livedesk 0.1.227 → 0.1.229

package/hub/src/remote-hub.js

@@ -1388,6 +1388,29 @@ export function createRemoteHub(options = {}) {
     const emitEvent = options.emitEvent || (() => {});
     const emitFrame = typeof options.emitFrame === 'function' ? options.emitFrame : (() => {});
     const emitAudio = typeof options.emitAudio === 'function' ? options.emitAudio : (() => {});
+    const getEffectiveDevicePolicy = typeof options.getEffectiveDevicePolicy === 'function'
+        ? options.getEffectiveDevicePolicy
+        : (() => ({}));
+
+    function getDevicePolicy(device) {
+        try {
+            return getEffectiveDevicePolicy({
+                deviceId: device?.deviceId || '',
+                capabilities: device?.capabilities || {}
+            }) || {};
+        } catch {
+            return {};
+        }
+    }
+
+    function policyError(device, permission = '') {
+        const policy = getDevicePolicy(device);
+        if (policy.accessMode === 'block-remote-access') return 'remote-access-blocked-by-settings';
+        if (permission && policy[permission] === false) {
+            return `${permission}-blocked-by-settings`;
+        }
+        return '';
+    }
 
     const enabled = isEnabledValue(env.LIVEDESK_REMOTE_HUB ?? env.MINDEXEC_REMOTE_HUB ?? env.REMOTE_HUB_ENABLED, true)
         && !isDisabledValue(env.REMOTE_HUB_DISABLED);
@@ -2644,6 +2667,7 @@ export function createRemoteHub(options = {}) {
             heartbeatMs,
             frameProtocol: buildRemoteFrameProtocolDescriptor(),
             frameModes: getSupportedRemoteFrameModeProfiles(),
+            effectivePolicy: getEffectiveDevicePolicy({ deviceId, capabilities }),
             serverTime: now
         });
 
@@ -4425,6 +4449,18 @@ export function createRemoteHub(options = {}) {
 
     function sendCommand(deviceId, command) {
         const device = devices.get(String(deviceId || ''));
+        const commandName = safeString(command?.command || 'ping', 80);
+        const requiredPermission = commandName === 'input.control'
+            ? 'allowControl'
+            : commandName.startsWith('file.transfer')
+                ? 'allowFileTransfer'
+                : commandName === 'audio.start'
+                    ? 'allowRemoteAudio'
+                    : commandName.startsWith('agent.')
+                        ? 'allowAgent'
+                        : '';
+        const denied = policyError(device, requiredPermission);
+        if (denied) return { ok: false, error: denied };
         if (device?.synthetic === true && device.connected) {
             const commandId = safeString(command?.commandId, 128) || crypto.randomUUID();
             device.counters.commandsSent += 1;
@@ -4437,7 +4473,7 @@ export function createRemoteHub(options = {}) {
             }
             emitRemoteEvent('RemoteCommandQueued', device, {
                 commandId,
-                command: safeString(command?.command || 'ping', 80),
+                command: commandName,
                 synthetic: true
             });
             emitRemoteEvent('RemoteCommandResult', device, {
@@ -4453,7 +4489,6 @@ export function createRemoteHub(options = {}) {
         }
 
         const commandId = safeString(command?.commandId, 128) || crypto.randomUUID();
-        const commandName = safeString(command?.command || 'ping', 80);
         const payload = {
             type: 'command',
             commandId,
@@ -4487,6 +4522,9 @@ export function createRemoteHub(options = {}) {
             return { ok: false, error: 'device-not-connected' };
         }
 
