livedesk 0.1.494 → 0.1.496

package/README.md

@@ -1,8 +1,8 @@
-# LiveDesk
-
-`livedesk` is a thin cross-platform launcher. npm installs only the matching
-RemoteFast package for the current operating system and CPU, so Windows, macOS,
-and Linux native binaries are no longer downloaded together.
+# LiveDesk
+
+`livedesk` is a thin cross-platform launcher. npm installs only the matching
+RemoteFast package for the current operating system and CPU, so Windows, macOS,
+and Linux native binaries are no longer downloaded together.
 
 One-command LiveDesk application. The same launcher resolves this computer's
 Hub or Client role, then starts only the runtime required by that role.
@@ -11,15 +11,15 @@ The `hub/`, `client/`, `runtime-core/`, and `web/` folders in this package are
 generated copies. Edit the source packages and run
 `node packages/livedesk/scripts/sync-web-dist.js` before building or packing
 the product. The published `livedesk` package owns both runtime roles; the
-source-only `@livedesk/client` workspace is not a runtime dependency.
-
-LiveDesk's top runtime contract is transmission performance together with
-long-running stability. A faster path is not accepted if it permits duplicate
-capture helpers, stale monitor generations, unbounded frame queues, or an
-unproven Direct/P2P/relay transition. Release builds run the same lifecycle,
-transport recovery, and browser H.264 population gates used by CI.
-
-## Unified launch
+source-only `@livedesk/client` workspace is not a runtime dependency.
+
+LiveDesk's top runtime contract is transmission performance together with
+long-running stability. A faster path is not accepted if it permits duplicate
+capture helpers, stale monitor generations, unbounded frame queues, or an
+unproven Direct/P2P/relay transition. Release builds run the same lifecycle,
+transport recovery, and browser H.264 population gates used by CI.
+
+## Unified launch
 
 ```powershell
 npx -y --prefer-online livedesk@latest
@@ -57,7 +57,7 @@ Pass `--no-clean` to disable the startup cleanup explicitly. If a child Hub
 still loses a startup race with `EADDRINUSE`, the launcher performs one cleanup
 and startup retry, then exits without looping.
 
-## Client compatibility
+## Client compatibility
 
