@livedesk/hub 0.1.54 → 0.1.56

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.54",
+  "version": "0.1.56",
   "description": "VuvoDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",
@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "@ffmpeg-installer/ffmpeg": "^1.1.0",
-    "@livedesk/runtime-core": "0.1.6",
+    "@livedesk/runtime-core": "0.1.7",
     "@openai/codex-sdk": "0.145.0",
     "cors": "^2.8.5",
     "express": "^4.21.2",

package/src/console-relay.js

@@ -1,7 +1,8 @@
 import WebSocket from 'ws';
 
-const DEFAULT_CONSOLE_RELAY_URL = 'https://livedesk-wake.lovecrdm.workers.dev';
-const DEFAULT_RETRY_DELAYS_MS = [1_000, 2_000, 5_000, 10_000, 20_000];
+const DEFAULT_CONSOLE_RELAY_URL = 'https://livedesk-wake.lovecrdm.workers.dev';
+const DEFAULT_RETRY_DELAYS_MS = [1_000, 2_000, 5_000, 10_000, 20_000, 60_000];
+const HTTP_429_RETRY_DELAY_MS = 60_000;
 const MAX_CHANNELS = 32;
 const MAX_HTTP_REQUEST_BYTES = 1024 * 1024;
 const MAX_HTTP_RESPONSE_BYTES = 4 * 1024 * 1024;
@@ -103,9 +104,12 @@ export function createHubConsoleRelay(options = {}) {
   let generation = 0;
   let stopped = true;
   let state = relayUrl ? 'idle' : 'disabled';
-  let lastConnectedAt = '';
-  let lastError = relayUrl instanceof URL ? '' : relayUrl === '' ? '' : 'invalid-relay-url';
-  let droppedBinaryMessages = 0;
+  let lastConnectedAt = '';
+  let lastError = relayUrl instanceof URL ? '' : relayUrl === '' ? '' : 'invalid-relay-url';
+  let lastHttpStatus = 0;
+  let retryNotBeforeAt = 0;
+  let nextRetryAt = '';
+  let droppedBinaryMessages = 0;
 
   const sendRelay = (payload, bypassBackpressure = false) => {
     if (!relaySocket || relaySocket.readyState !== WebSocketImpl.OPEN) return false;
@@ -265,11 +269,15 @@ export function createHubConsoleRelay(options = {}) {
   const handleMessage = raw => {
     const payload = parseMessage(raw);
     if (!payload?.type) return;
-    if (payload.type === 'relay-ready') {
-      state = 'connected';
-      lastConnectedAt = new Date().toISOString();
-      lastError = '';
-      return;
+    if (payload.type === 'relay-ready') {
+      state = 'connected';
+      lastConnectedAt = new Date().toISOString();
+      lastError = '';
+      lastHttpStatus = 0;
+      retryAttempt = 0;
+      retryNotBeforeAt = 0;
+      nextRetryAt = '';
+      return;
     }
     if (payload.type === 'console-detached') {
       closeConsoleChannels(String(payload.consoleId || ''));
@@ -294,22 +302,27 @@ export function createHubConsoleRelay(options = {}) {
     }
   };
 
-  const scheduleReconnect = connect => {
-    if (stopped || retryTimer || !(relayUrl instanceof URL)) return;
-    const delayMs = retryDelaysMs[Math.min(retryAttempt, retryDelaysMs.length - 1)];
-    retryAttempt += 1;
-    state = 'waiting-retry';
-    retryTimer = setTimeout(() => {
-      retryTimer = null;
-      void connect();
+  const scheduleReconnect = connect => {
+    if (stopped || retryTimer || !(relayUrl instanceof URL)) return;
+    const sequenceDelayMs = retryDelaysMs[Math.min(retryAttempt, retryDelaysMs.length - 1)];
+    const delayMs = Math.max(sequenceDelayMs, retryNotBeforeAt - Date.now(), 0);
+    retryAttempt += 1;
+    state = 'waiting-retry';
+    nextRetryAt = new Date(Date.now() + delayMs).toISOString();
+    retryTimer = setTimeout(() => {
+      retryTimer = null;
+      nextRetryAt = '';
+      void connect();
     }, delayMs);
     retryTimer.unref?.();
   };
 
