livedesk 0.1.460 → 0.1.461

package/hub/src/remote-hub.js

@@ -4689,6 +4689,10 @@ export function createRemoteHub(options = {}) {
                 ? message.nativeEncoderHardwareAccelerated
                 : null,
             nativeEncoderHardwareQueryStatus: safeString(message.nativeEncoderHardwareQueryStatus, 80),
+            nativeCaptureDisplayId: Number.isSafeInteger(Number(message.nativeCaptureDisplayId))
+                && Number(message.nativeCaptureDisplayId) > 0
+                ? Number(message.nativeCaptureDisplayId)
+                : 0,
             nativeCaptureFps: Number.isFinite(Number(message.nativeCaptureFps)) ? Number(message.nativeCaptureFps) : 0,
             nativeCompressionFps: Number.isFinite(Number(message.nativeCompressionFps)) ? Number(message.nativeCompressionFps) : 0,
             nativeEncodedFps: Number.isFinite(Number(message.nativeEncodedFps)) ? Number(message.nativeEncodedFps) : 0,
@@ -4746,7 +4750,7 @@ export function createRemoteHub(options = {}) {
         return true;
     }
 
-    function promotePendingLiveStream(device, streamState, message, transport) {
+    function matchPendingLiveStreamOwner(device, streamState, message, transport) {
         const pending = getPendingLiveStreamDescriptor(streamState);
         const commandId = safeString(message.commandId, 128);
         if (!pending || !commandId || commandId !== safeString(pending.commandId, 128)) {
@@ -4754,9 +4758,11 @@ export function createRemoteHub(options = {}) {
         }
         const messageCaptureGeneration = Number(message.captureGeneration || 0);
         const pendingCaptureGeneration = Number(pending.captureGeneration || 0);
-        if (messageCaptureGeneration > 0
-            && pendingCaptureGeneration > 0
-            && messageCaptureGeneration !== pendingCaptureGeneration) {
+        if (!Number.isSafeInteger(messageCaptureGeneration)
+            || messageCaptureGeneration <= 0
+            || !Number.isSafeInteger(pendingCaptureGeneration)
+            || pendingCaptureGeneration <= 0
+            || messageCaptureGeneration !== pendingCaptureGeneration) {
             emitRemoteEvent('RemoteLiveStreamOpenIgnored', device, {
                 reason: 'stale-pending-capture-generation',
                 streamId: streamState.streamId,
@@ -4795,6 +4801,27 @@ export function createRemoteHub(options = {}) {
             });
             return null;
         }
+        return {
+            pending,
+            commandId,
+            messageCaptureGeneration,
+            pendingCaptureGeneration,
+            pendingMonitorIndex
+        };
+    }
+
+    function promotePendingLiveStream(device, streamState, message, transport) {
+        const owner = matchPendingLiveStreamOwner(device, streamState, message, transport);
+        if (!owner) {
+            return null;
+        }
+        const {
+            pending,
+            commandId,
+            messageCaptureGeneration,
+            pendingCaptureGeneration,
+            pendingMonitorIndex
+        } = owner;
 
         const previousCommandId = safeString(streamState.commandId, 128);
         const transfer = buildRemoteFrameTransferDescriptorFromMessage(
@@ -4903,16 +4930,22 @@ export function createRemoteHub(options = {}) {
 
         const activatingPendingGeneration = isPendingGeneration && commandId !== activeCommandId;
         if (activatingPendingGeneration) {
-            const promoted = promotePendingLiveStream(device, streamState, message, transport);
-            if (!promoted) {
+            const owner = matchPendingLiveStreamOwner(device, streamState, message, transport);
+            if (!owner) {
                 return false;
             }
-            emitLiveStreamOpened(
-                device,
-                promoted.streamState,
-                promoted.transfer,
-                transport,
-                promoted.previousCommandId);
+            // stream.open travels on the manager connection while the binary
+            // first frame travels on a separate transport. Their arrival order
+            // is not defined. Keep the current generation and its last frame
+            // until the matching first real frame validates and commits the
+            // pending owner atomically.
+            emitRemoteEvent('RemoteLiveStreamOpenDeferred', device, {
+                streamId,
+                commandId,
+                captureGeneration: owner.messageCaptureGeneration,
+                monitorIndex: owner.pendingMonitorIndex,
+                transport
+            });
             return true;
         }
 
