livedesk 0.1.395 → 0.1.397

package/bin/livedesk.js

@@ -15,6 +15,7 @@ import { createRoleBootstrapServer } from '../bootstrap/role-bootstrap-server.js
 import { parseLsofPids } from '../bootstrap/port-inspection.js';
 import { isKnownLiveDeskClientAgentProcess } from '../bootstrap/client-process-identity.js';
 import { runLegacyClientUpdateSupervisorCli } from '../bootstrap/legacy-client-update.js';
+import { transferSavedClientSessionToHub } from '../bootstrap/hub-auth-handoff.js';
 
 const require = createRequire(import.meta.url);
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -1514,14 +1515,31 @@ async function runManager(args, resolvedRole = null) {
     });
   };
 
-  startHubProcess();
-  updatePollId = setInterval(pollUpdateRequest, HUB_UPDATE_POLL_MS);
-
-  if (options.openBrowserOnStart) {
-    void waitForManager(openUrl).then(ok => {
-      if (ok) {
-        openBrowser(openUrl);
-      } else {
+  startHubProcess();
+  updatePollId = setInterval(pollUpdateRequest, HUB_UPDATE_POLL_MS);
+
+  const hubReady = waitForManager(hubProbeBaseUrl);
+  const hubStartup = hubReady.then(async ok => {
+    if (!ok) {
+      return false;
+    }
+    const handoff = await transferSavedClientSessionToHub(hubProbeBaseUrl, MANAGER_STATE_DIR);
+    if (handoff.ok) {
+      reportLauncherUpdate('[LiveDesk Hub] Saved Client sign-in adopted by the Hub.');
+      if (!handoff.hostTargetOk) {
+        reportLauncherUpdate('[LiveDesk Hub] Sign-in was adopted; host publication will continue through lease renewal.', true);
+      }
+    } else if (!handoff.skipped) {
+      reportLauncherUpdate(`[LiveDesk Hub] Saved Client sign-in could not be adopted: ${handoff.reason}. Continue sign-in in the Hub page.`, true);
+    }
+    return true;
+  });
+
+  if (options.openBrowserOnStart) {
+    void hubStartup.then(ok => {
+      if (ok) {
+        openBrowser(openUrl);
+      } else {
         console.warn(`LiveDesk Hub did not answer at ${openUrl} yet. Open it manually when it is ready.`);
       }
     });

