@mindexec/cli 0.2.151 → 0.2.153

package/server.js

@@ -2125,10 +2125,13 @@ app.get('/api/local-files/:id', async (req, res) => {
 const httpServer = createServer(app);
 const wss = new WebSocketServer({ noServer: true });
 const remoteFrameWss = new WebSocketServer({ noServer: true });
+const remoteInputWss = new WebSocketServer({ noServer: true });
 const wsClients = new Set();
 const remoteFrameClients = new Set();
+const remoteInputClients = new Set();
 const shellJobs = new Map();
 let remoteFrameClientSeq = 0;
+let remoteInputClientSeq = 0;
 const remoteFrameWsDiagnostics = {
     opened: 0,
     closed: 0,
@@ -2157,6 +2160,25 @@ const remoteFrameWsDiagnostics = {
     lastAutoStartStarted: 0,
     lastAutoStartSkipped: 0
 };
+const remoteInputWsDiagnostics = {
+    opened: 0,
+    closed: 0,
+    errors: 0,
+    messagesReceived: 0,
+    messagesInvalid: 0,
+    inputsQueued: 0,
+    inputsFailed: 0,
+    pointerMovesQueued: 0,
+    keyEventsQueued: 0,
+    lastOpenAt: '',
+    lastCloseAt: '',
+    lastErrorAt: '',
+    lastInputAt: '',
+    lastDeviceId: '',
+    lastInputType: '',
+    lastCommandId: '',
+    lastError: ''
+};
 const REMOTE_FRAME_WS_AUTO_START_LIMIT = 120;
 const REMOTE_FRAME_WS_DEFAULT_FPS = 12;
 const REMOTE_FRAME_WS_DEFAULT_MAX_WIDTH = 960;
@@ -2183,6 +2205,14 @@ httpServer.on('upgrade', (req, socket, head) => {
             return;
         }
 
+        if (parsed.pathname === '/api/remote/input/ws'
+            && (!bridgeAuthRequired || token === bridgeToken)) {
+            remoteInputWss.handleUpgrade(req, socket, head, (ws) => {
+                remoteInputWss.emit('connection', ws, req);
+            });
+            return;
+        }
+
         {
             socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
             socket.destroy();
@@ -2552,6 +2582,195 @@ remoteFrameWss.on('connection', (ws, req) => {
     });
 });
 
+function sendRemoteInputClientJson(ws, payload) {
+    if (!ws || ws.readyState !== WebSocket.OPEN) {
+        return false;
+    }
+
+    try {
+        ws.send(JSON.stringify(payload));
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+function normalizeRemoteInputWsPayload(payload = {}) {
+    const outer = payload && typeof payload === 'object' ? payload : {};
+    const inputSource = outer.input && typeof outer.input === 'object'
+        ? outer.input
+        : outer.Input && typeof outer.Input === 'object'
+            ? outer.Input
+            : outer;
+    const input = { ...inputSource };
+    input.type = String(input.type ?? input.Type ?? '').trim();
+    const deviceId = String(
+        outer.deviceId
+        ?? outer.DeviceId
+        ?? input.deviceId
+        ?? input.DeviceId
+        ?? ''
+    ).trim();
+    delete input.deviceId;
+    delete input.DeviceId;
+
+    return {
+        deviceId,
+        input,
+        requestId: String(outer.requestId ?? outer.RequestId ?? '').trim(),
+        ack: outer.ack === true || outer.Ack === true
+    };
+}
+
+function serializeRemoteInputWsDiagnostics() {
+    const clients = [];
+    for (const client of remoteInputClients) {
+        clients.push({
+            id: client.remoteInputClientId || '',
+            readyState: client.readyState,
+            connectedAt: client.remoteInputConnectedAt || '',
+            received: Number(client.remoteInputReceivedCount || 0),
+            queued: Number(client.remoteInputQueuedCount || 0),
+            failed: Number(client.remoteInputFailedCount || 0),
+            bufferedAmount: Number(client.bufferedAmount || 0),
+            lastInputAt: client.remoteInputLastInputAt || '',
+            lastDeviceId: client.remoteInputLastDeviceId || '',
+            lastInputType: client.remoteInputLastInputType || ''
