livedesk 0.1.551 → 0.1.554

package/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/client",
-  "version": "0.1.246",
+  "version": "0.1.248",
   "description": "LiveDesk local remote client",
   "type": "module",
   "bin": {
@@ -42,10 +42,10 @@
     "ws": "^8.18.3"
   },
   "optionalDependencies": {
-    "@livedesk/fast-linux-x64": "0.1.443",
-    "@livedesk/fast-osx-arm64": "0.1.443",
-    "@livedesk/fast-osx-x64": "0.1.443",
-    "@livedesk/fast-win-x64": "0.1.443"
+    "@livedesk/fast-linux-x64": "0.1.445",
+    "@livedesk/fast-osx-arm64": "0.1.445",
+    "@livedesk/fast-osx-x64": "0.1.445",
+    "@livedesk/fast-win-x64": "0.1.445"
   },
   "publishConfig": {
     "access": "public"

package/electron/auth-session-owner.mjs

@@ -1,7 +1,7 @@
-export const DESKTOP_AUTH_REFRESH_SKEW_SECONDS = 5 * 60;
-export const DESKTOP_AUTH_RETRY_MS = 15_000;
-export const DESKTOP_AUTH_MINIMUM_TIMER_MS = 30_000;
-export const DESKTOP_AUTH_INVALID_CONFIRMATIONS = 3;
+export const DESKTOP_AUTH_REFRESH_SKEW_SECONDS = 5 * 60;
+export const DESKTOP_AUTH_RETRY_MS = 15_000;
+export const DESKTOP_AUTH_MINIMUM_TIMER_MS = 30_000;
+export const DESKTOP_AUTH_INVALID_CONFIRMATIONS = 3;
 
 export function desktopSessionNeedsRefresh(
   session,
@@ -35,55 +35,55 @@ export function desktopSessionRefreshDelayMs(
   );
 }
 
-export function isPermanentDesktopAuthRefreshFailure(error) {
-  const status = Number(error?.authStatus || 0);
-  return status === 400 || status === 401 || status === 403;
-}
-
-export function selectFreshestDesktopSession(currentSession, incomingSession) {
-  if (!currentSession) return incomingSession || null;
-  if (!incomingSession) return currentSession;
-  const currentUserId = String(currentSession.user?.id || '');
-  const incomingUserId = String(incomingSession.user?.id || '');
-  if (currentUserId && incomingUserId && currentUserId !== incomingUserId) return incomingSession;
-  const currentExpiry = Number(currentSession.expires_at || 0);
-  const incomingExpiry = Number(incomingSession.expires_at || 0);
-  return incomingExpiry > currentExpiry ? incomingSession : currentSession;
-}
-
-export function createDesktopAuthInvalidationGuard({
-  confirmations = DESKTOP_AUTH_INVALID_CONFIRMATIONS
-} = {}) {
-  const required = Math.max(2, Number(confirmations) || DESKTOP_AUTH_INVALID_CONFIRMATIONS);
-  let rejectedToken = '';
-  let rejectionCount = 0;
-
-  return {
-    observeSuccess() {
-      rejectedToken = '';
-      rejectionCount = 0;
-    },
-    observeFailure(error, refreshToken) {
-      if (!isPermanentDesktopAuthRefreshFailure(error)) {
-        rejectedToken = '';
-        rejectionCount = 0;
-        return { permanent: false, confirmedInvalid: false, rejectionCount };
-      }
-      const token = String(refreshToken || '');
-      if (!token || token !== rejectedToken) {
-        rejectedToken = token;
-        rejectionCount = 1;
-      } else {
-        rejectionCount += 1;
-      }
-      return {
-        permanent: true,
-        confirmedInvalid: rejectionCount >= required,
-        rejectionCount
-      };
-    },
-    snapshot() {
-      return { rejectedToken, rejectionCount, confirmations: required };
-    }
-  };
-}
+export function isPermanentDesktopAuthRefreshFailure(error) {
+  const status = Number(error?.authStatus || 0);
+  return status === 400 || status === 401 || status === 403;
+}
+
+export function selectFreshestDesktopSession(currentSession, incomingSession) {
+  if (!currentSession) return incomingSession || null;
+  if (!incomingSession) return currentSession;
+  const currentUserId = String(currentSession.user?.id || '');
+  const incomingUserId = String(incomingSession.user?.id || '');
+  if (currentUserId && incomingUserId && currentUserId !== incomingUserId) return incomingSession;
+  const currentExpiry = Number(currentSession.expires_at || 0);
+  const incomingExpiry = Number(incomingSession.expires_at || 0);
+  return incomingExpiry > currentExpiry ? incomingSession : currentSession;
+}
+
+export function createDesktopAuthInvalidationGuard({
+  confirmations = DESKTOP_AUTH_INVALID_CONFIRMATIONS
+} = {}) {
+  const required = Math.max(2, Number(confirmations) || DESKTOP_AUTH_INVALID_CONFIRMATIONS);
+  let rejectedToken = '';
+  let rejectionCount = 0;
+
+  return {
+    observeSuccess() {
+      rejectedToken = '';
+      rejectionCount = 0;
+    },
+    observeFailure(error, refreshToken) {
+      if (!isPermanentDesktopAuthRefreshFailure(error)) {
+        rejectedToken = '';
+        rejectionCount = 0;
+        return { permanent: false, confirmedInvalid: false, rejectionCount };
+      }
+      const token = String(refreshToken || '');
+      if (!token || token !== rejectedToken) {
+        rejectedToken = token;
+        rejectionCount = 1;
+      } else {
+        rejectionCount += 1;
+      }
+      return {
+        permanent: true,
+        confirmedInvalid: rejectionCount >= required,
+        rejectionCount
+      };
+    },
+    snapshot() {
+      return { rejectedToken, rejectionCount, confirmations: required };
+    }
+  };
+}