package/bootstrap/hub-auth-handoff.js

@@ -0,0 +1,189 @@
+import { randomBytes } from 'node:crypto';
+import {
+  chmodSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from 'node:fs';
+import { dirname, join } from 'node:path';
+import {
+  PRODUCTION_SUPABASE_PUBLISHABLE_KEY,
+  PRODUCTION_SUPABASE_URL
+} from '../runtime-core/src/auth-config.js';
+import { fetchAuthResponse } from '../runtime-core/src/auth-http.js';
+import { normalizeRuntimeAuthSession } from '../runtime-core/src/auth-session.js';
+
+const CLIENT_AUTH_STORAGE_KEY = 'livedesk.client.supabase.auth';
+const MINIMUM_SESSION_LIFETIME_SECONDS = 30;
+
+function parseStoredSession(value) {
+  if (value && typeof value === 'object') {
+    return value;
+  }
+  if (typeof value !== 'string' || !value.trim()) {
+    return null;
+  }
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
+
+function readAuthState(authPath) {
+  try {
+    const value = JSON.parse(readFileSync(authPath, 'utf8'));
+    return value && typeof value === 'object' ? value : {};
+  } catch {
+    return {};
+  }
+}
+
+function writePrivateJsonAtomic(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  const temporaryPath = `${path}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
+  try {
+    writeFileSync(temporaryPath, JSON.stringify(value, null, 2), 'utf8');
+    try { chmodSync(temporaryPath, 0o600); } catch { /* Windows profile ACLs apply instead. */ }
+    renameSync(temporaryPath, path);
+    try { chmodSync(path, 0o600); } catch { /* Windows profile ACLs apply instead. */ }
+  } catch (error) {
+    try { rmSync(temporaryPath, { force: true }); } catch { /* best effort cleanup */ }
+    throw error;
+  }
+}
+
+function sessionIsFresh(session, nowSeconds) {
+  const expiresAt = Number(session?.expires_at || 0);
+  return Number.isFinite(expiresAt)
+    && expiresAt - Number(nowSeconds || 0) > MINIMUM_SESSION_LIFETIME_SECONDS;
+}
+
+function resolveSupabaseAuthConfig(env = process.env) {
+  const supabaseUrl = String(
+    env.LIVEDESK_RUNTIME_SUPABASE_URL
+    || env.LIVEDESK_SUPABASE_URL
+    || PRODUCTION_SUPABASE_URL
+  ).trim().replace(/\/+$/, '');
+  const publishableKey = String(
+    env.LIVEDESK_RUNTIME_SUPABASE_PUBLISHABLE_KEY
+    || env.LIVEDESK_SUPABASE_PUBLISHABLE_KEY
+    || PRODUCTION_SUPABASE_PUBLISHABLE_KEY
+  ).trim();
+  return { supabaseUrl, publishableKey };
+}
+
+/**
+ * Contract:
+ * - Reads only the unified local Client auth store.
+ * - Returns only a refreshable session; transfer refreshes stale access tokens.
+ * - Never logs or serializes token values outside the loopback handoff.
+ */
+export async function readSavedClientSessionForHub(stateDir) {
+  const authState = readAuthState(join(stateDir, 'auth.json'));
+  const candidate = parseStoredSession(authState?.[CLIENT_AUTH_STORAGE_KEY]);
+  const normalized = normalizeRuntimeAuthSession(candidate, { requireRefreshToken: true });
+  return normalized.ok ? normalized.session : null;
+}
+
+async function refreshSavedClientSessionForHub(
+  session,
+  stateDir,
+  fetchImpl,
+  nowSeconds
+) {
+  const { supabaseUrl, publishableKey } = resolveSupabaseAuthConfig();
+  const response = await fetchAuthResponse(fetchImpl, `${supabaseUrl}/auth/v1/token?grant_type=refresh_token`, {
+    method: 'POST',
+    headers: {
+      apikey: publishableKey,
+      'Content-Type': 'application/json',
+      Accept: 'application/json'
+    },
+    body: JSON.stringify({ refresh_token: session.refresh_token })
+  }, 5_000);
+  const data = await response.json().catch(() => null);
+  if (!response.ok) {
+    throw new Error(`saved-client-session-refresh-failed:${response.status}`);
+  }
+  const expiresAt = Number(data?.expires_at || 0)
+    || (Number(data?.expires_in || 0) > 0
+      ? Number(nowSeconds || 0) + Number(data.expires_in)
+      : 0);
+  const normalized = normalizeRuntimeAuthSession({
+    ...data,
+    expires_at: expiresAt,
+    refresh_token: data?.refresh_token || session.refresh_token,
+    user: data?.user || session.user
+  }, { requireRefreshToken: true });
+  if (!normalized.ok || !sessionIsFresh(normalized.session, nowSeconds)) {
+    throw new Error('saved-client-session-refresh-invalid');
+  }
+
+  const authPath = join(stateDir, 'auth.json');
+  const authState = readAuthState(authPath);
+  authState[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(normalized.session);
+  writePrivateJsonAtomic(authPath, authState);
+  return normalized.session;
+}
+
+async function resolveTransferSession(stateDir, fetchImpl, nowSeconds) {
+  const saved = await readSavedClientSessionForHub(stateDir);
+  if (!saved) {
+    return null;
+  }
+  if (sessionIsFresh(saved, nowSeconds)) {
+    return { session: saved, refreshed: false };
+  }
+  const refreshed = await refreshSavedClientSessionForHub(saved, stateDir, fetchImpl, nowSeconds);
+  return { session: refreshed, refreshed: true };
+}
+
+export async function transferSavedClientSessionToHub(
+  baseUrl,
+  stateDir,
+  fetchImpl = fetch,
+  nowSeconds = Math.floor(Date.now() / 1000)
+) {
+  try {
+    const resolved = await resolveTransferSession(stateDir, fetchImpl, nowSeconds);
+    if (!resolved) {
+      return { ok: false, skipped: true, reason: 'no-refreshable-saved-client-session' };
+    }
+    const response = await fetchAuthResponse(fetchImpl, new URL('/api/auth/session', baseUrl), {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json'
+      },
+      body: JSON.stringify({
+        accessToken: resolved.session.access_token,
+        refreshToken: resolved.session.refresh_token,
+        expiresAt: resolved.session.expires_at
+      })
+    }, 5_000);
+    const data = await response.json().catch(() => null);
+    if (!response.ok || data?.authenticated !== true) {
+      return {
+        ok: false,
+        skipped: false,
+        reason: String(data?.error || `hub-auth-session-http-${response.status}`)
+      };
+    }
+    return {
+      ok: true,
+      skipped: false,
+      authenticated: true,
+      refreshed: resolved.refreshed,
+      hostTargetOk: data?.hostTarget?.ok !== false
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      skipped: false,
+      reason: error instanceof Error ? error.message : String(error)
+    };
+  }
+}

package/client/bin/livedesk-client.js

@@ -21,6 +21,7 @@ const packageRoot = resolve(__dirname, '..');
 const nodeAgentPath = join(__dirname, 'livedesk-client-node.js');
 const FAST_PREFLIGHT_TIMEOUT_MS = 5000;
 const DEFAULT_MANAGER = '127.0.0.1:5197';
+const DEFAULT_HUB_CLIENT_PORT = 5197;
 const DEFAULT_AUTH_CALLBACK_HOST = '127.0.0.1';
 const DEFAULT_AUTH_CALLBACK_PORT = 5179;
 const ENDPOINT_PROBE_TIMEOUT_MS = 900;
@@ -369,15 +370,64 @@ function parseLauncherArgs(argv) {
     };
 }
 
