livedesk 0.1.454 → 0.1.456

package/README.md

@@ -51,7 +51,7 @@ Pass `--no-clean` to disable the startup cleanup explicitly. If a child Hub
 still loses a startup race with `EADDRINUSE`, the launcher performs one cleanup
 and startup retry, then exits without looping.
 
-## Client compatibility
+## Client compatibility
 
 ```powershell
 npx -y --prefer-online livedesk@latest client 3
@@ -61,9 +61,36 @@ The `client` form remains as a legacy compatibility alias. It records the
 Client role and uses the same unified runtime lock. The client signs in with
 Google, discovers the active Hub, and connects to the wall. On Windows, enable
 **Start with Windows** on the connection page to reconnect automatically after
-reboot; the generated startup command uses the unified launcher.
-
-## Frame modes
+reboot; the generated startup command uses the unified launcher.
+
+## macOS physical diagnostic
+
+On a Mac with two connected displays, stop every running LiveDesk runtime,
+show visibly different content on the two displays, grant Screen Recording and
+Accessibility permissions, then run:
+
+```bash
+npx -y --prefer-online livedesk@latest diagnose mac-physical
+```
+
+This command branches before role resolution, state migration, and the normal
+runtime lock. It refuses to overlap an existing LiveDesk runtime or capture
+helper, and normal macOS startup reciprocally refuses an active diagnostic
+lease. It starts only an isolated loopback Hub and temporary RemoteFast Client
+and stops only the exact children it created. Ctrl+C and termination signals
+join the same owned cleanup before exit. The default JSON report is written to
+one final path after cleanup, and run/cleanup errors always produce a failed
+result. It is written under `~/.livedesk/diagnostics`. To select a path relative
+to the directory where the command was invoked:
+
+```bash
+npx -y --prefer-online livedesk@latest diagnose mac-physical --report ./mac-result.json
+```
+
+Use `diagnose mac-physical --help` to inspect requirements without starting a
+runtime or changing cached role/account state.
+
+## Frame modes
 
 - Mode 2: independent 320x180 RGB565+LZO tiles for large, stable walls.
 - Mode 3: direct hardware H.264 for focused remote control up to 4K.

package/bin/livedesk.js

@@ -34,6 +34,7 @@ import {
 import { runLegacyClientUpdateSupervisorCli } from '../bootstrap/legacy-client-update.js';
 import { transferSavedClientSessionToHub } from '../bootstrap/hub-auth-handoff.js';
 import { readWindowsOwnedProcessManifest } from '../client/src/runtime/windows-owned-process-manifest.js';
+import { inspectMacDiagnosticLease } from '../diagnostics/livedesk-mac-physical-isolation.mjs';
 
 const require = createRequire(import.meta.url);
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -143,6 +144,22 @@ function isPidAlive(pid) {
   }
 }
 
+async function assertNoActiveMacPhysicalDiagnosticLease() {
+  if (os.platform() !== 'darwin') return;
+  const lease = await inspectMacDiagnosticLease();
+  if (lease.status === 'missing' || lease.status === 'stale') return;
+  if (lease.status === 'active') {
+    throw new Error(
+      `Mac physical diagnostic is running (pid ${lease.pid}); normal LiveDesk startup was not started. `
+      + 'Wait for its owned cleanup to finish or stop the diagnostic with Ctrl+C.'
+    );
+  }
+  throw new Error(
+    `Mac physical diagnostic ownership is unreadable at ${lease.path}; normal LiveDesk startup was not started `
+    + 'to avoid overlapping a capture runtime.'
+  );
+}
+
 function canClaimHubUpdateResult(current, next) {
   const currentOperationId = String(current?.operationId || '');
   const nextOperationId = String(next?.operationId || '');
@@ -312,15 +329,18 @@ function printHelp() {
   process.stdout.write(`
 LiveDesk
 
-Usage:
-  npx -y --prefer-online livedesk@latest
-  npx -y --prefer-online livedesk@latest --force-role hub
-  npx -y --prefer-online livedesk@latest --force-role client
-
-Commands:
-  No command     Resolve the signed-in device role and start the matching runtime.
-  hub            Legacy alias for --force-role hub.
-  client         Legacy alias for --force-role client.
+Usage:
+  npx -y --prefer-online livedesk@latest
+  npx -y --prefer-online livedesk@latest --force-role hub
+  npx -y --prefer-online livedesk@latest --force-role client
+  npx -y --prefer-online livedesk@latest diagnose mac-physical
+
+Commands:
+  No command     Resolve the signed-in device role and start the matching runtime.
+  hub            Legacy alias for --force-role hub.
+  client         Legacy alias for --force-role client.
