose = String(streamPurpose || '').trim().toLowerCase();
+  if (!deviceId || !normalizedPurpose) {
+    return false;
+  }
+  for (const candidate of frameClients) {
+    if (candidate === ws || candidate.readyState !== candidate.OPEN) {
+      continue;
+    }
+    if (candidate.liveDeskAutoStart === true
+      && candidate.liveDeskDeviceIds instanceof Set
+      && candidate.liveDeskDeviceIds.has(deviceId)
+      && String(candidate.liveDeskLiveOptions?.streamPurpose || '').trim().toLowerCase()
+        === normalizedPurpose) {
+      return true;
+    }
+  }
+  return false;
+}
+
 function frameStreamStopKey(deviceId, streamId, streamPurpose) {
   return `${deviceId}\u0000${streamId}\u0000${streamPurpose}`;
 }
@@ -2147,6 +2200,15 @@ function snapshotFrameLaneResourceHealth() {
           .map(binding => String(binding?.streamPurpose || '').trim().toLowerCase())
           .filter(Boolean))]
           .slice(0, 4),
+        requestedProfile: ws.liveDeskLiveOptions ? {
+          frameMode: String(ws.liveDeskLiveOptions.frameMode || ws.liveDeskLiveOptions.mode || ''),
+          streamPurpose: String(ws.liveDeskLiveOptions.streamPurpose || ''),
+          fps: Math.max(0, Number(ws.liveDeskLiveOptions.fps || 0)),
+          maxWidth: Math.max(0, Number(ws.liveDeskLiveOptions.maxWidth || 0)),
+          maxHeight: Math.max(0, Number(ws.liveDeskLiveOptions.maxHeight || 0)),
+          quality: Math.max(0, Number(ws.liveDeskLiveOptions.quality || 0))
+        } : null,
+        sharedProfileReuseCount: Math.max(0, Number(ws.liveDeskSharedProfileReuseCount || 0)),
         queueDepth: Math.max(0, Number(lane?.queue?.length || 0)),
         queueLimit: frameClientQueueLimit(ws),
         queueHighWaterPackets: Math.max(0, Number(lane?.queuedPacketsHighWater || 0)),
@@ -2939,9 +3001,23 @@ function startFrameSubscriptionLive(
       monitorIndex,
       reuseExisting: liveOptions.forceRestart !== true
         && (liveOptions.reuseExisting === true || reason === 'subscribe' || reason === 'watchdog'),
+      // Wall capture is one shared native encoder per device. Two open browser
+      // views may ask for different soft profiles (for example mobile 5 fps at
+      // 1080p and desktop 20 fps at 540p). Once a healthy shared owner exists,
+      // those preferences must bind to that owner instead of replacing it back
+      // and forth every time either view refreshes its subscription.
+      reuseSharedExisting: liveOptions.forceRestart !== true
+        && String(liveOptions.streamPurpose || '').trim().toLowerCase() === 'wall'
+        && hasOtherFrameStreamDemand(ws, deviceId, 'wall'),
       silentReuse: reason === 'watchdog' && liveOptions.forceRestart !== true
     });
     if (result?.ok) {
+      if (result.sharedProfileReused === true) {
+        ws.liveDeskSharedProfileReuseCount = Math.max(
+          0,
+          Number(ws.liveDeskSharedProfileReuseCount || 0)
+        ) + 1;
+      }
       frameCaptureTransitionRetries.complete(ws, deviceId, intentGeneration, 'capture-started');
       const expectedBinding = {
         deviceId,
@@ -4249,10 +4325,10 @@ app.get('/api/remote/status', (_req, res) => {
     runtimeRole,
     deviceId: runtimeDeviceId,
     deviceName: runtimeDeviceName,
-    roleSource: runtimeRoleSource,
-    agentPackage: '@livedesk/client',
-    consoleRelay: hubConsoleRelay?.inspect() || { enabled: false, state: 'starting' },
-    frameLanes: snapshotFrameLaneResourceHealth(),
+    roleSource: runtimeRoleSource,
+    agentPackage: '@livedesk/client',
+    consoleRelay: hubConsoleRelay?.inspect() || { enabled: false, state: 'starting' },
+    frameLanes: snapshotFrameLaneResourceHealth(),
     update: getLiveDeskUpdateStatus()
   });
 });
@@ -4484,11 +4560,11 @@ app.post('/api/auth/session', async (req, res) => {
         csrfToken: uiSession.csrfToken,
         expiresAt: uiSession.expiresAt
       }
-    });
-    if (runtimeRole === 'hub') {
-      hubConsoleRelay?.refresh();
-      scheduleAuthenticatedHubHostTargetPublication('session-received');
-    }
+    });
+    if (runtimeRole === 'hub') {
+      hubConsoleRelay?.refresh();
+      scheduleAuthenticatedHubHostTargetPublication('session-received');
+    }
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     const status = authVerificationHttpStatus(message);
@@ -4508,11 +4584,11 @@ function getHubHostTargetLeaseStatus() {
     ...hubHostTargetLeaseState,
     renewing: hubHostTargetRenewInFlight,
     renewalIntervalMs: HUB_HOST_TARGET_RENEW_MS,
-    leaseDurationMs: HUB_HOST_TARGET_LEASE_MS,
-    authenticated: Boolean(runtimeAccessToken),
-    timerActive: Boolean(hubHostTargetRenewTimer),
-    wake: { ...hubWakeNotificationState },
-    consoleRelay: hubConsoleRelay?.inspect() || { enabled: false, state: 'starting' }
+    leaseDurationMs: HUB_HOST_TARGET_LEASE_MS,
+    authenticated: Boolean(runtimeAccessToken),
+    timerActive: Boolean(hubHostTargetRenewTimer),
+    wake: { ...hubWakeNotificationState },
+    consoleRelay: hubConsoleRelay?.inspect() || { enabled: false, state: 'starting' }
   };
 }
 