+        });
+    }
+
+    return {
+        protocol: 'mindexec.remote.input.json.v1',
+        path: '/api/remote/input/ws',
+        clientCount: remoteInputClients.size,
+        ...remoteInputWsDiagnostics,
+        clients
+    };
+}
+
+remoteInputWss.on('connection', (ws) => {
+    remoteInputClients.add(ws);
+    ws.remoteInputClientId = `riws-${++remoteInputClientSeq}`;
+    ws.remoteInputConnectedAt = new Date().toISOString();
+    ws.remoteInputReceivedCount = 0;
+    ws.remoteInputQueuedCount = 0;
+    ws.remoteInputFailedCount = 0;
+    remoteInputWsDiagnostics.opened += 1;
+    remoteInputWsDiagnostics.lastOpenAt = ws.remoteInputConnectedAt;
+
+    ws.on('message', data => {
+        const receivedAt = new Date().toISOString();
+        remoteInputWsDiagnostics.messagesReceived += 1;
+        ws.remoteInputReceivedCount = (ws.remoteInputReceivedCount || 0) + 1;
+
+        let payload = null;
+        try {
+            const text = Buffer.isBuffer(data) ? data.toString('utf8') : String(data || '');
+            payload = JSON.parse(text);
+        } catch {
+            remoteInputWsDiagnostics.messagesInvalid += 1;
+            sendRemoteInputClientJson(ws, {
+                type: 'RemoteInputError',
+                timestamp: receivedAt,
+                error: 'invalid-json'
+            });
+            return;
+        }
+
+        const messageType = String(payload?.type || payload?.Type || '').trim().toLowerCase();
+        if (messageType === 'ping') {
+            sendRemoteInputClientJson(ws, {
+                type: 'RemoteInputPong',
+                timestamp: receivedAt
+            });
+            return;
+        }
+
+        if (messageType !== 'input' && messageType !== 'remote.input') {
+            remoteInputWsDiagnostics.messagesInvalid += 1;
+            sendRemoteInputClientJson(ws, {
+                type: 'RemoteInputError',
+                timestamp: receivedAt,
+                error: 'unsupported-message'
+            });
+            return;
+        }
+
+        const normalized = normalizeRemoteInputWsPayload(payload);
+        if (!normalized.deviceId || !normalized.input.type) {
+            remoteInputWsDiagnostics.messagesInvalid += 1;
+            sendRemoteInputClientJson(ws, {
+                type: 'RemoteInputResult',
+                timestamp: receivedAt,
+                ok: false,
+                requestId: normalized.requestId,
+                deviceId: normalized.deviceId,
+                inputType: normalized.input.type,
+                error: !normalized.deviceId ? 'missing-device-id' : 'missing-input-type'
+            });
+            return;
+        }
+
+        const result = remoteHub.sendInputControl(normalized.deviceId, normalized.input);
+        const ok = result?.ok === true;
+        const inputType = String(normalized.input.type || '').trim();
+        remoteInputWsDiagnostics.lastInputAt = receivedAt;
+        remoteInputWsDiagnostics.lastDeviceId = normalized.deviceId;
+        remoteInputWsDiagnostics.lastInputType = inputType;
+        remoteInputWsDiagnostics.lastCommandId = String(result?.commandId || '');
+        ws.remoteInputLastInputAt = receivedAt;
+        ws.remoteInputLastDeviceId = normalized.deviceId;
+        ws.remoteInputLastInputType = inputType;
+
+        if (ok) {
+            remoteInputWsDiagnostics.inputsQueued += 1;
+            ws.remoteInputQueuedCount = (ws.remoteInputQueuedCount || 0) + 1;
+            if (/^pointermove$/i.test(inputType)) {
+                remoteInputWsDiagnostics.pointerMovesQueued += 1;
+            }
+            if (/^key(up|down)$/i.test(inputType)) {
+                remoteInputWsDiagnostics.keyEventsQueued += 1;
