livedesk 0.1.498 → 0.1.500

package/bin/livedesk.js

@@ -2640,9 +2640,9 @@ async function runManager(args, resolvedRole = null, runtimeLock = null, updateH
     );
     const packageTarget = `livedesk@${requestedVersion}`;
     const nextArgs = [
-      '-y',
-      '--prefer-online',
-      '--prefix',
+      '-y',
+      '--prefer-offline',
+      '--prefix',
       neutralCwd,
       '--workspaces=false',
       packageTarget,

package/bootstrap/legacy-client-update.js

@@ -1019,7 +1019,7 @@ export function prefetchExactNpxRestore(config, env = process.env, options = {})
   }
   const neutralCwd = prepareNeutralCwd(config?.neutralCwd);
   const invocation = resolveNpxInvocation(
-    buildExactNpxArgs(neutralCwd, '--prefer-online', version, ['--version']),
+    buildExactNpxArgs(neutralCwd, '--prefer-offline', version, ['--version']),
     env
   );
   const result = (options.spawnSyncImpl || spawnSync)(
@@ -1691,7 +1691,7 @@ export async function runLegacyClientUpdateSupervisor(options = {}) {
         config.targetProductVersion,
         'target',
         attempt,
-        '--prefer-online',
+        '--prefer-offline',
         config.targetVersion
       );
       ownershipCheck();

package/bootstrap/role-bootstrap-server.js

@@ -31,23 +31,30 @@ function writePrivateJson(path, value) {
   }
 }
 
-function originAllowed(req, host, port) {
-  const origin = clean(req.headers.origin, 300);
+function originAllowed(req, host, port) {
+  const origin = clean(req.headers.origin, 300);
   const requestHost = clean(req.headers.host, 300).split(':')[0].toLowerCase();
   const allowedHost = host.toLowerCase() === 'localhost' || host === '127.0.0.1' ? host.toLowerCase() : '127.0.0.1';
   if (requestHost && requestHost !== allowedHost && requestHost !== 'localhost' && requestHost !== '127.0.0.1') return false;
-  // Electron can load the local runtime from a shell whose serialized origin
-  // is `null`. The request is still restricted to a loopback Host above, so
-  // allow this local-shell origin for the bootstrap API and role selection.
-  if (!origin || origin === 'null') return true;
+  if (!origin) {
+    const fetchSite = clean(req.headers['sec-fetch-site'], 40).toLowerCase();
+    return !fetchSite
+      || fetchSite === 'same-origin'
+      || fetchSite === 'same-site'
+      || fetchSite === 'none';
+  }
+  // Electron loads the bootstrap UI from the loopback HTTP origin. An opaque
+  // origin cannot distinguish that UI from an attacker-controlled local file
+  // or sandbox and therefore receives no bootstrap API privilege.
+  if (origin === 'null') return false;
   return origin === `http://127.0.0.1:${port}` || origin === `http://localhost:${port}`;
 }
 
 function sendJson(req, res, status, payload, port) {
   const origin = clean(req.headers.origin, 300);
-  const allowedOrigin = origin === 'null'
-    ? 'null'
-    : origin === `http://localhost:${port}` ? origin : `http://127.0.0.1:${port}`;
+  const allowedOrigin = origin === `http://localhost:${port}`
+    ? origin
+    : `http://127.0.0.1:${port}`;
   res.writeHead(status, {
     'Content-Type': 'application/json; charset=utf-8',
     'Cache-Control': 'no-store',

package/client/bin/livedesk-client-node.js

@@ -251,7 +251,7 @@ async function waitForClientUpdateShutdownSignal(
     return { ready: false, error };
 }
 