-function normalizePort(value) {
+function normalizePort(value) {
     const port = Number(String(value || '').trim());
     if (!Number.isInteger(port) || port < 1 || port > 65535) {
         return 0;
     }
     return port;
-}
-
-function normalizeSlotNumber(value) {
+}
+
+export function resolveHubClientPort(env = process.env) {
+    return normalizePort(env.REMOTE_HUB_PORT || env.LIVEDESK_HUB_REMOTE_PORT) || DEFAULT_HUB_CLIENT_PORT;
+}
+
+export function preflightHubClientPort(port = resolveHubClientPort()) {
+    const normalizedPort = normalizePort(port);
+    if (!normalizedPort) {
+        return Promise.resolve({ ok: false, port: Number(port) || 0, code: 'invalid-hub-client-port' });
+    }
+    return new Promise(resolvePreflight => {
+        const probe = net.createServer();
+        let completed = false;
+        const finish = result => {
+            if (completed) return;
+            completed = true;
+            resolvePreflight({ port: normalizedPort, ...result });
+        };
+        probe.unref?.();
+        probe.once('error', error => {
+            finish({
+                ok: false,
+                code: error?.code === 'EADDRINUSE' ? 'hub-client-port-in-use' : 'hub-client-port-unavailable',
+                systemCode: String(error?.code || '')
+            });
+        });
+        probe.listen({ host: '0.0.0.0', port: normalizedPort, exclusive: true }, () => {
+            probe.close(error => {
+                if (error) {
+                    finish({ ok: false, code: 'hub-client-port-unavailable', systemCode: String(error?.code || '') });
+                    return;
+                }
+                finish({ ok: true, code: 'ok' });
+            });
+        });
+    });
+}
+
+function hubClientPortPreflightError(preflight) {
+    const port = Number(preflight?.port || resolveHubClientPort());
+    return {
+        ok: false,
+        code: String(preflight?.code || 'hub-client-port-unavailable'),
+        port,
+        error: preflight?.code === 'hub-client-port-in-use'
+            ? `LiveDesk cannot switch this computer to Hub because TCP ${port} is already in use. Change or stop the owning service, then try Switch to Hub again. The current Hub was not changed.`
+            : `LiveDesk cannot switch this computer to Hub because TCP ${port} is unavailable. Check the local port configuration, then try again. The current Hub was not changed.`
+    };
+}
+
+function normalizeSlotNumber(value) {
     const number = Number(String(value || '').trim());
     if (!Number.isInteger(number) || number < 1 || number > 999) {
         return '';
@@ -2648,12 +2698,18 @@ async function startConnectionChoiceServer(supabase, options = {}) {
                         payload = Object.fromEntries(params.entries());
                     }
                     const nextRole = String(payload.role || '').trim().toLowerCase();
-                    if (nextRole !== 'hub') {
+                    if (nextRole !== 'hub') {
                         res.writeHead(400, { 'Content-Type': 'application/json; charset=utf-8', 'Access-Control-Allow-Origin': '*' });
                         res.end(JSON.stringify({ ok: false, error: 'client-can-only-transition-to-hub' }));
-                        return;
-                    }
-                    const session = await refreshSessionIfNeeded(supabase);
+                        return;
+                    }
+                    const portPreflight = await preflightHubClientPort();
+                    if (!portPreflight.ok) {
+                        res.writeHead(409, { 'Content-Type': 'application/json; charset=utf-8', 'Access-Control-Allow-Origin': '*' });
+                        res.end(JSON.stringify(hubClientPortPreflightError(portPreflight)));
+                        return;
+                    }
+                    const session = await refreshSessionIfNeeded(supabase);
                     const expectedRoleVersion = Number(dashboardState.roleVersion || 0);
                     const { data, error } = await supabase.rpc('set_livedesk_device_role', {
                         p_device_id: deviceId,
@@ -2948,6 +3004,10 @@ async function chooseClientConnection(supabase, options = {}) {
                 if (!supabase) {
                     return { ok: false, error: 'supabase-session-required' };
                 }
+                const portPreflight = await preflightHubClientPort();
+                if (!portPreflight.ok) {
+                    return hubClientPortPreflightError(portPreflight);
+                }
                 const session = await refreshSessionIfNeeded(supabase);
                 if (!session?.access_token) {
                     return { ok: false, error: 'supabase-session-required' };

package/client/src/runtime/client-runtime-server.js

@@ -739,6 +739,7 @@ export function createClientRuntimeServer(options = {}) {
         osVersion: os.release(),
         pid: process.pid,
         cpuUsagePercent: Math.round(cpuUsagePercent * 10) / 10,
+        cpuLogicalCores: Math.max(1, os.cpus().length),
         memoryTotalBytes: totalMemoryBytes,
         memoryUsedBytes: Math.max(0, totalMemoryBytes - freeMemoryBytes),
         uptimeSeconds: Math.max(0, Math.floor(os.uptime())),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "livedesk",
-  "version": "0.1.395",
+  "version": "0.1.397",
   "livedeskClientVersion": "0.1.173",
   "buildFlavor": "production",
   "description": "LiveDesk Hub and client launcher",