@@ -4989,8 +5022,8 @@ export function createRemoteHub(options = {}) {
         const commandId = safeString(message.commandId, 128);
         let streamState = getDeviceLiveStream(device, streamId);
         if (!streamState?.active) {
-            device.counters.liveFramesDropped += 1;
-            emitRemoteEvent('RemoteFrameDropped', device, {
+            device.counters.liveFramesDropped += 1;
+            emitRemoteEvent('RemoteFrameDropped', device, {
                 reason: 'stale-live-stream-frame',
                 streamId,
                 frameSeq: Number.isFinite(frameSeq) ? frameSeq : null,
@@ -4998,9 +5031,91 @@ export function createRemoteHub(options = {}) {
             });
             return false;
         }
+        const byteLength = normalizeFrameByteLength(framePayload, frameData);
+        const streamFrameSeq = Number.isFinite(Number(message.streamFrameSeq))
+            ? Number(message.streamFrameSeq)
+            : frameSeq;
+        if (byteLength <= 0
+            || byteLength > MAX_STREAM_BINARY_BYTES
+            || !Number.isSafeInteger(frameSeq)
+            || frameSeq <= 0
+            || !Number.isSafeInteger(streamFrameSeq)
+            || streamFrameSeq <= 0) {
+            device.counters.liveFramesDropped += 1;
+            emitRemoteEvent('RemoteFrameDropped', device, {
+                reason: 'invalid-live-frame',
+                streamId,
+                commandId,
+                captureGeneration: Number(message.captureGeneration || 0),
+                monitorIndex: parseExactLiveStreamMonitorIndex(message.monitorIndex),
+                frameSeq: Number.isFinite(frameSeq) ? frameSeq : null,
+                transport
+            });
+            return false;
+        }
+        const payload = buildFramePayloadBuffer(framePayload, frameData);
+        if (payload.length <= 0 || payload.length > MAX_STREAM_BINARY_BYTES) {
+            device.counters.liveFramesDropped += 1;
+            emitRemoteEvent('RemoteFrameDropped', device, {
+                reason: 'invalid-live-frame-payload',
+                streamId,
+                commandId,
+                captureGeneration: Number(message.captureGeneration || 0),
+                monitorIndex: parseExactLiveStreamMonitorIndex(message.monitorIndex),
+                frameSeq,
+                transport
+            });
+            return false;
+        }
         let activeCommandId = safeString(streamState.commandId, 128);
-        let pendingCommandId = safeString(getPendingLiveStreamDescriptor(streamState)?.commandId, 128);
+        const pendingDescriptor = getPendingLiveStreamDescriptor(streamState);
+        let pendingCommandId = safeString(pendingDescriptor?.commandId, 128);
         if (pendingCommandId && commandId === pendingCommandId && commandId !== activeCommandId) {
+            if (!matchPendingLiveStreamOwner(device, streamState, message, `${transport}-implicit`)) {
+                return false;
+            }
+            const pendingFrameMode = safeString(
+                message.frameMode
+                    || message.mode
+                    || pendingDescriptor?.frameMode
+                    || pendingDescriptor?.mode,
+                40).toLowerCase();
+            const pendingMimeType = safeString(
+                message.mimeType
+                    || message.format
+                    || pendingDescriptor?.compression,
+                80).toLowerCase();
+            const pendingCodec = safeString(
+                message.codec
+                    || pendingDescriptor?.codec
+                    || pendingDescriptor?.encoding,
+                40).toLowerCase();
+            const requiresH264KeyFrame = pendingFrameMode === 'mode3-h264-hw'
+                || pendingMimeType.includes('h264')
+                || pendingMimeType.includes('avc')
+                || pendingCodec.includes('h264')
+                || pendingCodec.includes('avc');
+            const isH264KeyFrame = message.isKeyFrame === true
+                || safeString(message.chunkType, 20).toLowerCase() === 'key';
+            const h264 = requiresH264KeyFrame ? inspectAnnexBH264(payload) : null;
+            const independentlyDecodableH264KeyFrame = isH264KeyFrame
+                && h264?.annexB === true
+                && h264.hasSps === true
+                && h264.hasPps === true
+                && h264.hasIdr === true
+                && h264.nalOrderValid === true;
+            if (requiresH264KeyFrame && !independentlyDecodableH264KeyFrame) {
+                device.counters.liveFramesDropped += 1;
+                emitRemoteEvent('RemoteFrameDropped', device, {
+                    reason: 'pending-live-stream-decodable-keyframe-required',
+                    streamId,
+                    commandId,
+                    frameSeq,
+                    streamFrameSeq,
+                    transport
+                });
+                return false;
+            }
             const promoted = promotePendingLiveStream(device, streamState, message, `${transport}-implicit`);
             if (promoted) {
                 streamState = promoted.streamState;
@@ -5078,24 +5193,38 @@ export function createRemoteHub(options = {}) {
             return false;
         }
 