-function markClientUpdateConnected() {
+function markClientUpdateConnected() {
     const operationId = String(process.env.LIVEDESK_CLIENT_UPDATE_OPERATION_ID || '').trim();
     if (!operationId) return;
     void writeClientUpdateState('connected', {
@@ -262,8 +262,59 @@ function markClientUpdateConnected() {
         error: ''
     }).catch(error => {
         console.error(`LiveDesk client update diagnostics could not be persisted: ${error?.message || error}`);
-    });
-}
+    });
+}
+
+async function publishClientUpdateSupervisorProof(socket) {
+    const operationId = String(process.env.LIVEDESK_CLIENT_UPDATE_OPERATION_ID || '').trim();
+    const attemptId = String(process.env.LIVEDESK_CLIENT_UPDATE_ATTEMPT_ID || '').trim();
+    const expectedLauncherPid = Number(process.env.LIVEDESK_CLIENT_PARENT_PID || 0);
+    if (!operationId || !attemptId || !Number.isInteger(expectedLauncherPid) || expectedLauncherPid <= 1) return;
+    const deadline = Date.now() + 60_000;
+    while (Date.now() < deadline && !socket.destroyed) {
+        try {
+            const state = JSON.parse(await fs.readFile(getClientUpdateStatePath(), 'utf8'));
+            if (String(state?.operationId || '') !== operationId
+                || String(state?.attemptId || '') !== attemptId) {
+                await wait(100);
+                continue;
+            }
+            if (['failed', 'restored', 'cancelled'].includes(String(state.stage || ''))) return;
+            const launcherPid = Number(state.launcherPid || 0);
+            const agentPid = Number(state.agentPid || 0);
+            const supervisorPid = Number(state.supervisorPid || 0);
+            const completedAt = String(state.completedAt || '').trim();
+            const exactSupervisorCompletion = state.stage === 'connected'
+                && state.restartVerified === true
+                && Number.isFinite(Date.parse(completedAt))
+                && launcherPid === expectedLauncherPid
+                && agentPid === process.pid
+                && Number.isInteger(supervisorPid)
+                && supervisorPid > 1
+                && String(state.productVersion || '') === PRODUCT_VERSION
+                && String(state.agentVersion || '') === AGENT_VERSION
+                && String(state.targetProductVersion || '') === PRODUCT_VERSION
+                && String(state.targetAgentVersion || state.targetVersion || '') === AGENT_VERSION;
+            if (exactSupervisorCompletion) {
+                writeJsonLine(socket, {
+                    type: 'client.update.verified',
+                    operationId,
+                    attemptId,
+                    launcherPid,
+                    agentPid,
+                    supervisorPid,
+                    productVersion: PRODUCT_VERSION,
+                    agentVersion: AGENT_VERSION,
+                    completedAt
+                });
+                return;
+            }
+        } catch {
+            // The exact package supervisor may be replacing the atomic state file.
+        }
+        await wait(100);
+    }
+}
 
 function printHelp() {
     console.log(`
@@ -1972,9 +2023,10 @@ function connectOnce(options, deviceId) {
                     remoteFiles: true,
                     fileTransferMaxBytes: MAX_FILE_TRANSFER_BYTES,
                     computerAgent: options.taskEnabled,
-                    taskDispatch: options.taskEnabled,
-                    clientUpdate: true,
-                    productVersion: PRODUCT_VERSION,
+                    taskDispatch: options.taskEnabled,
+                    clientUpdate: true,
+                    clientUpdateVerifiedProof: true,
+                    productVersion: PRODUCT_VERSION,
                     agentApproval: options.taskEnabled,
                     agentAudit: options.taskEnabled,
                     agentTools: [...NODE_AGENT_OPERATIONS],
@@ -2000,8 +2052,13 @@ function connectOnce(options, deviceId) {
                     options.effectivePolicy = message.effectivePolicy && typeof message.effectivePolicy === 'object'
                         ? message.effectivePolicy
                         : null;
-                    console.log(`Connected to LiveDesk Hub as ${options.name} (${deviceId})`);
-                    markClientUpdateConnected();
+                    console.log(`Connected to LiveDesk Hub as ${options.name} (${deviceId})`);
+                    markClientUpdateConnected();
+                    void publishClientUpdateSupervisorProof(socket).catch(error => {
+                        if (!socket.destroyed) {
+                            console.error(`LiveDesk client update verification proof failed: ${error?.message || error}`);
+                        }
+                    });
                     writeJsonLine(socket, {
                         type: 'status',
                         status: getStatus(options)