package/electron/electron-builder.linux-x64.yml

@@ -0,0 +1,34 @@
+extends: file:packages/livedesk/electron/electron-builder.yml
+files:
+  - bin/**
+  - bootstrap/**
+  - client/**
+  - electron/**
+  - hub/**
+  - runtime-core/**
+  - web/**
+  - package.json
+  - README.md
+  - "!client/fast/win-x64/**"
+  - "!client/fast/osx-x64/**"
+  - "!client/fast/osx-arm64/**"
+asarUnpack:
+  - bin/**
+  - bootstrap/**
+  - client/**
+  - electron/icon.*
+  - electron/tray.*
+  - hub/**
+  - runtime-core/**
+  - web/**
+linux:
+  icon: packages/livedesk/electron/icon.png
+  category: Utility
+  executableName: livedesk
+  target:
+    - target: AppImage
+      arch:
+        - x64
+publish:
+  provider: generic
+  url: https://livedesk-desktop-updates.lovecrdm.workers.dev/stable/linux/x64

package/electron/electron-builder.mac-arm64.yml

@@ -24,6 +24,10 @@ asarUnpack:
 mac:
   icon: packages/livedesk/electron/icon.icns
   category: public.app-category.utilities
+  hardenedRuntime: true
+  notarize: true
+  entitlements: packages/livedesk/electron/entitlements.mac.plist
+  entitlementsInherit: packages/livedesk/electron/entitlements.mac.plist
   target:
     - target: dmg
       arch:
@@ -33,3 +37,6 @@ mac:
         - arm64
   extendInfo:
     NSMicrophoneUsageDescription: LiveDesk uses audio only when remote computer audio is enabled.
+publish:
+  provider: generic
+  url: https://livedesk-desktop-updates.lovecrdm.workers.dev/stable/macos/arm64

package/electron/electron-builder.mac-x64.yml

@@ -24,6 +24,10 @@ asarUnpack:
 mac:
   icon: packages/livedesk/electron/icon.icns
   category: public.app-category.utilities
+  hardenedRuntime: true
+  notarize: true
+  entitlements: packages/livedesk/electron/entitlements.mac.plist
+  entitlementsInherit: packages/livedesk/electron/entitlements.mac.plist
   target:
     - target: dmg
       arch:
@@ -33,3 +37,6 @@ mac:
         - x64
   extendInfo:
     NSMicrophoneUsageDescription: LiveDesk uses audio only when remote computer audio is enabled.
+publish:
+  provider: generic
+  url: https://livedesk-desktop-updates.lovecrdm.workers.dev/stable/macos/x64