-        const byteLength = normalizeFrameByteLength(framePayload, frameData);
-        if ((!Buffer.isBuffer(framePayload) && !frameData)
-            || byteLength > MAX_STREAM_BINARY_BYTES
-            || !Number.isFinite(frameSeq)) {
-            device.counters.liveFramesDropped += 1;
-            emitRemoteEvent('RemoteFrameDropped', device, {
-                reason: 'invalid-live-frame',
-                streamId,
-                frameSeq: Number.isFinite(frameSeq) ? frameSeq : null,
-                transport
-            });
-            return false;
-        }
-
-        const mimeType = safeString(message.mimeType || message.format || 'image/jpeg', 80) || 'image/jpeg';
-        const capturedAt = safeString(message.capturedAt, 80) || device.lastSeenAt;
-        const payload = buildFramePayloadBuffer(framePayload, frameData);
-        const contentHash = buildFrameContentHash(message, payload);
+        const previousFrame = streamState.latestFrame;
+        const currentOwnerCommandId = commandId || activeCommandId;
+        const currentOwnerCaptureGeneration = activeCaptureGeneration || frameCaptureGeneration;
+        const previousStreamFrameSeq = Number(previousFrame?.streamFrameSeq ?? previousFrame?.frameSeq);
+        const sameFrameOwner = previousFrame
+            && safeString(previousFrame.streamId, 128) === streamId
+            && safeString(previousFrame.commandId, 128) === currentOwnerCommandId
+            && Number(previousFrame.captureGeneration || 0) === currentOwnerCaptureGeneration
+            && parseExactLiveStreamMonitorIndex(previousFrame.monitorIndex) === frameMonitorIndex;
+        if (sameFrameOwner
+            && Number.isSafeInteger(previousStreamFrameSeq)
+            && streamFrameSeq <= previousStreamFrameSeq) {
+            device.counters.liveFramesDropped += 1;
+            emitRemoteEvent('RemoteFrameDropped', device, {
+                reason: streamFrameSeq === previousStreamFrameSeq
+                    ? 'duplicate-live-stream-frame'
+                    : 'out-of-order-live-stream-frame',
+                streamId,
+                commandId: currentOwnerCommandId,
+                captureGeneration: currentOwnerCaptureGeneration,
+                monitorIndex: frameMonitorIndex,
+                frameSeq,
+                streamFrameSeq,
+                previousStreamFrameSeq,
+                transport
+            });
+            return false;
+        }
+
+        const mimeType = safeString(message.mimeType || message.format || 'image/jpeg', 80) || 'image/jpeg';
+        const capturedAt = safeString(message.capturedAt, 80) || device.lastSeenAt;
+        const contentHash = buildFrameContentHash(message, payload);
         const sameContentStreak = computeSameContentStreak(streamState.latestFrame, contentHash);
         const transfer = buildRemoteFrameTransferDescriptorFromMessage(message, streamState.mode || DEFAULT_REMOTE_FRAME_MODE);
         if (streamState.open !== true) {
@@ -5129,7 +5258,7 @@ export function createRemoteHub(options = {}) {
         device.latestLiveFrame = {
             streamId,
             frameSeq,
-            streamFrameSeq: Number.isFinite(Number(message.streamFrameSeq)) ? Number(message.streamFrameSeq) : frameSeq,
+            streamFrameSeq,
             commandId: commandId || activeCommandId,
             sessionId: device.sessionId,
             captureGeneration: activeCaptureGeneration || frameCaptureGeneration,
@@ -5175,6 +5304,10 @@ export function createRemoteHub(options = {}) {
                 ? message.nativeEncoderHardwareAccelerated
                 : null,
             nativeEncoderHardwareQueryStatus: safeString(message.nativeEncoderHardwareQueryStatus, 80),
+            nativeCaptureDisplayId: Number.isSafeInteger(Number(message.nativeCaptureDisplayId))
+                && Number(message.nativeCaptureDisplayId) > 0
+                ? Number(message.nativeCaptureDisplayId)
+                : 0,
             nativeCaptureFps: Number.isFinite(Number(message.nativeCaptureFps)) ? Number(message.nativeCaptureFps) : 0,
             nativeCompressionFps: Number.isFinite(Number(message.nativeCompressionFps)) ? Number(message.nativeCompressionFps) : 0,
             nativeEncodedFps: Number.isFinite(Number(message.nativeEncodedFps)) ? Number(message.nativeEncodedFps) : 0,
@@ -5369,7 +5502,7 @@ export function createRemoteHub(options = {}) {
         return true;
     }
 
