livedesk 0.1.479 → 0.1.481

package/bin/livedesk.js

@@ -65,6 +65,20 @@ const MANAGER_STATE_DIR = resolve(
 const MANAGER_STATE_PATH = join(MANAGER_STATE_DIR, 'manager.json');
 const TERMINAL_HUB_UPDATE_OUTCOMES = new Set(['updated', 'restored', 'failed']);
 
+async function preflightPackagedRuntimeDependencies() {
+  try {
+    await Promise.all([
+      import('@livedesk/runtime-core'),
+      import('@livedesk/runtime-core/os-secret-store')
+    ]);
+  } catch (error) {
+    throw new Error(
+      'LiveDesk runtime dependency preflight failed before replacing the existing runtime: '
+      + `${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+
 function safeUpdatePathSegment(value, fallback = 'unknown') {
   return String(value || '')
     .replace(/[^A-Za-z0-9._-]/g, '_')
@@ -3193,6 +3207,7 @@ async function main() {
     }
   }
   await assertNoActiveMacPhysicalDiagnosticLease();
+  await preflightPackagedRuntimeDependencies();
   const roleStateOptions = {
     stateDir: MANAGER_STATE_DIR,
     legacyClientStateDir: process.env.LIVEDESK_LEGACY_CLIENT_STATE_DIR

package/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/client",
-  "version": "0.1.224",
+  "version": "0.1.225",
   "description": "LiveDesk local remote client",
   "type": "module",
   "bin": {
@@ -36,16 +36,16 @@
   "dependencies": {
     "@ffmpeg-installer/ffmpeg": "^1.1.0",
     "ffmpeg-static": "^5.3.0",
-    "@livedesk/runtime-core": "0.1.3",
+    "@livedesk/runtime-core": "0.1.4",
     "@supabase/supabase-js": "^2.110.0",
     "node-screenshots": "^0.2.8",
     "ws": "^8.18.3"
   },
   "optionalDependencies": {
-    "@livedesk/fast-linux-x64": "0.1.429",
-    "@livedesk/fast-osx-arm64": "0.1.429",
-    "@livedesk/fast-osx-x64": "0.1.429",
-    "@livedesk/fast-win-x64": "0.1.429"
+    "@livedesk/fast-linux-x64": "0.1.430",
+    "@livedesk/fast-osx-arm64": "0.1.430",
+    "@livedesk/fast-osx-x64": "0.1.430",
+    "@livedesk/fast-win-x64": "0.1.430"
   },
   "publishConfig": {
     "access": "public"

package/hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.31",
+  "version": "0.1.32",
   "description": "LiveDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",
@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "@ffmpeg-installer/ffmpeg": "^1.1.0",
-    "@livedesk/runtime-core": "0.1.3",
+    "@livedesk/runtime-core": "0.1.4",
     "@openai/codex-sdk": "0.145.0",
     "cors": "^2.8.5",
     "express": "^4.21.2",

package/hub/src/filesystem/transfer-jobs.js

@@ -322,7 +322,11 @@ export class HubTransferJobs {
     try {
       await job.onComplete({ completed, job: snapshot(job) });
     } catch (error) {
-      job.error = error instanceof Error ? error.message : String(error);
+      // A completion callback can be the durable security-audit gate. Never
+      // leave a job looking successful when that final record was not stored.
+      job.state = 'failed';
+      job.error = `completion-callback-failed:${error instanceof Error ? error.message : String(error)}`;
+      job.completedAt ||= new Date().toISOString();
       markUpdated(job);
     }
   }

package/hub/src/remote-hub.js

@@ -2331,11 +2331,12 @@ export function createRemoteHub(options = {}) {
     const getSecurityIdentity = typeof options.getSecurityIdentity === 'function'
         ? options.getSecurityIdentity
         : () => ({ accountId: safeString(options.accountId || env.LIVEDESK_ACCOUNT_ID, 128) });
-    udpTransport?.setRendezvousProofIssuer?.(({ roomId, deviceId, ttlMs }) => {
+    udpTransport?.setRendezvousProofIssuer?.(({ roomId, deviceId, role, ttlMs }) => {
         const identity = getSecurityIdentity() || {};
         return deviceCredentialAuthority.issueRendezvousProof({
             roomId,
             deviceId,
+            role,
             ttlMs,
             accountId: safeString(identity.accountId, 128)
         });
@@ -8321,7 +8322,7 @@ export function createRemoteHub(options = {}) {
         };
     }
 