+        const denied = policyError(device, 'allowControl');
+        if (denied) return { ok: false, error: denied };
+
         if (!readCapabilityFlag(device.capabilities, 'control')) {
             return { ok: false, error: 'device-input-control-unavailable' };
         }
@@ -4527,6 +4565,8 @@ export function createRemoteHub(options = {}) {
 
     function requestAgentTask(deviceId, options = {}) {
         const device = devices.get(String(deviceId || ''));
+        const denied = policyError(device, 'allowAgent');
+        if (denied) return { ok: false, error: denied };
         const requestedOperation = safeString(options.operation, 80);
         const operation = normalizeAgentOperation(requestedOperation);
         if (requestedOperation && !operation) {
@@ -4890,6 +4930,8 @@ export function createRemoteHub(options = {}) {
 
     function startLiveStream(deviceId, options = {}) {
         const device = devices.get(String(deviceId || ''));
+        const denied = policyError(device);
+        if (denied) return { ok: false, error: denied };
         if (device?.synthetic === true && device.connected) {
             if (!readCapabilityFlag(device.capabilities, 'liveStream')) {
                 return { ok: false, error: 'device-live-stream-unavailable' };
@@ -5186,6 +5228,8 @@ export function createRemoteHub(options = {}) {
         if (!device.connected) {
             return { ok: false, error: 'device-not-connected' };
         }
+        const denied = policyError(device, 'allowRemoteAudio');
+        if (denied) return { ok: false, error: denied };
         if (!readCapabilityFlag(device.capabilities, 'audio') && !readCapabilityFlag(device.capabilities, 'remoteAudio')) {
             return { ok: false, error: 'device-audio-unavailable' };
         }

package/hub/src/server.js

@@ -21,7 +21,10 @@ import { AgentProviderError } from './agents/provider-errors.js';
 import { AGENT_PERMISSION_MODES, createAgentPermissionPolicy, evaluateAgentToolPermission, hashAgentPermissionPolicy } from './agents/agent-permissions.js';
 import { createAgentPermissionStore } from './agents/agent-permission-store.js';
 import { createAgentAuditStore } from './agents/agent-audit-store.js';
-import { getAgentToolDefinition } from './agents/agent-tool-registry.js';
+import { getAgentToolDefinition } from './agents/agent-tool-registry.js';
+import { LiveDeskSettingsStore, SettingsConflictError } from './settings/settings-store.js';
+import { effectiveDevicePolicy } from './settings/settings-schema.js';
+import { buildEffectiveDevicePolicy } from './settings/effective-device-policy.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const webDistCandidates = [
@@ -140,9 +143,25 @@ function activeDeviceLimit() {
   return plan === 'pro' ? Number.POSITIVE_INFINITY : plan === 'ltd' ? PLUS_DEVICE_LIMIT : FREE_DEVICE_LIMIT;
 }
 
-function hasHubFeatureAccess() {
-  return connectedDeviceCount <= activeDeviceLimit();
-}
+function hasHubFeatureAccess() {
+  return connectedDeviceCount <= activeDeviceLimit();
+}
+
+function hasHubFeatureAccessForRequest(req) {
+  const limit = activeDeviceLimit();
+  if (!Number.isFinite(limit)) return true;
+  const ids = new Set();
+  const parameterId = String(req?.params?.deviceId || '').trim();
+  if (parameterId) ids.add(parameterId);
+  const bodyIds = Array.isArray(req?.body?.deviceIds) ? req.body.deviceIds : [];
+  for (const value of bodyIds) {
+    const id = String(value || '').trim();
+    if (id) ids.add(id);
+  }
+  // A user may operate on any selected device, but a single request may not
+  // fan out to more devices than the active plan includes.
+  return ids.size <= limit;
+}
 
 function licenseSnapshot() {
   const plan = activeLicensePlan();
@@ -201,15 +220,26 @@ async function syncVerifiedLicense(accessToken) {
   return licenseSnapshot();
 }
 
-function requireHubFeatureAccess(_req, res, next) {
-  if (hasHubFeatureAccess()) {
-    next();
+function requireHubFeatureAccess(_req, res, next) {
+  if (hasHubFeatureAccessForRequest(_req)) {
+    const policy = effectiveDevicePolicy(liveDeskSettingsStore.getCached());
+    if (policy.accessMode === 'block-remote-access') {
+      res.status(403).json({ ok: false, error: 'remote-access-blocked-by-settings' });
+      return;
+    }
+    next();
     return;
   }
   res.status(402).json({ ok: false, error: 'livedesk-plan-device-limit', license: licenseSnapshot() });
 }
 
