instar 1.3.1596 → 1.3.1598

package/dashboard/desktop.css

@@ -41,3 +41,11 @@ body.desktop-live #localCursor{display:block}
 .setup-actions { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 8px; }
 .setup-note:empty { display: none; }
 .setup-quiet { background: none; border: none; color: inherit; opacity: 0.7; text-decoration: underline; }
+
+#lockedPassword{position:absolute;z-index:8;left:max(.5rem,env(safe-area-inset-left));right:max(.5rem,env(safe-area-inset-right));top:max(.5rem,env(safe-area-inset-top));display:grid;gap:.4rem;padding:.6rem;background:#111827f2;border:1px solid #64748b;border-radius:10px;color:#f1f5f9}
+#lockedPassword[hidden],#leaveUnlockedButton[hidden]{display:none}
+#lockedPassword input{width:100%;font-size:16px;padding:.55rem}
+#lockedPassword p{margin:0;font-size:.8rem}
+#leaveUnlockedButton{position:absolute;z-index:8;right:max(.5rem,env(safe-area-inset-right));bottom:4rem;padding:.55rem .8rem}
+#lockedCard{margin-top:.8rem}
+#lockedCard[hidden]{display:none}

package/dashboard/desktop.html

@@ -19,6 +19,10 @@
     <label>Machine <select id="machine"></select></label>
     <button id="requestButton">Open selected machine</button>
     <ul id="machineNotes" class="machine-notes" aria-label="Machines that are not ready"></ul>
+    <div id="lockedCard" hidden>
+      <p id="lockedCardText"></p>
+      <button id="lockedToggle" type="button" hidden></button>
+    </div>
   </section>
   <section id="setup" hidden>
     <h2>Machines</h2>
@@ -86,6 +90,12 @@
       <button data-remote-key="F11" type="button">F11</button>
       <button data-remote-key="F12" type="button">F12</button>
     </div>
+    <form id="lockedPassword" hidden>
+      <label>Mac password <input id="lockedPasswordInput" type="password" autocomplete="off" autocapitalize="off" autocorrect="off" spellcheck="false" maxlength="256"></label>
+      <button type="submit">Unlock</button>
+      <p>The machine serving this page and the tunnel provider can read what you type here. The Instar app is safer.</p>
+    </form>
+    <button id="leaveUnlockedButton" type="button" hidden>Leave unlocked</button>
     <div id="keyboardBar" hidden>
       <label class="type-label" for="typeText">Type on remote desktop</label>
       <input id="typeText" maxlength="64" autocomplete="off" autocapitalize="off" autocorrect="off" spellcheck="false" enterkeyhint="done">

