livedesk 0.1.447 → 0.1.448

package/bin/livedesk.js

@@ -1422,30 +1422,163 @@ async function collectWindowsPortRecords(ports) {
   return records;
 }
 
-async function stopWindowsProcessesOnPorts(ports) {
-  const records = await collectWindowsPortRecords(ports);
-  const stoppedPids = new Set();
-  for (const record of records) {
+async function terminateExactWindowsPortOwners(records) {
+  const roots = [];
+  const seenRoots = new Set();
+  for (const record of Array.isArray(records) ? records : []) {
     const pid = Number(record?.Pid || 0);
-    if (record?.KnownLiveDesk !== true || stoppedPids.has(pid)) continue;
-    const details = await getProcessDetails(pid);
-    if (!details
-        || String(details.startOrder || '') !== String(record?.CreationUtcTicks || '')
-        || !isKnownLiveDeskProcess(details.processName, details.commandLine)) {
+    const startOrder = String(record?.CreationUtcTicks || '').trim();
+    if (record?.KnownLiveDesk !== true
+        || !Number.isInteger(pid)
+        || pid <= 1
+        || !/^\d+$/.test(startOrder)
+        || seenRoots.has(`${pid}:${startOrder}`)) {
       continue;
     }
-    await terminateExactWindowsProcessTree(details, {
-      label: `verified LiveDesk port owner pid=${pid}`
-    });
-    stoppedPids.add(pid);
-    for (const matching of records.filter(candidate => Number(candidate?.Pid) === pid)) {
-      matching.Action = 'stopped';
-      matching.KillAttempted = true;
+    seenRoots.add(`${pid}:${startOrder}`);
+    roots.push({ pid, startOrder });
+  }
+  if (roots.length === 0) return;
+
+  const encodedRoots = Buffer.from(JSON.stringify(roots), 'utf8').toString('base64');
+  const script = [
+    '$ErrorActionPreference = "Stop";',
+    `$rootsJson = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("${encodedRoots}"));`,
+    '$requestedRoots = @(ConvertFrom-Json -InputObject $rootsJson);',
+    '$validatedRoots = [System.Collections.Generic.List[object]]::new();',
+    'foreach ($item in $requestedRoots) {',
+    '  $targetPid = [int]$item.pid;',
+    '  $expectedStartTicks = [string]$item.startOrder;',
+    '  $proc = Get-CimInstance Win32_Process -Filter "ProcessId = $targetPid" -Property ProcessId,ParentProcessId,Name,CommandLine,CreationDate -ErrorAction SilentlyContinue | Select-Object -First 1;',
+    '  if (-not $proc) { continue };',
+    '  $actualStartTicks = if ($proc.CreationDate) { [string]$proc.CreationDate.ToUniversalTime().Ticks } else { "" };',
+    '  $processName = [string]$proc.Name;',
+    '  $commandLine = [string]$proc.CommandLine;',
+    '  $isNodeProcess = $processName -match "(?i)^node(?:\\.exe)?$";',
+    '  $hasKnownLiveDeskHubPath = $commandLine -match "(?i)(?:packages[\\\\/](?:livedesk[\\\\/])?hub|node_modules[\\\\/]@?livedesk[\\\\/]hub)[\\\\/]src[\\\\/]server\\.js";',
+    '  $hasUnifiedLauncherPath = $commandLine -match "(?i)(?:node_modules[\\\\/]livedesk|packages[\\\\/]livedesk)[\\\\/]bin[\\\\/]livedesk\\.js";',
+    '  $hasLegacyClientPath = $commandLine -match "(?i)(?:node_modules[\\\\/]@livedesk[\\\\/]client|packages[\\\\/]client|packages[\\\\/]livedesk[\\\\/]client)[\\\\/]bin[\\\\/]livedesk-client\\.js";',
+    '  if ($actualStartTicks -ne $expectedStartTicks -or -not $isNodeProcess -or -not ($hasKnownLiveDeskHubPath -or $hasUnifiedLauncherPath -or $hasLegacyClientPath)) { continue };',
+    '  $validatedRoots.Add([pscustomobject]@{ ProcessId = [int]$proc.ProcessId; ParentProcessId = [int]$proc.ParentProcessId; CreationUtcTicks = $actualStartTicks; Depth = 0 });',
+    '}',
+    'if ($validatedRoots.Count -eq 0) { exit 0 };',
+    '$snapshot = @(Get-CimInstance Win32_Process -Property ProcessId,ParentProcessId,CreationDate | ForEach-Object {',
+    '  $ticks = if ($_.CreationDate) { [string]$_.CreationDate.ToUniversalTime().Ticks } else { "" };',
+    '  if ($ticks) { [pscustomobject]@{ ProcessId = [int]$_.ProcessId; ParentProcessId = [int]$_.ParentProcessId; CreationUtcTicks = $ticks } }',
+    '});',
+    '$targets = @{};',
+    'foreach ($root in $validatedRoots) {',
+    '  $currentRoot = @($snapshot | Where-Object { [int]$_.ProcessId -eq [int]$root.ProcessId }) | Select-Object -First 1;',
+    '  if (-not $currentRoot -or [string]$currentRoot.CreationUtcTicks -ne [string]$root.CreationUtcTicks) { continue };',
+    '  $queue = [System.Collections.Generic.Queue[object]]::new();',
+    '  $queue.Enqueue([pscustomobject]@{ Record = $currentRoot; Depth = 0 });',
+    '  $seen = [System.Collections.Generic.HashSet[int]]::new();',
+    '  while ($queue.Count -gt 0) {',
+    '    $current = $queue.Dequeue();',
+    '    $currentRecord = $current.Record;',
+    '    $currentPid = [int]$currentRecord.ProcessId;',
+    '    if (-not $seen.Add($currentPid)) { continue };',
+    '    $key = "$currentPid`:$([string]$currentRecord.CreationUtcTicks)";',
+    '    $targets[$key] = [pscustomobject]@{ ProcessId = $currentPid; CreationUtcTicks = [string]$currentRecord.CreationUtcTicks; Depth = [int]$current.Depth };',
+    '    foreach ($child in @($snapshot | Where-Object { [int]$_.ParentProcessId -eq $currentPid })) {',