+            }
+        } else {
+            remoteInputWsDiagnostics.inputsFailed += 1;
+            remoteInputWsDiagnostics.lastError = String(result?.error || 'input-failed');
+            ws.remoteInputFailedCount = (ws.remoteInputFailedCount || 0) + 1;
+        }
+
+        const shouldAck = normalized.ack === true || !ok || !/^pointermove$/i.test(inputType);
+        if (shouldAck) {
+            sendRemoteInputClientJson(ws, {
+                type: 'RemoteInputResult',
+                timestamp: receivedAt,
+                ok,
+                requestId: normalized.requestId,
+                deviceId: normalized.deviceId,
+                inputType,
+                commandId: result?.commandId || '',
+                error: result?.error || ''
+            });
+        }
+    });
+
+    ws.on('close', () => {
+        remoteInputClients.delete(ws);
+        remoteInputWsDiagnostics.closed += 1;
+        remoteInputWsDiagnostics.lastCloseAt = new Date().toISOString();
+    });
+    ws.on('error', error => {
+        remoteInputClients.delete(ws);
+        remoteInputWsDiagnostics.errors += 1;
+        remoteInputWsDiagnostics.lastErrorAt = new Date().toISOString();
+        remoteInputWsDiagnostics.lastError = String(error?.message || error || 'input-ws-error');
+    });
+    sendRemoteInputClientJson(ws, {
+        type: 'RemoteInputSocketReady',
+        timestamp: new Date().toISOString(),
+        protocol: 'mindexec.remote.input.json.v1',
+        clientId: ws.remoteInputClientId
+    });
+});
+
 // Helper: Validate path is within workspace
 function validatePath(requestedPath) {
     const fullPath = resolveWorkspaceBoundPath(requestedPath);
@@ -3146,6 +3365,15 @@ const REMOTE_REGISTRY_REALTIME_ENABLED = REMOTE_REGISTRY_FOLLOWER_ENABLED
 const REMOTE_REGISTRY_REALTIME_HEARTBEAT_MS = Math.max(10000, Number(process.env.MINDEXEC_REMOTE_REGISTRY_REALTIME_HEARTBEAT_MS || 25000) || 25000);
 const REMOTE_REGISTRY_REALTIME_RECONNECT_MS = Math.max(1000, Number(process.env.MINDEXEC_REMOTE_REGISTRY_REALTIME_RECONNECT_MS || 2500) || 2500);
 const REMOTE_REGISTRY_REALTIME_DEBOUNCE_MS = Math.max(100, Number(process.env.MINDEXEC_REMOTE_REGISTRY_REALTIME_DEBOUNCE_MS || 250) || 250);
+const REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED = REMOTE_REGISTRY_FOLLOWER_ENABLED
+    && !/^(0|false|no|off)$/i.test(String(process.env.MINDEXEC_REMOTE_HOST_TARGET_AUTO_RENEW || 'true'));
+const REMOTE_HOST_TARGET_LEASE_MS = Math.max(60000, Number(process.env.MINDEXEC_REMOTE_HOST_TARGET_LEASE_MS || 120000) || 120000);
+const REMOTE_HOST_TARGET_RENEW_MS = Math.max(
+    5000,
+    Math.min(
+        Math.floor(REMOTE_HOST_TARGET_LEASE_MS / 2),
+        Number(process.env.MINDEXEC_REMOTE_HOST_TARGET_RENEW_MS || 25000) || 25000));
+const REMOTE_HOST_TARGET_RENEW_LOG_REPEAT_MS = 60000;
 let remoteAgentState = createRemoteAgentIdleState();
 let remoteAgentSyncReportState = null;
 let remoteAgentSyncReportLogKey = '';
@@ -3168,6 +3396,10 @@ let remoteRegistryRealtimeHeartbeatTimer = null;
 let remoteRegistryRealtimeReconnectTimer = null;
 let remoteRegistryRealtimeReconnectContext = null;
 let remoteRegistryRealtimeLastWakeAt = 0;
+let remoteHostTargetRenewTimer = null;
+let remoteHostTargetRenewInFlight = false;
+let remoteHostTargetRenewLogKey = '';
+let remoteHostTargetRenewLogAt = 0;
 let remoteRegistryFollowerState = {
     enabled: REMOTE_REGISTRY_FOLLOWER_ENABLED,
     status: REMOTE_REGISTRY_FOLLOWER_ENABLED ? 'idle' : 'disabled',
@@ -3201,6 +3433,20 @@ let remoteRegistryRealtimeState = {
     changes: 0,
     wakeups: 0
 };
+let remoteHostTargetRenewState = {
+    enabled: REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED,