package/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/client",
-  "version": "0.1.238",
+  "version": "0.1.239",
   "description": "LiveDesk local remote client",
   "type": "module",
   "bin": {
@@ -42,10 +42,10 @@
     "ws": "^8.18.3"
   },
   "optionalDependencies": {
-    "@livedesk/fast-linux-x64": "0.1.436",
-    "@livedesk/fast-osx-arm64": "0.1.436",
-    "@livedesk/fast-osx-x64": "0.1.436",
-    "@livedesk/fast-win-x64": "0.1.436"
+    "@livedesk/fast-linux-x64": "0.1.437",
+    "@livedesk/fast-osx-arm64": "0.1.437",
+    "@livedesk/fast-osx-x64": "0.1.437",
+    "@livedesk/fast-win-x64": "0.1.437"
   },
   "publishConfig": {
     "access": "public"

package/client/src/runtime/client-runtime-server.js

@@ -1022,10 +1022,9 @@ function isLoopbackRequest(req) {
   return address === '127.0.0.1' || address === '::1' || address === 'localhost' || !address;
 }
 
-function isTrustedApiOrigin(value, trustedWebOrigins) {
-  const rawOrigin = normalizeString(value, 300);
-  if (rawOrigin === 'null') return true;
-  const origin = normalizeOrigin(rawOrigin);
+function isTrustedApiOrigin(value, trustedWebOrigins) {
+  const rawOrigin = normalizeString(value, 300);
+  const origin = normalizeOrigin(rawOrigin);
   if (!origin) return false;
   if (trustedWebOrigins.has(origin)) return true;
   try {
@@ -1049,11 +1048,10 @@ function isTrustedLocalRequest(req, host, port, options = {}) {
   const requestHost = normalizeString(req.headers.host, 300).split(':')[0].toLowerCase();
   if (requestHost && requestHost !== host.toLowerCase() && requestHost !== 'localhost' && requestHost !== '127.0.0.1') return false;
 
-  // Chromium can mark modulepreload/stylesheet requests as cross-site, or
-  // send Origin: null when the page was opened from a local shell. Static
-  // assets are not privileged, and the local shell still needs to read the
-  // loopback runtime API to determine the active role. Mutating API routes
-  // remain protected by the CSRF token check below.
+  // Chromium can mark modulepreload/stylesheet requests as cross-site. Static
+  // assets are not privileged. An opaque Origin (`null`) is never accepted for
+  // an API route because it cannot distinguish the LiveDesk shell from an
+  // attacker-controlled file, sandbox, or data page.
   if (options.allowStaticCrossSite === true) {
     return true;
   }
@@ -1073,10 +1071,9 @@ function isTrustedLocalRequest(req, host, port, options = {}) {
     || fetchSite === 'none';
 }
 
-function resolveCorsOrigin(requestOrigin, port, trustedWebOrigins) {
-  const origin = normalizeString(requestOrigin, 300);
-  if (origin === 'null') return 'null';
-  return origin && isTrustedApiOrigin(origin, trustedWebOrigins)
+function resolveCorsOrigin(requestOrigin, port, trustedWebOrigins) {
+  const origin = normalizeString(requestOrigin, 300);
+  return origin && isTrustedApiOrigin(origin, trustedWebOrigins)
     ? normalizeOrigin(origin)
     : `http://127.0.0.1:${port}`;
 }

package/hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "description": "LiveDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",