package/dashboard/desktop.js

@@ -251,7 +251,7 @@ const base64ToBytes = text => Uint8Array.from(atob(text), character => character
 function recordIv(direction, sequence) {
   const iv = new Uint8Array(12);
   const view = new DataView(iv.buffer);
-  view.setUint32(0, direction === 'frame' ? 1 : 2);
+  view.setUint32(0, { frame: 1, input: 2, control: 3 }[direction]);
   view.setBigUint64(4, sequence);
   return iv;
 }
@@ -410,11 +410,65 @@ function receiveH264(bytes, epoch) {
     timestamp, data }));
   needsVideoKeyframe = false;
 }
+const CONTROL_MARKER = 0xc7;
+let controlSequence = 0n;
+let lockedSealKey = '';
+let lockedScreenState = '';
+let lockedBoxAllowed = false;
+let secretSequence = 0;
+function syncLockedPassword() {
+  const show = lockedBoxAllowed && lockedScreenState === 'locked-in-session' && !!lockedSealKey;
+  $('lockedPassword').hidden = !show;
+  if (!show) $('lockedPasswordInput').value = '';
+}
+function lockedMessage(reason) {
+  return { 'relock-pending': 'This Mac is finishing a relock. Try again in a couple of minutes.',
+    'attempts-per-request': 'Too many tries in this session.', 'attempts-per-day': 'Too many tries today.',
+    'seal-stale': 'The connection changed. Type your password again.',
+    aborted: 'Stopped before the password finished. Type it again.',
+    'field-dirty': 'Clearing the password field. Try again in a moment.',
+    'browser-box-off': 'Password entry from a browser is off for this Mac.',
+    'tunnel-not-first-tier': 'Password entry is off while the backup connection is in use.' }[reason]
+    ?? 'This Mac did not accept that. Try again.';
+}
+async function receiveControl(record) {
+  const view = new DataView(record.buffer, record.byteOffset, record.byteLength);
+  const sequence = view.getBigUint64(0) & 0x00ff_ffff_ffff_ffffn;
+  if (sequence <= controlSequence) throw new Error('Remote control record invalid.');
+  const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: recordIv('control', sequence),
+    additionalData: recordAad('control') }, aesKey, record.subarray(8));
+  controlSequence = sequence;
+  const value = JSON.parse(new TextDecoder().decode(plain));
+  if (value.type === 'seal') lockedSealKey = value.key;
+  if (value.type === 'state') { lockedScreenState = value.state; lockedBoxAllowed = value.box === true; }
+  if (value.type === 'secret-result' && value.refused) status(lockedMessage(value.refused));
+  if (value.type === 'secret-result' && value.sent) { $('leaveUnlockedButton').hidden = false; }
+  if (value.type === 'relock') status(value.phase === 'left-unlocked' ? 'This Mac will stay unlocked.' : 'Relocking has begun.');
+  syncLockedPassword();
+}
+/** Sealed for the helper alone: Node and the front carry bytes they cannot read. */
+async function sendLockedPassword(text) {
+  const helperKey = lockedSealKey;
+  const pair = await crypto.subtle.generateKey({ name: 'ECDH', namedCurve: 'P-256' }, true, ['deriveBits']);
+  const helper = await crypto.subtle.importKey('raw', base64ToBytes(helperKey), { name: 'ECDH', namedCurve: 'P-256' }, false, []);
+  const bits = await crypto.subtle.deriveBits({ name: 'ECDH', public: helper }, pair.privateKey, 256);
+  const hkdf = await crypto.subtle.importKey('raw', bits, 'HKDF', false, ['deriveKey']);
+  const key = await crypto.subtle.deriveKey({ name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0),
+    info: encoder.encode(`instar-desktop-secret-v1:${requestId}:${helperKey}`) }, hkdf,
+  { name: 'AES-GCM', length: 256 }, false, ['encrypt']);
+  const seq = ++secretSequence;
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv,
+    additionalData: encoder.encode(JSON.stringify(['instar-desktop-secret-v1', requestId, seq])) }, key, encoder.encode(text));
+  const ephemeral = await crypto.subtle.exportKey('raw', pair.publicKey);
+  return sendCommand({ type: 'secret', secret: { ephemeral: bytesToBase64(ephemeral), iv: bytesToBase64(iv), ct: bytesToBase64(ct), seq } });
+}
 async function receiveFrame(recordBuffer, epoch) {
   if (!inputEnabled || epoch !== streamEpoch) return;
   if (!aesKey || !(recordBuffer instanceof ArrayBuffer) || recordBuffer.byteLength < 28
     || recordBuffer.byteLength > 1_600_000) throw new Error('Encrypted frame invalid.');
   const record = new Uint8Array(recordBuffer);
+  if (record[0] === CONTROL_MARKER) { await receiveControl(record); return; }
   const sequence = new DataView(recordBuffer).getBigUint64(0);
   // The target may drop an already-encrypted frame under backpressure. A
   // strictly increasing nonce still rejects replay/reordering without treating
@@ -699,6 +753,7 @@ async function loadTargetsAndMaybeOpen({ open = true } = {}) {
     const trustedKey = typeof target.targetSigningPublicKey === 'string'
       ? target.targetSigningPublicKey : '';
     option.disabled = !target.ready || !trustedKey;
+    setTimeout(() => { void refreshLockedCard(); }, 0);
     option.textContent = option.disabled
       ? `${target.label} — ${target.unavailableReason || 'Unavailable right now'}`
       : target.label;
@@ -817,6 +872,8 @@ async function requestDesktop() {
       browserEcdhPublicKey: bytesToBase64(ecdhPublicKey),
       browserNonce: crypto.randomUUID().replaceAll('-', ''),
       videoCodec,
+      client: 'browser',
+      controlRecords: true,
     });
     requestId = result.requestId;
     const approved = await api(`/desktop/requests/${encodeURIComponent(requestId)}`);
@@ -875,6 +932,10 @@ async function openStream(result, resume = null) {
   sendChain = Promise.resolve();
   receiveChain = Promise.resolve();
   socket.binaryType = 'arraybuffer';
+  controlSequence = 0n;
+  lockedSealKey = '';
+  secretSequence = 0;
+  syncLockedPassword();
   return new Promise((resolve, reject) => {
   let opened = false;
   let settled = false;
@@ -930,8 +991,17 @@ async function openStream(result, resume = null) {
   });
 }
 