+    '      try { if ([System.Numerics.BigInteger]::Parse([string]$child.CreationUtcTicks) -lt [System.Numerics.BigInteger]::Parse([string]$currentRecord.CreationUtcTicks)) { continue } } catch { continue };',
+    '      $queue.Enqueue([pscustomobject]@{ Record = $child; Depth = [int]$current.Depth + 1 });',
+    '    }',
+    '  }',
+    '}',
+    '$failures = [System.Collections.Generic.List[string]]::new();',
+    '$exitTicks = @{};',
+    '$orderedTargets = @($targets.Values | Sort-Object @{ Expression = { -[int]$_.Depth } });',
+    'foreach ($targetRecord in $orderedTargets) {',
+    '  $targetPid = [int]$targetRecord.ProcessId;',
+    '  $expectedStartTicks = [string]$targetRecord.CreationUtcTicks;',
+    '  $targetKey = "$targetPid`:$expectedStartTicks";',
+    '  try {',
+    '    $current = Get-CimInstance Win32_Process -Filter "ProcessId = $targetPid" -Property ProcessId,CreationDate -ErrorAction SilentlyContinue | Select-Object -First 1;',
+    '    if (-not $current) { continue };',
+    '    $currentStartTicks = if ($current.CreationDate) { [string]$current.CreationDate.ToUniversalTime().Ticks } else { "" };',
+    '    if ($currentStartTicks -ne $expectedStartTicks) { continue };',
+    '    Stop-Process -Id $targetPid -Force -ErrorAction Stop;',
+    '    $exitTicks[$targetKey] = [string][DateTime]::UtcNow.Ticks;',
+    '  } catch {',
+    '    $failures.Add("pid=$targetPid $($_.Exception.Message)");',
+    '  }',
+    '}',
+    'Start-Sleep -Milliseconds 75;',
+    '$lateSnapshot = @(Get-CimInstance Win32_Process -Property ProcessId,ParentProcessId,CreationDate | ForEach-Object {',
+    '  $ticks = if ($_.CreationDate) { [string]$_.CreationDate.ToUniversalTime().Ticks } else { "" };',
+    '  if ($ticks) { [pscustomobject]@{ ProcessId = [int]$_.ProcessId; ParentProcessId = [int]$_.ParentProcessId; CreationUtcTicks = $ticks } }',
+    '});',
+    '$lateTargets = @{};',
+    '$lateQueue = [System.Collections.Generic.Queue[object]]::new();',
+    'foreach ($tracked in $targets.Values) {',
+    '  $trackedKey = "$([int]$tracked.ProcessId)`:$([string]$tracked.CreationUtcTicks)";',
+    '  if (-not $exitTicks.ContainsKey($trackedKey)) { $exitTicks[$trackedKey] = [string][DateTime]::UtcNow.Ticks };',
+    '  $lateQueue.Enqueue([pscustomobject]@{ Record = $tracked; Depth = [int]$tracked.Depth; ExitTicks = [string]$exitTicks[$trackedKey] });',
+    '}',
+    '$lateSeen = [System.Collections.Generic.HashSet[string]]::new();',
+    'while ($lateQueue.Count -gt 0) {',
+    '  $parent = $lateQueue.Dequeue();',
+    '  $parentRecord = $parent.Record;',
+    '  $parentKey = "$([int]$parentRecord.ProcessId)`:$([string]$parentRecord.CreationUtcTicks)";',
+    '  if (-not $lateSeen.Add($parentKey)) { continue };',
+    '  foreach ($child in @($lateSnapshot | Where-Object { [int]$_.ParentProcessId -eq [int]$parentRecord.ProcessId })) {',
+    '    try {',
+    '      $childStart = [System.Numerics.BigInteger]::Parse([string]$child.CreationUtcTicks);',
+    '      if ($childStart -lt [System.Numerics.BigInteger]::Parse([string]$parentRecord.CreationUtcTicks)) { continue };',
+    '      if ($parent.ExitTicks -and $childStart -gt [System.Numerics.BigInteger]::Parse([string]$parent.ExitTicks)) { continue };',
+    '    } catch { continue };',
+    '    $childKey = "$([int]$child.ProcessId)`:$([string]$child.CreationUtcTicks)";',
+    '    $childDepth = [int]$parent.Depth + 1;',
+    '    $lateTargets[$childKey] = [pscustomobject]@{ ProcessId = [int]$child.ProcessId; CreationUtcTicks = [string]$child.CreationUtcTicks; Depth = $childDepth };',
+    '    $lateQueue.Enqueue([pscustomobject]@{ Record = $child; Depth = $childDepth; ExitTicks = "" });',
+    '  }',
+    '}',
+    '$orderedLateTargets = @($lateTargets.Values | Sort-Object @{ Expression = { -[int]$_.Depth } });',
+    'foreach ($targetRecord in $orderedLateTargets) {',
+    '  $targetPid = [int]$targetRecord.ProcessId;',
+    '  $expectedStartTicks = [string]$targetRecord.CreationUtcTicks;',
+    '  try {',
+    '    $current = Get-CimInstance Win32_Process -Filter "ProcessId = $targetPid" -Property ProcessId,CreationDate -ErrorAction SilentlyContinue | Select-Object -First 1;',
+    '    if (-not $current) { continue };',
+    '    $currentStartTicks = if ($current.CreationDate) { [string]$current.CreationDate.ToUniversalTime().Ticks } else { "" };',
+    '    if ($currentStartTicks -ne $expectedStartTicks) { continue };',
+    '    Stop-Process -Id $targetPid -Force -ErrorAction Stop;',
+    '  } catch {',
+    '    $failures.Add("late pid=$targetPid $($_.Exception.Message)");',
+    '  }',
+    '}',
+    'if ($failures.Count -gt 0) { [Console]::Error.WriteLine(($failures -join "; ")); exit 1 };',
+    'exit 0;'
+  ].join(' ');
+  const result = await runQuiet(
+    'powershell.exe',
+    ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', script],
+    { timeout: 15000, killSignal: 'SIGKILL', maxBuffer: 4 * 1024 * 1024 }
+  );
+  if (!result.ok) {
+    throw new Error(
+      `Could not stop exact LiveDesk Windows port owner tree: `
+      + `${result.stderr || result.error?.message || 'PowerShell failed'}`
+    );
+  }
+}
+
+async function stopWindowsProcessesOnPorts(ports) {
+  const records = await collectWindowsPortRecords(ports);