 ```powershell
 npx -y --prefer-online livedesk@latest client 3
@@ -67,75 +67,75 @@ The `client` form remains as a legacy compatibility alias. It records the
 Client role and uses the same unified runtime lock. The client signs in with
 Google, discovers the active Hub, and connects to the wall. On Windows, enable
 **Start with Windows** on the connection page to reconnect automatically after
-reboot; the generated startup command uses the unified launcher.
-
-## macOS physical diagnostic
-
-On a Mac with two connected displays, stop every running LiveDesk runtime,
-start visibly different continuously moving content on both displays, grant
-Screen Recording and Accessibility permissions, then explicitly confirm that
-the motion is already running:
-
-```bash
-npx -y --prefer-online livedesk@latest diagnose mac-physical --confirm-active-motion
-```
-
-This command branches before role resolution, state migration, and the normal
-runtime lock. It refuses to overlap an existing LiveDesk runtime or capture
-helper, and normal macOS startup reciprocally refuses an active diagnostic
-lease. The lease owner authorizes exactly one direct-child production unified
-Hub launcher and one direct-child production unified Client launcher using the
-lease PID, parent PID, and token, then each launcher consumes and removes that
-capability before starting descendants. The Client therefore runs
-the normal Client bootstrap and starts its normal RemoteFast child instead of
-testing RemoteFast in isolation. All state and network discovery remain
-isolated. Cleanup joins those exact launcher roots after their Hub, RemoteFast,
-and ScreenCaptureKit descendants drain. Ctrl+C and termination signals join the
-same owned cleanup before exit. The default JSON report is written to
-one final path after cleanup, and run/cleanup errors always produce a failed
-result. It is written under `~/.livedesk/diagnostics`. To select a path relative
-to the directory where the command was invoked:
-
-```bash
-npx -y --prefer-online livedesk@latest diagnose mac-physical --confirm-active-motion --report ./mac-result.json
-```
-
-Use `diagnose mac-physical --help` to inspect requirements without starting a
-runtime or changing cached role/account state. The confirmation flag is not
-treated as proof by itself: each display must also show two different decoded
-pixel hashes while native capture/compression/stdout counters advance at the
-active cadence. Diagnostic ffmpeg observers run sequentially after product
-CPU/RSS/process sampling, are labeled as diagnostic observers, and are excluded
-from those product budgets. Product resource evidence covers both unified
-launcher roots plus the Hub, RemoteFast, and ScreenCaptureKit descendants.
-VideoToolbox ownership comes from native active and terminal telemetry. The
-terminal v4 record must match the exact final restored-Wall helper observation,
-PID, profile, start time, capture generation, purpose, and stream, and must be
-newer than that stream's stop request. Its PID must equal the single OS helper
-sampled at that exact restored-Wall ready point; an earlier aggregate PID sighting
-is insufficient. A stale/ownerless/internal-only terminal record or a retired
-helper process alone is not accepted as encoder-session cleanup proof.
-
-## Physical transport diagnostic
-
-While the local Hub is running and at least one Client is sending a current
-Mode 3 H.264 stream, run:
-
-```bash
-npx -y --prefer-online livedesk@latest diagnose transport-physical
-```
-
-The diagnostic proves one unchanged stream identity through Direct TCP,
-encrypted UDP P2P, encrypted relay, and Direct recovery. Every phase requires
-an independently decodable SPS/PPS/IDR frame observed by the Hub within a
-bounded deadline. It uses an exact-owner temporary lease, changes no firewall
-or router settings, and writes a redacted report under
-`~/.livedesk/diagnostics`. Use `diagnose transport-physical --help` for
-device, Hub URL, timeout, and report-path options.
-
-## Frame modes
-
-- Mode 2: independent 320x180 RGB565+LZO tiles for large, stable walls.
+reboot; the generated startup command uses the unified launcher.
+
+## macOS physical diagnostic
+
+On a Mac with two connected displays, stop every running LiveDesk runtime,
+start visibly different continuously moving content on both displays, grant
+Screen Recording and Accessibility permissions, then explicitly confirm that
+the motion is already running:
+
+```bash
+npx -y --prefer-online livedesk@latest diagnose mac-physical --confirm-active-motion
+```
+
+This command branches before role resolution, state migration, and the normal
+runtime lock. It refuses to overlap an existing LiveDesk runtime or capture
+helper, and normal macOS startup reciprocally refuses an active diagnostic
+lease. The lease owner authorizes exactly one direct-child production unified
+Hub launcher and one direct-child production unified Client launcher using the
+lease PID, parent PID, and token, then each launcher consumes and removes that
+capability before starting descendants. The Client therefore runs
+the normal Client bootstrap and starts its normal RemoteFast child instead of
+testing RemoteFast in isolation. All state and network discovery remain
+isolated. Cleanup joins those exact launcher roots after their Hub, RemoteFast,
+and ScreenCaptureKit descendants drain. Ctrl+C and termination signals join the
+same owned cleanup before exit. The default JSON report is written to
+one final path after cleanup, and run/cleanup errors always produce a failed
+result. It is written under `~/.livedesk/diagnostics`. To select a path relative
+to the directory where the command was invoked:
+
+```bash
+npx -y --prefer-online livedesk@latest diagnose mac-physical --confirm-active-motion --report ./mac-result.json
+```
+
+Use `diagnose mac-physical --help` to inspect requirements without starting a
+runtime or changing cached role/account state. The confirmation flag is not
+treated as proof by itself: each display must also show two different decoded
+pixel hashes while native capture/compression/stdout counters advance at the
+active cadence. Diagnostic ffmpeg observers run sequentially after product
+CPU/RSS/process sampling, are labeled as diagnostic observers, and are excluded
+from those product budgets. Product resource evidence covers both unified
+launcher roots plus the Hub, RemoteFast, and ScreenCaptureKit descendants.
+VideoToolbox ownership comes from native active and terminal telemetry. The
+terminal v4 record must match the exact final restored-Wall helper observation,
+PID, profile, start time, capture generation, purpose, and stream, and must be
+newer than that stream's stop request. Its PID must equal the single OS helper
+sampled at that exact restored-Wall ready point; an earlier aggregate PID sighting
+is insufficient. A stale/ownerless/internal-only terminal record or a retired
+helper process alone is not accepted as encoder-session cleanup proof.
+
+## Physical transport diagnostic
+
+While the local Hub is running and at least one Client is sending a current
+Mode 3 H.264 stream, run:
+
+```bash
+npx -y --prefer-online livedesk@latest diagnose transport-physical
+```
+
+The diagnostic proves one unchanged stream identity through Direct TCP,
+encrypted UDP P2P, encrypted relay, and Direct recovery. Every phase requires
+an independently decodable SPS/PPS/IDR frame observed by the Hub within a
+bounded deadline. It uses an exact-owner temporary lease, changes no firewall
+or router settings, and writes a redacted report under
+`~/.livedesk/diagnostics`. Use `diagnose transport-physical --help` for
+device, Hub URL, timeout, and report-path options.
+
+## Frame modes
+
+- Mode 2: independent 320x180 RGB565+LZO tiles for large, stable walls.
 - Mode 3: direct hardware H.264 for focused remote control up to 4K.
 - Mode 4: client Mode 2 inputs composited by an isolated Hub worker into one
   bounded H.264 Atlas stream, then split by UV into the normal browser slots.
@@ -148,7 +148,7 @@ device, Hub URL, timeout, and report-path options.
 