+const LOCK_SCREEN_KEYS = new Set(['Enter', 'Tab', 'Escape', 'ArrowLeft', 'ArrowRight', 'ArrowUp', 'ArrowDown']);
+/** A password typed at the shield must never leave as plain input. The helper
+ * also refuses it, but only this stops it reaching the server at all. */
+function refusedAtLock(action) {
+  if (!['locked-in-session', 'locked-by-policy', 'screensaver-or-sleep', 'unknown'].includes(lockedScreenState)) return false;
+  if (action.kind === 'type') return true;
+  return action.kind === 'keyDown' && !LOCK_SCREEN_KEYS.has(action.key);
+}
 function send(action) {
   if (!inputEnabled) return Promise.resolve(false);
+  if (refusedAtLock(action)) return Promise.resolve(true);
   if (screenSwitch && Date.now() - screenSwitch.at >= SCREEN_SWITCH_LIMIT_MS) screenSwitch = null;
   if (screenSwitch && ['click', 'buttonDown', 'move'].includes(action.kind)) return Promise.resolve(false);
   return sendCommand({ type: 'input', action });
@@ -1559,6 +1629,33 @@ $('stopButton').addEventListener('click', async () => {
   catch { message = 'The viewer closed, but the target has not confirmed revocation. Access expires automatically.'; }
   leave(message);
 });
+$('lockedPassword')?.addEventListener('submit', event => {
+  event.preventDefault();
+  const input = $('lockedPasswordInput');
+  const text = input.value;
+  input.value = '';
+  if (text) void sendLockedPassword(text);
+});
+const LOCKED_REASONS = { 'unsupported-macos': 'Not available yet: this Mac\u2019s macOS has not passed the crash and Stop tests.' };
+async function refreshLockedCard() {
+  let rows;
+  try { rows = (await api('/desktop/locked/status?scope=pool')).machines; }
+  catch { $('lockedCard').hidden = true; return; }
+  const row = rows?.find(item => item.machineId === $('machine').value);
+  if (!row) { $('lockedCard').hidden = true; return; }
+  $('lockedCard').hidden = !row.enabled && !!row.refusal;
+  $('lockedCardText').textContent = row.refusal ? LOCKED_REASONS[row.refusal] ?? 'Opening this Mac at its lock screen is unavailable.'
+    : row.enabled ? 'You can open this Mac at its lock screen. It relocks when you finish.' : 'Opening this Mac at its lock screen is off.';
+  $('lockedToggle').hidden = !!row.refusal;
+  $('lockedToggle').textContent = row.enabled ? 'Turn off' : 'Turn on';
+  $('lockedToggle').onclick = async () => {
+    try { await api('/desktop/locked/settings', 'POST', { machineId: row.machineId, enabled: !row.enabled }); }
+    catch (error) { status(error.message); }
+    void refreshLockedCard();
+  };
+}
+$('machine')?.addEventListener('change', () => { void refreshLockedCard(); });
+$('leaveUnlockedButton')?.addEventListener('click', () => { void sendCommand({ type: 'leave-unlocked' }); });
 window.addEventListener('beforeunload', () => {
   stopping = true;
   sendCommand({ type: 'stop' });