package/hub/src/live-desk-update.js

@@ -8,10 +8,11 @@ export const LIVE_DESK_UPDATE_COMMAND = 'livedesk.client-update';
 // same device returned, so the Hub-owned compatibility bridge upgrades them.
 export const LIVE_DESK_DEDICATED_CLIENT_UPDATE_MIN_VERSION = '0.1.172';
 export const LIVE_DESK_UPDATE_CLIENT_BATCH_SIZE = 5;
-export const LIVE_DESK_UPDATE_TARGET_TIMEOUT_MS = 480_000;
-export const LIVE_DESK_UPDATE_TIMEOUT_MS = 90 * 60_000;
-export const LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS = 60_000;
-export const LIVE_DESK_UPDATE_CHECK_INTERVAL_MS = 60_000;
+export const LIVE_DESK_UPDATE_TARGET_TIMEOUT_MS = 480_000;
+export const LIVE_DESK_UPDATE_TIMEOUT_MS = 90 * 60_000;
+export const LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS = 60_000;
+export const LIVE_DESK_UPDATE_VERIFIED_CLIENT_STABILITY_MS = 10_000;
+export const LIVE_DESK_UPDATE_CHECK_INTERVAL_MS = 60_000;
 export const LIVE_DESK_LEGACY_COMMAND_MAX_LENGTH = 3900;
 
 function cleanVersion(value) {
@@ -194,9 +195,10 @@ function statusForRun(run) {
     activeCount,
     queuedCount,
     pendingOfflineCount,
-    failedCount,
-    batchSize: run.batchSize,
-    clientRestartStabilityMs: run.clientRestartStabilityMs,
+    failedCount,
+    batchSize: run.batchSize,
+    clientRestartStabilityMs: run.clientRestartStabilityMs,
+    verifiedClientRestartStabilityMs: run.verifiedClientRestartStabilityMs,
     latestManagerVersion: run.latestManagerVersion,
     latestClientVersion: run.latestClientVersion,
     error: run.error || '',
@@ -226,10 +228,14 @@ function resetReconnectCandidate(target) {
   target.candidatePid = 0;
   target.candidateConnectedAt = '';
   target.candidateProductVersion = '';
-  target.candidateAgentVersion = '';
-  target.candidateSince = '';
-  target.stabilityDeadlineAt = '';
-}
+  target.candidateAgentVersion = '';
+  target.candidateSupervisorProofId = '';
+  target.verificationSource = '';
+  target.requiredStabilityMs = 0;
+  target.supervisorProofAt = '';
+  target.candidateSince = '';
+  target.stabilityDeadlineAt = '';
+}
 
 export function createLiveDeskUpdateManager({
   remoteHub,
@@ -240,10 +246,11 @@ export function createLiveDeskUpdateManager({
   fetchImpl = globalThis.fetch,
   now = () => Date.now(),
   clientBatchSize = LIVE_DESK_UPDATE_CLIENT_BATCH_SIZE,
-  targetTimeoutMs = LIVE_DESK_UPDATE_TARGET_TIMEOUT_MS,
-  operationTimeoutMs = LIVE_DESK_UPDATE_TIMEOUT_MS,
-  clientRestartStabilityMs = LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS
-}) {
+  targetTimeoutMs = LIVE_DESK_UPDATE_TARGET_TIMEOUT_MS,
+  operationTimeoutMs = LIVE_DESK_UPDATE_TIMEOUT_MS,
+  clientRestartStabilityMs = LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS,
+  verifiedClientRestartStabilityMs = LIVE_DESK_UPDATE_VERIFIED_CLIENT_STABILITY_MS
+}) {
   let latestRelease = null;
   let checkError = '';
   let checkPromise = null;
@@ -262,12 +269,18 @@ export function createLiveDeskUpdateManager({
     effectiveTargetTimeoutMs,
     Number(operationTimeoutMs) || LIVE_DESK_UPDATE_TIMEOUT_MS
   );
-  const effectiveClientRestartStabilityMs = Math.max(
+  const effectiveClientRestartStabilityMs = Math.max(
     0,
     Number.isFinite(Number(clientRestartStabilityMs))
       ? Number(clientRestartStabilityMs)
-      : LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS
-  );
+      : LIVE_DESK_UPDATE_CLIENT_RESTART_STABILITY_MS
+  );
+  const effectiveVerifiedClientRestartStabilityMs = Math.max(
+    5_000,
+    Number.isFinite(Number(verifiedClientRestartStabilityMs))
+      ? Number(verifiedClientRestartStabilityMs)
+      : LIVE_DESK_UPDATE_VERIFIED_CLIENT_STABILITY_MS
+  );
 