+    status: REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED ? 'idle' : 'disabled',
+    reason: '',
+    nodeId: '',
+    leaseId: '',
+    hostInstanceId: '',
+    endpoint: '',
+    endpointCandidates: [],
+    expiresAt: '',
+    lastAttemptAt: '',
+    lastSuccessAt: '',
+    lastError: ''
+};
 
 function createRemoteAgentIdleState(overrides = {}) {
     return {
@@ -4499,6 +4745,23 @@ function updateRemoteRegistryFollowerState(patch = {}) {
     emitBridgeEvent('RemoteRegistryFollowerUpdated', serializeRemoteRegistryFollowerState());
 }
 
+function serializeRemoteHostTargetRenewState() {
+    return {
+        ...remoteHostTargetRenewState,
+        leaseMs: REMOTE_HOST_TARGET_LEASE_MS,
+        renewMs: REMOTE_HOST_TARGET_RENEW_MS
+    };
+}
+
+function updateRemoteHostTargetRenewState(patch = {}) {
+    remoteHostTargetRenewState = {
+        ...remoteHostTargetRenewState,
+        ...patch,
+        enabled: REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED
+    };
+    emitBridgeEvent('RemoteHostTargetRenewUpdated', serializeRemoteHostTargetRenewState());
+}
+
 function serializeRemoteRegistryRealtimeState() {
     return {
         ...remoteRegistryRealtimeState,
@@ -5094,6 +5357,328 @@ async function fetchRemoteRegistryTarget(config, session) {
     return normalizeRemoteRegistryTarget(Array.isArray(payload) ? payload[0] : payload);
 }
 
+async function callRemoteRegistryRpc(config, session, functionName, payload) {
+    const url = new URL(`/rest/v1/rpc/${functionName}`, config.url);
+    const response = await fetch(url.toString(), {
+        method: 'POST',
+        headers: {
+            apikey: config.key,
+            Authorization: `Bearer ${session.accessToken}`,
+            Accept: 'application/json',
+            'Content-Type': 'application/json'
+        },
+        body: JSON.stringify(payload)
+    });
+
+    if (!response.ok) {
+        const text = await response.text().catch(() => '');
+        const error = new Error(`registry-rpc-${functionName}-${response.status}${text ? `:${shortenText(text, 160)}` : ''}`);
+        error.statusCode = response.status;
+        throw error;
+    }
+
+    const rpcPayload = await response.json().catch(() => null);
+    const row = Array.isArray(rpcPayload) ? rpcPayload[0] : rpcPayload;
+    return {
+        ok: row?.ok === true || row?.Ok === true,
+        reason: safeRemoteAgentField(row?.reason || row?.Reason || '', 160)
+    };
+}
+
+async function readRemoteRegistryContext() {
+    const config = readSupabaseRuntimeConfig();
+    if (!config.url || !config.key) {
+        return { ok: false, reason: 'supabase-config-missing' };
+    }
+
+    const sessionPayload = await readStableAuthSessionPayload();
+    const session = sessionPayload.found ? parseSupabaseSessionForRegistry(sessionPayload.content) : null;
+    if (!session) {
+        return { ok: false, reason: 'registry-not-authenticated' };
+    }
+
+    if (session.expiresAtMs && session.expiresAtMs <= Date.now()) {
+        return { ok: false, reason: 'session-expired' };
+    }
+
+    return { ok: true, config, session };
+}
+
+function getRemoteHostTargetEndpointReason(endpoint) {
+    const normalized = normalizeRemoteManagerEndpoint(endpoint);
+    if (!normalized) {
+        return 'invalid-manager-endpoint';
+    }
+
+    const match = normalized.match(/^(\[[^\]]+\]|[^:\s]+):(\d{1,5})$/);
+    const host = String(match?.[1] || '').replace(/^\[|\]$/g, '').toLowerCase();
+    if (!host || host === 'localhost' || host === '::1' || host === '0:0:0:0:0:0:0:1' || /^127\./.test(host)) {
+        return 'loopback-endpoint';
+    }
+
+    if (host === '0.0.0.0' || host === '::' || host === '*') {
+        return 'wildcard-endpoint';