+  const killable = records.filter(record => record?.KnownLiveDesk === true);
+  if (killable.length > 0) {
+    await terminateExactWindowsPortOwners(killable);
+    for (const record of killable) {
+      record.Action = 'stopped';
+      record.KillAttempted = true;
     }
   }
 
   const probes = await Promise.all(ports.map(port => waitForPortBindable(port)));
-  const finalRecords = await collectWindowsPortRecords(ports);
+  const finalRecords = probes.every(probe => probe.ok)
+    ? []
+    : await collectWindowsPortRecords(ports);
   const portStates = ports.map((port, index) => {
     const busy = finalRecords.some(record => Number(record?.Port) === Number(port));
     return {

package/client/README.md

@@ -62,9 +62,9 @@ System Settings path when access is missing; after granting access, restart the
 client. When file transfer is enabled by the Hub, received files are saved
 to `Desktop/LiveDeskFiles` unless the Hub sets another destination folder.
 
-By default, the launcher uses the packaged C# RemoteFast engine when supported.
-It falls back to the Node engine for AI assist or when a compatible RemoteFast
-runtime is unavailable. Windows, macOS, and Linux all try RemoteFast first so
+By default, the launcher uses the packaged C# RemoteFast engine when supported.
+It falls back to the Node engine only when a compatible RemoteFast runtime is
+unavailable. Windows, macOS, and Linux all try RemoteFast first so
 the Hub can request the Mode 3 hardware video path when it is available.
 RemoteFast is shipped as a platform-specific self-contained .NET executable,
 so client computers do not need a separate .NET installation.

package/client/bin/livedesk-client-node.js

@@ -1571,15 +1571,16 @@ function buildClientUpdateBootstrapScript() {
         'const isGroupAlive = pid => { try { process.kill(-pid, 0); return true; } catch (error) { return error?.code === "EPERM"; } };',
         'const runWindowsPowerShell = script => new Promise((resolve, reject) => { execFile("powershell.exe", ["-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-Command", script], { windowsHide: true, timeout: 15000, killSignal: "SIGKILL", maxBuffer: 4 * 1024 * 1024 }, (error, stdout, stderr) => { if (error) { reject(new Error(String(stderr || error.message || "PowerShell failed").trim())); return; } resolve(String(stdout || "").trim()); }); });',
         'const queryWindowsProcessTable = async () => { const stdout = await runWindowsPowerShell(`$ErrorActionPreference = "Stop"; $records = @(Get-CimInstance Win32_Process -Property ProcessId,ParentProcessId,CreationDate | ForEach-Object { $ticks = if ($_.CreationDate) { [string]$_.CreationDate.ToUniversalTime().Ticks } else { "" }; [pscustomobject]@{ ProcessId = [int]$_.ProcessId; ParentProcessId = [int]$_.ParentProcessId; CreationUtcTicks = $ticks } }); [pscustomobject]@{ Records = $records } | ConvertTo-Json -Compress -Depth 4`); if (!stdout) throw new Error("Windows process snapshot returned no data"); const parsed = JSON.parse(stdout); const values = parsed?.Records == null ? [] : (Array.isArray(parsed.Records) ? parsed.Records : [parsed.Records]); return values.map(item => ({ pid: Number(item?.ProcessId || 0), parentPid: Number(item?.ParentProcessId || 0), startOrder: String(item?.CreationUtcTicks || "") })).filter(item => Number.isInteger(item.pid) && item.pid > 1 && /^\\d+$/.test(item.startOrder)); };',
+        'const queryTrackedWindowsProcessTable = child => { if (child.livedeskWindowsSnapshotPromise) return child.livedeskWindowsSnapshotPromise; const pending = queryWindowsProcessTable(); child.livedeskWindowsSnapshotPromise = pending; const clear = () => { if (child.livedeskWindowsSnapshotPromise === pending) child.livedeskWindowsSnapshotPromise = null; }; pending.then(clear, clear); return pending; };',
         'const sameWindowsIdentity = (left, right) => Number(left?.pid || 0) === Number(right?.pid || 0) && String(left?.startOrder || "") === String(right?.startOrder || "");',
-        'const captureWindowsIdentity = async pid => { const processId = Number(pid || 0); const deadline = Date.now() + 2500; let lastError = null; do { try { const snapshot = await queryWindowsProcessTable(); const identity = snapshot.find(item => item.pid === processId) || null; if (identity) return identity; } catch (error) { lastError = error; } if (Date.now() < deadline) await sleep(50); } while (Date.now() < deadline); throw new Error(`Could not capture immutable Windows CreationDate for pid=${processId}: ${lastError?.message || "process not visible"}`); };',
+        'const captureWindowsIdentity = async child => { const processId = Number(child?.pid || 0); const deadline = Date.now() + 2500; let lastError = null; do { try { const snapshot = await queryTrackedWindowsProcessTable(child); const identity = snapshot.find(item => item.pid === processId) || null; if (identity) return identity; } catch (error) { lastError = error; } if (Date.now() < deadline) await sleep(50); } while (Date.now() < deadline); throw new Error(`Could not capture immutable Windows CreationDate for pid=${processId}: ${lastError?.message || "process not visible"}`); };',