package/dist/commands/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAuHA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAgBjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA6BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6J7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA4GtD,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA0DD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAukBD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAiZjB;AA0xBD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAo4BN;AA+pBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAm41BtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDzE;AA+BD,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE5E"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/commands/server.ts"],"names":[],"mappings":"AAuHA,OAAO,EAAE,cAAc,EAAwD,MAAM,2BAA2B,CAAC;AAgBjH,OAAO,EAAE,eAAe,EAAiC,MAAM,iCAAiC,CAAC;AA6BjG,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AA6J7D,OAAO,KAAK,EAAW,oBAAoB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AA4GtD,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,OAAO,CAUT;AA0ID,UAAU,YAAY;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;2DACuD;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA0DD,+EAA+E;AAC/E,wBAAgB,qCAAqC,CACnD,SAAS,EAAE,IAAI,CAAC,OAAO,2BAA2B,EAAE,cAAc,EAAE,QAAQ,CAAC,GAAG,IAAI,EACpF,OAAO,EAAE,MAAM,GACd,IAAI,CAEN;AAukBD,wBAAsB,oBAAoB,CACxC,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,eAAe,EACzB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,kBAAkB,CAAC,EAAE,MAAM;AAC3B;;qCAEqC;AACrC,WAAW,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD;;wEAEwE;AACxE,SAAS,CAAC,EAAE;IACV,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;sEAGkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GACA,OAAO,CAAC,MAAM,CAAC,CAiZjB;AA0xBD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,YAAY,EACpB,YAAY,EAAE,oBAAoB,GAAG,IAAI,GACxC;IACD,YAAY,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,CAqBA;AAED,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,eAAe,EACzB,cAAc,EAAE,cAAc,EAC9B,YAAY,CAAC,EAAE,YAAY,EAC3B,WAAW,CAAC,EAAE,WAAW,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAGvE,UAAU,CAAC,EAAE,MAAM,OAAO,8BAA8B,EAAE,WAAW,GAAG,IAAI,EAK5E,qBAAqB,CAAC,EAAE,MAAM,OAAO,gCAAgC,EAAE,kBAAkB,GAAG,IAAI,EAKhG,mBAAmB,CAAC,EAAE,MAAM,MAAM,GAAG,IAAI,GAAG,SAAS,EAQrD,oBAAoB,CAAC,EAAE,MAAM;IAC3B,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,IAAI,GACP,IAAI,CAo4BN;AA+pBD,wBAAsB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAq41BtE;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuDzE;AA+BD,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE5E"}

package/dist/commands/server.js

@@ -4442,16 +4442,19 @@ export async function startServer(options) {
             onLeasePullTick: () => _leaseHandbackReconciler?.observe(),
         });
         const machineRole = coordinator.start();
-        // The origin writer below requires a current lease even on ordinary,
-        // non-development installations. Enroll its renewal carrier before lease
-        // initialization; this does not bypass explicit opt-outs or lease fences.
-        const originLeaseRenewal = config.messaging.some(m => m.type === 'telegram' && m.enabled)
-            ? coordinator.enrollOriginWriterLeaseRenewal() : undefined;
+        // The origin writer and native app conversations require a current lease even
+        // on ordinary, non-development installations (without Telegram, the app was
+        // the only surface and its lease lapsed at TTL between 2-minute heartbeats).
+        // Enroll the renewal carrier before lease initialization; this does not bypass
+        // explicit opt-outs or lease fences.
+        const { leaseRenewalDependencies } = await import('../server/leaseRenewalDependencies.js');
+        const leaseRenewalReleases = leaseRenewalDependencies(config).map((name) => coordinator.enrollLeaseRenewalDependency(name));
         const releaseOriginLeaseRenewal = () => {
-            originLeaseRenewal?.();
+            for (const release of leaseRenewalReleases.splice(0))
+                release();
             process.removeListener('exit', releaseOriginLeaseRenewal);
         };
-        if (originLeaseRenewal)
+        if (leaseRenewalReleases.length > 0)
             process.once('exit', releaseOriginLeaseRenewal);
         if (coordinator.enabled) {
             console.log(pc.green(`  Multi-machine: ${pc.bold(machineRole)} (${coordinator.identity.machineId.slice(0, 12)}...)`));