package/electron/electron-builder.win.yml

@@ -36,3 +36,6 @@ nsis:
   createStartMenuShortcut: true
   shortcutName: LiveDesk
   deleteAppDataOnUninstall: false
+publish:
+  provider: generic
+  url: https://livedesk-desktop-updates.lovecrdm.workers.dev/stable/windows/x64

package/electron/entitlements.mac.plist

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>com.apple.security.cs.allow-jit</key>
+  <true/>
+  <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+  <true/>
+  <key>com.apple.security.device.audio-input</key>
+  <true/>
+</dict>
+</plist>

package/electron/main.mjs

@@ -7,14 +7,14 @@ import { createProductUpdateManager } from './update-manager.mjs';
 import { createPkceAuthorizationUrl, exchangePkceCode, fetchSupabaseUser, parsePkceCallbackUrl, refreshSupabaseSession } from './oauth-pkce.mjs';
 import { getRuntimeAuthEnvironment, resolveDesktopAuthConfig, resolveDesktopBuildFlavor } from './auth-config.mjs';
 import { createBoundedDesktopLogger } from './bounded-desktop-log.mjs';
-import {
-  DESKTOP_AUTH_RETRY_MS,
-  createDesktopAuthInvalidationGuard,
-  desktopSessionIsUsable,
-  desktopSessionNeedsRefresh,
-  desktopSessionRefreshDelayMs,
-  selectFreshestDesktopSession
-} from './auth-session-owner.mjs';
+import {
+  DESKTOP_AUTH_RETRY_MS,
+  createDesktopAuthInvalidationGuard,
+  desktopSessionIsUsable,
+  desktopSessionNeedsRefresh,
+  desktopSessionRefreshDelayMs,
+  selectFreshestDesktopSession
+} from './auth-session-owner.mjs';
 import { resolveDeviceRole } from '../bootstrap/device-role.js';
 import {
   registerOwnedWindowsChild,
@@ -102,11 +102,11 @@ let productUpdates = null;
 let pendingOAuth = null;
 let pendingProtocolUrl = '';
 let runtimeLogoutPromise = null;
-let desktopAuthRefreshTimer = null;
-let desktopSessionRestorePromise = null;
-let lastDesktopResumeRecoveryAt = 0;
-let desktopSessionEpoch = 0;
-const desktopAuthInvalidationGuard = createDesktopAuthInvalidationGuard();
+let desktopAuthRefreshTimer = null;
+let desktopSessionRestorePromise = null;
+let lastDesktopResumeRecoveryAt = 0;
+let desktopSessionEpoch = 0;
+const desktopAuthInvalidationGuard = createDesktopAuthInvalidationGuard();
 const FALLBACK_ICON_DATA_URL = `data:image/svg+xml;charset=utf-8,${encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 32 32" fill="none"><rect x="1" y="1" width="30" height="30" rx="7" fill="#111827"/><g transform="translate(5 5) scale(.785714)"><rect x="2.5" y="4" width="14" height="9" rx="1.5" stroke="#F8FAFC" stroke-width="1.7" opacity=".42"/><path d="M7 16v1.5h5" stroke="#F8FAFC" stroke-width="1.7" stroke-linecap="round" opacity=".42"/><rect x="10.5" y="2.5" width="14" height="9" rx="1.5" stroke="#F8FAFC" stroke-width="1.7" opacity=".62"/><path d="M15 14.5V16h5" stroke="#F8FAFC" stroke-width="1.7" stroke-linecap="round" opacity=".62"/><rect x="6.5" y="8.5" width="15" height="10" rx="1.7" fill="#F8FAFC" fill-opacity=".12" stroke="#F8FAFC" stroke-width="1.9"/><path d="M12 21v1.5H9.5M16 21v1.5h2.5M9.5 22.5h9" stroke="#F8FAFC" stroke-width="1.9" stroke-linecap="round"/></g></svg>')}`;
 const desktopLogger = createBoundedDesktopLogger({ logPath });
 
@@ -642,7 +642,7 @@ function clearDesktopAuthRefreshTimer() {
   desktopAuthRefreshTimer = null;
 }
 