-const remoteHub = createRemoteHub({
+const agentDataDir = process.env.LIVEDESK_DATA_DIR || undefined;
+const liveDeskSettingsStore = new LiveDeskSettingsStore({ dataDir: agentDataDir });
+void liveDeskSettingsStore.getRecord().catch(error => {
+  console.warn(`[LiveDesk Hub] settings load failed: ${error instanceof Error ? error.message : String(error)}`);
+});
+
+const remoteHub = createRemoteHub({
   managerPackage: '@livedesk/hub',
   managerVersion: packageInfo.version,
   env: {
@@ -218,12 +248,12 @@ const remoteHub = createRemoteHub({
     MINDEXEC_MANAGER_VERSION: packageInfo.version
   },
   logEvent: (_scope, message) => console.log(`[LiveDesk Hub] ${message}`),
-  logWarn: (_scope, message) => console.warn(`[LiveDesk Hub] ${message}`),
-  emitEvent: handleRemoteHubEvent,
-  emitFrame: broadcastRemoteBinaryFrame,
-  emitAudio: broadcastRemoteBinaryAudio
-});
-const agentDataDir = process.env.LIVEDESK_DATA_DIR || undefined;
+  logWarn: (_scope, message) => console.warn(`[LiveDesk Hub] ${message}`),
+  emitEvent: handleRemoteHubEvent,
+  emitFrame: broadcastRemoteBinaryFrame,
+  emitAudio: broadcastRemoteBinaryAudio,
+  getEffectiveDevicePolicy: ({ deviceId, capabilities }) => buildEffectiveDevicePolicy(liveDeskSettingsStore.getCached(), { deviceId, capabilities })
+});
 const agentMcpSessions = new Map();
 const agentMcpRunBatches = new Map();
 const agentMcpRunCleanupTimers = new Map();
@@ -1218,12 +1248,8 @@ function updateFrameSubscription(ws, payload = {}) {
   }
 }
 
-function startFrameSubscriptionLive(ws, reason = 'subscribe', onlyDeviceId = '', overrideLiveOptions = null) {
-  if (!hasHubFeatureAccess()) {
-    sendJson(ws, { type: 'RemoteFrameSubscriptionError', error: 'livedesk-plan-device-limit', license: licenseSnapshot() });
-    return;
-  }
-  const subscribedIds = [...(ws.liveDeskDeviceIds || [])];
+function startFrameSubscriptionLive(ws, reason = 'subscribe', onlyDeviceId = '', overrideLiveOptions = null) {
+  const subscribedIds = [...(ws.liveDeskDeviceIds || [])];
   if (!ws.liveDeskAutoStart || subscribedIds.length === 0) {
     return;
   }
@@ -1439,13 +1465,10 @@ function buildRemoteAudioBinaryPacket(audioEvent) {
   return Buffer.concat([header, metaBuffer, payload], 4 + metaBuffer.length + payload.length);
 }
 
-function broadcastRemoteBinaryFrame(frameEvent) {
+function broadcastRemoteBinaryFrame(frameEvent) {
   for (const session of atlasClients.values()) {
     session.ingest(frameEvent);
   }
-  if (!hasHubFeatureAccess()) {
-    return;
-  }
   const deviceId = String(frameEvent?.deviceId || frameEvent?.frame?.deviceId || '').trim();
   if (!deviceId || frameClients.size === 0) {
     return;
@@ -1490,10 +1513,7 @@ function broadcastRemoteBinaryFrame(frameEvent) {
   }
 }
 