   const connect = async () => {
     if (stopped || !(relayUrl instanceof URL) || !deviceId) return;
-    const ownerGeneration = ++generation;
-    state = 'connecting';
+    const ownerGeneration = ++generation;
+    let ownerHttpStatus = 0;
+    state = 'connecting';
+    nextRetryAt = '';
     let accessToken = '';
     try {
       accessToken = String(await getAccessToken() || '').trim();
@@ -339,25 +352,46 @@ export function createHubConsoleRelay(options = {}) {
       try { socket.terminate?.(); } catch { /* stale connect is already gone */ }
       return;
     }
-    relaySocket = socket;
-    socket.once('open', () => {
-      if (relaySocket !== socket || ownerGeneration !== generation || stopped) return;
-      retryAttempt = 0;
-      state = 'authenticating';
-    });
+    relaySocket = socket;
+    socket.once('open', () => {
+      if (relaySocket !== socket || ownerGeneration !== generation || stopped) return;
+      state = 'authenticating';
+    });
+    socket.once('unexpected-response', (_request, response) => {
+      if (ownerGeneration !== generation || stopped) {
+        response.resume?.();
+        return;
+      }
+      const status = Math.max(0, Number(response?.statusCode || 0));
+      ownerHttpStatus = status;
+      lastHttpStatus = status;
+      lastError = status > 0
+        ? `Console relay returned HTTP ${status}`
+        : 'Console relay returned an unexpected response.';
+      if (status === 429) {
+        retryNotBeforeAt = Math.max(retryNotBeforeAt, Date.now() + HTTP_429_RETRY_DELAY_MS);
+      }
+      if (relaySocket === socket) relaySocket = null;
+      response.resume?.();
+      try { socket.terminate?.(); } catch { /* retry owns the rejected upgrade */ }
+      scheduleReconnect(connect);
+    });
     socket.on('message', raw => {
       if (relaySocket === socket && ownerGeneration === generation && !stopped) handleMessage(raw);
     });
-    socket.once('close', () => {
-      if (relaySocket === socket) relaySocket = null;
-      if (ownerGeneration !== generation || stopped) return;
-      state = 'disconnected';
-      closeAllLocalSockets('relay-disconnected');
-      scheduleReconnect(connect);
+    socket.once('close', () => {
+      if (relaySocket === socket) relaySocket = null;
+      if (ownerGeneration !== generation || stopped) return;
+      if (!retryTimer) state = 'disconnected';
+      closeAllLocalSockets('relay-disconnected');
+      scheduleReconnect(connect);
     });
-    socket.once('error', error => {
-      lastError = error instanceof Error ? error.message : String(error);
-      try { socket.terminate?.(); } catch { /* close handler owns retry */ }
+    socket.once('error', error => {
+      if (ownerHttpStatus <= 0) {
+        lastHttpStatus = 0;
+        lastError = error instanceof Error ? error.message : String(error);
+      }
+      try { socket.terminate?.(); } catch { /* close handler owns retry */ }
     });
   };
 