-function scheduleDesktopAuthRefresh(session, delayMs = desktopSessionRefreshDelayMs(session)) {
+function scheduleDesktopAuthRefresh(session, delayMs = desktopSessionRefreshDelayMs(session)) {
   clearDesktopAuthRefreshTimer();
   if (!session || isQuitting) return;
   desktopAuthRefreshTimer = setTimeout(() => {
@@ -655,53 +655,53 @@ function scheduleDesktopAuthRefresh(session, delayMs = desktopSessionRefreshDela
       log(`scheduled secure auth session recovery failed: ${error?.message || error}`);
     });
   }, Math.max(1_000, Number(delayMs) || DESKTOP_AUTH_RETRY_MS));
-  desktopAuthRefreshTimer.unref?.();
-}
-
-function saveAuthoritativeDesktopSession(session) {
-  const previous = readEncryptedSession();
-  const saved = saveEncryptedSession(session);
-  if (String(previous?.refresh_token || '') !== String(saved.refresh_token || '')) {
-    desktopSessionEpoch += 1;
-  }
-  desktopAuthInvalidationGuard.observeSuccess();
-  scheduleDesktopAuthRefresh(saved);
-  return saved;
-}
-
-async function restoreEncryptedSessionOwned({ syncRuntime = true } = {}) {
-  let session = readEncryptedSession();
-  if (!session) return null;
-  const operationEpoch = desktopSessionEpoch;
-  if (desktopSessionNeedsRefresh(session)) {
-    try {
-      const refreshed = await refreshSupabaseSession({
+  desktopAuthRefreshTimer.unref?.();
+}
+
+function saveAuthoritativeDesktopSession(session) {
+  const previous = readEncryptedSession();
+  const saved = saveEncryptedSession(session);
+  if (String(previous?.refresh_token || '') !== String(saved.refresh_token || '')) {
+    desktopSessionEpoch += 1;
+  }
+  desktopAuthInvalidationGuard.observeSuccess();
+  scheduleDesktopAuthRefresh(saved);
+  return saved;
+}
+
+async function restoreEncryptedSessionOwned({ syncRuntime = true } = {}) {
+  let session = readEncryptedSession();
+  if (!session) return null;
+  const operationEpoch = desktopSessionEpoch;
+  if (desktopSessionNeedsRefresh(session)) {
+    try {
+      const refreshed = await refreshSupabaseSession({
         supabaseUrl: SUPABASE_URL,
-        publishableKey: SUPABASE_PUBLISHABLE_KEY,
-        refreshToken: session.refresh_token
-      });
-      if (operationEpoch !== desktopSessionEpoch) return readEncryptedSession();
-      session = {
-        ...session,
-        ...refreshed,
-        user: refreshed?.user && typeof refreshed.user === 'object' ? refreshed.user : session.user
-      };
-      session = saveAuthoritativeDesktopSession(session);
-    } catch (error) {
-      if (operationEpoch !== desktopSessionEpoch) return readEncryptedSession();
-      log(`secure auth session refresh failed: ${error?.message || error}`);
-      const rejection = desktopAuthInvalidationGuard.observeFailure(error, session.refresh_token);
-      if (rejection.confirmedInvalid) {
-        desktopSessionEpoch += 1;
-        clearEncryptedSession();
-        sendAuthEvent({ ok: true, signedOut: true, reason: 'refresh-rejected' });
-        return null;
-      }
-      // Sleep/wake commonly resumes before DNS and Wi-Fi. Even a credential
-      // rejection is confirmed three times so one stale or raced response
-      // cannot destroy the durable desktop sign-in.
-      scheduleDesktopAuthRefresh(session, DESKTOP_AUTH_RETRY_MS);
-      return session;
+        publishableKey: SUPABASE_PUBLISHABLE_KEY,
+        refreshToken: session.refresh_token
+      });
+      if (operationEpoch !== desktopSessionEpoch) return readEncryptedSession();
+      session = {
+        ...session,
+        ...refreshed,
+        user: refreshed?.user && typeof refreshed.user === 'object' ? refreshed.user : session.user
+      };
+      session = saveAuthoritativeDesktopSession(session);
+    } catch (error) {
+      if (operationEpoch !== desktopSessionEpoch) return readEncryptedSession();
+      log(`secure auth session refresh failed: ${error?.message || error}`);
+      const rejection = desktopAuthInvalidationGuard.observeFailure(error, session.refresh_token);
+      if (rejection.confirmedInvalid) {
+        desktopSessionEpoch += 1;
+        clearEncryptedSession();
+        sendAuthEvent({ ok: true, signedOut: true, reason: 'refresh-rejected' });
+        return null;
+      }
+      // Sleep/wake commonly resumes before DNS and Wi-Fi. Even a credential
+      // rejection is confirmed three times so one stale or raced response
+      // cannot destroy the durable desktop sign-in.
+      scheduleDesktopAuthRefresh(session, DESKTOP_AUTH_RETRY_MS);
+      return session;
     }
   }
   if (syncRuntime) {
@@ -717,7 +717,7 @@ async function restoreEncryptedSessionOwned({ syncRuntime = true } = {}) {
   return session;
 }
 
