livedesk 0.1.479 → 0.1.481

package/hub/src/server.js

@@ -814,17 +814,41 @@ function requestAuditHash(value) {
   }
 }
 
-function recordSecurityAudit(event = {}) {
-  if (!securityAuditStore) return;
+function securityAuditEvent(event = {}) {
   const runtime = runtimeManager.getSnapshot();
-  void securityAuditStore.record({
+  return {
     actorAccountId: event.actorAccountId || runtime.userId || '',
     actorUserId: event.actorUserId || runtime.userId || '',
     hubId: event.hubId || runtime.deviceId || '',
     ...event
-  }).catch(error => {
+  };
+}
+
+function markSecurityAuditFailed(error) {
+  if (securityAuditHealthy) {
     securityAuditHealthy = false;
     console.error(`[LiveDesk Hub] SECURITY AUDIT FAILURE: ${error?.message || error}`);
+  }
+}
+
+async function recordSecurityAuditRequired(event = {}) {
+  if (!securityAuditStore || !securityAuditHealthy) {
+    const error = new Error('security-audit-unavailable');
+    error.code = 'security-audit-unavailable';
+    throw error;
+  }
+  try {
+    return await securityAuditStore.record(securityAuditEvent(event));
+  } catch (error) {
+    markSecurityAuditFailed(error);
+    throw error;
+  }
+}
+
+function recordSecurityAudit(event = {}) {
+  void recordSecurityAuditRequired(event).catch(() => {
+    // Required mutation paths await recordSecurityAuditRequired directly.
+    // Best-effort lifecycle telemetry still marks the global audit gate failed.
   });
 }
 
@@ -1519,12 +1543,16 @@ async function synchronizeAgentEnablement() {
   return enabled;
 }
 
-const hubFilesystem = createHubFilesystem();
+const hubFilesystem = createHubFilesystem();
+const fileTransferCommandAckTimeoutMs = readPositiveIntegerEnv(
+  'LIVEDESK_FILE_CHUNK_ACK_TIMEOUT_MS',
+  30_000
+);
 hubTransferJobs = createHubTransferJobs({
   filesystem: hubFilesystem,
   remoteHub,
   maxConcurrent: Number(process.env.LIVEDESK_MAX_FILE_JOBS || 2),
-  commandResultTimeoutMs: readPositiveIntegerEnv('LIVEDESK_FILE_CHUNK_ACK_TIMEOUT_MS', 30_000),
+  commandResultTimeoutMs: fileTransferCommandAckTimeoutMs,
   getMaxFileSizeBytes: () => Number(
     liveDeskSettingsStore.getCached()?.filesAudio?.maxFileSizeBytes
     || 1024 * 1024 * 1024)
@@ -1677,7 +1705,7 @@ app.use((req, res, next) => {
   }
   const mutating = ['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method);
   const sensitiveRead = req.method === 'GET'
-    && ['/api/security/audit', '/api/privacy/inventory'].includes(req.path);
+    && ['/api/security/audit', '/api/security/rendezvous-issuer', '/api/privacy/inventory'].includes(req.path);
   if (!mutating && !sensitiveRead) {
     next();
     return;
@@ -1713,7 +1741,58 @@ app.use((req, res, next) => {
     return;
   }
   req.liveDeskAdminSessionId = localAdminSessionId;
-  next();
+  if (!mutating) {
+    next();
+    return;
+  }
+
+  const mutationRequestHash = requestAuditHash({ method: req.method, path: req.path });
+  void recordSecurityAuditRequired({
+    action: 'local-admin.mutation',
+    phase: 'accepted',
+    result: 'accepted',
+    sessionId: localAdminSessionId,
+    requestHash: mutationRequestHash,
+    authMethod: 'local-admin-session',
+    details: { method: req.method, path: req.path }
+  }).then(() => {
+    const originalEnd = res.end.bind(res);
+    let completionStarted = false;
+    res.end = (...args) => {
+      if (completionStarted) return res;
+      completionStarted = true;
+      const statusCode = Number(res.statusCode || 200);
+      void recordSecurityAuditRequired({
+        action: 'local-admin.mutation',
+        phase: 'complete',
+        result: statusCode >= 200 && statusCode < 400 ? 'success' : 'rejected',
+        reason: statusCode >= 400 ? `http-${statusCode}` : '',
+        sessionId: localAdminSessionId,
+        requestHash: mutationRequestHash,
+        authMethod: 'local-admin-session',
+        details: { method: req.method, path: req.path, statusCode }
+      }).then(() => {
+        originalEnd(...args);
+      }).catch(error => {
+        if (res.headersSent) {
+          res.destroy(error);
+          return;
+        }
+        const callback = [...args].reverse().find(value => typeof value === 'function');
+        const body = JSON.stringify({ ok: false, error: 'security-audit-unavailable' });
+        res.statusCode = 503;
+        res.removeHeader('Content-Length');
+        res.removeHeader('Transfer-Encoding');
+        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+        res.setHeader('Content-Length', Buffer.byteLength(body));
+        originalEnd(body, 'utf8', callback);
+      });
+      return res;
+    };
+    next();
+  }).catch(() => {
+    res.status(503).json({ ok: false, error: 'security-audit-unavailable' });
+  });
 });
 app.use(express.json({ limit: '32mb' }));
 app.use((req, res, next) => {
@@ -4247,6 +4326,19 @@ app.get('/api/security/trusted-devices', (_req, res) => {
   res.json({ ok: true, devices });
 });
 