@@ -373,10 +407,13 @@ export function createHubConsoleRelay(options = {}) {
       return;
     }
     generation += 1;
-    if (retryTimer) {
+    if (retryTimer) {
       clearTimeout(retryTimer);
       retryTimer = null;
-    }
+    }
+    retryAttempt = 0;
+    retryNotBeforeAt = 0;
+    nextRetryAt = '';
     const socket = relaySocket;
     relaySocket = null;
     try { socket?.terminate?.(); } catch { /* refresh owns the exact socket */ }
@@ -389,7 +426,8 @@ export function createHubConsoleRelay(options = {}) {
     stopped = true;
     generation += 1;
     if (retryTimer) clearTimeout(retryTimer);
-    retryTimer = null;
+    retryTimer = null;
+    nextRetryAt = '';
     closeAllLocalSockets('hub-shutdown');
     const socket = relaySocket;
     relaySocket = null;
@@ -408,9 +446,12 @@ export function createHubConsoleRelay(options = {}) {
       connected: state === 'connected',
       localWebSocketChannels: localSockets.size,
       pendingHttpRequests: pendingHttp.size,
-      droppedBinaryMessages,
-      lastConnectedAt,
-      lastError
+      droppedBinaryMessages,
+      lastConnectedAt,
+      lastError,
+      lastHttpStatus,
+      retryAttempt,
+      nextRetryAt
     })
   };
 }
@@ -420,5 +461,5 @@ export const consoleRelayContract = Object.freeze({
   maxHttpRequestBytes: MAX_HTTP_REQUEST_BYTES,
   maxHttpResponseBytes: MAX_HTTP_RESPONSE_BYTES,
   maxBufferedBytes: MAX_RELAY_BUFFERED_BYTES,
-  binaryHeaderBytes: BINARY_HEADER_BYTES
-});
+  binaryHeaderBytes: BINARY_HEADER_BYTES
+});

package/src/remote-hub.js

@@ -1,7 +1,14 @@
-import net from 'net';
-import os from 'os';
-import crypto from 'crypto';
-import { createHubRelayControl } from './transport/relay-hub-control.js';
+import net from 'net';
+import os from 'os';
+import crypto from 'crypto';
+import {
+    acceptSecureDirectSocket,
+    isDirectSecureChannel,
+    isLoopbackSocketAddress,
+    isPrivateSocketAddress,
+    isSecureDirectHandshakeStart
+} from '../../runtime-core/src/direct-secure-transport.js';
+import { createHubRelayControl } from './transport/relay-hub-control.js';
 import { parseExactLiveStreamMonitorIndex } from './live-stream-monitor-contract.js';
 import {
     BoundedSegmentedBuffer,
@@ -2397,9 +2404,12 @@ export function createRemoteHub(options = {}) {
     const hostInstanceId = safeString(options.hostInstanceId ?? env.LIVEDESK_HUB_INSTANCE_ID ?? env.MINDEXEC_BRIDGE_INSTANCE_ID ?? crypto.randomUUID(), 128) || crypto.randomUUID();
     const publicEndpoint = safeString(env.LIVEDESK_REMOTE_PUBLIC_ENDPOINT || env.MINDEXEC_REMOTE_PUBLIC_ENDPOINT || env.REMOTE_HUB_PUBLIC_ENDPOINT, 256);
     const publicHost = safeString(env.LIVEDESK_REMOTE_PUBLIC_HOST || env.MINDEXEC_REMOTE_PUBLIC_HOST || env.REMOTE_HUB_PUBLIC_HOST, 128);
-    const pairToken = safeString(
-        options.pairToken || env.REMOTE_HUB_PAIR_TOKEN || env.LIVEDESK_CLIENT_PAIR_TOKEN || env.MINDEXEC_REMOTE_PAIR_TOKEN || crypto.randomBytes(6).toString('hex'),
-        256);
+    const pairToken = safeString(
+        options.pairToken || env.REMOTE_HUB_PAIR_TOKEN || env.LIVEDESK_CLIENT_PAIR_TOKEN || env.MINDEXEC_REMOTE_PAIR_TOKEN || crypto.randomBytes(32).toString('hex'),
+        256);
+    const allowInsecurePrivateDirect = isEnabledValue(
+        options.allowInsecureDirect ?? env.LIVEDESK_ALLOW_INSECURE_DIRECT,
+        false);
     const relayControl = options.relayControl && typeof options.relayControl === 'object'
         ? options.relayControl
         : createHubRelayControl({
@@ -7949,10 +7959,24 @@ export function createRemoteHub(options = {}) {
     function handleAgentMessage(socket, state, message) {
         if (!message || typeof message !== 'object') {
             return;
-        }
-
-        if (!state.authenticated) {
-            if (message.type === 'hello' && socket.__liveDeskRelayControl === true) {
+        }
+
+        if (!state.authenticated) {
+            if (socket.__liveDeskSecureDirect === true) {
+                const applicationChannel = message.type === 'slot.assign'
+                    ? 'control'
+                    : message.type === 'hello'
+                        ? (safeString(message.channel || message.Channel, 40).toLowerCase() || 'control')
+                        : '';
+                if (applicationChannel
+                    && (!isDirectSecureChannel(applicationChannel)
+                        || applicationChannel !== socket.__liveDeskSecureChannel)) {
+                    writeJsonLine(socket, { type: 'error', error: 'direct-secure-channel-mismatch' });
+                    socket.end();
+                    return;
+                }
+            }
+            if (message.type === 'hello' && socket.__liveDeskRelayControl === true) {
                 message = {
                     ...message,
                     capabilities: {
@@ -7988,7 +8012,7 @@ export function createRemoteHub(options = {}) {
                 return;
             }
 