@@ -4609,9 +4685,9 @@ async function callHubSupabaseRpc(name, payload, accessToken) {
   );
   const data = await response.json().catch(() => null);
   const result = Array.isArray(data) ? data[0] : data;
-  if (response.status === 401 || response.status === 403) {
-    if (!desktopMainAuthConfig) clearRuntimeSession();
-    throw new Error(`${name}-not-authenticated:${response.status}`);
+  if (response.status === 401 || response.status === 403) {
+    if (!desktopMainAuthConfig) clearRuntimeSession();
+    throw new Error(`${name}-not-authenticated:${response.status}`);
   }
   if (!response.ok) {
     throw new Error(`${name}-failed:${response.status}`);
@@ -4816,11 +4892,11 @@ app.get('/api/hub/status', (_req, res) => {
     ...remoteHub.getStatus({ includeSecrets: false }),
     role: 'hub',
     deviceId: runtimeDeviceId,
-    deviceName: runtimeDeviceName,
-    roleSource: runtimeRoleSource,
-    runtimeStarted: true,
-    consoleRelay: hubConsoleRelay?.inspect() || { enabled: false, state: 'starting' },
-    hostTargetLease: getHubHostTargetLeaseStatus(),
+    deviceName: runtimeDeviceName,
+    roleSource: runtimeRoleSource,
+    runtimeStarted: true,
+    consoleRelay: hubConsoleRelay?.inspect() || { enabled: false, state: 'starting' },
+    hostTargetLease: getHubHostTargetLeaseStatus(),
     update: getLiveDeskUpdateStatus()
   });
 });
@@ -5106,12 +5182,64 @@ app.post('/api/remote/devices/:deviceId/status-diagnostic', (req, res) => {
   }));
 });
 