+app.get('/api/security/rendezvous-issuer', (_req, res) => {
+  noStore(res);
+  const security = remoteHub.getSecurityStatus();
+  res.json({
+    ok: true,
+    hubId: security.hubId,
+    issuerKeyId: security.hubIssuerKeyId,
+    publicKey: security.hubPublicKey,
+    algorithm: 'P-256/SHA-256',
+    environmentVariable: 'LIVEDESK_UDP_RENDEZVOUS_TRUSTED_ISSUER_PUBLIC_KEYS'
+  });
+});
+
 app.get('/api/security/audit', async (req, res) => {
   noStore(res);
   try {
@@ -5479,11 +5571,37 @@ app.post('/api/remote/files/from-hub', requireHubFeatureAccess, (req, res) => {
       res.status(400).json({ ok: false, error: 'no-filesystem-items-selected' });
       return;
     }
-    const job = hubTransferJobs.create({
-      itemIds,
-      deviceIds,
-      remoteDirectory: req.body?.remoteDirectory
-    });
+    const job = hubTransferJobs.create({
+      itemIds,
+      deviceIds,
+      remoteDirectory: req.body?.remoteDirectory,
+      onComplete: async ({ completed, job: completedJob }) => {
+        await recordSecurityAuditRequired({
+          action: 'remote.file.job',
+          phase: 'complete',
+          result: completed ? 'success' : 'failed',
+          reason: completed ? '' : completedJob?.error || 'file-transfer-failed',
+          deviceIds,
+          sessionId: completedJob?.jobId || '',
+          requestHash: requestAuditHash({
+            jobId: completedJob?.jobId || '',
+            deviceIds,
+            remoteDirectory: req.body?.remoteDirectory || ''
+          }),
+          authMethod: 'local-admin-session',
+          details: {
+            state: completedJob?.state || '',
+            totalFiles: Number(completedJob?.totalFiles || 0),
+            completedFiles: Number(completedJob?.completedFiles || 0),
+            totalBytes: Number(completedJob?.totalBytes || 0),
+            sentBytes: Number(completedJob?.sentBytes || 0),
+            failedTargets: Array.isArray(completedJob?.failedTargets)
+              ? completedJob.failedTargets.length
+              : 0
+          }
+        });
+      }
+    });
     res.status(202).json({ ok: true, jobId: job.jobId, state: job.state });
   } catch (error) {
     sendFilesystemError(res, error);
@@ -5564,7 +5682,7 @@ app.post('/api/remote/filesystem/shared-folders/:folderId/sync', requireHubFeatu
   }
 });
 