-function broadcastRemoteBinaryAudio(audioEvent) {
-  if (!hasHubFeatureAccess()) {
-    return;
-  }
+function broadcastRemoteBinaryAudio(audioEvent) {
   const deviceId = String(audioEvent?.deviceId || audioEvent?.frame?.deviceId || '').trim();
   if (!deviceId || audioClients.size === 0) {
     return;
@@ -1517,8 +1537,8 @@ function broadcastRemoteBinaryAudio(audioEvent) {
   }
 }
 
-function sendMode4AtlasFrame(ws, output) {
-  if (!hasHubFeatureAccess() || ws.readyState !== ws.OPEN || !output?.payload?.length) return;
+function sendMode4AtlasFrame(ws, output) {
+  if (ws.readyState !== ws.OPEN || !output?.payload?.length) return;
   const metadata = output.metadata || {};
   const frameSeq = Number(metadata.frameSeq || 0) || 0;
   const isKeyFrame = metadata.isKeyFrame === true;
@@ -1697,12 +1717,83 @@ function isCapabilityEnabled(device, key) {
   return /^(1|true|yes|on)$/i.test(String(value || '').trim());
 }
 
-app.get('/api/health', (_req, res) => {
-  noStore(res);
-  res.json({ ok: true, product: 'LiveDesk', timestamp: new Date().toISOString() });
-});
-
-app.get('/api/settings/agent', async (_req, res) => {
+app.get('/api/health', (_req, res) => {
+  noStore(res);
+  res.json({ ok: true, product: 'LiveDesk', timestamp: new Date().toISOString() });
+});
+
+app.get('/api/settings', async (_req, res) => {
+  noStore(res);
+  try {
+    const record = await liveDeskSettingsStore.getRecord();
+    res.json({ ok: true, revision: record.revision, updatedAt: record.updatedAt, settings: record.settings });
+  } catch (error) {
+    res.status(500).json({ ok: false, error: error instanceof Error ? error.message : String(error) });
+  }
+});
+
+app.patch('/api/settings', async (req, res) => {
+  noStore(res);
+  try {
+    const body = req.body && typeof req.body === 'object' && !Array.isArray(req.body) ? req.body : {};
+    const revision = body.revision === undefined ? undefined : Number(body.revision);
+    const patch = { ...body };
+    delete patch.revision;
+    const record = await liveDeskSettingsStore.update(patch, revision);
+    res.json({ ok: true, revision: record.revision, updatedAt: record.updatedAt, settings: record.settings });
+  } catch (error) {
+    if (error instanceof SettingsConflictError) {
+      res.status(409).json({ ok: false, error: error.code, revision: error.settings.revision, updatedAt: error.settings.updatedAt, settings: error.settings.settings });
+      return;
+    }
+    res.status(error?.status || 400).json({ ok: false, error: error instanceof Error ? error.message : String(error) });
+  }
+});
+
+app.get('/api/settings/capabilities', async (_req, res) => {
+  noStore(res);
+  const settings = await liveDeskSettingsStore.get();