         'const windowsTicksAtMilliseconds = value => BigInt(Math.trunc(Number(value) || Date.now())) * 10000n + 621355968000000000n;',
         'const setWindowsRootLifetimeEnd = (child, ticks) => { const candidate = BigInt(ticks); const previous = child.livedeskWindowsRootLifetimeEndTicks; if (!previous || candidate < BigInt(previous)) child.livedeskWindowsRootLifetimeEndTicks = String(candidate); return BigInt(child.livedeskWindowsRootLifetimeEndTicks); };',
         'const mergeRootAbsentWindowsTree = (child, rootPid, snapshot) => { const tracked = child.livedeskWindowsTrackedRecords || (child.livedeskWindowsTrackedRecords = new Map()); const currentByPid = new Map(snapshot.map(item => [item.pid, item])); const exactCurrentByPid = new Map(); for (const record of tracked.values()) { const current = currentByPid.get(record.pid); if (sameWindowsIdentity(current, record)) exactCurrentByPid.set(record.pid, record); } const lowerBound = windowsTicksAtMilliseconds(Number(child.livedeskWindowsSpawnedAtMs || Date.now()) - 2000); const upperBound = child.livedeskWindowsRootLifetimeEndTicks ? BigInt(child.livedeskWindowsRootLifetimeEndTicks) : null; let changed = true; while (changed) { changed = false; for (const record of snapshot) { const key = `${record.pid}:${record.startOrder}`; if (record.pid === rootPid || tracked.has(key)) continue; let recordStart; try { recordStart = BigInt(record.startOrder); if (recordStart < lowerBound || (upperBound && recordStart > upperBound)) continue; } catch { continue; } const parent = record.parentPid === rootPid ? { depth: 0 } : exactCurrentByPid.get(record.parentPid); if (!parent) continue; const descendant = { ...record, depth: Number(parent.depth || 0) + 1 }; tracked.set(key, descendant); exactCurrentByPid.set(descendant.pid, descendant); changed = true; } } return tracked; };',
         'const mergeExactWindowsTree = (child, root, snapshot) => { const tracked = child.livedeskWindowsTrackedRecords || (child.livedeskWindowsTrackedRecords = new Map()); const currentByPid = new Map(snapshot.map(item => [item.pid, item])); const currentRoot = currentByPid.get(root.pid) || null; const rootIsExact = sameWindowsIdentity(currentRoot, root); const rootWasReused = Boolean(currentRoot && !rootIsExact); if (rootWasReused) setWindowsRootLifetimeEnd(child, BigInt(currentRoot.startOrder) - 1n); else if (!currentRoot && child.livedeskWindowsRootExitedAtMs) setWindowsRootLifetimeEnd(child, windowsTicksAtMilliseconds(child.livedeskWindowsRootExitedAtMs)); const rootLifetimeClosed = Boolean(child.livedeskWindowsRootLifetimeEndTicks); if (rootIsExact) tracked.set(`${root.pid}:${root.startOrder}`, { ...root, depth: 0 }); const exactCurrentByPid = new Map(); if (rootIsExact) exactCurrentByPid.set(root.pid, { ...root, depth: 0 }); for (const record of tracked.values()) { const current = currentByPid.get(record.pid); if (sameWindowsIdentity(current, record)) exactCurrentByPid.set(record.pid, record); } let changed = true; while (changed) { changed = false; for (const record of snapshot) { const key = `${record.pid}:${record.startOrder}`; if (record.pid === root.pid || tracked.has(key)) continue; let recordStart; try { recordStart = BigInt(record.startOrder); if (recordStart < BigInt(root.startOrder)) continue; if (rootLifetimeClosed && recordStart > BigInt(child.livedeskWindowsRootLifetimeEndTicks)) continue; } catch { continue; } let parent = exactCurrentByPid.get(record.parentPid) || null; if (!parent && !currentRoot && rootLifetimeClosed && record.parentPid === root.pid) parent = { ...root, depth: 0 }; if (!parent) continue; const descendant = { ...record, depth: Number(parent.depth || 0) + 1 }; tracked.set(key, descendant); exactCurrentByPid.set(descendant.pid, descendant); changed = true; } } return tracked; };',
-        'const refreshTrackedWindowsTree = async (child, root = child.livedeskWindowsIdentity || null) => { const snapshot = await queryWindowsProcessTable(); if (root) mergeExactWindowsTree(child, root, snapshot); else mergeRootAbsentWindowsTree(child, Number(child.pid || 0), snapshot); return snapshot; };',
+        'const refreshTrackedWindowsTree = async (child, root = child.livedeskWindowsIdentity || null) => { const snapshot = await queryTrackedWindowsProcessTable(child); if (root) mergeExactWindowsTree(child, root, snapshot); else mergeRootAbsentWindowsTree(child, Number(child.pid || 0), snapshot); return snapshot; };',
         'const stopExactWindowsRecords = async records => { if (!Array.isArray(records) || records.length === 0) return; const encoded = Buffer.from(JSON.stringify(records.map(record => ({ pid: record.pid, startOrder: record.startOrder }))), "utf8").toString("base64"); const script = `$ErrorActionPreference = "Stop"; $targetsJson = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("${encoded}")); $targets = ConvertFrom-Json -InputObject $targetsJson; $failures = [System.Collections.Generic.List[string]]::new(); foreach ($item in $targets) { $targetPid = [int]$item.pid; $expectedStartTicks = [string]$item.startOrder; try { $target = Get-CimInstance Win32_Process -Filter "ProcessId = $targetPid" -Property ProcessId,CreationDate -ErrorAction SilentlyContinue | Select-Object -First 1; if (-not $target) { continue }; $targetStartTicks = if ($target.CreationDate) { [string]$target.CreationDate.ToUniversalTime().Ticks } else { "" }; if ($targetStartTicks -ne $expectedStartTicks) { continue }; Stop-Process -Id $targetPid -Force -ErrorAction Stop } catch { $failures.Add("pid=$targetPid $($_.Exception.Message)") } }; if ($failures.Count -gt 0) { [Console]::Error.WriteLine(($failures -join "; ")); exit 1 }`; await runWindowsPowerShell(script); };',