-    function applyAudioStatus(device, message, framePayload, transport = 'binary') {
+    function applyAudioStatus(device, message, framePayload, transport = 'binary') {
         if (!Buffer.isBuffer(framePayload) || framePayload.length < 1) {
             device.counters.audioFramesDropped += 1;
             return false;
@@ -5410,9 +5543,184 @@ export function createRemoteHub(options = {}) {
             payload: framePayload,
             byteLength: framePayload.length
         });
-        return true;
-    }
-
+        return true;
+    }
+
+    function readFrameTransportProof(message = {}) {
+        if (message.frameTransportProofId === undefined
+            && message.frameTransportProofVersion === undefined) {
+            return null;
+        }
+        const rawProofId = typeof message.frameTransportProofId === 'string'
+            ? message.frameTransportProofId.trim()
+            : '';
+        const captureGeneration = Number(message.captureGeneration);
+        const monitorIndex = parseExactLiveStreamMonitorIndex(message.monitorIndex);
+        const proof = {
+            proofId: rawProofId,
+            streamId: safeString(message.streamId, 128),
+            commandId: safeString(message.commandId, 128),
+            captureGeneration,
+            monitorIndex
+        };
+        const valid = Number(message.frameTransportProofVersion) === 1
+            && /^[a-f0-9]{32}$/.test(rawProofId)
+            && !!proof.streamId
+            && !!proof.commandId
+            && Number.isSafeInteger(captureGeneration)
+            && captureGeneration > 0
+            && monitorIndex !== null;
+        return {
+            ...proof,
+            valid,
+            error: valid ? '' : 'frame-proof-owner-invalid'
+        };
+    }
+
+    function applyLiveFrameWithTransportProof(
+        device,
+        message,
+        framePayload,
+        transport) {
+        const proof = readFrameTransportProof(message);
+        if (!proof) {
+            return {
+                accepted: applyLiveFrame(device, message, framePayload, transport),
+                proofAccepted: false,
+                proof: null,
+                error: ''
+            };
+        }
+        const frameMode = safeString(message.frameMode || message.mode, 40).toLowerCase();
+        const mimeType = safeString(message.mimeType || message.format, 80).toLowerCase();
+        const chunkType = safeString(message.chunkType, 20).toLowerCase();
+        const proofFrameSeq = Number(message.frameSeq);
+        const proofStreamFrameSeq = message.streamFrameSeq === undefined
+            || message.streamFrameSeq === null
+            || message.streamFrameSeq === ''
+            ? proofFrameSeq
+            : Number(message.streamFrameSeq);
+        const proofOnly = message.frameTransportProofOnly === true;
+        const h264 = inspectAnnexBH264(framePayload);
+        const proofPayloadValid = proof.valid
+            && (transport === 'udp-p2p' || transport === 'relay-binary')
+            && Buffer.isBuffer(framePayload)
+            && framePayload.length > 0
+            && framePayload.length <= MAX_STREAM_BINARY_BYTES
+            && Number.isSafeInteger(proofFrameSeq)
+            && proofFrameSeq > 0
+            && Number.isSafeInteger(proofStreamFrameSeq)
+            && proofStreamFrameSeq > 0
+            && frameMode === 'mode3-h264-hw'
+            && mimeType === 'video/h264'
+            && (message.isKeyFrame === true || chunkType === 'key')
+            && safeString(message.frameTransportActive, 20).toLowerCase() === 'none'
+            && safeString(message.frameTransportState, 20).toLowerCase() === 'probing'
+            && h264.annexB
+            && h264.hasSps
+            && h264.hasPps
+            && h264.hasIdr
+            && h264.nalOrderValid;
+        if (!proofPayloadValid) {
+            device.counters.liveFramesDropped += 1;
+            emitRemoteEvent('RemoteFrameDropped', device, {
+                reason: proof.error || 'frame-proof-h264-invalid',
+                streamId: proof.streamId,
+                commandId: proof.commandId,
+                captureGeneration: proof.captureGeneration,
+                monitorIndex: proof.monitorIndex,
+                transport
+            });
+            return {
+                accepted: false,
+                proofAccepted: false,