-app.post('/api/remote/files/transfer', requireHubFeatureAccess, (req, res) => {
+app.post('/api/remote/files/transfer', requireHubFeatureAccess, async (req, res) => {
   noStore(res);
   const deviceIds = normalizeDeviceIds(req.body?.deviceIds);
   if (deviceIds.length === 0) {
@@ -5581,44 +5699,53 @@ app.post('/api/remote/files/transfer', requireHubFeatureAccess, (req, res) => {
   const transferId = String(req.body?.transferId || crypto.randomUUID()).replace(/[^a-zA-Z0-9_.:-]/g, '-').slice(0, 128);
   const remoteDirectory = String(req.body?.remoteDirectory || '').replace(/[\0\r\n\t]/g, ' ').trim().slice(0, 600);
   const queuedAt = new Date().toISOString();
-  const results = deviceIds.map(deviceId => ({
-    deviceId,
-    ...remoteHub.sendCommand(deviceId, {
-      command: 'file.transfer',
-      payload: {
-        transferId,
-        remoteDirectory,
-        files: normalized.files,
-        totalBytes: normalized.totalBytes,
-        requestedAt: queuedAt
-      }
-    })
-  }));
-  const queued = results.filter(result => result.ok).length;
-  recordSecurityAudit({
-    action: 'remote.file.transfer',
-    phase: 'start',
-    result: queued > 0 ? 'queued' : 'rejected',
-    reason: queued > 0 ? '' : 'no-transfer-queued',
-    deviceIds,
-    sessionId: transferId,
-    requestHash: requestAuditHash({ transferId, remoteDirectory, files: normalized.files.map(file => ({ name: file.name, relativePath: file.relativePath, byteLength: file.size })), totalBytes: normalized.totalBytes }),
-    authMethod: 'local-admin-session',
-    details: { queued, total: deviceIds.length, totalBytes: normalized.totalBytes, files: normalized.files.length }
-  });
-  res.json({
-    ok: queued > 0,
-    transferId,
-    queued,
-    total: deviceIds.length,
-    totalBytes: normalized.totalBytes,
-    files: normalized.files.length,
-    results,
-    error: queued > 0 ? undefined : 'no-transfer-queued'
-  });
-});
-
-app.post('/api/remote/files/chunk', requireHubFeatureAccess, (req, res) => {
+  try {
+    const results = await Promise.all(deviceIds.map(async deviceId => ({
+      deviceId,
+      ...await remoteHub.sendCommandAwaitResult(deviceId, {
+        command: 'file.transfer',
+        payload: {
+          transferId,
+          remoteDirectory,
+          files: normalized.files,
+          totalBytes: normalized.totalBytes,
+          requestedAt: queuedAt
+        }
+      }, { timeoutMs: fileTransferCommandAckTimeoutMs })
+    })));
+    const queued = results.filter(result => result.queued).length;
+    const acknowledged = results.filter(result => result.acknowledged).length;
+    const success = acknowledged === deviceIds.length;
+    const partial = acknowledged > 0 && !success;
+    const error = success ? undefined : partial ? 'partial-transfer-failed' : 'no-transfer-acknowledged';
+    await recordSecurityAuditRequired({
+      action: 'remote.file.transfer',
+      phase: 'complete',
+      result: success ? 'success' : partial ? 'partial' : 'rejected',
+      reason: error || '',
+      deviceIds,
+      sessionId: transferId,
+      requestHash: requestAuditHash({ transferId, remoteDirectory, files: normalized.files.map(file => ({ name: file.name, relativePath: file.relativePath, byteLength: file.size })), totalBytes: normalized.totalBytes }),
+      authMethod: 'local-admin-session',
+      details: { queued, acknowledged, total: deviceIds.length, totalBytes: normalized.totalBytes, files: normalized.files.length }
+    });
+    res.json({
+      ok: success,
+      transferId,
+      queued,
+      acknowledged,
+      total: deviceIds.length,
+      totalBytes: normalized.totalBytes,
+      files: normalized.files.length,
+      results,
+      error
+    });
+  } catch (error) {
+    res.status(503).json({ ok: false, error: error?.code || 'security-audit-unavailable' });