-        'const trackWindowsChild = child => { if (process.platform !== "win32" || Number(child?.pid || 0) <= 1 || child.livedeskWindowsIdentityPromise) return; child.livedeskWindowsTrackedRecords = new Map(); child.livedeskWindowsSpawnedAtMs = Date.now(); child.livedeskWindowsRootExitedAtMs = null; child.livedeskWindowsTrackingStopped = false; child.once("exit", () => { if (!child.livedeskWindowsRootExitedAtMs) child.livedeskWindowsRootExitedAtMs = Date.now(); setWindowsRootLifetimeEnd(child, windowsTicksAtMilliseconds(child.livedeskWindowsRootExitedAtMs)); }); const refresh = () => { void refreshTrackedWindowsTree(child).then(() => { child.livedeskWindowsTrackingError = null; }).catch(error => { child.livedeskWindowsTrackingError = error; }); }; refresh(); child.livedeskWindowsTrackingTimer = setInterval(refresh, 250); child.livedeskWindowsTrackingTimer.unref?.(); child.livedeskWindowsIdentityPromise = (async () => { while (!child.livedeskWindowsTrackingStopped && !child.livedeskWindowsRootExitedAtMs) { try { const identity = await captureWindowsIdentity(child.pid); child.livedeskWindowsIdentity = identity; refresh(); return identity; } catch (error) { child.livedeskWindowsIdentityError = error; if (!child.livedeskWindowsTrackingStopped && !child.livedeskWindowsRootExitedAtMs) await sleep(250); } } return null; })(); };',
+        'const trackWindowsChild = child => { if (process.platform !== "win32" || Number(child?.pid || 0) <= 1 || child.livedeskWindowsIdentityPromise) return; child.livedeskWindowsTrackedRecords = new Map(); child.livedeskWindowsSpawnedAtMs = Date.now(); child.livedeskWindowsRootExitedAtMs = null; child.livedeskWindowsTrackingStopped = false; child.once("exit", () => { if (!child.livedeskWindowsRootExitedAtMs) child.livedeskWindowsRootExitedAtMs = Date.now(); setWindowsRootLifetimeEnd(child, windowsTicksAtMilliseconds(child.livedeskWindowsRootExitedAtMs)); }); const refresh = () => { void refreshTrackedWindowsTree(child).then(() => { child.livedeskWindowsTrackingError = null; }).catch(error => { child.livedeskWindowsTrackingError = error; }); }; refresh(); child.livedeskWindowsTrackingTimer = setInterval(refresh, 250); child.livedeskWindowsTrackingTimer.unref?.(); child.livedeskWindowsIdentityPromise = (async () => { while (!child.livedeskWindowsTrackingStopped && !child.livedeskWindowsRootExitedAtMs) { try { const identity = await captureWindowsIdentity(child); child.livedeskWindowsIdentity = identity; refresh(); return identity; } catch (error) { child.livedeskWindowsIdentityError = error; if (!child.livedeskWindowsTrackingStopped && !child.livedeskWindowsRootExitedAtMs) await sleep(250); } } return null; })(); };',
         'const stopWindowsTracking = child => { child.livedeskWindowsTrackingStopped = true; if (child?.livedeskWindowsTrackingTimer) clearInterval(child.livedeskWindowsTrackingTimer); child.livedeskWindowsTrackingTimer = null; };',
         'const terminateExactWindowsTrackedTree = (child, root) => { if (child.livedeskWindowsDrainPromise) return child.livedeskWindowsDrainPromise; child.livedeskWindowsDrainPromise = (async () => { let attempt = 0; let emptyPasses = 0; for (;;) { attempt += 1; try { const snapshot = await refreshTrackedWindowsTree(child, root); const currentByPid = new Map(snapshot.map(item => [item.pid, item])); const remaining = [...child.livedeskWindowsTrackedRecords.values()].filter(target => sameWindowsIdentity(currentByPid.get(target.pid), target)).sort((left, right) => Number(right.depth || 0) - Number(left.depth || 0)); if (remaining.length === 0) { emptyPasses += 1; if (emptyPasses >= 2) { stopWindowsTracking(child); return; } } else { emptyPasses = 0; await stopExactWindowsRecords(remaining); } child.livedeskWindowsTrackingError = null; } catch (error) { emptyPasses = 0; child.livedeskWindowsTrackingError = error; if (attempt === 1 || attempt % 10 === 0) process.stderr.write(`LiveDesk update cleanup is retrying exact Windows process-tree drain: ${error?.message || error}\\n`); } await sleep(Math.min(1000, 100 + (attempt * 50))); } })(); return child.livedeskWindowsDrainPromise; };',
         'const stateLockPath = statePath + ".lock"; const lockWaitBuffer = new Int32Array(new SharedArrayBuffer(4));',

package/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/client",
-  "version": "0.1.202",
+  "version": "0.1.203",
   "description": "LiveDesk local remote client",
   "type": "module",
   "bin": {
@@ -41,10 +41,10 @@
     "ws": "^8.18.3"
   },
   "optionalDependencies": {
-    "@livedesk/fast-linux-x64": "0.1.410",
-    "@livedesk/fast-osx-arm64": "0.1.410",
-    "@livedesk/fast-osx-x64": "0.1.410",
-    "@livedesk/fast-win-x64": "0.1.410"