+    }
+
+    if (/^169\.254\./.test(host)) {
+        return 'link-local-endpoint';
+    }
+
+    return 'ok';
+}
+
+function buildRemoteHostTargetRegistryPayload(hub) {
+    const rawEndpointCandidates = normalizeRemoteManagerEndpointList(
+        hub?.hostTargetEndpointCandidates,
+        hub?.agentEndpointCandidates,
+        hub?.hostTargetEndpoint,
+        hub?.agentEndpoint);
+    const endpointCandidates = rawEndpointCandidates
+        .filter(endpoint => getRemoteHostTargetEndpointReason(endpoint) === 'ok')
+        .slice(0, 12);
+    const endpoint = endpointCandidates[0] || '';
+    const pairToken = safeRemoteAgentField(hub?.pairToken, 512);
+    const leaseId = safeRemoteAgentField(hub?.hostTargetLeaseId, 128);
+    const hostInstanceId = safeRemoteAgentField(hub?.hostTargetHostInstanceId || hub?.hostInstanceId, 128);
+    const nodeId = safeRemoteAgentField(hub?.hostTargetNodeId, 128);
+    const activatedAt = safeRemoteAgentField(hub?.hostTargetActivatedAt, 80) || new Date().toISOString();
+    const expiresAt = safeRemoteAgentField(hub?.hostTargetExpiresAt, 80) || new Date(Date.now() + REMOTE_HOST_TARGET_LEASE_MS).toISOString();
+
+    if (!pairToken || !leaseId || !hostInstanceId || !nodeId) {
+        return {
+            ok: false,
+            reason: 'missing-fields',
+            endpoint: '',
+            endpointCandidates: []
+        };
+    }
+
+    if (endpointCandidates.length === 0) {
+        const reason = rawEndpointCandidates.length === 0
+            ? safeRemoteAgentField(hub?.agentEndpointRouteReason || 'missing-endpoint-candidates', 160)
+            : getRemoteHostTargetEndpointReason(rawEndpointCandidates[0]);
+        return {
+            ok: false,
+            reason,
+            endpoint: rawEndpointCandidates[0] || '',
+            endpointCandidates: rawEndpointCandidates
+        };
+    }
+
+    return {
+        ok: true,
+        endpoint,
+        endpointCandidates,
+        leaseId,
+        hostInstanceId,
+        nodeId,
+        expiresAt,
+        payload: {
+            p_node_id: nodeId,
+            p_lease_id: leaseId,
+            p_host_instance_id: hostInstanceId,
+            p_endpoint: endpoint,
+            p_pair_token: pairToken,
+            p_manager_package: safeRemoteAgentField(hub?.managerPackage || '@mindexec/cli', 160),
+            p_manager_version: safeRemoteAgentField(hub?.managerVersion || '', 80),
+            p_agent_package: safeRemoteAgentField(hub?.agentPackage || '@mindexec/remote', 160),
+            p_activated_at: activatedAt,
+            p_expires_at: expiresAt,
+            p_endpoint_candidates: endpointCandidates
+        }
+    };
+}
+
+function logRemoteHostTargetRenew(status, reason, endpoint = '') {
+    const key = [status, reason, endpoint].join('|');
+    const now = Date.now();
+    if (key === remoteHostTargetRenewLogKey
+        && now - remoteHostTargetRenewLogAt < REMOTE_HOST_TARGET_RENEW_LOG_REPEAT_MS) {
+        return;
+    }
+
+    remoteHostTargetRenewLogKey = key;
+    remoteHostTargetRenewLogAt = now;
+    logEvent(
+        'remote',
+        `host target renew ${status} ${formatKeyValue('reason', reason || '-')} ${formatKeyValue('endpoint', endpoint || '-')}`,
+        status === 'ok' ? 'remote' : 'warn');
+}
+
+function isRemoteHostTargetRenewSoftSkipReason(reason) {
+    return /^(registry-not-authenticated|session-expired|supabase-config-missing|missing-endpoint-candidates|loopback-endpoint|wildcard-endpoint|link-local-endpoint)$/i
+        .test(String(reason || '').trim());
+}
+
+async function publishLocalRemoteHostTargetToRegistry(hub, { takeover = false } = {}) {
+    const registryPayload = buildRemoteHostTargetRegistryPayload(hub);