-            const channel = safeString(message.channel || message.Channel, 40).toLowerCase();
+            const channel = safeString(message.channel || message.Channel, 40).toLowerCase() || 'control';
             if (channel === 'input') {
                 const device = attachInputSocket(socket, message);
                 if (!device) {
@@ -8538,18 +8562,60 @@ export function createRemoteHub(options = {}) {
         if (firstChunk) {
             processData(firstChunk);
         }
-    }
-
-    function handleSocket(socket) {
-        socket.once('data', chunk => {
-            const firstChunk = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-            if (isRemoteHubWebSocketUpgradeStart(firstChunk)) {
-                handleWebSocketUpgradeSocket(socket, firstChunk);
-                return;
-            }
-
-            handleTcpAgentSocket(socket, firstChunk);
-        });
+    }
+
+    function handleSocket(socket) {
+        allSockets.add(socket);
+        const prefaceTimer = setTimeout(() => {
+            if (!socket.destroyed) socket.destroy();
+        }, 10_000);
+        prefaceTimer.unref?.();
+        socket.once('close', () => {
+            clearTimeout(prefaceTimer);
+            allSockets.delete(socket);
+        });
+        socket.once('data', chunk => {
+            clearTimeout(prefaceTimer);
+            const firstChunk = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            if (isSecureDirectHandshakeStart(firstChunk)) {
+                void acceptSecureDirectSocket(socket, firstChunk, pairToken)
+                    .then(secureSocket => {
+                        allSockets.delete(socket);
+                        handleTcpAgentSocket(secureSocket);
+                    })
+                    .catch(error => {
+                        if (socket.destroyed) return;
+                        if (error?.code === 'LIVEDESK_INVALID_PAIR_TOKEN_REJECTED') {
+                            const forcedCloseTimer = setTimeout(() => socket.destroy(), 1_000);
+                            forcedCloseTimer.unref?.();
+                            socket.once('close', () => clearTimeout(forcedCloseTimer));
+                            if (typeof socket.destroySoon === 'function') socket.destroySoon();
+                            else socket.end();
+                            return;
+                        }
+                        socket.destroy();
+                    });
+                return;
+            }
+
+            const remoteAddress = socket.remoteAddress;
+            const allowLegacyPlaintext = isLoopbackSocketAddress(remoteAddress)
+                || (allowInsecurePrivateDirect && isPrivateSocketAddress(remoteAddress));
+            if (isRemoteHubWebSocketUpgradeStart(firstChunk)) {
+                if (!allowLegacyPlaintext) {
+                    socket.destroy();
+                    return;
+                }
+                handleWebSocketUpgradeSocket(socket, firstChunk);
+                return;
+            }
+
+            if (!allowLegacyPlaintext) {
+                socket.destroy();
+                return;
+            }
+            handleTcpAgentSocket(socket, firstChunk);
+        });
 