   const touch = () => {
     if (run) run.updatedAt = new Date(now()).toISOString();
@@ -341,9 +354,10 @@ export function createLiveDeskUpdateManager({
         queuedCount: 0,
         pendingOfflineCount: 0,
         failedCount: 0,
-        batchSize: effectiveClientBatchSize,
-        clientRestartStabilityMs: effectiveClientRestartStabilityMs,
-        targets: []
+        batchSize: effectiveClientBatchSize,
+        clientRestartStabilityMs: effectiveClientRestartStabilityMs,
+        verifiedClientRestartStabilityMs: effectiveVerifiedClientRestartStabilityMs,
+        targets: []
       })
     };
   };
@@ -535,9 +549,30 @@ export function createLiveDeskUpdateManager({
         const connectedAtEpochMs = Date.parse(connectedAt);
         const dispatchedAtEpochMs = Date.parse(target.dispatchedAt || '');
         const candidatePid = Math.max(0, Math.floor(Number(device?.pid) || 0));
-        const candidateProductVersion = String(device?.productVersion || '');
-        const candidateAgentVersion = String(device?.agentVersion || '');
-        const qualifiesForStability = device?.connected === true
+        const candidateProductVersion = String(device?.productVersion || '');
+        const candidateAgentVersion = String(device?.agentVersion || '');
+        const supervisorProof = device?.clientUpdateProof;
+        const supervisorProofId = [
+          String(supervisorProof?.operationId || ''),
+          String(supervisorProof?.attemptId || ''),
+          String(supervisorProof?.sessionId || ''),
+          String(supervisorProof?.agentPid || ''),
+          String(supervisorProof?.launcherPid || ''),
+          String(supervisorProof?.completedAt || '')
+        ].join(':');
+        const hasSupervisorProof = !!supervisorProof
+          && String(supervisorProof.operationId || '') === run.operationId
+          && !!String(supervisorProof.attemptId || '')
+          && String(supervisorProof.sessionId || '') === sessionId
+          && Number(supervisorProof.agentPid || 0) === candidatePid
+          && Number(supervisorProof.launcherPid || 0) > 1
+          && cleanVersion(supervisorProof.productVersion) === cleanVersion(candidateProductVersion)
+          && cleanVersion(supervisorProof.agentVersion) === cleanVersion(candidateAgentVersion)
+          && Date.parse(String(supervisorProof.receivedAt || '')) >= connectedAtEpochMs;
+        const requiredStabilityMs = hasSupervisorProof
+          ? run.verifiedClientRestartStabilityMs
+          : run.clientRestartStabilityMs;
+        const qualifiesForStability = device?.connected === true
           && !!sessionId
           && candidatePid > 1
           && sessionId !== target.dispatchedSessionId
@@ -546,9 +581,10 @@ export function createLiveDeskUpdateManager({
         const sameCandidate = qualifiesForStability
           && target.candidateSessionId === sessionId
           && target.candidatePid === candidatePid
-          && target.candidateConnectedAt === connectedAt
-          && target.candidateProductVersion === candidateProductVersion
-          && target.candidateAgentVersion === candidateAgentVersion;
+          && target.candidateConnectedAt === connectedAt
+          && target.candidateProductVersion === candidateProductVersion
+          && target.candidateAgentVersion === candidateAgentVersion
+          && target.candidateSupervisorProofId === (hasSupervisorProof ? supervisorProofId : '');
 
         if (!qualifiesForStability) {
           resetReconnectCandidate(target);
@@ -556,12 +592,18 @@ export function createLiveDeskUpdateManager({
           target.candidateSessionId = sessionId;
           target.candidatePid = candidatePid;
           target.candidateConnectedAt = connectedAt;
-          target.candidateProductVersion = candidateProductVersion;
-          target.candidateAgentVersion = candidateAgentVersion;
-          target.candidateSince = new Date(currentTime).toISOString();
-          target.stabilityDeadlineAt = new Date(
-            currentTime + run.clientRestartStabilityMs
-          ).toISOString();
+          target.candidateProductVersion = candidateProductVersion;
+          target.candidateAgentVersion = candidateAgentVersion;
+          target.candidateSupervisorProofId = hasSupervisorProof ? supervisorProofId : '';
+          target.verificationSource = hasSupervisorProof ? 'supervisor-proof' : 'hub-session';
+          target.requiredStabilityMs = requiredStabilityMs;
+          target.supervisorProofAt = hasSupervisorProof
+            ? String(supervisorProof.receivedAt || supervisorProof.completedAt || '')
+            : '';
+          target.candidateSince = new Date(currentTime).toISOString();
+          target.stabilityDeadlineAt = new Date(
+            currentTime + requiredStabilityMs
+          ).toISOString();
         }
 