+    if (!registryPayload.ok) {
+        return {
+            ok: false,
+            active: false,
+            reason: registryPayload.reason,
+            endpoint: registryPayload.endpoint,
+            endpointCandidates: registryPayload.endpointCandidates,
+            stale: false
+        };
+    }
+
+    const context = await readRemoteRegistryContext();
+    if (!context.ok) {
+        return {
+            ok: false,
+            active: false,
+            reason: context.reason,
+            endpoint: registryPayload.endpoint,
+            endpointCandidates: registryPayload.endpointCandidates,
+            stale: false
+        };
+    }
+
+    const row = await callRemoteRegistryRpc(
+        context.config,
+        context.session,
+        'set_remote_host_target',
+        {
+            ...registryPayload.payload,
+            p_takeover: takeover === true
+        });
+    const reason = row.reason || (row.ok ? 'ok' : 'registry-publish-failed');
+    return {
+        ok: row.ok,
+        active: row.ok,
+        reason,
+        endpoint: registryPayload.endpoint,
+        endpointCandidates: registryPayload.endpointCandidates,
+        leaseId: registryPayload.leaseId,
+        nodeId: registryPayload.nodeId,
+        hostInstanceId: registryPayload.hostInstanceId,
+        expiresAt: registryPayload.expiresAt,
+        stale: reason === 'host-target-taken'
+    };
+}
+
+function scheduleRemoteHostTargetRenew(delayMs = REMOTE_HOST_TARGET_RENEW_MS, reason = 'timer') {
+    if (!REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED || isShuttingDown) {
+        return;
+    }
+
+    if (remoteHostTargetRenewTimer) {
+        clearTimeout(remoteHostTargetRenewTimer);
+        remoteHostTargetRenewTimer = null;
+    }
+
+    remoteHostTargetRenewTimer = setTimeout(() => {
+        remoteHostTargetRenewTimer = null;
+        runRemoteHostTargetRenewOnce(reason).catch(error => {
+            const message = error?.message || String(error || '');
+            updateRemoteHostTargetRenewState({
+                status: 'error',
+                reason: 'renew-error',
+                lastAttemptAt: new Date().toISOString(),
+                lastError: message
+            });
+            logRemoteHostTargetRenew('failed', message);
+            scheduleRemoteHostTargetRenew(REMOTE_REGISTRY_FOLLOWER_FAST_RETRY_MS, 'error-retry');
+        });
+    }, Math.max(0, Number(delayMs) || 0));
+    remoteHostTargetRenewTimer?.unref?.();
+}
+
+function stopRemoteHostTargetRenew(reason = 'stopped') {
+    if (remoteHostTargetRenewTimer) {
+        clearTimeout(remoteHostTargetRenewTimer);
+        remoteHostTargetRenewTimer = null;
+    }
+    updateRemoteHostTargetRenewState({
+        status: REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED ? 'idle' : 'disabled',
+        reason,
+        nodeId: '',
+        leaseId: '',
+        hostInstanceId: '',
+        endpoint: '',
+        endpointCandidates: [],
+        expiresAt: '',
+        lastError: ''
+    });
+}
+
+async function runRemoteHostTargetRenewOnce(trigger = 'timer', options = {}) {
+    if (!REMOTE_HOST_TARGET_AUTO_RENEW_ENABLED || remoteHostTargetRenewInFlight) {
+        return serializeRemoteHostTargetRenewState();
+    }
+
+    remoteHostTargetRenewInFlight = true;
+    const attemptedAt = new Date().toISOString();
+    try {
+        const currentHub = remoteHub.getStatus({ includeSecrets: true });
+        if (currentHub?.hostTargetActive !== true || !currentHub.hostTargetNodeId) {
+            stopRemoteHostTargetRenew('no-local-host-target');
+            return serializeRemoteHostTargetRenewState();
+        }
+
+        const renewed = remoteHub.setHostTarget({
