livedesk 0.1.477 → 0.1.480

package/README.md

@@ -148,7 +148,7 @@ device, Hub URL, timeout, and report-path options.
 
 Monthly and yearly subscriptions are planned after the LTD launch.
 
-## Free ad slot
+## Free ad slot
 
 Free accounts show a standard bottom ad slot. Set these Vite build variables
 for a real AdSense placement:
@@ -158,5 +158,36 @@ VITE_LIVEDESK_ADSENSE_CLIENT=ca-pub-...
 VITE_LIVEDESK_ADSENSE_SLOT=...
 ```
 
-Without those values, LiveDesk renders a neutral sponsored-placement placeholder
-so the free-plan layout can still be tested.
+Without those values, LiveDesk renders a neutral sponsored-placement placeholder
+so the free-plan layout can still be tested.
+
+## Signed update configuration
+
+Production update checks fail closed until all applicable values are set:
+
+```text
+LIVEDESK_UPDATE_MANIFEST_URL=https://updates.example.com/stable.json
+LIVEDESK_UPDATE_PUBLIC_KEY=<Ed25519 SPKI PEM or base64 DER public key>
+LIVEDESK_UPDATE_URL=https://updates.example.com/desktop
+```
+
+The public key may instead be bundled at
+`electron/update-public-key.pem` for desktop builds. Keep the Ed25519 private
+key offline and outside this repository. Release automation supplies it only to
+the signing command as `LIVEDESK_UPDATE_PRIVATE_KEY` or `--private-key`:
+
+```powershell
+npm run sign:update-manifest -- --input release-payload.json --output stable.json --private-key E:\secure\livedesk-update-ed25519.pem
+```
+
+The payload must include exact npm `dist.integrity` values for `livedesk` and
+`@livedesk/client`, desktop version/platform/architecture SHA-512 values, a
+maximum 31-day validity window, and emergency blocked-version lists.
+
+Desktop publisher signing is independent of the LiveDesk manifest signature.
+Configure electron-builder secrets only in the release environment: `CSC_LINK`
+and `CSC_KEY_PASSWORD` for the Windows/macOS certificate; for Apple
+notarization also configure `APPLE_ID`, `APPLE_APP_SPECIFIC_PASSWORD`, and
+`APPLE_TEAM_ID`. Do not put any private key, certificate password, OAuth secret,
+Supabase service key, Dodo webhook secret, or API token in source, Vite public
+variables, logs, or the signed manifest.

package/bin/livedesk.js

@@ -2506,7 +2506,8 @@ async function runManager(args, resolvedRole = null, runtimeLock = null) {
     : (existsSync(internalHubEntry)
       ? internalHubEntry
       : resolvePackageEntry('@livedesk/hub', '@livedesk/hub/src/server.js'));
-  const packagedWebDist = resolve(packageRoot, 'web', 'dist');
+  const packagedWebDist = resolve(packageRoot, 'web', 'dist');
+  const launcherShutdownToken = randomBytes(32).toString('base64url');
   const env = {
     ...process.env,
     LIVEDESK_HUB_HTTP_HOST: configuredHttpHost,
@@ -2527,6 +2528,7 @@ async function runManager(args, resolvedRole = null, runtimeLock = null) {
     LIVEDESK_DEVICE_NAME: String(resolvedRole?.deviceName || process.env.LIVEDESK_DEVICE_NAME || os.hostname()),
     LIVEDESK_ROLE_CACHE_PATH: join(MANAGER_STATE_DIR, 'device-role.json'),