+  }
+});
+
+app.post('/api/remote/files/chunk', requireHubFeatureAccess, async (req, res) => {
   noStore(res);
   const deviceIds = normalizeDeviceIds(req.body?.deviceIds);
   if (deviceIds.length === 0) {
@@ -5636,42 +5763,51 @@ app.post('/api/remote/files/chunk', requireHubFeatureAccess, (req, res) => {
   const transferId = String(req.body?.transferId || crypto.randomUUID()).replace(/[^a-zA-Z0-9_.:-]/g, '-').slice(0, 128);
   const remoteDirectory = String(req.body?.remoteDirectory || '').replace(/[\0\r\n\t]/g, ' ').trim().slice(0, 600);
   const queuedAt = new Date().toISOString();
-  const results = deviceIds.map(deviceId => ({
-    deviceId,
-    ...remoteHub.sendCommand(deviceId, {
-      command: 'file.transfer.chunk',
-      payload: {
-        transferId,
-        remoteDirectory,
-        ...normalized.chunk,
-        requestedAt: queuedAt
-      }
-    })
-  }));
-  const queued = results.filter(result => result.ok).length;
-  recordSecurityAudit({
-    action: 'remote.file.chunk',
-    phase: normalized.chunk.final ? 'complete' : 'progress',
-    result: queued > 0 ? 'queued' : 'rejected',
-    reason: queued > 0 ? '' : 'no-transfer-queued',
-    deviceIds,
-    sessionId: transferId,
-    requestHash: requestAuditHash({ transferId, remoteDirectory, offset: normalized.chunk.offset, byteLength: normalized.chunk.byteLength, final: normalized.chunk.final }),
-    authMethod: 'local-admin-session',
-    details: { queued, total: deviceIds.length, byteLength: normalized.chunk.byteLength, offset: normalized.chunk.offset, final: normalized.chunk.final }
-  });
-  res.json({
-    ok: queued > 0,
-    transferId,
-    queued,
-    total: deviceIds.length,
-    byteLength: normalized.chunk.byteLength,
-    offset: normalized.chunk.offset,
-    final: normalized.chunk.final,
-    results,
-    error: queued > 0 ? undefined : 'no-transfer-queued'
-  });
-});
+  try {
+    const results = await Promise.all(deviceIds.map(async deviceId => ({
+      deviceId,
+      ...await remoteHub.sendCommandAwaitResult(deviceId, {
+        command: 'file.transfer.chunk',
+        payload: {
+          transferId,
+          remoteDirectory,
+          ...normalized.chunk,
+          requestedAt: queuedAt
+        }
+      }, { timeoutMs: fileTransferCommandAckTimeoutMs })
+    })));
+    const queued = results.filter(result => result.queued).length;
+    const acknowledged = results.filter(result => result.acknowledged).length;
+    const success = acknowledged === deviceIds.length;
+    const partial = acknowledged > 0 && !success;
+    const error = success ? undefined : partial ? 'partial-transfer-failed' : 'no-transfer-acknowledged';
+    await recordSecurityAuditRequired({
+      action: 'remote.file.chunk',
+      phase: normalized.chunk.final ? 'complete' : 'progress',
+      result: success ? 'success' : partial ? 'partial' : 'rejected',
+      reason: error || '',
+      deviceIds,
+      sessionId: transferId,
+      requestHash: requestAuditHash({ transferId, remoteDirectory, offset: normalized.chunk.offset, byteLength: normalized.chunk.byteLength, final: normalized.chunk.final }),
+      authMethod: 'local-admin-session',
+      details: { queued, acknowledged, total: deviceIds.length, byteLength: normalized.chunk.byteLength, offset: normalized.chunk.offset, final: normalized.chunk.final }
+    });
+    res.json({
+      ok: success,
+      transferId,
+      queued,
+      acknowledged,
+      total: deviceIds.length,
+      byteLength: normalized.chunk.byteLength,
+      offset: normalized.chunk.offset,
+      final: normalized.chunk.final,
+      results,
+      error
+    });
+  } catch (error) {
+    res.status(503).json({ ok: false, error: error?.code || 'security-audit-unavailable' });
+  }
+});
 