 Monthly and yearly subscriptions are planned after the LTD launch.
 
-## Free ad slot
+## Free ad slot
 
 Free accounts show a standard bottom ad slot. Set these Vite build variables
 for a real AdSense placement:
@@ -158,36 +158,5 @@ VITE_LIVEDESK_ADSENSE_CLIENT=ca-pub-...
 VITE_LIVEDESK_ADSENSE_SLOT=...
 ```
 
-Without those values, LiveDesk renders a neutral sponsored-placement placeholder
-so the free-plan layout can still be tested.
-
-## Signed update configuration
-
-Production update checks fail closed until all applicable values are set:
-
-```text
-LIVEDESK_UPDATE_MANIFEST_URL=https://updates.example.com/stable.json
-LIVEDESK_UPDATE_PUBLIC_KEY=<Ed25519 SPKI PEM or base64 DER public key>
-LIVEDESK_UPDATE_URL=https://updates.example.com/desktop
-```
-
-The public key may instead be bundled at
-`electron/update-public-key.pem` for desktop builds. Keep the Ed25519 private
-key offline and outside this repository. Release automation supplies it only to
-the signing command as `LIVEDESK_UPDATE_PRIVATE_KEY` or `--private-key`:
-
-```powershell
-npm run sign:update-manifest -- --input release-payload.json --output stable.json --private-key E:\secure\livedesk-update-ed25519.pem
-```
-
-The payload must include exact npm `dist.integrity` values for `livedesk` and
-`@livedesk/client`, desktop version/platform/architecture SHA-512 values, a
-maximum 31-day validity window, and emergency blocked-version lists.
-
-Desktop publisher signing is independent of the LiveDesk manifest signature.
-Configure electron-builder secrets only in the release environment: `CSC_LINK`
-and `CSC_KEY_PASSWORD` for the Windows/macOS certificate; for Apple
-notarization also configure `APPLE_ID`, `APPLE_APP_SPECIFIC_PASSWORD`, and
-`APPLE_TEAM_ID`. Do not put any private key, certificate password, OAuth secret,
-Supabase service key, Dodo webhook secret, or API token in source, Vite public
-variables, logs, or the signed manifest.
+Without those values, LiveDesk renders a neutral sponsored-placement placeholder
+so the free-plan layout can still be tested.

package/bin/livedesk.js

@@ -65,20 +65,6 @@ const MANAGER_STATE_DIR = resolve(
 const MANAGER_STATE_PATH = join(MANAGER_STATE_DIR, 'manager.json');
 const TERMINAL_HUB_UPDATE_OUTCOMES = new Set(['updated', 'restored', 'failed']);
 
-async function preflightPackagedRuntimeDependencies() {
-  try {
-    await Promise.all([
-      import('@livedesk/runtime-core'),
-      import('@livedesk/runtime-core/os-secret-store')
-    ]);
-  } catch (error) {
-    throw new Error(
-      'LiveDesk runtime dependency preflight failed before replacing the existing runtime: '
-      + `${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-
 function safeUpdatePathSegment(value, fallback = 'unknown') {
   return String(value || '')
     .replace(/[^A-Za-z0-9._-]/g, '_')
@@ -2521,7 +2507,6 @@ async function runManager(args, resolvedRole = null, runtimeLock = null) {
       ? internalHubEntry
       : resolvePackageEntry('@livedesk/hub', '@livedesk/hub/src/server.js'));
   const packagedWebDist = resolve(packageRoot, 'web', 'dist');
-  const launcherShutdownToken = randomBytes(32).toString('base64url');
   const env = {
     ...process.env,
     LIVEDESK_HUB_HTTP_HOST: configuredHttpHost,
@@ -2542,7 +2527,6 @@ async function runManager(args, resolvedRole = null, runtimeLock = null) {
     LIVEDESK_DEVICE_NAME: String(resolvedRole?.deviceName || process.env.LIVEDESK_DEVICE_NAME || os.hostname()),