         if (qualifiesForStability
@@ -646,8 +688,9 @@ export function createLiveDeskUpdateManager({
       latestManagerVersion: release.latestManagerVersion,
       latestClientVersion: release.latestClientVersion,
       needsHubRestart,
-      batchSize: effectiveClientBatchSize,
-      clientRestartStabilityMs: effectiveClientRestartStabilityMs,
+      batchSize: effectiveClientBatchSize,
+      clientRestartStabilityMs: effectiveClientRestartStabilityMs,
+      verifiedClientRestartStabilityMs: effectiveVerifiedClientRestartStabilityMs,
       error: '',
       targets: targets.map(device => ({
         deviceId: String(device.deviceId || ''),
@@ -666,9 +709,13 @@ export function createLiveDeskUpdateManager({
         candidateSessionId: '',
         candidatePid: 0,
         candidateConnectedAt: '',
-        candidateProductVersion: '',
-        candidateAgentVersion: '',
-        candidateSince: '',
+        candidateProductVersion: '',
+        candidateAgentVersion: '',
+        candidateSupervisorProofId: '',
+        verificationSource: '',
+        requiredStabilityMs: 0,
+        supervisorProofAt: '',
+        candidateSince: '',
         stabilityDeadlineAt: '',
         completedAt: '',
         error: ''
@@ -698,7 +745,9 @@ export function createLiveDeskUpdateManager({
 
   const handleRemoteEvent = (type, event) => {
     if (!run || run.state !== 'waiting-for-clients') return;
-    if (type === 'RemoteDeviceConnected' || type === 'RemoteDeviceDisconnected') {
+    if (type === 'RemoteDeviceConnected'
+      || type === 'RemoteDeviceDisconnected'
+      || type === 'RemoteClientUpdateVerified') {
       verifyTargets();
       return;
     }

package/hub/src/remote-hub.js

@@ -286,7 +286,7 @@ function normalizePort(value) {
     return clampNumber(value, 0, 65535, DEFAULT_REMOTE_HUB_PORT);
 }
 
-function safeString(value, maxLength = 200) {
+function safeString(value, maxLength = 200) {
     return String(value ?? '').replace(/[\r\n\t]/g, ' ').trim().slice(0, maxLength);
 }
 
@@ -1123,6 +1123,42 @@ function safeText(value, maxLength = 1000) {
     return String(value ?? '').replace(/\0/g, '').trim().slice(0, maxLength);
 }
 