+  res.json({
+    ok: true,
+    settingsSchemaVersion: settings.settingsSchemaVersion,
+    sections: ['connection', 'security', 'control', 'wall', 'filesAudio', 'agent', 'advanced'],
+    policy: effectiveDevicePolicy(settings),
+    externalTransport: 'encrypted-only'
+  });
+});
+
+app.get('/api/security/trusted-devices', (_req, res) => {
+  noStore(res);
+  const devices = remoteHub.listDevices({ includeDataUrl: false }).map(device => ({
+    deviceId: device.deviceId,
+    deviceName: device.deviceName,
+    platform: device.platform,
+    connected: device.connected === true,
+    trusted: device.connected === true,
+    firstConnectedAt: device.connectedAt || device.lastSeenAt || '',
+    lastSeenAt: device.lastSeenAt || '',
+    ipRange: String(device.remoteAddress || '').replace(/^::ffff:/, '').split(':')[0]
+  }));
+  res.json({ ok: true, devices });
+});
+
+app.delete('/api/security/trusted-devices/:deviceId', (req, res) => {
+  noStore(res);
+  const result = remoteHub.disconnectDevice(req.params.deviceId, 'trusted-device-revoked');
+  res.json({ ok: result === true, revoked: result === true, deviceId: req.params.deviceId });
+});
+
+app.post('/api/security/revoke-all', (_req, res) => {
+  noStore(res);
+  const devices = remoteHub.listDevices({ includeDataUrl: false });
+  let revoked = 0;
+  for (const device of devices) {
+    if (device.connected && remoteHub.disconnectDevice(device.deviceId, 'trusted-devices-revoked')) revoked += 1;
+  }
+  res.json({ ok: true, revoked });
+});
+
+app.get('/api/settings/agent', async (_req, res) => {
   noStore(res);
   try {
     res.json({ ok: true, settings: await agentManager.getSettings() });
@@ -1798,10 +1889,6 @@ app.post('/api/internal/agent-mcp/tool', async (req, res) => {
     res.status(401).json({ ok: false, error: 'agent-mcp-session-invalid' });
     return;
   }
-  if (!hasHubFeatureAccess()) {
-    res.status(402).json({ ok: false, error: 'livedesk-plan-device-limit' });
-    return;
-  }
   try {
     const name = String(req.body?.name || '').slice(0, 120);
     const result = await dispatchAgentMcpTool(session, name, req.body?.arguments || {});
@@ -2605,12 +2692,8 @@ audioWss.on('connection', (ws, req) => {
 inputWss.on('connection', ws => {
   inputClients.add(ws);
   ws.liveDeskInputClientId = `riws-${++inputClientSeq}`;
-  ws.on('message', data => {
-    if (!hasHubFeatureAccess()) {
-      sendJson(ws, { type: 'RemoteInputError', error: 'livedesk-plan-device-limit', license: licenseSnapshot() });
-      return;
-    }
-    let payload;
+  ws.on('message', data => {
+    let payload;
     try {
       payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));
     } catch {