     LIVEDESK_AUTH_STATE_PATH: join(MANAGER_STATE_DIR, 'auth.json'),
+    LIVEDESK_LAUNCHER_SHUTDOWN_TOKEN: launcherShutdownToken,
     LIVEDESK_ROLE_SOURCE: String(resolvedRole?.source || process.env.LIVEDESK_ROLE_SOURCE || '')
   };
   const debugConsole = process.env.LIVEDESK_DEBUG === '1';
@@ -2601,6 +2603,7 @@ async function runManager(args, resolvedRole = null, runtimeLock = null) {
         try {
           const response = await fetch(`${hubProbeBaseUrl}/api/runtime/shutdown`, {
             method: 'POST',
+            headers: { 'X-LiveDesk-Launcher-Shutdown': launcherShutdownToken },
             signal: AbortSignal.timeout(750)
           });
           if (!response.ok) throw new Error(`HTTP ${response.status}`);
@@ -2855,6 +2858,7 @@ async function runManager(args, resolvedRole = null, runtimeLock = null) {
         updateStopTimer.unref?.();
         void fetch(`${hubProbeBaseUrl}/api/runtime/shutdown`, {
           method: 'POST',
+          headers: { 'X-LiveDesk-Launcher-Shutdown': launcherShutdownToken },
           signal: AbortSignal.timeout(2_500)
         }).then(response => {
           if (!response.ok) throw new Error(`HTTP ${response.status}`);

package/bootstrap/hub-auth-handoff.js

@@ -14,6 +14,7 @@ import {
 } from '../runtime-core/src/auth-config.js';
 import { fetchAuthResponse } from '../runtime-core/src/auth-http.js';
 import { normalizeRuntimeAuthSession } from '../runtime-core/src/auth-session.js';
+import { createOsSecretStore, OS_SECRET_REFERENCE } from '../runtime-core/src/os-secret-store.js';
 
 const CLIENT_AUTH_STORAGE_KEY = 'livedesk.client.supabase.auth';
 const MINIMUM_SESSION_LIFETIME_SECONDS = 30;
@@ -61,6 +62,28 @@ function sessionIsFresh(session, nowSeconds) {
     && expiresAt - Number(nowSeconds || 0) > MINIMUM_SESSION_LIFETIME_SECONDS;
 }
 
+function clientRefreshSecretStore(stateDir) {
+  return createOsSecretStore({
+    service: 'LiveDesk',
+    account: 'client-refresh-token',
+    dataDir: stateDir
+  });
+}
+
+function persistProtectedClientSession(stateDir, session) {
+  const normalized = normalizeRuntimeAuthSession(session, { requireRefreshToken: true });
+  if (!normalized.ok) return false;
+  const secretStore = clientRefreshSecretStore(stateDir);
+  if (!secretStore.write(normalized.session.refresh_token)) return false;
+  const persisted = { ...normalized.session, refresh_token_ref: OS_SECRET_REFERENCE };
+  delete persisted.refresh_token;
+  const authPath = join(stateDir, 'auth.json');
+  const authState = readAuthState(authPath);
+  authState[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(persisted);
+  writePrivateJsonAtomic(authPath, authState);
+  return true;
+}
+
 function resolveSupabaseAuthConfig(env = process.env) {
   const supabaseUrl = String(
     env.LIVEDESK_RUNTIME_SUPABASE_URL
@@ -82,9 +105,22 @@ function resolveSupabaseAuthConfig(env = process.env) {
  * - Never logs or serializes token values outside the loopback handoff.