+                proof,
+                error: proof.error || 'frame-proof-h264-invalid'
+            };
+        }
+        if (proofOnly) {
+            const streamState = getDeviceLiveStream(device, proof.streamId);
+            // A proof-only frame is an out-of-band path challenge. It must
+            // prove the exact current stream owner and carry a complete
+            // independently decodable H.264 key frame, but it must not race
+            // the presentation lane's latest delta frame. WAN fragmentation
+            // can legitimately deliver this challenge several relay frames
+            // after the same source key was presented.
+            const exactActiveStreamOwner = transport === 'udp-p2p'
+                && streamState?.active === true
+                && safeString(streamState.commandId, 128) === proof.commandId
+                && Number(streamState.captureGeneration || 0) === proof.captureGeneration
+                && parseExactLiveStreamMonitorIndex(streamState.monitorIndex) === proof.monitorIndex;
+            if (exactActiveStreamOwner) {
+                emitRemoteEvent('RemoteFrameTransportProofAccepted', device, {
+                    proofOnly: true,
+                    proofId: proof.proofId,
+                    streamId: proof.streamId,
+                    commandId: proof.commandId,
+                    captureGeneration: proof.captureGeneration,
+                    monitorIndex: proof.monitorIndex,
+                    frameSeq: proofFrameSeq,
+                    streamFrameSeq: proofStreamFrameSeq,
+                    transport
+                });
+            }
+            return {
+                accepted: exactActiveStreamOwner,
+                proofAccepted: exactActiveStreamOwner,
+                proofOnly: true,
+                proof,
+                error: exactActiveStreamOwner
+                    ? ''
+                    : 'frame-proof-active-owner-mismatch'
+            };
+        }
+        const accepted = applyLiveFrame(device, message, framePayload, transport);
+        const frame = device.latestLiveFrame;
+        const exactAcceptedFrame = accepted
+            && frame?.currentGenerationVerified === true
+            && safeString(frame.streamId, 128) === proof.streamId
+            && safeString(frame.commandId, 128) === proof.commandId
+            && Number(frame.captureGeneration) === proof.captureGeneration
+            && parseExactLiveStreamMonitorIndex(frame.monitorIndex) === proof.monitorIndex;
+        if (exactAcceptedFrame) {
+            emitRemoteEvent('RemoteFrameTransportProofAccepted', device, {
+                proofOnly: false,
+                proofId: proof.proofId,
+                streamId: proof.streamId,
+                commandId: proof.commandId,
+                captureGeneration: proof.captureGeneration,
+                monitorIndex: proof.monitorIndex,
+                frameSeq: proofFrameSeq,
+                streamFrameSeq: proofStreamFrameSeq,
+                transport
+            });
+        }
+        return {
+            accepted: exactAcceptedFrame,
+            proofAccepted: exactAcceptedFrame,
+            proof,
+            error: exactAcceptedFrame ? '' : 'frame-proof-current-generation-rejected'
+        };
+    }
+
+    function writeFrameTransportProofResponse(socket, result) {
+        const proof = result?.proof;
+        if (!proof?.proofId) return;
+        const accepted = result.proofAccepted === true;
+        writeJsonLine(socket, {
+            type: accepted
+                ? 'frame.transport.proof-accepted'
+                : 'frame.transport.proof-rejected',
+            protocol: 'livedesk.frame-transport-proof.v1',
+            proofId: proof.proofId,
+            streamId: proof.streamId,
+            commandId: proof.commandId,
+            captureGeneration: proof.captureGeneration,
+            monitorIndex: proof.monitorIndex,
+            ...(accepted ? {} : { error: safeString(result.error || 'frame-proof-rejected', 160) })
+        });
+    }
+
     function handleAgentBinaryFrame(socket, state, header, framePayload) {
         if (!state.authenticated || !state.device) {
             writeJsonLine(socket, { type: 'error', error: 'hello-required' });
@@ -5448,11 +5756,12 @@ export function createRemoteHub(options = {}) {
         }
 