-app.post('/api/remote/devices/:deviceId/input', requireHubFeatureAccess, (req, res) => {
-  noStore(res);
-  res.json(remoteHub.sendInputControl(req.params.deviceId, req.body || {}));
-});
-
-app.get('/api/remote/filesystem/roots', requireHubFeatureAccess, async (req, res) => {
+app.post('/api/remote/devices/:deviceId/input', requireHubFeatureAccess, (req, res) => {
+  noStore(res);
+  res.json(remoteHub.sendInputControl(req.params.deviceId, req.body || {}));
+});
+
+app.post('/api/remote/devices/:deviceId/clipboard', requireHubFeatureAccess, async (req, res) => {
+  noStore(res);
+  try {
+    const request = normalizeRemoteClipboardRequest(req.body || {});
+    const inputClient = findLiveRemoteInputClient(request.hubConnectionId);
+    if (!inputClient) {
+      res.status(409).json({ ok: false, error: 'clipboard-input-owner-not-live' });
+      return;
+    }
+    const deviceId = String(req.params.deviceId || '').trim();
+    inputClient.liveDeskInputDeviceIds?.add?.(deviceId);
+
+    if (REMOTE_CLIPBOARD_INPUT_ACTIONS.has(request.action)) {
+      const result = remoteHub.sendInputControl(deviceId, {
+        type: request.action,
+        clipboardOperationId: request.operationId,
+        operationId: request.operationId,
+        clipboardDirection: request.clipboardDirection,
+        manifest: request.payload.manifest || null,
+        contentKind: request.payload.contentKind || request.payload.manifest?.contentKind || '',
+        controlSessionId: request.binding.controlSessionId,
+        controlCommandId: request.binding.controlCommandId,
+        captureGeneration: request.binding.captureGeneration,
+        monitorIndex: request.binding.monitorIndex,
+        hubConnectionId: request.hubConnectionId,
+        requestAck: true
+      });
+      res.status(result.ok ? 200 : clipboardHttpStatus(result.error)).json({
+        ok: result.ok === true,
+        action: request.action,
+        operationId: request.operationId,
+        input: result,
+        ...(result.ok ? {} : { error: result.error || 'clipboard-input-failed' })
+      });
+      return;
+    }
+
+    const result = await remoteHub.sendClipboardCommand(deviceId, request);
+    res.status(result.ok ? 200 : clipboardHttpStatus(result.error)).json(result);
+  } catch (error) {
+    const status = error instanceof RemoteClipboardContractError
+      ? error.status
+      : 500;
+    res.status(status).json({
+      ok: false,
+      error: error instanceof RemoteClipboardContractError
+        ? error.code
+        : 'clipboard-request-failed'
+    });
+  }
+});
+
+app.get('/api/remote/filesystem/roots', requireHubFeatureAccess, async (req, res) => {
   noStore(res);
   try {
     res.json(await hubFilesystem.getRoots({ refresh: /^(1|true|yes|on)$/i.test(String(req.query?.refresh || '')) }));
@@ -5827,14 +5955,14 @@ hubSharedFolders.startAutoSync(
   () => remoteHub.listDevices({ includeDataUrl: false }).filter(device => device.connected).map(device => device.deviceId),
   () => process.env.LIVEDESK_REMOTE_DIRECTORY || 'Desktop/LiveDeskFiles'
 );
-httpServer.listen(httpPort, httpHost, () => {
+httpServer.listen(httpPort, httpHost, () => {
   const status = remoteHub.getStatus({ includeSecrets: true });
   const managerVersion = String(process.env.LIVEDESK_MANAGER_VERSION || packageInfo.version || 'dev');
   console.log(`[LiveDesk Hub] Version ${managerVersion}`);
-  console.log(`[LiveDesk Hub] HTTP API http://${httpHost}:${httpPort}`);
-  console.log(`[LiveDesk Hub] Client endpoint ${status.agentEndpoint} pair=${status.pairTokenPreview}`);
-  hubConsoleRelay?.start();
-});
+  console.log(`[LiveDesk Hub] HTTP API http://${httpHost}:${httpPort}`);
+  console.log(`[LiveDesk Hub] Client endpoint ${status.agentEndpoint} pair=${status.pairTokenPreview}`);
+  hubConsoleRelay?.start();
+});
 
 const roleWatchTimer = runtimeRole === 'hub'
   ? setInterval(() => { void watchAuthoritativeRuntimeRole(); }, 5000)
@@ -5915,10 +6043,10 @@ function shutdownHub(signal) {
     const startedAt = Date.now();
     console.log(`[LiveDesk Hub] Shutdown started signal=${signal} grace=${hubShutdownGraceMs}ms timeout=${hubShutdownTimeoutMs}ms.`);
     if (roleWatchTimer) clearInterval(roleWatchTimer);
-    clearInterval(browserWebSocketHeartbeatTimer);
-    runSynchronousShutdownStep('update manager close', () => liveDeskUpdateManager?.close());
-    runSynchronousShutdownStep('mobile console relay close', () => hubConsoleRelay?.close());
-    atlasClients.clear();
+    clearInterval(browserWebSocketHeartbeatTimer);
+    runSynchronousShutdownStep('update manager close', () => liveDeskUpdateManager?.close());
+    runSynchronousShutdownStep('mobile console relay close', () => hubConsoleRelay?.close());
+    atlasClients.clear();
     runSynchronousShutdownStep('shared folder close', () => hubSharedFolders.close());
 
     const httpClosed = new Promise(resolveClose => {

package/src/settings/effective-device-policy.js

@@ -1,14 +1,36 @@
-import { effectiveDevicePolicy } from './settings-schema.js';
+import { effectiveDevicePolicy } from './settings-schema.js';
+import { REMOTE_CLIPBOARD_LIMITS } from '../remote-clipboard-contract.mjs';
 