  */
 export async function readSavedClientSessionForHub(stateDir) {
-  const authState = readAuthState(join(stateDir, 'auth.json'));
+  const authPath = join(stateDir, 'auth.json');
+  const authState = readAuthState(authPath);
   const candidate = parseStoredSession(authState?.[CLIENT_AUTH_STORAGE_KEY]);
-  const normalized = normalizeRuntimeAuthSession(candidate, { requireRefreshToken: true });
+  if (!candidate) return null;
+  const plaintextRefreshToken = String(candidate.refresh_token || '').trim();
+  const refreshToken = plaintextRefreshToken || (candidate.refresh_token_ref === OS_SECRET_REFERENCE
+    ? clientRefreshSecretStore(stateDir).read()
+    : '');
+  const normalized = normalizeRuntimeAuthSession(
+    { ...candidate, refresh_token: refreshToken },
+    { requireRefreshToken: true }
+  );
+  if (normalized.ok && plaintextRefreshToken
+    && !persistProtectedClientSession(stateDir, normalized.session)) {
+    return null;
+  }
   return normalized.ok ? normalized.session : null;
 }
 
@@ -122,10 +158,9 @@ async function refreshSavedClientSessionForHub(
     throw new Error('saved-client-session-refresh-invalid');
   }
 
-  const authPath = join(stateDir, 'auth.json');
-  const authState = readAuthState(authPath);
-  authState[CLIENT_AUTH_STORAGE_KEY] = JSON.stringify(normalized.session);
-  writePrivateJsonAtomic(authPath, authState);
+  if (!persistProtectedClientSession(stateDir, normalized.session)) {
+    throw new Error('saved-client-session-secure-store-unavailable');
+  }
   return normalized.session;
 }
 
@@ -152,11 +187,29 @@ export async function transferSavedClientSessionToHub(
     if (!resolved) {
       return { ok: false, skipped: true, reason: 'no-refreshable-saved-client-session' };
     }
+    const adminSessionResponse = await fetchAuthResponse(fetchImpl, new URL('/api/security/session', baseUrl), {
+      method: 'GET',
+      headers: { Accept: 'application/json' }
+    }, 5_000);
+    const adminSession = adminSessionResponse.status === 404
+      ? null
+      : await adminSessionResponse.json().catch(() => null);
+    if (adminSessionResponse.status !== 404 && (
+      !adminSessionResponse.ok
+      || !adminSession?.adminToken
+      || !adminSession?.csrfToken
+    )) {
+      throw new Error(`hub-admin-session-http-${adminSessionResponse.status}`);
+    }
     const response = await fetchAuthResponse(fetchImpl, new URL('/api/auth/session', baseUrl), {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        Accept: 'application/json'
+        Accept: 'application/json',
+        ...(adminSession ? {
+          'X-LiveDesk-Admin-Session': String(adminSession.adminToken),
+          'X-LiveDesk-Admin-CSRF': String(adminSession.csrfToken)
+        } : {})
       },
       body: JSON.stringify({
         accessToken: resolved.session.access_token,

package/client/bin/livedesk-client-node.js

@@ -4,10 +4,12 @@ import net from 'net';
 import os from 'os';
 import path from 'path';
 import crypto from 'crypto';
-import { existsSync, promises as fs, statfsSync } from 'fs';
+import { constants as fsConstants, existsSync, promises as fs, statfsSync } from 'fs';
 import { spawn } from 'child_process';
-import { createRequire } from 'node:module';
-import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import { createClientDeviceCredentialStore } from '../src/security/device-credential-store.js';
+import { connectSecureDirect } from '../src/security/secure-direct-client.js';
 
 const require = createRequire(import.meta.url);
 const CLIENT_UPDATE_BOOTSTRAP_PATH = fileURLToPath(
@@ -657,7 +659,7 @@ function sanitizePathSegment(value, fallback = 'file') {
     return normalized.slice(0, 160);
 }
 
-function sanitizeRelativeFilePath(value, fallbackName = 'file') {