-    function sendCommand(deviceId, command) {
+    function sendCommand(deviceId, command) {
         const device = devices.get(String(deviceId || ''));
         const commandName = safeString(command?.command || 'ping', 80);
         const requiredPermission = commandName === 'input.control'
@@ -8387,8 +8388,62 @@ export function createRemoteHub(options = {}) {
             command: payload.command,
             channel: dedicatedFileSocket ? 'file' : 'control'
         });
-        return { ok: true, commandId };
-    }
+        return { ok: true, commandId };
+    }
+
+    async function sendCommandAwaitResult(deviceId, command, options = {}) {
+        const normalizedDeviceId = safeString(deviceId, 160);
+        const device = devices.get(normalizedDeviceId);
+        const commandId = safeString(command?.commandId, 128) || crypto.randomUUID();
+        const commandWithId = { ...(command || {}), commandId };
+
+        if (device?.synthetic === true && device.connected) {
+            const sent = sendCommand(normalizedDeviceId, commandWithId);
+            return {
+                ...sent,
+                queued: sent.ok === true,
+                acknowledged: sent.ok === true,
+                acknowledgement: sent.ok === true
+                    ? { ok: true, commandId, result: { ok: true, synthetic: true }, error: '' }
+                    : { ok: false, commandId, result: null, error: sent.error || 'command-not-sent' }
+            };
+        }
+
+        if (!device?.socket || device.socket.destroyed || !device.connected) {
+            const sent = sendCommand(normalizedDeviceId, commandWithId);
+            return {
+                ...sent,
+                queued: false,
+                acknowledged: false,
+                acknowledgement: {
+                    ok: false,
+                    commandId,
+                    result: null,
+                    error: sent.error || 'device-not-connected'
+                }
+            };
+        }
+
+        const timeoutMs = clampNumber(options.timeoutMs, 1000, 120_000, 30_000);
+        // Register before writing: a loopback Agent can return command.result in
+        // the same event-loop turn as the command write.
+        const acknowledgementPromise = waitForCommandResult(device, commandId, timeoutMs);
+        const sent = sendCommand(normalizedDeviceId, commandWithId);
+        if (!sent.ok) {
+            failPendingCommandResultWaiter(device, commandId, sent.error || 'command-not-sent');
+        }
+        const acknowledgement = await acknowledgementPromise;
+        return {
+            ...sent,
+            ok: sent.ok === true && acknowledgement.ok === true,
+            queued: sent.ok === true,
+            acknowledged: acknowledgement.ok === true,
+            acknowledgement,
+            error: acknowledgement.ok === true
+                ? undefined
+                : acknowledgement.error || sent.error || 'command-result-failed'
+        };
+    }
 
     function refreshDevicePolicies(deviceIds = undefined) {
         const requestedIds = Array.isArray(deviceIds) && deviceIds.length > 0
@@ -11277,9 +11332,10 @@ export function createRemoteHub(options = {}) {
         retryTaskBatch,
         listDeviceFrames,
         disconnectDevice,
-        assignDeviceSlot,
-        sendCommand,
-        refreshDevicePolicies,
+        assignDeviceSlot,
+        sendCommand,
+        sendCommandAwaitResult,
+        refreshDevicePolicies,
         sendLegacyClientUpdate,
         sendInputControl,
         releaseInputOwner,
@@ -11311,6 +11367,7 @@ export function createRemoteHub(options = {}) {
         getSecurityStatus: () => ({
             hubId: deviceCredentialAuthority.hubId,
             hubPublicKey: deviceCredentialAuthority.hubPublicKey,
+            hubIssuerKeyId: deviceCredentialAuthority.hubIssuerKeyId,
             direct: secureDirectAcceptor.getStatus(),
             devices: deviceCredentialAuthority.listDevices()
         }),

package/hub/src/security/device-credential-authority.js

@@ -174,6 +174,9 @@ export function createDeviceCredentialAuthority({
   if (!privateKeyText) throw securityError('hub-private-key-secure-store-unavailable');
   const hubPrivateKey = requireP256PrivateKey(privateKeyText);
   const hubPublic = requireP256PublicKey(authority.publicKey);
+  const hubIssuerKeyId = crypto.createHash('sha256')
+    .update(Buffer.from(hubPublic.text, 'base64url'))
+    .digest('base64url');
   const derivedPublic = crypto.createPublicKey(hubPrivateKey).export({ format: 'der', type: 'spki' }).toString('base64url');
   if (derivedPublic !== hubPublic.text) throw securityError('hub-device-authority-key-mismatch');
   const hubId = clean(authority.hubId, 128);
@@ -183,18 +186,33 @@ export function createDeviceCredentialAuthority({
     registry = { version: AUTHORITY_VERSION, devices: {} };
   }
 