         if (frameKind === 'stream' || frameKind === 'live' || header.type === 'stream.binary') {
-            applyLiveFrame(device, {
+            const result = applyLiveFrameWithTransportProof(device, {
                 ...header,
                 hubIngressDropped: Number(state.binaryQueueDrops || 0),
                 hubIngressCounterEpoch: state.binaryQueueEpoch
             }, framePayload, binaryTransport);
+            writeFrameTransportProofResponse(socket, result);
             return;
         }
 
@@ -5472,7 +5781,7 @@ export function createRemoteHub(options = {}) {
         });
     }
 
-    function handleUdpFrame({ deviceId, sessionId, header, payload } = {}) {
+    function handleUdpFrame({ deviceId, sessionId, header, payload } = {}) {
         const device = devices.get(safeString(deviceId, 160));
         if (!device || !device.connected) {
             return false;
@@ -5485,19 +5794,25 @@ export function createRemoteHub(options = {}) {
             emitRemoteEvent('RemoteFrameDropped', device, { reason: 'udp-frame-mode-not-supported', transport: 'udp-p2p', frameMode });
             return false;
         }
-        device.udp = {
-            ...device.udp,
-            state: 'udp-active',
-            ready: true,
-            lastFrameAt: new Date().toISOString(),
-            framesReceived: Number(device.udp?.framesReceived || 0) + 1
-        };
-        return applyLiveFrame(device, {
+        const result = applyLiveFrameWithTransportProof(device, {
             ...header,
             transport: 'udp-p2p',
             hubIngressCounterEpoch: sessionId
         }, payload, 'udp-p2p');
-    }
+        if (result.accepted) {
+            device.udp = {
+                ...device.udp,
+                state: result.proof ? 'udp-proof-accepted' : 'udp-active',
+                ready: true,
+                lastFrameAt: new Date().toISOString(),
+                framesReceived: Number(device.udp?.framesReceived || 0)
+                    + (result.proofOnly === true ? 0 : 1)
+            };
+        }
+        return result.proof
+            ? result
+            : result.accepted;
+    }
 
     function dropQueuedAgentBinaryFrame(state) {
         if (!Array.isArray(state.binaryQueue) || state.binaryQueue.length === 0) {