+function sanitizeRelativeFilePath(value, fallbackName = 'file') {
     const parts = String(value || '')
         .replace(/\0/g, '')
         .split(/[\\/]+/)
@@ -668,7 +670,52 @@ function sanitizeRelativeFilePath(value, fallbackName = 'file') {
         return sanitizePathSegment(fallbackName, 'file');
     }
     return path.join(...parts.slice(-8));
-}
+}
+
+function isPathInsideRoot(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === '' || (relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative));
+}
+
+async function resolveReceiveDirectory(options, remoteDirectory) {
+    const configuredRoot = path.resolve(options.filesDir || getDefaultFilesDir());
+    await fs.mkdir(configuredRoot, { recursive: true });
+    const rootStat = await fs.lstat(configuredRoot);
+    if (rootStat.isSymbolicLink()) throw new Error('The LiveDesk receive root cannot be a symbolic link or junction.');
+    const canonicalRoot = await fs.realpath(configuredRoot);
+    const relativeDirectory = String(remoteDirectory || '').replace(/\0/g, '').trim();
+    if (relativeDirectory.length > 600 || path.isAbsolute(relativeDirectory)) {
+        throw new Error('The remote receive directory must be relative to the LiveDesk files root.');
+    }
+    const candidate = path.resolve(canonicalRoot, relativeDirectory || '.');
+    if (!isPathInsideRoot(canonicalRoot, candidate)) throw new Error('The remote receive directory escapes the LiveDesk files root.');
+    await assertAgentPathDoesNotTraverseLink(canonicalRoot, candidate);
+    await fs.mkdir(candidate, { recursive: true });
+    await assertAgentPathDoesNotTraverseLink(canonicalRoot, candidate);
+    const canonicalCandidate = await fs.realpath(candidate);
+    if (!isPathInsideRoot(canonicalRoot, canonicalCandidate)) throw new Error('The remote receive directory resolves outside the LiveDesk files root.');
+    return { root: canonicalRoot, directory: canonicalCandidate };
+}
+
+function requireFileSha256(value) {
+    const hash = String(value || '').trim().toLowerCase();
+    if (!/^[a-f0-9]{64}$/.test(hash)) throw new Error('A valid SHA-256 file hash is required.');
+    return hash;
+}
+
+function hashBuffer(buffer) {
+    return crypto.createHash('sha256').update(buffer).digest('hex');
+}
+
+async function commitNewFile(tempPath, targetPath) {
+    try {
+        await fs.link(tempPath, targetPath);
+    } catch (error) {
+        if (error?.code === 'EEXIST') throw new Error(`Refusing to overwrite an existing file: ${path.basename(targetPath)}`);
+        throw error;
+    }
+    await fs.rm(tempPath, { force: true });
+}
 
 async function handleFileTransferCommand(options, payload = {}) {
     const files = Array.isArray(payload.files) ? payload.files.slice(0, MAX_FILE_TRANSFER_FILES) : [];
@@ -676,32 +723,46 @@ async function handleFileTransferCommand(options, payload = {}) {
         throw new Error('No files were included in the transfer.');
     }
 
-    const baseDir = normalizeDirectoryPath(payload.remoteDirectory || options.filesDir);
-    await fs.mkdir(baseDir, { recursive: true });
+    const { root, directory: baseDir } = await resolveReceiveDirectory(options, payload.remoteDirectory);
 
     let totalBytes = 0;
     const saved = [];
     for (const file of files) {
         const name = sanitizePathSegment(file?.name, 'file');
         const relativePath = sanitizeRelativeFilePath(file?.relativePath || name, name);
-        const targetPath = path.resolve(baseDir, relativePath);
-        const relativeFromBase = path.relative(baseDir, targetPath);
-        if (relativeFromBase.startsWith('..') || path.isAbsolute(relativeFromBase)) {
-            throw new Error(`Unsafe file path: ${relativePath}`);
-        }