+function normalizeClientUpdateVerifiedProof(device, message, receivedAt) {
+    const operationId = safeString(message?.operationId, 180);
+    const attemptId = safeString(message?.attemptId, 180);
+    const productVersion = safeString(message?.productVersion, 40);
+    const agentVersion = safeString(message?.agentVersion, 40);
+    const completedAt = safeString(message?.completedAt, 64);
+    const launcherPid = Math.max(0, Math.floor(Number(message?.launcherPid) || 0));
+    const agentPid = Math.max(0, Math.floor(Number(message?.agentPid) || 0));
+    const supervisorPid = Math.max(0, Math.floor(Number(message?.supervisorPid) || 0));
+    if (!operationId
+        || !attemptId
+        || !productVersion
+        || !agentVersion
+        || !Number.isFinite(Date.parse(completedAt))
+        || launcherPid <= 1
+        || agentPid <= 1
+        || supervisorPid <= 1
+        || agentPid !== Number(device?.pid || 0)
+        || productVersion !== String(device?.productVersion || '')
+        || agentVersion !== String(device?.agentVersion || '')) {
+        return null;
+    }
+    return {
+        operationId,
+        attemptId,
+        sessionId: String(device.sessionId || ''),
+        launcherPid,
+        agentPid,
+        supervisorPid,
+        productVersion,
+        agentVersion,
+        completedAt,
+        receivedAt
+    };
+}
+
 function normalizeRemoteKeyboardKey(value) {
     const raw = String(value ?? '').replace(/\0/g, '');
     return raw === ' ' ? ' ' : safeString(raw, 80);
@@ -1626,8 +1662,9 @@ function serializeDevice(device, options = {}) {
                 byteLength: device.latestAudioFrame.byteLength
             }
             : null,
-        latestAudioStatus: device.latestAudioStatus ? { ...device.latestAudioStatus } : null,
-        udp: device.udp ? { ...device.udp } : { enabled: false, state: 'tcp-only', ready: false },
+        latestAudioStatus: device.latestAudioStatus ? { ...device.latestAudioStatus } : null,
+        clientUpdateProof: device.clientUpdateProof ? { ...device.clientUpdateProof } : null,
+        udp: device.udp ? { ...device.udp } : { enabled: false, state: 'tcp-only', ready: false },
         latestTask: device.latestTask ? { ...device.latestTask } : null,
         synthetic: device.synthetic === true,
         recentTasks: Array.isArray(device.recentTasks)
@@ -4427,8 +4464,9 @@ export function createRemoteHub(options = {}) {
             liveCapturePause: existing?.liveCapturePause || null,
             activeAudioStream: null,
             latestAudioFrame: null,
-            latestAudioStatus: null,
-            udp: {
+            latestAudioStatus: null,
+            clientUpdateProof: null,
+            udp: {
                 enabled: capabilities.udpP2p === true,
                 state: 'tcp-only',
                 ready: false,
@@ -7441,7 +7479,7 @@ export function createRemoteHub(options = {}) {
                 device.counters.statusReceived += 1;
                 emitRemoteEvent('RemoteDeviceStatus', device);
                 break;
-            case 'command.result':
+            case 'command.result':
             case 'command.error':
                 device.counters.commandResultsReceived += 1;
                 {
@@ -7469,9 +7507,23 @@ export function createRemoteHub(options = {}) {
                     commandId: safeString(message.commandId, 128),
                     result: message.result ?? null,
                     error: safeString(message.error, 500)
-                });
-                break;
-            case 'input.applied':
+                });
+                break;
+            case 'client.update.verified': {
+                const receivedAt = new Date().toISOString();
+                const proof = normalizeClientUpdateVerifiedProof(device, message, receivedAt);
+                if (!proof) {
+                    logWarn(
+                        'remote',
+                        `ignored invalid Client update supervisor proof from ${device.deviceName} (${device.deviceId})`
+                    );
+                    break;
+                }
+                device.clientUpdateProof = proof;
+                emitRemoteEvent('RemoteClientUpdateVerified', device, { proof });
+                break;
+            }
+            case 'input.applied':
             case 'input.error':
                 handleRemoteInputOutcome(device, message, 'main');
                 break;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "livedesk",
-  "version": "0.1.498",
-  "livedeskClientVersion": "0.1.238",
+  "version": "0.1.500",
+  "livedeskClientVersion": "0.1.239",
   "buildFlavor": "production",
   "description": "LiveDesk Hub and client launcher",
   "type": "module",
@@ -52,10 +52,10 @@
     "ws": "^8.18.3"
   },
   "optionalDependencies": {
-    "@livedesk/fast-linux-x64": "0.1.436",
-    "@livedesk/fast-osx-arm64": "0.1.436",
-    "@livedesk/fast-osx-x64": "0.1.436",
-    "@livedesk/fast-win-x64": "0.1.436"
+    "@livedesk/fast-linux-x64": "0.1.437",
+    "@livedesk/fast-osx-arm64": "0.1.437",
+    "@livedesk/fast-osx-x64": "0.1.437",
+    "@livedesk/fast-win-x64": "0.1.437"
   },
   "publishConfig": {
     "access": "public"