-async function restoreEncryptedSession(options = {}) {
+async function restoreEncryptedSession(options = {}) {
   if (desktopSessionRestorePromise) return desktopSessionRestorePromise;
   const operation = restoreEncryptedSessionOwned(options);
   desktopSessionRestorePromise = operation;
@@ -725,18 +725,18 @@ async function restoreEncryptedSession(options = {}) {
     return await operation;
   } finally {
     if (desktopSessionRestorePromise === operation) desktopSessionRestorePromise = null;
-  }
-}
-
-async function signOutDesktopSession() {
-  desktopSessionEpoch += 1;
-  desktopAuthInvalidationGuard.observeSuccess();
-  clearEncryptedSession();
-  if (!runtimeLogoutPromise) {
-    runtimeLogoutPromise = clearRuntimeSessionWithRecovery().finally(() => { runtimeLogoutPromise = null; });
-  }
-  return { ok: true, ...(await runtimeLogoutPromise) };
-}
+  }
+}
+
+async function signOutDesktopSession() {
+  desktopSessionEpoch += 1;
+  desktopAuthInvalidationGuard.observeSuccess();
+  clearEncryptedSession();
+  if (!runtimeLogoutPromise) {
+    runtimeLogoutPromise = clearRuntimeSessionWithRecovery().finally(() => { runtimeLogoutPromise = null; });
+  }
+  return { ok: true, ...(await runtimeLogoutPromise) };
+}
 