+  diagnose mac-physical
+                 Run the isolated two-display macOS capture/control physical gate.
 
 Hub options:
   --no-open      Do not open the browser automatically.
@@ -342,10 +362,63 @@ Common:
                  Do not ask for a role on first run; fail if no role is known.
   --help         Show this help.
   --version      Show version.
-`.trimStart());
-}
-
-function printClientHelp() {
+`.trimStart());
+}
+
+function printMacPhysicalDiagnosticHelp() {
+  process.stdout.write(`
+LiveDesk macOS physical diagnostic
+
+Usage:
+  npx -y --prefer-online livedesk@latest diagnose mac-physical
+  npx -y --prefer-online livedesk@latest diagnose mac-physical --report ./mac-result.json
+
+Requirements:
+  macOS with two connected displays showing visibly different content.
+  Screen Recording permission for the terminal/LiveDesk capture helper.
+  Accessibility permission for the terminal/LiveDesk input helper.
+  Stop every existing LiveDesk Hub, Client, and desktop runtime first.
+
+Behavior:
+  Starts one isolated loopback Hub and one temporary RemoteFast Client.
+  Refuses to overlap a running LiveDesk runtime or capture helper.
+  Stops only the exact child processes created by this diagnostic.
+  Writes the default report under ~/.livedesk/diagnostics.
+
+Options:
+  --report <path>  Write the JSON report relative to the invocation directory.
+  --monitor <n>    Initial zero-based display index. Default: 0.
+  --width <px>     Requested capture width. Default: 1920.
+  --height <px>    Requested capture height. Default: 1080.
+  --help           Show this help without resolving a role or acquiring a runtime lock.
+`.trimStart());
+}
+
+async function runDiagnosticCommand(args) {
+  const name = String(args[0] || '').trim().toLowerCase();
+  if (!name || name === '--help' || name === '-h' || name === 'help') {
+    printMacPhysicalDiagnosticHelp();
+    return;
+  }
+  if (name !== 'mac-physical') {
+    throw new Error(`Unknown LiveDesk diagnostic: ${name}. Supported diagnostic: mac-physical.`);
+  }
+  if (args.slice(1).some(argument => ['--help', '-h', 'help'].includes(String(argument).toLowerCase()))) {
+    printMacPhysicalDiagnosticHelp();
+    return;
+  }
+  const diagnosticEntry = resolve(
+    packageRoot,
+    'diagnostics',
+    'livedesk-mode3-capture-smoke.mjs'
+  );
+  if (!existsSync(diagnosticEntry)) {
+    throw new Error(`LiveDesk mac-physical diagnostic is missing from this package: ${diagnosticEntry}`);
+  }
+  await import(pathToFileURL(diagnosticEntry).href);
+}
+
+function printClientHelp() {
   process.stdout.write(`
 LiveDesk Client
 
@@ -2847,8 +2920,14 @@ async function runDesktopRoleBootstrap() {
 
 async function main() {
   const rawArgs = process.argv.slice(2);
+  const rawCommand = String(rawArgs[0] || '').trim().toLowerCase();
+  if (rawCommand === 'diagnose') {
+    await runDiagnosticCommand(rawArgs.slice(1));
+    return;
+  }
   restoreUpdateOriginalCwd();
   if (rawArgs.includes('--internal-legacy-client-update')) {
+    await assertNoActiveMacPhysicalDiagnosticLease();
     await runLegacyClientUpdateSupervisorCli();
     return;
   }
@@ -2870,11 +2949,12 @@ async function main() {
     printHelp();
     return;
   }
-  if (command === '--version' || command === '-v' || command === 'version') {
-    console.log(readVersion());
-    return;
-  }
-  const explicitRoleCommand = command === 'hub' || command === 'manager' || command === 'client';
+  if (command === '--version' || command === '-v' || command === 'version') {
+    console.log(readVersion());
+    return;
+  }
+  await assertNoActiveMacPhysicalDiagnosticLease();
+  const explicitRoleCommand = command === 'hub' || command === 'manager' || command === 'client';
   let resolvedRole;
   let runtimeArgs = args;
   if (explicitRoleCommand) {

package/client/bin/livedesk-client-node.js

@@ -1432,9 +1432,11 @@ function remotePolicyAllows(options, command) {
     const policy = options.effectivePolicy;
     if (!policy || typeof policy !== 'object') return { ok: true };
     if (policy.accessMode === 'block-remote-access') return { ok: false, error: 'remote-access-blocked-by-settings' };
-    const required = command === 'input.control'
-        ? ['allowControl']
-        : command.startsWith('file.transfer')
+    const required = command === 'input.control'
+        ? ['allowControl']
+        : command === 'system.power'
+            ? ['allowPowerActions']
+        : command.startsWith('file.transfer')