-  function persistRegistry() {
-    atomicPrivateJson(registryPath, registry);
+  function persistRegistry(nextRegistry = registry) {
+    atomicPrivateJson(registryPath, nextRegistry);
   }
 
-  function issueCredential({ accountId, deviceId, devicePublicKey, replace = false }) {
+  function normalizeCredentialRequest({ accountId, deviceId, devicePublicKey } = {}) {
     const owner = clean(accountId, 128);
     const id = clean(deviceId, 128);
     if (!owner) throw securityError('device-account-required');
     if (!id) throw securityError('device-id-required');
     const deviceKey = requireP256PublicKey(devicePublicKey);
+    return { owner, id, deviceKey };
+  }
+
+  function assertEnrollmentAllowed(request) {
+    const normalized = normalizeCredentialRequest(request);
+    const existing = registry.devices[normalized.id];
+    if (existing && !existing.revokedAt) throw securityError('device-already-enrolled');
+    if (!existing && Object.keys(registry.devices).length >= MAX_DEVICES) {
+      throw securityError('device-registry-capacity');
+    }
+    return true;
+  }
+
+  function issueCredential({ accountId, deviceId, devicePublicKey }) {
+    const { owner, id, deviceKey } = normalizeCredentialRequest({ accountId, deviceId, devicePublicKey });
     const existing = registry.devices[id];
-    if (existing && !existing.revokedAt && !replace) throw securityError('device-already-enrolled');
+    if (existing && !existing.revokedAt) throw securityError('device-already-enrolled');
     if (!existing && Object.keys(registry.devices).length >= MAX_DEVICES) throw securityError('device-registry-capacity');
     const issuedAt = Math.floor(now());
     const payload = {
@@ -213,18 +231,25 @@ export function createDeviceCredentialAuthority({
       dsaEncoding: 'ieee-p1363'
     }).toString('base64url');
     const credential = `${payloadText}.${signature}`;
-    registry.devices[id] = {
-      serial: payload.serial,
-      accountId: owner,
-      hubId,
-      devicePublicKey: deviceKey.text,
-      credential,
-      issuedAt,
-      expiresAt: payload.expiresAt,
-      revokedAt: '',
-      lastConnectedAt: ''
+    const nextRegistry = {
+      ...registry,
+      devices: {
+        ...registry.devices,
+        [id]: {
+          serial: payload.serial,
+          accountId: owner,
+          hubId,
+          devicePublicKey: deviceKey.text,
+          credential,
+          issuedAt,
+          expiresAt: payload.expiresAt,
+          revokedAt: '',
+          lastConnectedAt: ''
+        }
+      }
     };
-    persistRegistry();
+    persistRegistry(nextRegistry);
+    registry = nextRegistry;
     return { credential, payload: { ...payload }, hubPublicKey: hubPublic.text };
   }
 
@@ -279,23 +304,26 @@ export function createDeviceCredentialAuthority({
     }).toString('base64url');
   }
 