package/hub/src/settings/effective-device-policy.js

@@ -0,0 +1,16 @@
+import { effectiveDevicePolicy } from './settings-schema.js';
+
+export function buildEffectiveDevicePolicy(settings, { deviceId = '', capabilities = {} } = {}) {
+  const policy = effectiveDevicePolicy(settings);
+  return {
+    ...policy,
+    deviceId: String(deviceId || ''),
+    supported: {
+      control: capabilities.control !== false,
+      clipboardText: capabilities.clipboardText !== false,
+      fileTransfer: capabilities.fileTransfer !== false,
+      remoteAudio: capabilities.audio === true || capabilities.remoteAudio === true,
+      agent: Array.isArray(capabilities.agentTools) && capabilities.agentTools.length > 0
+    }
+  };
+}

package/hub/src/settings/settings-schema.js

@@ -0,0 +1,236 @@
+import os from 'node:os';
+import path from 'node:path';
+
+export const SETTINGS_SCHEMA_VERSION = 1;
+
+export const DEFAULT_LIVEDESK_SETTINGS = Object.freeze({
+  settingsSchemaVersion: SETTINGS_SCHEMA_VERSION,
+  connection: {
+    usePinToAddDevices: true,
+    pinValidityMinutes: 30,
+    rotatePinAfterPairing: true,
+    allowNewDevices: true,
+    approveNewDevices: true,
+    startWithComputer: true,
+    keepRunningInTray: true,
+    showConnectionNotifications: true
+  },
+  security: {
+    accessMode: 'trusted-only',
+    requireEncryptedConnections: true,
+    allowInternetConnections: false,
+    allowLanConnections: true,
+    allowUnencryptedLanFallback: false,
+    requireNewDeviceApproval: true,
+    requireAdministratorForSecurityChanges: true,
+    visibleControlIndicator: true,
+    lockOnControlEnd: true,
+    disconnectIdleControlSessions: true,
+    idleControlMinutes: 30,
+    keepSessionHistory: true,
+    sessionHistoryDays: 30
+  },
+  control: {
+    allowKeyboardMouse: true,
+    allowSystemShortcuts: true,
+    allowClipboardText: true,
+    allowRemoteRestart: false,
+    reconnectAfterRemoteRestart: true,
+    allowSwitchingMonitors: true,
+    showConnectionToolbar: true,
+    showRemoteCursor: true,
+    openControlOnDoubleClick: true,
+    startRemoteAudioWithControl: false,
+    fitRemoteScreen: true,
+    rememberLastMonitor: true,
+    keepControlReadyBetweenPages: true
+  },
+  wall: {
+    performanceMode: 'auto',
+    autoStart: true,
+    connectedOnly: false,
+    keepEmptySlots: true,
+    showDeviceStatus: true,
+    showPerformanceDetails: false,
+    pauseHiddenTiles: true,
+    reduceWhenHidden: true,
+    autoAdjustTileQuality: true,
+    rememberDevicePositions: true
+  },
+  filesAudio: {
+    allowFileTransfer: true,
+    allowFolderSync: false,
+    askBeforeReceivingFiles: true,
+    openReceivedFolder: false,
+    notifyTransferComplete: true,
+    allowOverwrite: false,
+    defaultReceiveFolder: 'Desktop/LiveDeskFiles',
+    maxFileSizeBytes: 1024 * 1024 * 1024,
+    allowRemoteAudio: true,
+    startAudioMuted: false,
+    rememberVolume: true,
+    automaticallyRecoverAudio: true,
+    showAudioTroubleshooting: false
+  },
+  agent: {
+    enabled: false,
+    defaultPermissionMode: 'safe-auto',
+    askBeforeDestructive: true,
+    allowProcessManagement: true,
+    allowServiceManagement: true,
+    allowFileChanges: true,
+    allowCommandExecution: false,
+    allowSoftwareInstallation: false,
+    allowPowerActions: false,
+    keepAuditHistory: true,
+    timeoutMinutes: 10
+  },
+  advanced: {
+    wallFrameMode: 'auto',
+    wallFps: 20,
+    wallMaxWidth: 960,
+    wallMaxHeight: 540,
+    wallQuality: 55,
+    controlFrameMode: 'mode3-h264-hw',
+    controlFps: 30,
+    controlMaxWidth: 1920,
+    controlMaxHeight: 1080,
+    controlQuality: 60,
+    transport: 'auto',
+    allowPlainLanFallback: false,
+    verboseLogs: false,
+    frameStatistics: false
+  }
+});
+
+const ENUMS = {
+  accessMode: new Set(['trusted-only', 'ask-every-time', 'view-only', 'block-remote-access']),