+        const targetPath = path.resolve(baseDir, relativePath);
+        if (!isPathInsideRoot(baseDir, targetPath)) {
+            throw new Error(`Unsafe file path: ${relativePath}`);
+        }
 
         const dataBase64 = String(file?.dataBase64 || '').replace(/^data:[^,]*,/i, '').trim();
         if (!dataBase64) {
             throw new Error(`Missing file data: ${name}`);
         }
-        const buffer = Buffer.from(dataBase64, 'base64');
+        const buffer = Buffer.from(dataBase64, 'base64');
+        const expectedSha256 = requireFileSha256(file?.sha256);
+        if (hashBuffer(buffer) !== expectedSha256) throw new Error(`File SHA-256 mismatch: ${name}`);
         totalBytes += buffer.length;
         if (totalBytes > MAX_FILE_TRANSFER_BYTES) {
             throw new Error('File transfer exceeded the local size limit.');
         }
 
-        await fs.mkdir(path.dirname(targetPath), { recursive: true });
-        await fs.writeFile(targetPath, buffer);
+        await fs.mkdir(path.dirname(targetPath), { recursive: true });
+        await assertAgentPathDoesNotTraverseLink(root, path.dirname(targetPath));
+        await assertAgentPathDoesNotTraverseLink(root, targetPath);
+        const tempPath = `${targetPath}.livedesk-${crypto.randomBytes(12).toString('hex')}.part`;
+        try {
+            const handle = await fs.open(tempPath, 'wx', 0o600);
+            try {
+                await handle.writeFile(buffer);
+                await handle.sync();
+            } finally {
+                await handle.close();
+            }
+            await commitNewFile(tempPath, targetPath);
+        } finally {
+            await fs.rm(tempPath, { force: true }).catch(() => undefined);
+        }
         saved.push({
             name,
             relativePath,
@@ -722,12 +783,11 @@ async function handleFileTransferCommand(options, payload = {}) {
 }
 
 async function handleFileTransferChunkCommand(options, payload = {}) {
-    const baseDir = normalizeDirectoryPath(payload.remoteDirectory || options.filesDir);
+    const { root, directory: baseDir } = await resolveReceiveDirectory(options, payload.remoteDirectory);
     const name = sanitizePathSegment(payload.name, 'file');
     const relativePath = sanitizeRelativeFilePath(payload.relativePath || name, name);
     const targetPath = path.resolve(baseDir, relativePath);
-    const relativeFromBase = path.relative(baseDir, targetPath);
-    if (relativeFromBase.startsWith('..') || path.isAbsolute(relativeFromBase)) {
+    if (!isPathInsideRoot(baseDir, targetPath)) {
         throw new Error(`Unsafe file path: ${relativePath}`);
     }
 
@@ -736,19 +796,31 @@ async function handleFileTransferChunkCommand(options, payload = {}) {
     const totalBytes = Math.max(0, Math.floor(Number(payload.totalBytes) || 0));
     const final = payload.final === true;
     const buffer = payload.dataBase64 ? Buffer.from(String(payload.dataBase64), 'base64') : Buffer.alloc(0);
-    if (!transferId || offset > totalBytes || offset + buffer.length > totalBytes || buffer.length > 512 * 1024) {
+    if (!transferId || totalBytes > MAX_FILE_TRANSFER_BYTES || offset > totalBytes || offset + buffer.length > totalBytes || buffer.length > 512 * 1024) {
         throw new Error('Invalid file transfer chunk.');
     }
     if (buffer.length === 0 && !(final && totalBytes === 0 && offset === 0)) {
         throw new Error('Empty file chunks are not allowed.');
     }
 
-    await fs.mkdir(path.dirname(targetPath), { recursive: true });
-    const tempPath = `${targetPath}.livedesk-${transferId}.part`;
-    const handle = await fs.open(tempPath, offset === 0 ? 'w+' : 'r+');
+    await fs.mkdir(path.dirname(targetPath), { recursive: true });
+    await assertAgentPathDoesNotTraverseLink(root, path.dirname(targetPath));