         socket.once('error', () => {
             // The transport-specific handler owns logging after the first byte.
@@ -8571,10 +8637,10 @@ export function createRemoteHub(options = {}) {
                 started = true;
                 boundPort = candidateServer.address()?.port || port;
                 lastError = '';
-                logEvent('remote', `VuvoDesk Hub client endpoint listening on tcp://${host}:${boundPort}`, 'success');
-                if (host === '0.0.0.0' || host === '::') {
-                    logWarn('remote', 'VuvoDesk Hub client endpoint is externally reachable. Use a strong pairing token and trusted network.');
-                }
+                logEvent('remote', `VuvoDesk Hub client endpoint listening on tcp://${host}:${boundPort}`, 'success');
+                if (host === '0.0.0.0' || host === '::') {
+                    logWarn('remote', 'VuvoDesk Hub client endpoint is externally reachable. Non-loopback Direct connections require authenticated encryption.');
+                }
                 emitRemoteEvent('RemoteHubStarted', null);
                 resolve();
             });

package/src/server.js

@@ -4342,27 +4342,35 @@ app.post('/api/settings/agent/summary', async (req, res) => {
   }
 });
 
-app.get('/api/remote/status', (_req, res) => {
-  noStore(res);
-  if (runtimeRole !== 'hub') {
+app.get('/api/remote/status', async (_req, res) => {
+  noStore(res);
+  if (runtimeRole !== 'hub') {
     res.status(403).json({ ok: false, error: 'role-not-allowed' });
     return;
   }
-  const secretStatus = remoteHub.getStatus({ includeSecrets: true });
-  res.json({
-    ...remoteHub.getStatus({ includeSecrets: false }),
-    pairingPin: secretStatus.pairingPin,
-    product: 'LiveDesk',
-    runtimeRole,
-    deviceId: runtimeDeviceId,
-    deviceName: runtimeDeviceName,
-    roleSource: runtimeRoleSource,
-    agentPackage: '@livedesk/client',
-    consoleRelay: hubConsoleRelay?.inspect() || { enabled: false, state: 'starting' },
-    frameLanes: snapshotFrameLaneResourceHealth(),
-    update: getLiveDeskUpdateStatus()
-  });
-});
+  try {
+    const [secretStatus, wallPreferences] = await Promise.all([
+      Promise.resolve(remoteHub.getStatus({ includeSecrets: true })),
+      liveDeskSettingsStore.getWallPreferencesRecord()
+    ]);
+    res.json({
+      ...remoteHub.getStatus({ includeSecrets: false }),
+      pairingPin: secretStatus.pairingPin,
+      product: 'LiveDesk',
+      runtimeRole,
+      deviceId: runtimeDeviceId,
+      deviceName: runtimeDeviceName,
+      roleSource: runtimeRoleSource,
+      agentPackage: '@livedesk/client',
+      wallPreferences,
+      consoleRelay: hubConsoleRelay?.inspect() || { enabled: false, state: 'starting' },
+      frameLanes: snapshotFrameLaneResourceHealth(),
+      update: getLiveDeskUpdateStatus()
+    });
+  } catch (error) {
+    res.status(500).json({ ok: false, error: error instanceof Error ? error.message : String(error) });
+  }
+});
 
 app.post('/api/remote/diagnostics/transport/start', async (req, res) => {
   noStore(res);

package/src/settings/settings-schema.js

@@ -46,9 +46,11 @@ export const DEFAULT_LIVEDESK_SETTINGS = Object.freeze({
     rememberLastMonitor: true,
     keepControlReadyBetweenPages: true
   },
-  wall: {
-    performanceMode: 'auto',
-    autoStart: true,
+  wall: {
+    performanceMode: 'auto',
+    cadence: 'fast',
+    viewScale: 100,
+    autoStart: true,
     connectedOnly: false,
     keepEmptySlots: true,
     showDeviceStatus: true,
@@ -110,9 +112,10 @@ export const DEFAULT_LIVEDESK_SETTINGS = Object.freeze({
   }
 });
 