+    "@livedesk/fast-linux-x64": "0.1.411",
+    "@livedesk/fast-osx-arm64": "0.1.411",
+    "@livedesk/fast-osx-x64": "0.1.411",
+    "@livedesk/fast-win-x64": "0.1.411"
   },
   "publishConfig": {
     "access": "public"

package/hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "LiveDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",

package/hub/src/agents/agent-manager.js

@@ -1,175 +1,132 @@
-import os from 'node:os';
-import path from 'node:path';
-import { AgentSettingsStore, AGENT_PROVIDER_CODEX, AGENT_PROVIDER_OPENCODE_GO } from './agent-settings.js';
-import { createOsSecretStore } from './secret-store.js';
-import { createOpenCodeGoProvider } from './opencode-go-provider.js';
-import { AgentProviderError } from './provider-errors.js';
-import { createCodexAgentRuntime } from './codex-agent-runtime.js';
-
-function maskApiKey(value) {
-  const key = String(value || '');
-  return key.length >= 4 ? `••••${key.slice(-4)}` : '';
-}
-
-function publicCodexStatus(status = {}) {
-  return {
-    installed: status.installed === true,
-    authenticated: ['signed-in', 'not-signed-in'].includes(status.authenticated) ? status.authenticated : 'unknown',
-    status: String(status.status || 'unknown').slice(0, 40),
-    codexPath: String(status.codexPath || '').slice(0, 500),
-    detail: String(status.detail || '').slice(0, 300)
-  };
-}
-
-export function createAgentManager({
-  dataDir = path.join(os.homedir(), '.livedesk'),
-  settingsStore,
-  secretStore,
-  provider,
-  codexRuntime
-} = {}) {
-  const settings = settingsStore || new AgentSettingsStore({ dataDir });
-  const secrets = secretStore || createOsSecretStore({ dataDir });
-  const legacyProvider = provider || createOpenCodeGoProvider();
-  const runtime = codexRuntime;
-  let statusCache = { expiresAt: 0, value: null };
-
-  async function getCodexStatus() {
-    if (!runtime) return { installed: false, authenticated: 'unknown', status: 'unavailable', codexPath: '' };
-    if (statusCache.value && statusCache.expiresAt > Date.now()) return statusCache.value;
-    let value;
-    try {
-      value = publicCodexStatus(await runtime.getStatus());
-    } catch (error) {
-      value = publicCodexStatus({ installed: true, authenticated: 'unknown', status: error?.code || 'security-unavailable', detail: error?.message || 'Codex security isolation is unavailable.' });
-    }
-    statusCache = { value, expiresAt: Date.now() + 10000 };
-    return value;
-  }
-
-  async function publicSettings() {
-    const current = await settings.get();
-    const { codexMaxTurns: _codexMaxTurns, ...exposedSettings } = current;
-    let hasApiKey = false;
-    let apiKeyPreview = '';
-    let secretStoreAvailable = true;
-    if (current.provider === AGENT_PROVIDER_OPENCODE_GO) {
-      try {
-        const key = await secrets.getApiKey(AGENT_PROVIDER_OPENCODE_GO);
-        hasApiKey = Boolean(key);
-        apiKeyPreview = maskApiKey(key);
-      } catch {
-        secretStoreAvailable = false;
-      }
-    }
-    const codex = await getCodexStatus();
-    const securityStatus = runtime?.getSecurityStatus?.() || {
-      isolatedCodexHome: false,
-      restrictedEnvironment: false,
-      livedeskMcpOnly: false,
-      selectedDeviceScopeEnforced: false,
-      failClosed: true,
-      verified: false,
-      state: 'unavailable'
-    };
-    return {
-      ...exposedSettings,
-      hasApiKey,
-      apiKeyPreview,
-      secretStoreAvailable,
-      codexInstallation: codex.installed ? 'installed' : 'not-installed',
-      codexAuth: codex.authenticated,
-      codexStatus: codex.status,
-      codexPath: codex.codexPath,
-      agentWorkspacePath: current.codexWorkingDirectory,
-      securityStatus
-    };
-  }
-
-  async function legacyApiKey() {
-    const key = await secrets.getApiKey(AGENT_PROVIDER_OPENCODE_GO);
-    if (!key) throw new AgentProviderError('agent-api-key-missing', 'OpenCode Go API key is not configured.', { status: 401 });
-    return key;
-  }
-
-  async function currentProvider() {
-    const current = await settings.get();
-    return { current, active: current.provider === AGENT_PROVIDER_CODEX ? runtime : legacyProvider };
-  }
-
-  return {
-    getSettings: publicSettings,
-    async updateSettings(patch = {}) {
-      const nextPatch = { ...patch };
-      const apiKey = typeof nextPatch.apiKey === 'string' ? nextPatch.apiKey.trim() : '';
-      delete nextPatch.apiKey;
-      const current = await settings.get();
-      const requestedProvider = String(nextPatch.provider || current.provider);
-      if (apiKey) {
-        if (requestedProvider !== AGENT_PROVIDER_OPENCODE_GO) {
-          throw new AgentProviderError('agent-codex-does-not-use-api-key', 'Codex authentication is owned by the installed Codex CLI.', { status: 400 });
-        }
-        await secrets.setApiKey(AGENT_PROVIDER_OPENCODE_GO, apiKey);
-      }
-      await settings.update(nextPatch);
-      statusCache = { expiresAt: 0, value: null };
-      return publicSettings();
-    },
-    async resetSettings() {
-      await settings.reset();
-      statusCache = { expiresAt: 0, value: null };
-      return publicSettings();
-    },
-    async deleteApiKey() {