 const MANUAL_POWER_ACTIONS = new Set(['lock', 'sleep', 'restart', 'shutdown']);
 
@@ -5990,11 +6126,37 @@ httpServer.on('upgrade', (req, socket, head) => {
     socket.destroy();
     return;
   }
-  try {
-    const parsed = new URL(req.url || '/', `http://${req.headers.host || '127.0.0.1'}`);
-    if (parsed.pathname === '/api/remote/frames/ws') {
-      frameWss.handleUpgrade(req, socket, head, ws => frameWss.emit('connection', ws, req));
-      return;
+  let parsed;
+  try {
+    parsed = new URL(req.url || '/', `http://${req.headers.host || '127.0.0.1'}`);
+  } catch {
+    socket.write('HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n');
+    socket.destroy();
+    return;
+  }
+  const websocketPath = parsed.pathname;
+  if (![
+    '/api/remote/frames/ws',
+    '/api/remote/atlas/ws',
+    '/api/remote/input/ws',
+    '/api/remote/audio/ws'
+  ].includes(websocketPath)) {
+    socket.write('HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n');
+    socket.destroy();
+    return;
+  }
+  void recordSecurityAuditRequired({
+    action: 'local-admin.websocket',
+    phase: 'accepted',
+    result: 'accepted',
+    sessionId: localAdminSessionId,
+    requestHash: requestAuditHash({ path: websocketPath }),
+    authMethod: 'local-admin-websocket',
+    details: { path: websocketPath }
+  }).then(() => {
+    if (parsed.pathname === '/api/remote/frames/ws') {
+      frameWss.handleUpgrade(req, socket, head, ws => frameWss.emit('connection', ws, req));
+      return;
     }
     if (parsed.pathname === '/api/remote/atlas/ws') {
       atlasWss.handleUpgrade(req, socket, head, ws => atlasWss.emit('connection', ws, req));
@@ -6005,16 +6167,14 @@ httpServer.on('upgrade', (req, socket, head) => {
       return;
     }
     if (parsed.pathname === '/api/remote/audio/ws') {
-      audioWss.handleUpgrade(req, socket, head, ws => audioWss.emit('connection', ws, req));
-      return;
-    }
-    socket.write('HTTP/1.1 404 Not Found\r\n\r\n');
-    socket.destroy();
-  } catch {
-    socket.write('HTTP/1.1 400 Bad Request\r\n\r\n');
-    socket.destroy();
-  }
-});
+      audioWss.handleUpgrade(req, socket, head, ws => audioWss.emit('connection', ws, req));
+      return;
+    }
+  }).catch(() => {
+    socket.write('HTTP/1.1 503 Service Unavailable\r\nConnection: close\r\n\r\n');
+    socket.destroy();
+  });
+});
 
 frameWss.on('connection', (ws, req) => {
   frameClients.add(ws);
@@ -6127,23 +6287,21 @@ audioWss.on('connection', (ws, req) => {
 });
 