     LIVEDESK_ROLE_CACHE_PATH: join(MANAGER_STATE_DIR, 'device-role.json'),
     LIVEDESK_AUTH_STATE_PATH: join(MANAGER_STATE_DIR, 'auth.json'),
-    LIVEDESK_LAUNCHER_SHUTDOWN_TOKEN: launcherShutdownToken,
     LIVEDESK_ROLE_SOURCE: String(resolvedRole?.source || process.env.LIVEDESK_ROLE_SOURCE || '')
   };
   const debugConsole = process.env.LIVEDESK_DEBUG === '1';
@@ -2617,7 +2601,6 @@ async function runManager(args, resolvedRole = null, runtimeLock = null) {
         try {
           const response = await fetch(`${hubProbeBaseUrl}/api/runtime/shutdown`, {
             method: 'POST',
-            headers: { 'X-LiveDesk-Launcher-Shutdown': launcherShutdownToken },
             signal: AbortSignal.timeout(750)
           });
           if (!response.ok) throw new Error(`HTTP ${response.status}`);
@@ -2872,7 +2855,6 @@ async function runManager(args, resolvedRole = null, runtimeLock = null) {
         updateStopTimer.unref?.();
         void fetch(`${hubProbeBaseUrl}/api/runtime/shutdown`, {
           method: 'POST',
-          headers: { 'X-LiveDesk-Launcher-Shutdown': launcherShutdownToken },
           signal: AbortSignal.timeout(2_500)
         }).then(response => {
           if (!response.ok) throw new Error(`HTTP ${response.status}`);
@@ -3054,24 +3036,24 @@ async function runManager(args, resolvedRole = null, runtimeLock = null) {
   updatePollId = setInterval(pollUpdateRequest, HUB_UPDATE_POLL_MS);
 
   const hubReady = waitForManager(hubProbeBaseUrl);
-  void hubReady.then(ok => {
-    if (!ok) return;
-    void transferSavedClientSessionToHub(hubProbeBaseUrl, MANAGER_STATE_DIR).then(handoff => {
-      if (handoff.ok) {
-        reportLauncherUpdate('[LiveDesk Hub] Saved Client sign-in adopted by the Hub.');
-        if (!handoff.hostTargetOk) {
-          reportLauncherUpdate('[LiveDesk Hub] Sign-in was adopted; host publication will continue through lease renewal.', true);
-        }
-      } else if (!handoff.skipped) {
-        reportLauncherUpdate(`[LiveDesk Hub] Saved Client sign-in could not be adopted: ${handoff.reason}. Continue sign-in in the Hub page.`, true);
+  const hubStartup = hubReady.then(async ok => {
+    if (!ok) {
+      return false;
+    }
+    const handoff = await transferSavedClientSessionToHub(hubProbeBaseUrl, MANAGER_STATE_DIR);
+    if (handoff.ok) {
+      reportLauncherUpdate('[LiveDesk Hub] Saved Client sign-in adopted by the Hub.');
+      if (!handoff.hostTargetOk) {
+        reportLauncherUpdate('[LiveDesk Hub] Sign-in was adopted; host publication will continue through lease renewal.', true);
       }
-    }).catch(error => {
-      reportLauncherUpdate(`[LiveDesk Hub] Saved Client sign-in handoff failed: ${error?.message || error}. Continue sign-in in the Hub page.`, true);
-    });
+    } else if (!handoff.skipped) {
+      reportLauncherUpdate(`[LiveDesk Hub] Saved Client sign-in could not be adopted: ${handoff.reason}. Continue sign-in in the Hub page.`, true);
+    }
+    return true;
   });
 
   if (options.openBrowserOnStart) {
-    void hubReady.then(ok => {
+    void hubStartup.then(ok => {
       if (ok) {
         openBrowser(openUrl);
       } else {
@@ -3207,7 +3189,6 @@ async function main() {
     }
   }
   await assertNoActiveMacPhysicalDiagnosticLease();
-  await preflightPackagedRuntimeDependencies();
   const roleStateOptions = {
     stateDir: MANAGER_STATE_DIR,
     legacyClientStateDir: process.env.LIVEDESK_LEGACY_CLIENT_STATE_DIR