-      await secrets.deleteApiKey(AGENT_PROVIDER_OPENCODE_GO);
-      return publicSettings();
-    },
-    async getModels() {
-      const { current, active } = await currentProvider();
-      if (current.provider === AGENT_PROVIDER_CODEX) {
-        return [{ id: '', name: 'Codex default', protocol: 'codex-sdk', available: true, capabilities: { supportsReasoningLevel: true, supportsStreaming: true, supportsTools: true } }];
-      }
-      return active.getModels(current, await legacyApiKey());
-    },
-    async testConnection() {
-      const { current, active } = await currentProvider();
-      if (current.provider === AGENT_PROVIDER_CODEX) {
-        if (!active) throw new AgentProviderError('codex-sdk-not-installed', 'Codex SDK is not installed.', { status: 503 });
-        statusCache = { expiresAt: 0, value: null };
-        return active.testConnection();
-      }
-      return active.testConnection(current, await legacyApiKey());
-    },
-    async createPlan(input) {
-      const { current, active } = await currentProvider();
-      if (!current.enabled) throw new AgentProviderError('agent-ai-disabled', 'Agent AI is disabled in Settings.', { status: 409 });
-      if (current.provider === AGENT_PROVIDER_CODEX) {
-        throw new AgentProviderError('agent-codex-run-required', 'Codex runs use the LiveDesk tool loop.', { status: 409 });
-      }
-      return active.createPlan(input, current, await legacyApiKey());
-    },
-    async createSummary(input) {
-      const { current, active } = await currentProvider();
-      if (!current.enabled || !current.generateSummary) throw new AgentProviderError('agent-summary-disabled', 'Agent summaries are disabled in Settings.', { status: 409 });
-      if (current.provider === AGENT_PROVIDER_CODEX) {
-        const source = input && typeof input === 'object' ? input : {};
-        const results = Array.isArray(source.results) ? source.results : [];
-        return { summary: String(results.length ? `${source.completed || 0} completed, ${source.failed || 0} failed.` : 'LiveDesk Agent run completed.').slice(0, 1200), modelId: current.codexModelId || 'Codex default' };
-      }
-      const source = input && typeof input === 'object' ? input : {};
-      const results = Array.isArray(source.results) ? source.results : [];
-      const safeResults = current.includeRawDeviceDetails
-        ? results.map(result => ({ deviceName: String(result?.deviceName || '').slice(0, 120), status: String(result?.status || '').slice(0, 40), result: String(result?.result || '').slice(0, 1200), error: String(result?.error || '').slice(0, 500) }))
-        : results.map(result => ({ deviceName: String(result?.deviceName || '').slice(0, 120), status: String(result?.status || '').slice(0, 40), hasResult: Boolean(result?.result), hasError: Boolean(result?.error) }));
-      return active.createSummary({ instruction: String(source.instruction || '').slice(0, 500), operation: String(source.operation || '').slice(0, 80), summary: { total: Number(source.total || results.length), completed: Number(source.completed || 0), failed: Number(source.failed || 0), results: safeResults } }, current, await legacyApiKey());
-    },
-    async startRun(input) {
-      const current = await settings.get();
-      if (current.provider !== AGENT_PROVIDER_CODEX || !runtime) throw new AgentProviderError('agent-codex-not-active', 'Codex SDK is not the active Agent provider.', { status: 409 });
-      return runtime.start(input);
-    },
-    getRun(runId) { return runtime?.get(runId) || null; },
-    cancelRun(runId) { return runtime?.cancel(runId) || null; },
-    cancelAllRuns() { return runtime?.cancelAll?.() || 0; }
-  };
-}
+import os from 'node:os';
+import path from 'node:path';
+import { AgentSettingsStore, AGENT_PROVIDER_CODEX } from './agent-settings.js';
+import { AgentProviderError } from './provider-errors.js';
+
+function publicCodexStatus(status = {}) {
+  return {
+    installed: status.installed === true,
+    authenticated: ['signed-in', 'not-signed-in'].includes(status.authenticated) ? status.authenticated : 'unknown',
+    status: String(status.status || 'unknown').slice(0, 40),
+    codexPath: String(status.codexPath || '').slice(0, 500),
+    detail: String(status.detail || '').slice(0, 300)
+  };
+}
+
+export function createAgentManager({
+  dataDir = path.join(os.homedir(), '.livedesk'),
+  settingsStore,
+  codexRuntime
+} = {}) {
+  const settings = settingsStore || new AgentSettingsStore({ dataDir });
+  const runtime = codexRuntime;
+  let statusCache = { expiresAt: 0, value: null };
+
+  async function getCodexStatus() {
+    if (!runtime) return { installed: false, authenticated: 'unknown', status: 'unavailable', codexPath: '' };
+    if (statusCache.value && statusCache.expiresAt > Date.now()) return statusCache.value;
+    let value;
+    try {
+      value = publicCodexStatus(await runtime.getStatus());
+    } catch (error) {
+      value = publicCodexStatus({
+        installed: true,
+        authenticated: 'unknown',
+        status: error?.code || 'security-unavailable',
+        detail: error?.message || 'Codex security isolation is unavailable.'