+    await assertAgentPathDoesNotTraverseLink(root, targetPath);
+    const tempPath = `${targetPath}.livedesk-${transferId}.part`;
+    if (offset > 0) {
+        const staging = await fs.lstat(tempPath);
+        if (!staging.isFile() || staging.isSymbolicLink() || staging.nlink !== 1) {
+            throw new Error('Unsafe file transfer staging path.');
+        }
+    }
+    const openFlags = offset === 0
+        ? fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_RDWR
+        : fsConstants.O_RDWR | (fsConstants.O_NOFOLLOW || 0);
+    const handle = await fs.open(tempPath, openFlags, 0o600);
     let completedSize = 0;
     try {
-        const before = await handle.stat();
+        const before = await handle.stat();
+        if (!before.isFile() || before.nlink !== 1) throw new Error('Unsafe file transfer staging path.');
         if (offset > before.size) {
             throw new Error(`File chunk gap detected at ${offset}; current length is ${before.size}.`);
         }
@@ -767,9 +839,19 @@ async function handleFileTransferChunkCommand(options, payload = {}) {
         await handle.close();
     }
 
-    if (final) {
-        await fs.rm(targetPath, { force: true });
-        await fs.rename(tempPath, targetPath);
+    if (final) {
+        const expectedSha256 = requireFileSha256(payload.sha256);
+        const received = await fs.readFile(tempPath);
+        if (hashBuffer(received) !== expectedSha256) {
+            await fs.rm(tempPath, { force: true });
+            throw new Error('File SHA-256 mismatch.');
+        }
+        try {
+            await commitNewFile(tempPath, targetPath);
+        } catch (error) {
+            await fs.rm(tempPath, { force: true });
+            throw error;
+        }
         const lastModified = Number(payload.lastModified || 0);
         if (lastModified > 0) {
             const modifiedAt = new Date(lastModified);
@@ -1430,7 +1512,20 @@ function normalizeNodeAgentTaskResult(result) {
     return { ...result, ok, status: ok ? 'completed' : 'failed', error };
 }
 
-const NODE_AGENT_OPERATIONS = new Set(['process.control', 'service.control', 'application.launch', 'application.close', 'file.read', 'file.write', 'file.delete', 'file.list', 'command.run', 'script.run', 'software.install', 'network.status', 'system.power', 'system.configure', 'logs.collect']);
+const NODE_AGENT_OPERATIONS = new Set(['file.read', 'file.list', 'network.status', 'logs.collect']);
+const RETIRED_NODE_AGENT_MUTATING_OPERATIONS = new Set([
+    'process.control',
+    'service.control',
+    'application.launch',
+    'application.close',
+    'file.write',
+    'file.delete',
+    'command.run',
+    'script.run',
+    'software.install',
+    'system.power',
+    'system.configure'
+]);
 
 function remotePolicyAllows(options, command) {
     const policy = options.effectivePolicy;
@@ -1587,8 +1682,8 @@ async function scheduleClientUpdate(options, payload = {}) {
     }
 }
 
-async function handleRemoteCommand(socket, options, message, nextFrameSeq, activeStreams) {
-    const command = String(message.command || '');
+async function handleRemoteCommand(socket, options, message, nextFrameSeq, activeStreams) {
+    const command = String(message.command || '');
     if (command === 'ping') {
         writeJsonLine(socket, {
             type: 'command.result',
@@ -1598,8 +1693,20 @@ async function handleRemoteCommand(socket, options, message, nextFrameSeq, activ
                 at: new Date().toISOString()
             }
         });
-        return;
-    }
+        return;
+    }
+
+    // LD-SEC-AI-001 is enforced before settings or permission modes. A stale
+    // Hub can therefore never revive a retired mutation with full-access.