+            enabled: true,
+            nodeId: currentHub.hostTargetNodeId,
+            leaseMs: REMOTE_HOST_TARGET_LEASE_MS
+        });
+        if (renewed?.ok !== true || renewed?.active !== true) {
+            updateRemoteHostTargetRenewState({
+                status: 'error',
+                reason: renewed?.error || 'local-host-renew-failed',
+                nodeId: currentHub.hostTargetNodeId,
+                lastAttemptAt: attemptedAt,
+                lastError: renewed?.error || 'local-host-renew-failed'
+            });
+            scheduleRemoteHostTargetRenew(REMOTE_REGISTRY_FOLLOWER_FAST_RETRY_MS, 'local-renew-failed');
+            return serializeRemoteHostTargetRenewState();
+        }
+
+        const hub = remoteHub.getStatus({ includeSecrets: true });
+        const registry = await publishLocalRemoteHostTargetToRegistry(hub, {
+            takeover: options.takeover === true
+        });
+        const status = registry.ok ? 'active' : registry.stale ? 'superseded' : 'skipped';
+        updateRemoteHostTargetRenewState({
+            status,
+            reason: registry.reason || (registry.ok ? 'ok' : 'registry-skipped'),
+            nodeId: hub.hostTargetNodeId,
+            leaseId: hub.hostTargetLeaseId,
+            hostInstanceId: hub.hostTargetHostInstanceId || hub.hostInstanceId,
+            endpoint: registry.endpoint || hub.hostTargetEndpoint,
+            endpointCandidates: registry.endpointCandidates || hub.hostTargetEndpointCandidates || [],
+            expiresAt: hub.hostTargetExpiresAt,
+            lastAttemptAt: attemptedAt,
+            lastSuccessAt: registry.ok ? new Date().toISOString() : remoteHostTargetRenewState.lastSuccessAt,
+            lastError: registry.ok || /^(registry-not-authenticated|session-expired|supabase-config-missing)$/i.test(registry.reason || '')
+                ? ''
+                : (registry.reason || 'registry-publish-failed')
+        });
+
+        if (registry.stale) {
+            remoteHub.setHostTarget({
+                enabled: false,
+                nodeId: hub.hostTargetNodeId
+            });
+            logRemoteHostTargetRenew('superseded', registry.reason, registry.endpoint);
+            stopRemoteHostTargetRenew('host-target-superseded');
+            wakeRemoteRegistryFollower('host-target-superseded').catch(() => {});
+            return serializeRemoteHostTargetRenewState();
+        }
+
+        logRemoteHostTargetRenew(registry.ok ? 'ok' : 'skipped', registry.reason, registry.endpoint);
+        const retryDelay = registry.ok || isRemoteHostTargetRenewSoftSkipReason(registry.reason)
+            ? REMOTE_HOST_TARGET_RENEW_MS
+            : REMOTE_REGISTRY_FOLLOWER_FAST_RETRY_MS;
+        scheduleRemoteHostTargetRenew(
+            retryDelay,
+            registry.ok ? 'renewed' : 'renew-skipped');
+        return serializeRemoteHostTargetRenewState();
+    } finally {
+        remoteHostTargetRenewInFlight = false;
+    }
+}
+
 async function reportRemoteRegistryFollowerSync(payload = {}) {
     const report = createRemoteAgentSyncReport(payload);
     rememberRemoteAgentSyncReport(report);
@@ -9913,14 +10498,17 @@ app.get('/api/status', async (req, res) => {
         wsToken,
         wsPath: '/events',
         remoteFrameWsPath: '/api/remote/frames/ws',
+        remoteInputWsPath: '/api/remote/input/ws',
         bridgeToken,
         bridgeTokenHeader,
         bridgeAuthRequired,
         remoteHub: remoteHub.getStatus({ includeSecrets: false }),
         remoteFrameWs: serializeRemoteFrameWsDiagnostics(),
+        remoteInputWs: serializeRemoteInputWsDiagnostics(),
         remoteAgent: serializeRemoteAgentState(),