+      });
+    }
+    statusCache = { value, expiresAt: Date.now() + 10000 };
+    return value;
+  }
+
+  async function publicSettings() {
+    const current = await settings.get();
+    const { codexMaxTurns: _codexMaxTurns, ...exposedSettings } = current;
+    const codex = await getCodexStatus();
+    const securityStatus = runtime?.getSecurityStatus?.() || {
+      isolatedCodexHome: false,
+      restrictedEnvironment: false,
+      livedeskMcpOnly: false,
+      selectedDeviceScopeEnforced: false,
+      failClosed: true,
+      verified: false,
+      state: 'unavailable'
+    };
+    return {
+      ...exposedSettings,
+      provider: AGENT_PROVIDER_CODEX,
+      codexInstallation: codex.installed ? 'installed' : 'not-installed',
+      codexAuth: codex.authenticated,
+      codexStatus: codex.status,
+      codexPath: codex.codexPath,
+      agentWorkspacePath: current.codexWorkingDirectory,
+      securityStatus
+    };
+  }
+
+  return {
+    getSettings: publicSettings,
+    async updateSettings(patch = {}) {
+      const nextPatch = { ...patch };
+      const requestedProvider = String(nextPatch.provider || AGENT_PROVIDER_CODEX).trim().toLowerCase();
+      const suppliedLegacyKey = typeof nextPatch.apiKey === 'string' && nextPatch.apiKey.trim().length > 0;
+      delete nextPatch.provider;
+      delete nextPatch.apiKey;
+      if (requestedProvider !== AGENT_PROVIDER_CODEX || suppliedLegacyKey) {
+        throw new AgentProviderError(
+          'agent-provider-retired',
+          'LiveDesk uses the Hub-hosted Codex Agent and does not configure alternate model providers.',
+          { status: 400 }
+        );
+      }
+      await settings.update({ ...nextPatch, provider: AGENT_PROVIDER_CODEX });
+      statusCache = { expiresAt: 0, value: null };
+      return publicSettings();
+    },
+    async resetSettings() {
+      await settings.reset();
+      statusCache = { expiresAt: 0, value: null };
+      return publicSettings();
+    },
+    // Kept as a harmless compatibility endpoint for an older cached web UI.
+    // No credential is read, written, or returned by the current Hub.
+    async deleteApiKey() {
+      return publicSettings();
+    },
+    async getModels() {
+      return [{
+        id: '',
+        name: 'Codex default',
+        protocol: 'codex-sdk',
+        available: true,
+        capabilities: { supportsReasoningLevel: true, supportsStreaming: true, supportsTools: true }
+      }];
+    },
+    async testConnection() {
+      if (!runtime) throw new AgentProviderError('codex-sdk-not-installed', 'Codex SDK is not installed.', { status: 503 });
+      statusCache = { expiresAt: 0, value: null };
+      return runtime.testConnection();
+    },
+    async createPlan() {
+      throw new AgentProviderError('agent-codex-run-required', 'Codex Agent requests use the LiveDesk tool loop.', { status: 409 });
+    },
+    async createSummary(input) {
+      const source = input && typeof input === 'object' ? input : {};
+      const results = Array.isArray(source.results) ? source.results : [];
+      return {
+        summary: String(results.length ? `${source.completed || 0} completed, ${source.failed || 0} failed.` : 'LiveDesk Agent run completed.').slice(0, 1200)
+      };
+    },
+    async startRun(input) {
+      const current = await settings.get();
+      if (current.provider !== AGENT_PROVIDER_CODEX || !runtime) {
+        throw new AgentProviderError('agent-codex-not-active', 'Codex SDK is not the active Agent runtime.', { status: 409 });
+      }
+      return runtime.start(input);
+    },
+    getRun(runId) { return runtime?.get(runId) || null; },
+    cancelRun(runId) { return runtime?.cancel(runId) || null; },
+    cancelAllRuns() { return runtime?.cancelAll?.() || 0; }
+  };
+}