-const ENUMS = {
+const ENUMS = {
   accessMode: new Set(['trusted-only', 'ask-every-time', 'view-only', 'block-remote-access']),
-  performanceMode: new Set(['auto', 'responsive', 'quality', 'custom']),
+  performanceMode: new Set(['auto', 'responsive', 'quality', 'custom']),
+  wallCadence: new Set(['slow', 'fast']),
   permissionMode: new Set(['ask', 'safe-auto', 'full-access', 'custom']),
   wallFrameMode: new Set(['auto', 'mode2-lzo', 'mode3-h264-hw', 'mode4-h264-atlas']),
   controlFrameMode: new Set(['mode3-h264-hw', 'mode5-lzo-delta']),
@@ -169,9 +172,11 @@ const RULES = {
   control: {
     ...bools(['allowKeyboardMouse', 'allowSystemShortcuts', 'allowClipboardText', 'allowRemoteRestart', 'reconnectAfterRemoteRestart', 'allowSwitchingMonitors', 'showConnectionToolbar', 'showRemoteCursor', 'openControlOnDoubleClick', 'startRemoteAudioWithControl', 'fitRemoteScreen', 'rememberLastMonitor', 'keepControlReadyBetweenPages'])
   },
-  wall: {
-    performanceMode: { type: 'enum', values: ENUMS.performanceMode },
-    ...bools(['autoStart', 'connectedOnly', 'keepEmptySlots', 'showDeviceStatus', 'showPerformanceDetails', 'pauseHiddenTiles', 'reduceWhenHidden', 'autoAdjustTileQuality', 'rememberDevicePositions'])
+  wall: {
+    performanceMode: { type: 'enum', values: ENUMS.performanceMode },
+    cadence: { type: 'enum', values: ENUMS.wallCadence },
+    viewScale: { type: 'number', min: 0, max: 100 },
+    ...bools(['autoStart', 'connectedOnly', 'keepEmptySlots', 'showDeviceStatus', 'showPerformanceDetails', 'pauseHiddenTiles', 'reduceWhenHidden', 'autoAdjustTileQuality', 'rememberDevicePositions'])
   },
   filesAudio: {
     ...bools(['allowFileTransfer', 'allowFolderSync', 'askBeforeReceivingFiles', 'openReceivedFolder', 'notifyTransferComplete', 'allowOverwrite', 'allowRemoteAudio', 'startAudioMuted', 'rememberVolume', 'automaticallyRecoverAudio', 'showAudioTroubleshooting', 'rollingBufferEnabled', 'includeRemoteCursor']),

package/src/settings/settings-store.js

@@ -40,12 +40,22 @@ export class LiveDeskSettingsStore {
     return structuredClone(this.record);
   }
 
-  getCached() {
-    if (!this.record) return DEFAULT_LIVEDESK_SETTINGS;
-    return { ...this.record.settings, revision: this.record.revision };
-  }
-
-  async get() {
+  getCached() {
+    if (!this.record) return DEFAULT_LIVEDESK_SETTINGS;
+    return { ...this.record.settings, revision: this.record.revision };
+  }
+
+  async getWallPreferencesRecord() {
+    if (!this.record) await this.getRecord();
+    return {
+      revision: this.record.revision,
+      updatedAt: this.record.updatedAt,
+      cadence: this.record.settings.wall.cadence,
+      viewScale: this.record.settings.wall.viewScale
+    };
+  }
+
+  async get() {
     return publicSettings((await this.getRecord()).settings);
   }