-  function issueRendezvousProof({ roomId, accountId, deviceId, ttlMs = 60_000 } = {}) {
+  function issueRendezvousProof({ roomId, accountId, deviceId, role, ttlMs = 60_000 } = {}) {
     const room = clean(roomId, 160);
     const owner = clean(accountId, 128);
     const device = clean(deviceId, 128);
+    const normalizedRole = clean(role, 16).toLowerCase();
     if (!room || !owner || !device) throw securityError('rendezvous-proof-binding-required');
+    if (!['hub', 'client'].includes(normalizedRole)) throw securityError('rendezvous-proof-role-required');
     const issuedAt = Math.floor(now());
     const payload = {
-      version: 1,
-      protocol: 'livedesk.udp.rendezvous-proof.v1',
+      version: 2,
+      protocol: 'livedesk.udp.rendezvous-proof.v2',
+      issuerKeyId: hubIssuerKeyId,
       roomId: room,
+      role: normalizedRole,
       accountId: owner,
       hubId,
       deviceId: device,
       issuedAt,
       expiresAt: issuedAt + Math.max(10_000, Math.min(120_000, Number(ttlMs) || 60_000)),
-      nonce: crypto.randomBytes(16).toString('base64url'),
-      hubPublicKey: hubPublic.text
+      nonce: crypto.randomBytes(16).toString('base64url')
     };
     const payloadText = Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');
     return { proof: `${payloadText}.${signHubMessage(payloadText)}`, payload };
@@ -305,9 +333,19 @@ export function createDeviceCredentialAuthority({
     const id = clean(deviceId, 128);
     const record = registry.devices[id];
     if (!record || record.revokedAt) return false;
-    record.revokedAt = new Date(now()).toISOString();
-    record.revokeReason = clean(reason, 160);
-    persistRegistry();
+    const nextRegistry = {
+      ...registry,
+      devices: {
+        ...registry.devices,
+        [id]: {
+          ...record,
+          revokedAt: new Date(now()).toISOString(),
+          revokeReason: clean(reason, 160)
+        }
+      }
+    };
+    persistRegistry(nextRegistry);
+    registry = nextRegistry;
     return true;
   }
 
@@ -315,8 +353,15 @@ export function createDeviceCredentialAuthority({
     const id = clean(deviceId, 128);
     const record = registry.devices[id];
     if (!record || record.revokedAt) return false;
-    record.lastConnectedAt = new Date(now()).toISOString();
-    persistRegistry();
+    const nextRegistry = {
+      ...registry,
+      devices: {
+        ...registry.devices,
+        [id]: { ...record, lastConnectedAt: new Date(now()).toISOString() }
+      }
+    };
+    persistRegistry(nextRegistry);
+    registry = nextRegistry;
     return true;
   }
 
@@ -335,14 +380,17 @@ export function createDeviceCredentialAuthority({
 
   function clearDevices() {
     const removed = Object.keys(registry.devices).length;
-    registry = { version: AUTHORITY_VERSION, devices: {} };
-    persistRegistry();
+    const nextRegistry = { version: AUTHORITY_VERSION, devices: {} };
+    persistRegistry(nextRegistry);
+    registry = nextRegistry;
     return removed;
   }
 
   return Object.freeze({
     hubId,
     hubPublicKey: hubPublic.text,
+    hubIssuerKeyId,
+    assertEnrollmentAllowed,
     issueCredential,
     verifyCredential,
     verifyDeviceSignature,

package/hub/src/security/security-audit-store.js

@@ -1,5 +1,5 @@
 import crypto from 'node:crypto';
-import { appendFile, mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { mkdir, open, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -85,6 +85,25 @@ function parseSeal(raw) {
   }
 }
 
+async function syncFile(filePath, flags = 'r') {
+  const handle = await open(filePath, flags, 0o600);
+  try {
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+
+async function appendDurably(filePath, value) {
+  const handle = await open(filePath, 'a', 0o600);
+  try {
+    await handle.writeFile(value, { encoding: 'utf8' });
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+}
+
 export function createSecurityAuditStore({ dataDir = path.join(os.homedir(), '.livedesk') } = {}) {
   const filePath = path.join(dataDir, 'security', 'security-audit-v1.jsonl');
   const sealStore = createOsSecretStore({
@@ -175,6 +194,7 @@ export function createSecurityAuditStore({ dataDir = path.join(os.homedir(), '.l
     }
     const temporary = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
     await writeFile(temporary, `${rebuilt.map(record => JSON.stringify(record)).join('\n')}\n`, { encoding: 'utf8', mode: 0o600 });
+    await syncFile(temporary);
     await rename(temporary, filePath);
     records = rebuilt;
     seal.headHash = previousHash;
@@ -195,7 +215,9 @@ export function createSecurityAuditStore({ dataDir = path.join(os.homedir(), '.l
         const recordHash = hashRecord(previousHash, payloadHash, mac);
         written = { version: AUDIT_VERSION, previousHash, payloadHash, mac, recordHash, payload };
         await mkdir(path.dirname(filePath), { recursive: true });
-        await appendFile(filePath, `${JSON.stringify(written)}\n`, { encoding: 'utf8', mode: 0o600 });
+        // A successful record() is the mutation gate for security-sensitive
+        // operations. Resolve only after the JSONL record is on stable storage.
+        await appendDurably(filePath, `${JSON.stringify(written)}\n`);
         current.push(written);
         seal.headHash = recordHash;
         seal.recordCount = current.length;