+    if (RETIRED_NODE_AGENT_MUTATING_OPERATIONS.has(command)) {
+        writeJsonLine(socket, {
+            type: 'command.result',
+            commandId: message.commandId,
+            error: 'agent-mutating-tool-disabled',
+            result: { ok: false, status: 'rejected', error: 'agent-mutating-tool-disabled', sideEffects: 'none' }
+        });
+        return;
+    }
 
     const policyDecision = remotePolicyAllows(options, command);
     if (!policyDecision.ok) {
@@ -1900,18 +2007,20 @@ async function handleRemoteCommand(socket, options, message, nextFrameSeq, activ
     });
 }
 
-function connectOnce(options, deviceId) {
-    const manager = parseManagerAddress(options.manager);
-    if (!isPrivateLanHost(manager.host) && !isTruthy(process.env.LIVEDESK_ALLOW_UNENCRYPTED_LAN)) {
-        return Promise.reject(new Error('Plain TCP LiveDesk connections are limited to loopback/private LAN. Use an encrypted endpoint for external connections.'));
-    }
-    return new Promise((resolve, reject) => {
-        const socket = net.createConnection({
-            host: manager.host,
-            port: manager.port
-        });
-
-        let buffer = '';
+async function connectOnce(options, deviceId) {
+    const manager = parseManagerAddress(options.manager);
+    const credentialStore = createClientDeviceCredentialStore({ deviceId });
+    const socket = await connectSecureDirect({
+        host: manager.host,
+        port: manager.port,
+        channel: 'control',
+        deviceId,
+        enrollmentToken: options.pair,
+        credentialStore,
+        timeoutMs: 5000
+    });
+    return new Promise((resolve, reject) => {
+        let buffer = '';
         let heartbeatTimer = null;
         let resolved = false;
         let frameSeq = 0;
@@ -1945,44 +2054,43 @@ function connectOnce(options, deviceId) {
         socket.setNoDelay(true);
         socket.setKeepAlive(true, options.heartbeatMs);
 
-        socket.once('connect', () => {
-            writeJsonLine(socket, {
-                type: 'hello',
-                pairToken: options.pair,
-                deviceId,
-                deviceName: options.name,
-                slotNumber: options.slotNumber || undefined,
-                hostname: os.hostname(),
-                platform: os.platform(),
-                arch: os.arch(),
-                pid: process.pid,
-                agentVersion: AGENT_VERSION,
-                productVersion: PRODUCT_VERSION,
-                capabilities: {
-                    status: true,
-                    thumbnail: options.thumbnailEnabled,
-                    liveStream: options.liveEnabled,
-                    monitorSelection: true,
-                    screenCount: 1,
-                    monitorCount: 1,
-                    control: false,
-                    audio: false,
-                    remoteAudio: false,
-                    fileTransfer: true,
-                    remoteFiles: true,
-                    fileTransferMaxBytes: MAX_FILE_TRANSFER_BYTES,
-                    computerAgent: options.taskEnabled,
-                    taskDispatch: options.taskEnabled,
-                    clientUpdate: true,
-                    productVersion: PRODUCT_VERSION,
-                    agentApproval: options.taskEnabled,
-                    agentAudit: options.taskEnabled,
-                    agentTools: [...NODE_AGENT_OPERATIONS],
-                    elevation: typeof process.getuid === 'function' ? process.getuid() === 0 : false,
-                    externalEffects: options.taskEnabled
-                }
-            });
-        });
+        writeJsonLine(socket, {
+            type: 'hello',
+            deviceId,
+            deviceName: options.name,
+            slotNumber: options.slotNumber || undefined,
+            hostname: os.hostname(),
+            platform: os.platform(),
+            arch: os.arch(),
+            pid: process.pid,
+            agentVersion: AGENT_VERSION,
+            productVersion: PRODUCT_VERSION,
+            capabilities: {
+                status: true,
+                thumbnail: options.thumbnailEnabled,
+                liveStream: options.liveEnabled,
+                monitorSelection: true,
+                screenCount: 1,
+                monitorCount: 1,
+                control: false,
+                audio: false,
+                remoteAudio: false,
+                fileTransfer: true,
+                remoteFiles: true,
+                fileTransferMaxBytes: MAX_FILE_TRANSFER_BYTES,
+                computerAgent: options.taskEnabled,
+                taskDispatch: options.taskEnabled,
+                clientUpdate: true,
+                productVersion: PRODUCT_VERSION,
+                agentApproval: options.taskEnabled,
+                agentAudit: options.taskEnabled,
+                agentTools: [...NODE_AGENT_OPERATIONS],
+                elevation: typeof process.getuid === 'function' ? process.getuid() === 0 : false,
+                externalEffects: false,
+                authenticatedDeviceCredential: true,
+                encryptedDirect: true
+            }
+        });
 
         socket.on('data', chunk => {
             buffer += chunk;