 inputWss.on('connection', ws => {
-  inputClients.add(ws);
-  ws.liveDeskInputClientId = `riws-${++inputClientSeq}`;
+  inputClients.add(ws);
+  ws.liveDeskInputClientId = `riws-${++inputClientSeq}`;
   ws.liveDeskInputDeviceIds = new Set();
-  recordSecurityAudit({
-    action: 'remote.control.browser-session',
-    phase: 'start',
-    result: 'success',
-    sessionId: ws.liveDeskInputClientId,
-    authMethod: 'local-admin-websocket'
-  });
+  ws.liveDeskInputAuditReady = false;
   try {
     ws._socket?.setNoDelay?.(true);
   } catch {
     // Best-effort latency hint for browser input sockets.
-  }
-  ws.on('message', data => {
-    let payload;
+  }
+  ws.on('message', data => {
+    if (ws.liveDeskInputAuditReady !== true) {
+      sendJson(ws, { type: 'RemoteInputError', error: 'security-audit-pending' });
+      return;
+    }
+    let payload;
     try {
       payload = JSON.parse(Buffer.isBuffer(data) ? data.toString('utf8') : String(data || ''));
     } catch {
@@ -6189,7 +6347,7 @@ inputWss.on('connection', ws => {
     for (const deviceId of ws.liveDeskInputDeviceIds || []) {
       remoteHub.releaseInputOwner(deviceId, ws.liveDeskInputClientId, reason);
     }
-    recordSecurityAudit({
+    void recordSecurityAuditRequired({
       action: 'remote.control.browser-session',
       phase: 'complete',
       result: 'success',
@@ -6197,18 +6355,31 @@ inputWss.on('connection', ws => {
       deviceIds: [...(ws.liveDeskInputDeviceIds || [])],
       sessionId: ws.liveDeskInputClientId,
       authMethod: 'local-admin-websocket'
+    }).catch(() => {
+      // The global fail-closed gate is marked by recordSecurityAuditRequired.
     });
-    ws.liveDeskInputDeviceIds?.clear?.();
-  };
-  ws.on('close', () => releaseBrowserInputOwner('browser-input-websocket-closed'));
-  ws.on('error', () => releaseBrowserInputOwner('browser-input-websocket-error'));
-  sendJson(ws, {
-    type: 'RemoteInputSocketReady',
-    protocol: 'livedesk.remote.input.json.v1',
-    clientId: ws.liveDeskInputClientId,
-    timestamp: new Date().toISOString()
-  });
-});
+    ws.liveDeskInputDeviceIds?.clear?.();
+  };
+  ws.on('close', () => releaseBrowserInputOwner('browser-input-websocket-closed'));
+  ws.on('error', () => releaseBrowserInputOwner('browser-input-websocket-error'));
+  void recordSecurityAuditRequired({
+    action: 'remote.control.browser-session',
+    phase: 'start',
+    result: 'success',
+    sessionId: ws.liveDeskInputClientId,
+    authMethod: 'local-admin-websocket'
+  }).then(() => {
+    ws.liveDeskInputAuditReady = true;
+    sendJson(ws, {
+      type: 'RemoteInputSocketReady',
+      protocol: 'livedesk.remote.input.json.v1',
+      clientId: ws.liveDeskInputClientId,
+      timestamp: new Date().toISOString()
+    });
+  }).catch(() => {
+    ws.close(1011, 'security-audit-unavailable');
+  });
+});
 
 await remoteHub.start();
 connectedDeviceCount = Number(remoteHub.getStatus({ includeSecrets: false }).connectedDeviceCount || 0);

package/hub/src/transport/relay-hub-control.js

@@ -1029,8 +1029,9 @@ export function createHubRelayControl({
                     throw relayError('secure-enrollment-proof-invalid');
                 }
                 verifyP256Signature(devicePublic.key, clientTranscript, message.deviceSignature);
+                authority.assertEnrollmentAllowed?.({ accountId, deviceId, devicePublicKey: devicePublic.text });
                 if (!secureSession.consumeEnrollmentToken?.(enrollmentSecret)) throw relayError('secure-enrollment-token-used');
-                issued = authority.issueCredential({ accountId, deviceId, devicePublicKey: devicePublic.text, replace: true });
+                issued = authority.issueCredential({ accountId, deviceId, devicePublicKey: devicePublic.text });
             } else {
                 const verified = authority.verifyCredential(message.credential, { accountId, deviceId });
                 if (verified.payload.devicePublicKey !== devicePublic.text) throw relayError('device-credential-binding-invalid');