+  performanceMode: new Set(['auto', 'responsive', 'quality', 'custom']),
+  permissionMode: new Set(['ask', 'safe-auto', 'full-access', 'custom']),
+  wallFrameMode: new Set(['auto', 'mode2-lzo', 'mode3-h264-hw', 'mode4-h264-atlas']),
+  controlFrameMode: new Set(['mode3-h264-hw', 'mode5-lzo-delta']),
+  transport: new Set(['auto', 'encrypted', 'plain-lan'])
+};
+
+function booleanValue(value, fallback) {
+  return typeof value === 'boolean' ? value : fallback;
+}
+
+function numberValue(value, min, max, fallback) {
+  const number = Number(value);
+  return Number.isFinite(number) ? Math.max(min, Math.min(max, Math.round(number))) : fallback;
+}
+
+function enumValue(value, allowed, fallback) {
+  const normalized = String(value ?? fallback).trim().toLowerCase();
+  return allowed.has(normalized) ? normalized : fallback;
+}
+
+function stringValue(value, fallback, maxLength = 600) {
+  return typeof value === 'string' ? value.replace(/[\0\r\n]/g, ' ').trim().slice(0, maxLength) : fallback;
+}
+
+function normalizeSection(source, defaults, rules = {}) {
+  const input = source && typeof source === 'object' && !Array.isArray(source) ? source : {};
+  const result = {};
+  for (const [key, fallback] of Object.entries(defaults)) {
+    const rule = rules[key];
+    if (rule?.type === 'boolean') result[key] = booleanValue(input[key], fallback);
+    else if (rule?.type === 'number') result[key] = numberValue(input[key], rule.min, rule.max, fallback);
+    else if (rule?.type === 'enum') result[key] = enumValue(input[key], rule.values, fallback);
+    else if (rule?.type === 'string') result[key] = stringValue(input[key], fallback, rule.maxLength);
+    else result[key] = input[key] === undefined ? fallback : fallback;
+  }
+  return result;
+}
+
+const bools = keys => Object.fromEntries(keys.map(key => [key, { type: 'boolean' }]));
+const numbers = (entries) => Object.fromEntries(entries.map(([key, min, max]) => [key, { type: 'number', min, max }]));
+
+const RULES = {
+  connection: {
+    ...bools(['usePinToAddDevices', 'rotatePinAfterPairing', 'allowNewDevices', 'approveNewDevices', 'startWithComputer', 'keepRunningInTray', 'showConnectionNotifications']),
+    ...numbers([['pinValidityMinutes', 10, 1440]])
+  },
+  security: {
+    accessMode: { type: 'enum', values: ENUMS.accessMode },
+    ...bools(['requireEncryptedConnections', 'allowInternetConnections', 'allowLanConnections', 'allowUnencryptedLanFallback', 'requireNewDeviceApproval', 'requireAdministratorForSecurityChanges', 'visibleControlIndicator', 'lockOnControlEnd', 'disconnectIdleControlSessions', 'keepSessionHistory']),
+    ...numbers([['idleControlMinutes', 5, 1440], ['sessionHistoryDays', 7, 365]])
+  },
+  control: {
+    ...bools(['allowKeyboardMouse', 'allowSystemShortcuts', 'allowClipboardText', 'allowRemoteRestart', 'reconnectAfterRemoteRestart', 'allowSwitchingMonitors', 'showConnectionToolbar', 'showRemoteCursor', 'openControlOnDoubleClick', 'startRemoteAudioWithControl', 'fitRemoteScreen', 'rememberLastMonitor', 'keepControlReadyBetweenPages'])
+  },
+  wall: {
+    performanceMode: { type: 'enum', values: ENUMS.performanceMode },
+    ...bools(['autoStart', 'connectedOnly', 'keepEmptySlots', 'showDeviceStatus', 'showPerformanceDetails', 'pauseHiddenTiles', 'reduceWhenHidden', 'autoAdjustTileQuality', 'rememberDevicePositions'])
+  },
+  filesAudio: {
+    ...bools(['allowFileTransfer', 'allowFolderSync', 'askBeforeReceivingFiles', 'openReceivedFolder', 'notifyTransferComplete', 'allowOverwrite', 'allowRemoteAudio', 'startAudioMuted', 'rememberVolume', 'automaticallyRecoverAudio', 'showAudioTroubleshooting']),
+    defaultReceiveFolder: { type: 'string', maxLength: 600 },
+    maxFileSizeBytes: { type: 'number', min: 1, max: Number.MAX_SAFE_INTEGER }
+  },
+  agent: {