package/hub/src/server.js

@@ -2137,6 +2137,10 @@ function buildRemoteFrameBinaryPacket(frameEvent, diagnostics = {}) {
       ? frame.nativeEncoderHardwareAccelerated
       : null,
     nativeEncoderHardwareQueryStatus: frame.nativeEncoderHardwareQueryStatus || '',
+    nativeCaptureDisplayId: Number.isSafeInteger(Number(frame.nativeCaptureDisplayId))
+      && Number(frame.nativeCaptureDisplayId) > 0
+      ? Number(frame.nativeCaptureDisplayId)
+      : 0,
     nativeCaptureFps: Number(frame.nativeCaptureFps || 0) || 0,
     nativeCompressionFps: Number(frame.nativeCompressionFps || 0) || 0,
     nativeEncodedFps: Number(frame.nativeEncodedFps || 0) || 0,

package/hub/src/transport/udp-hub-transport.js

@@ -263,7 +263,7 @@ export function createHubUdpTransport({ env = process.env, logEvent = () => {},
         if (!complete) return;
         session.framesReceived += 1;
         const reassembly = session.reassembler.getStats();
-        frameHandler({
+        const handled = frameHandler({
             deviceId: session.deviceId,
             sessionId: session.sessionId,
             header: {
@@ -276,11 +276,34 @@ export function createHubUdpTransport({ env = process.env, logEvent = () => {},
             },
             payload: complete.payload,
             transport: 'udp-p2p'
-        });
-        sendPacket(session, 'pong', {
-            state: 'frame-ack',
-            frameSeq: Number(complete.header?.frameSeq || 0) || 0
-        });
+        });
+        const accepted = handled === true || handled?.accepted === true;
+        const proofId = safeText(complete.header?.frameTransportProofId, 96);
+        if (proofId) {
+            if (handled?.suppressProofResponse === true) return;
+            const proofAccepted = accepted && handled?.proofAccepted === true;
+            sendPacket(session, 'pong', {
+                state: proofAccepted ? 'frame-proof-ack' : 'frame-proof-reject',
+                proofId,
+                protocol: 'livedesk.frame-transport-proof.v1',
+                streamId: safeText(complete.header?.streamId, 128),
+                commandId: safeText(complete.header?.commandId, 128),
+                captureGeneration: Number(complete.header?.captureGeneration || 0) || 0,
+                monitorIndex: Number(complete.header?.monitorIndex ?? -1),
+                error: proofAccepted ? '' : safeText(handled?.error || 'frame-proof-rejected', 160)
+            });
+            return;
+        }
+        if (accepted) {
+            sendPacket(session, 'pong', {
+                state: 'frame-ack',
+                frameSeq: Number(complete.header?.frameSeq || 0) || 0,
+                streamId: safeText(complete.header?.streamId, 128),
+                commandId: safeText(complete.header?.commandId, 128),
+                captureGeneration: Number(complete.header?.captureGeneration || 0) || 0,
+                monitorIndex: Number(complete.header?.monitorIndex ?? -1)
+            });
+        }
     });
     socket.on('error', error => logWarn('udp', `UDP socket error: ${error?.message || error}`));
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "livedesk",
-  "version": "0.1.460",
-  "livedeskClientVersion": "0.1.213",
+  "version": "0.1.461",
+  "livedeskClientVersion": "0.1.214",
   "buildFlavor": "production",
   "description": "LiveDesk Hub and client launcher",
   "type": "module",
@@ -15,9 +15,10 @@
     "diagnostics/",
     "hub/",
     "runtime-core/",
-    "client/",
-    "electron/",
-    "web/",
+    "client/",
+    "electron/",
+    "scripts/",
+    "web/",
     "README.md"
   ],
   "scripts": {
@@ -50,10 +51,10 @@
     "ws": "^8.18.3"
   },
   "optionalDependencies": {
-    "@livedesk/fast-linux-x64": "0.1.417",
-    "@livedesk/fast-osx-arm64": "0.1.417",
-    "@livedesk/fast-osx-x64": "0.1.417",
-    "@livedesk/fast-win-x64": "0.1.417"
+    "@livedesk/fast-linux-x64": "0.1.419",
+    "@livedesk/fast-osx-arm64": "0.1.419",
+    "@livedesk/fast-osx-x64": "0.1.419",
+    "@livedesk/fast-win-x64": "0.1.419"
   },
   "publishConfig": {
     "access": "public"