             ? ['allowFileTransfer']
             : command === 'audio.start'
                 ? ['allowRemoteAudio']
@@ -2044,8 +2046,8 @@ function connectOnce(options, deviceId) {
 
                 const message = JSON.parse(line);
                 if (message.type === 'welcome') {
-                    options.effectivePolicy = message.effectivePolicy && typeof message.effectivePolicy === 'object'
-                        ? message.effectivePolicy
+                    options.effectivePolicy = message.effectivePolicy && typeof message.effectivePolicy === 'object'
+                        ? message.effectivePolicy
                         : null;
                     console.log(`Connected to LiveDesk Hub as ${options.name} (${deviceId})`);
                     markClientUpdateConnected();
@@ -2058,13 +2060,17 @@ function connectOnce(options, deviceId) {
                         return;
                     }
 
-                    heartbeatTimer = setInterval(() => {
-                        writeJsonLine(socket, {
-                            type: 'status',
-                            status: getStatus(options)
-                        });
-                    }, options.heartbeatMs);
-                } else if (message.type === 'command') {
+                    heartbeatTimer = setInterval(() => {
+                        writeJsonLine(socket, {
+                            type: 'status',
+                            status: getStatus(options)
+                        });
+                    }, options.heartbeatMs);
+                } else if (message.type === 'policy.update') {
+                    options.effectivePolicy = message.effectivePolicy && typeof message.effectivePolicy === 'object'
+                        ? message.effectivePolicy
+                        : options.effectivePolicy;
+                } else if (message.type === 'command') {
                     handleRemoteCommand(socket, options, message, () => {
                         frameSeq += 1;
                         return frameSeq;

package/client/bin/livedesk-client.js

@@ -4795,8 +4795,8 @@ export async function runClientRuntime(argv = process.argv.slice(2)) {
     const parsed = parseLauncherArgs(argv);
     if (parsed.retiredModelOptionsDiscarded > 0) {
         console.warn(
-            '[LiveDesk Client] Ignored retired Client model-runtime options. '
-            + 'Approved AI computer commands are handled by the Hub Codex Agent.'
+            '[LiveDesk Client] Ignored retired Client options. '
+            + 'Computer commands are handled by the Hub Codex Agent.'
         );
     }
     if (parsed.updateWaitPid) {

package/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/client",
-  "version": "0.1.209",
+  "version": "0.1.211",
   "description": "LiveDesk local remote client",
   "type": "module",
   "bin": {
@@ -9,12 +9,12 @@
     "livedesk-client-node": "bin/livedesk-client-node.js",
     "livedesk-client-fast": "bin/livedesk-client-fast.js"
   },
-  "files": [
-    "bin/",
-    "src/",
-    "README.md",
-    "THIRD_PARTY_NOTICES.md"
-  ],
+  "files": [
+    "bin/",
+    "src/",
+    "README.md",
+    "THIRD_PARTY_NOTICES.md"
+  ],
   "scripts": {
     "check": "node --check bin/client-version.js && node --check bin/livedesk-client.js && node --check bin/livedesk-client-node.js && node --check bin/livedesk-client-fast.js",
     "test:version": "node --test tests/client-version.test.mjs",
@@ -31,21 +31,21 @@
   "engines": {
     "node": ">=20"
   },
-  "dependencies": {
-    "@ffmpeg-installer/ffmpeg": "^1.1.0",
-    "ffmpeg-static": "^5.3.0",
-    "@livedesk/runtime-core": "0.1.0",
-    "@supabase/supabase-js": "^2.110.0",
-    "node-screenshots": "^0.2.8",
-    "ws": "^8.18.3"
-  },
-  "optionalDependencies": {
-    "@livedesk/fast-linux-x64": "0.1.414",
-    "@livedesk/fast-osx-arm64": "0.1.414",
-    "@livedesk/fast-osx-x64": "0.1.414",
-    "@livedesk/fast-win-x64": "0.1.414"
-  },
-  "publishConfig": {
+  "dependencies": {
+    "@ffmpeg-installer/ffmpeg": "^1.1.0",
+    "ffmpeg-static": "^5.3.0",
+    "@livedesk/runtime-core": "0.1.0",
+    "@supabase/supabase-js": "^2.110.0",
+    "node-screenshots": "^0.2.8",
+    "ws": "^8.18.3"
+  },
+  "optionalDependencies": {
+    "@livedesk/fast-linux-x64": "0.1.415",
+    "@livedesk/fast-osx-arm64": "0.1.415",
+    "@livedesk/fast-osx-x64": "0.1.415",
+    "@livedesk/fast-win-x64": "0.1.415"
+  },
+  "publishConfig": {
     "access": "public"
   }
 }