-export function buildEffectiveDevicePolicy(settings, { deviceId = '', capabilities = {} } = {}) {
-  const policy = effectiveDevicePolicy(settings);
-  return {
+export function buildEffectiveDevicePolicy(settings, { deviceId = '', capabilities = {} } = {}) {
+  const policy = effectiveDevicePolicy(settings);
+  const clipboardV1 = capabilities.clipboardProtocol === 'livedesk.clipboard.v1';
+  const clipboardCommonLimits = clipboardV1
+    && capabilities.sessionBoundSideChannels === true
+    && Number.isSafeInteger(Number(capabilities.clipboardMaxTextBytes))
+    && Number(capabilities.clipboardMaxTextBytes) > 0
+    && Number.isSafeInteger(Number(capabilities.clipboardMaxTotalBytes))
+    && Number(capabilities.clipboardMaxTotalBytes) > 0
+    && Number.isSafeInteger(Number(capabilities.clipboardMaxChunkBytes))
+    && Number(capabilities.clipboardMaxChunkBytes) >= REMOTE_CLIPBOARD_LIMITS.maxChunkBytes;
+  const clipboardMaxImageBytes = Number(
+    capabilities.clipboardMaxImageBytes ?? capabilities.clipboardMaxPngBytes);
+  return {
     ...policy,
-    deviceId: String(deviceId || ''),
-    supported: {
-      control: capabilities.control !== false,
-      clipboardText: capabilities.clipboardText !== false,
-      fileTransfer: capabilities.fileTransfer !== false,
+    deviceId: String(deviceId || ''),
+    supported: {
+      control: capabilities.control !== false,
+      clipboardText: clipboardCommonLimits && capabilities.clipboardText === true,
+      clipboardImage: clipboardCommonLimits
+        && capabilities.clipboardImage === true
+        && Number.isSafeInteger(clipboardMaxImageBytes)
+        && clipboardMaxImageBytes > 0,
+      clipboardFiles: clipboardCommonLimits
+        && capabilities.clipboardFiles === true
+        && Number.isSafeInteger(Number(capabilities.clipboardMaxFiles))
+        && Number(capabilities.clipboardMaxFiles) > 0,
+      clipboardCopy: clipboardCommonLimits && capabilities.clipboardCopy === true,
+      clipboardPaste: clipboardCommonLimits && capabilities.clipboardPaste === true,
+      fileTransfer: capabilities.fileTransfer !== false,
       remoteAudio: capabilities.audio === true || capabilities.remoteAudio === true,
       agent: Array.isArray(capabilities.agentTools) && capabilities.agentTools.length > 0
     }

package/src/settings/settings-schema.js

@@ -13,7 +13,8 @@ export const DEFAULT_LIVEDESK_SETTINGS = Object.freeze({
     approveNewDevices: true,
     startWithComputer: true,
     keepRunningInTray: true,
-    showConnectionNotifications: true
+    showConnectionNotifications: true,
+    showThisComputer: false
   },
   security: {
     accessMode: 'trusted-only',
@@ -157,7 +158,7 @@ const numbers = (entries) => Object.fromEntries(entries.map(([key, min, max]) =>
 
 const RULES = {
   connection: {
-    ...bools(['usePinToAddDevices', 'rotatePinAfterPairing', 'allowNewDevices', 'approveNewDevices', 'startWithComputer', 'keepRunningInTray', 'showConnectionNotifications']),
+    ...bools(['usePinToAddDevices', 'rotatePinAfterPairing', 'allowNewDevices', 'approveNewDevices', 'startWithComputer', 'keepRunningInTray', 'showConnectionNotifications', 'showThisComputer']),
     ...numbers([['pinValidityMinutes', 10, 1440]])
   },
   security: {