package/hub/src/transport/secure-direct-acceptor.js

@@ -237,8 +237,9 @@ export function createSecureDirectAcceptor({
         throw directError('secure-enrollment-proof-invalid');
       }
       verifyP256Signature(devicePublic.key, clientTranscript, hello.deviceSignature);
+      authority.assertEnrollmentAllowed?.({ accountId, deviceId, devicePublicKey: devicePublic.text });
       if (!consumeEnrollmentToken(token)) throw directError('secure-enrollment-token-used');
-      const issued = authority.issueCredential({ accountId, deviceId, devicePublicKey: devicePublic.text, replace: true });
+      const issued = authority.issueCredential({ accountId, deviceId, devicePublicKey: devicePublic.text });
       credential = issued.credential;
       credentialPayload = issued.payload;
       enrollmentCount += 1;

package/hub/src/transport/udp-hub-transport.js

@@ -441,12 +441,23 @@ export function createHubUdpTransport({ env = process.env, logEvent = () => {},
             udpSessionId = crypto.randomUUID();
             routeKey = udpSessionRouteKey(udpSessionId);
         } while (sessionsByRouteKey.has(routeKey));
-        const proof = typeof rendezvousProofIssuer === 'function'
-            ? rendezvousProofIssuer({ roomId: udpSessionId, deviceId: id, ttlMs: 60_000 })
+        const hubProof = typeof rendezvousProofIssuer === 'function'
+            ? rendezvousProofIssuer({ roomId: udpSessionId, deviceId: id, role: 'hub', ttlMs: 60_000 })
             : null;
-        const signedRendezvousProof = safeText(proof?.proof, 2048);
+        const clientProof = typeof rendezvousProofIssuer === 'function'
+            ? rendezvousProofIssuer({ roomId: udpSessionId, deviceId: id, role: 'client', ttlMs: 60_000 })
+            : null;
+        const signedHubRendezvousProof = safeText(hubProof?.proof, 2048);
+        const signedClientRendezvousProof = safeText(clientProof?.proof, 2048);
         const allowLegacyUnsignedProofForTests = env.LIVEDESK_TEST_MODE === '1'
             || env.LIVEDESK_TEST_ALLOW_LEGACY_UDP_RENDEZVOUS === '1';
+        const legacyRendezvousToken = allowLegacyUnsignedProofForTests
+            && (!signedHubRendezvousProof || !signedClientRendezvousProof)
+            ? crypto.randomBytes(16).toString('hex')
+            : '';
+        const proofExpiries = [hubProof?.payload?.expiresAt, clientProof?.payload?.expiresAt]
+            .map(Number)
+            .filter(Number.isSafeInteger);
         const session = {
             deviceId: id,
             tcpSessionId: safeText(tcpSessionId, 160),
@@ -455,9 +466,9 @@ export function createHubUdpTransport({ env = process.env, logEvent = () => {},
             routeKey,
             key,
             keyBase64: key.toString('base64'),
-            rendezvousToken: signedRendezvousProof
-                || (allowLegacyUnsignedProofForTests ? crypto.randomBytes(16).toString('hex') : ''),
-            rendezvousProofExpiresAt: Number(proof?.payload?.expiresAt || 0),
+            rendezvousToken: signedHubRendezvousProof || legacyRendezvousToken,
+            clientRendezvousToken: signedClientRendezvousProof || legacyRendezvousToken,
+            rendezvousProofExpiresAt: proofExpiries.length === 2 ? Math.min(...proofExpiries) : 0,
             sendControl,
             clientEndpoint: null,
             peerEndpoint: null,
@@ -493,8 +504,8 @@ export function createHubUdpTransport({ env = process.env, logEvent = () => {},
             frameChunkHeader: UDP_FRAME_CHUNK_PROTOCOL,
             frameTimeoutMs,
             maxPendingFrames,
-            rendezvous: rendezvousHost && session.rendezvousToken
-                ? { host: rendezvousHost, port: rendezvousPort, roomId: session.sessionId, token: session.rendezvousToken }
+            rendezvous: rendezvousHost && session.clientRendezvousToken
+                ? { host: rendezvousHost, port: rendezvousPort, roomId: session.sessionId, token: session.clientRendezvousToken }
                 : null
         });
         sendRendezvousRegister(session);