+    defaultPermissionMode: { type: 'enum', values: ENUMS.permissionMode },
+    ...bools(['enabled', 'askBeforeDestructive', 'allowProcessManagement', 'allowServiceManagement', 'allowFileChanges', 'allowCommandExecution', 'allowSoftwareInstallation', 'allowPowerActions', 'keepAuditHistory']),
+    timeoutMinutes: { type: 'number', min: 1, max: 120 }
+  },
+  advanced: {
+    wallFrameMode: { type: 'enum', values: ENUMS.wallFrameMode },
+    controlFrameMode: { type: 'enum', values: ENUMS.controlFrameMode },
+    transport: { type: 'enum', values: ENUMS.transport },
+    ...bools(['allowPlainLanFallback', 'verboseLogs', 'frameStatistics']),
+    ...numbers([['wallFps', 1, 60], ['wallMaxWidth', 320, 3840], ['wallMaxHeight', 180, 2160], ['wallQuality', 20, 95], ['controlFps', 20, 60], ['controlMaxWidth', 640, 3840], ['controlMaxHeight', 360, 2160], ['controlQuality', 20, 95]])
+  }
+};
+
+export function normalizeLiveDeskSettings(value = {}) {
+  const source = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+  const settings = {
+    settingsSchemaVersion: SETTINGS_SCHEMA_VERSION,
+    connection: normalizeSection(source.connection, DEFAULT_LIVEDESK_SETTINGS.connection, RULES.connection),
+    security: normalizeSection(source.security, DEFAULT_LIVEDESK_SETTINGS.security, RULES.security),
+    control: normalizeSection(source.control, DEFAULT_LIVEDESK_SETTINGS.control, RULES.control),
+    wall: normalizeSection(source.wall, DEFAULT_LIVEDESK_SETTINGS.wall, RULES.wall),
+    filesAudio: normalizeSection(source.filesAudio, DEFAULT_LIVEDESK_SETTINGS.filesAudio, RULES.filesAudio),
+    agent: normalizeSection(source.agent, DEFAULT_LIVEDESK_SETTINGS.agent, RULES.agent),
+    advanced: normalizeSection(source.advanced, DEFAULT_LIVEDESK_SETTINGS.advanced, RULES.advanced)
+  };
+  // Security invariants are enforced at the authority boundary, not just in
+  // the browser. Internet access can never use an unencrypted transport.
+  if (settings.security.requireEncryptedConnections) {
+    settings.security.allowUnencryptedLanFallback = false;
+  }
+  if (!settings.security.allowInternetConnections) {
+    settings.advanced.transport = settings.advanced.transport === 'encrypted' ? 'encrypted' : 'auto';
+  }
+  if (settings.agent.defaultPermissionMode === 'safe-auto') {
+    settings.agent.askBeforeDestructive = true;
+  }
+  return settings;
+}
+
+export function defaultSettingsPath(dataDir = undefined) {
+  return path.join(dataDir || path.join(os.homedir(), '.livedesk'), 'settings.json');
+}
+
+export function publicSettings(settings) {
+  return normalizeLiveDeskSettings(settings);
+}
+
+export function effectiveDevicePolicy(settings = DEFAULT_LIVEDESK_SETTINGS) {
+  const normalized = normalizeLiveDeskSettings(settings);
+  return {
+    settingsSchemaVersion: normalized.settingsSchemaVersion,
+    policyRevision: Number(settings?.revision || 0),
+    accessMode: normalized.security.accessMode,
+    allowInternetConnections: normalized.security.allowInternetConnections,
+    allowLanConnections: normalized.security.allowLanConnections,
+    requireEncryptedConnections: normalized.security.requireEncryptedConnections,
+    allowUnencryptedLanFallback: normalized.security.allowUnencryptedLanFallback,
+    allowControl: normalized.security.accessMode !== 'block-remote-access' && normalized.control.allowKeyboardMouse,
+    allowClipboardText: normalized.security.accessMode !== 'block-remote-access' && normalized.control.allowClipboardText,
+    allowFileTransfer: normalized.security.accessMode !== 'block-remote-access' && normalized.filesAudio.allowFileTransfer,
+    allowRemoteAudio: normalized.security.accessMode !== 'block-remote-access' && normalized.filesAudio.allowRemoteAudio,
+    allowAgent: normalized.security.accessMode !== 'block-remote-access' && normalized.agent.enabled
+  };
+}