         remoteRegistryFollower: serializeRemoteRegistryFollowerState(),
         remoteRegistryRealtime: serializeRemoteRegistryRealtimeState(),
+        remoteHostTargetRenew: serializeRemoteHostTargetRenewState(),
         shellJobsPath: '/api/shell/jobs',
         companyCore: {
             baseUrl: companyCoreBaseUrl,
@@ -9997,20 +10585,27 @@ app.post('/api/remote/frames', (req, res) => {
 app.post('/api/remote/host-target', async (req, res) => {
     res.setHeader('Cache-Control', 'no-store');
     try {
+        const requestedLeaseMs = Number(req.body?.leaseMs);
         const result = remoteHub.setHostTarget({
             enabled: req.body?.enabled !== false,
             nodeId: req.body?.nodeId,
-            leaseMs: req.body?.leaseMs
+            leaseMs: Math.max(
+                REMOTE_HOST_TARGET_LEASE_MS,
+                Number.isFinite(requestedLeaseMs) && requestedLeaseMs > 0 ? requestedLeaseMs : 0)
         });
         if (result?.ok === true && result?.active === true && isLocalRemoteHostTargetActive()) {
             if (isRemoteAgentProcessRunning()) {
                 await stopRemoteAgentConnection('local-host-target-active');
                 logEvent('remote', 'managed RemoteAgent held stopped while local host target is active', 'remote');
             }
+            await runRemoteHostTargetRenewOnce('set-host', { takeover: true });
+        } else if (result?.active !== true) {
+            stopRemoteHostTargetRenew('host-target-inactive');
         }
         res.json({
             ...result,
-            agent: serializeRemoteAgentState()
+            agent: serializeRemoteAgentState(),
+            hostTargetRenew: serializeRemoteHostTargetRenewState()
         });
     } catch (err) {
         logError('remote', 'remote host target update failed.', err);
@@ -10018,17 +10613,25 @@ app.post('/api/remote/host-target', async (req, res) => {
             ok: false,
             active: false,
             error: err?.message || String(err),
-            agent: serializeRemoteAgentState()
+            agent: serializeRemoteAgentState(),
+            hostTargetRenew: serializeRemoteHostTargetRenewState()
         });
     }
 });
 
 app.delete('/api/remote/host-target', (req, res) => {
     res.setHeader('Cache-Control', 'no-store');
-    res.json(remoteHub.setHostTarget({
+    const result = remoteHub.setHostTarget({
         enabled: false,
         nodeId: req.body?.nodeId
-    }));
+    });
+    if (result?.ok === true) {
+        stopRemoteHostTargetRenew('host-target-cleared');
+    }
+    res.json({
+        ...result,
+        hostTargetRenew: serializeRemoteHostTargetRenewState()
+    });
 });
 
 app.get('/api/remote/agent/status', (req, res) => {
@@ -11745,12 +12348,46 @@ async function shutdownBridge(signal) {
         // Ignore if already closed
     }
 
+    for (const client of remoteFrameClients) {
+        try {
+            client.close();
+        } catch {
+            // Ignore close race
+        }
+    }
+
+    for (const client of remoteInputClients) {
+        try {
+            client.close();
+        } catch {
+            // Ignore close race
+        }
+    }
+
+    try {
+        remoteFrameWss.close();
+    } catch {
+        // Ignore if already closed
+    }
+
+    try {
+        remoteInputWss.close();
+    } catch {
+        // Ignore if already closed
+    }
+
     try {
         stopRemoteRegistryFollower();
     } catch {
         // Ignore registry follower shutdown errors
     }
 
+    try {
+        stopRemoteHostTargetRenew('bridge-shutdown');
+    } catch {
+        // Ignore host-target renew shutdown errors
+    }
+
     try {
         closeRemoteRegistryRealtime('bridge-shutdown');
     } catch {