 function requestDesktopResumeAuthRecovery(source) {
   const now = Date.now();
@@ -835,11 +835,11 @@ async function handleProtocolUrl(rawUrl) {
   try {
     const { code, stateVerified } = parsePkceCallbackUrl(rawUrl, request.state, { allowMissingState: true });
     if (!stateVerified) log('oauth callback omitted state; accepted only with the matching in-memory PKCE verifier');
-    const session = saveAuthoritativeDesktopSession(await exchangePkceCode({
-      supabaseUrl: SUPABASE_URL,
-      publishableKey: SUPABASE_PUBLISHABLE_KEY,
-      code,
-      codeVerifier: request.codeVerifier
+    const session = saveAuthoritativeDesktopSession(await exchangePkceCode({
+      supabaseUrl: SUPABASE_URL,
+      publishableKey: SUPABASE_PUBLISHABLE_KEY,
+      code,
+      codeVerifier: request.codeVerifier
     }));
     pendingOAuth = null;
     await syncSessionToRuntime(session);
@@ -945,37 +945,37 @@ function registerIpc() {
       }
       return { ok: false, error: mask(error?.message || error) };
     }
-  });
-  handle('auth:sign-in-google', () => beginGoogleAuth());
-  handle('auth:sign-out', () => signOutDesktopSession());
-  handle('auth:get-session', () => restoreEncryptedSession({ syncRuntime: true }));
-  handle('auth:persist-session', async session => {
-    if (session) {
-      try {
-        const incoming = await validateSessionWithSupabase(session);
-        const current = readEncryptedSession();
-        const selected = selectFreshestDesktopSession(current, incoming);
-        if (selected !== incoming) {
-          scheduleDesktopAuthRefresh(selected);
-          return { ok: true, ignoredStaleRendererSession: true };
-        }
-        const saved = saveAuthoritativeDesktopSession(incoming);
-        try {
-          await syncSessionToRuntime(saved);
-        } catch (error) {
-          log(`renderer auth session runtime sync deferred: ${error?.message || error}`);
-          scheduleDesktopAuthRefresh(saved, DESKTOP_AUTH_RETRY_MS);
-        }
-        return { ok: true };
-      } catch (error) {
+  });
+  handle('auth:sign-in-google', () => beginGoogleAuth());
+  handle('auth:sign-out', () => signOutDesktopSession());
+  handle('auth:get-session', () => restoreEncryptedSession({ syncRuntime: true }));
+  handle('auth:persist-session', async session => {
+    if (session) {
+      try {
+        const incoming = await validateSessionWithSupabase(session);
+        const current = readEncryptedSession();
+        const selected = selectFreshestDesktopSession(current, incoming);
+        if (selected !== incoming) {
+          scheduleDesktopAuthRefresh(selected);
+          return { ok: true, ignoredStaleRendererSession: true };
+        }
+        const saved = saveAuthoritativeDesktopSession(incoming);
+        try {
+          await syncSessionToRuntime(saved);
+        } catch (error) {
+          log(`renderer auth session runtime sync deferred: ${error?.message || error}`);
+          scheduleDesktopAuthRefresh(saved, DESKTOP_AUTH_RETRY_MS);
+        }
+        return { ok: true };
+      } catch (error) {
         const message = String(error?.message || error);
         log(`renderer auth session validation failed: ${message}`);
         return { ok: false, error: message };
       }
     }
-    // Supabase may emit a null renderer session after a temporary failure.
-    // Durable auth is cleared only by the explicit auth:sign-out IPC.
-    return { ok: true, ignoredImplicitSignOut: true };
+    // Supabase may emit a null renderer session after a temporary failure.
+    // Durable auth is cleared only by the explicit auth:sign-out IPC.
+    return { ok: true, ignoredImplicitSignOut: true };
   });
   handle('app:quit', () => { app.quit(); return { ok: true }; });
   handle('runtime:get-status', async () => {
@@ -1055,7 +1055,12 @@ if (!app.requestSingleInstanceLock()) {
     productUpdates = createProductUpdateManager({
       app,
       onStatus: status => {
+        if (mainWindow && !mainWindow.isDestroyed() && !mainWindow.webContents.isDestroyed()) {
+          mainWindow.webContents.send('updates:status', status);
+        }
         if (status.state === 'available') updateTray(`Update ${status.availableVersion} available`);
+        else if (status.state === 'downloading') updateTray(`Downloading update ${Math.round(status.progress || 0)}%`);
+        else if (status.state === 'downloaded') updateTray(`Update ${status.availableVersion} ready`);
       },
       beforeInstall: prepareRuntimeForUpdateInstall,
       onInstallError: recoverRuntimeAfterUpdateInstallError
@@ -1063,6 +1068,9 @@ if (!app.requestSingleInstanceLock()) {
     registerIpc();
     powerMonitor.on('resume', () => requestDesktopResumeAuthRecovery('system-resume'));
     powerMonitor.on('unlock-screen', () => requestDesktopResumeAuthRecovery('screen-unlock'));
+    if (DESKTOP_BUILD_FLAVOR !== 'e2e') {
+      await productUpdates.checkAtStartup();
+    }
     const startupSession = await restoreEncryptedSession({ syncRuntime: false });
     const forceBootstrapForE2e = DESKTOP_BUILD_FLAVOR === 'e2e' && process.env.LIVEDESK_E2E_ROLE_BOOTSTRAP === '1';
     const startupRole = forceBootstrapForE2e ? null : await resolveStartupRole(startupSession);

package/electron/preload.cjs

@@ -8,10 +8,10 @@ contextBridge.exposeInMainWorld('liveDesk', {
     about: () => ipcRenderer.invoke('app:about'),
     showWindow: () => ipcRenderer.invoke('app:show-window')
   },
-  auth: {
-    signInWithGoogle: () => ipcRenderer.invoke('auth:sign-in-google'),
-    signOut: () => ipcRenderer.invoke('auth:sign-out'),
-    getSession: () => ipcRenderer.invoke('auth:get-session'),
+  auth: {
+    signInWithGoogle: () => ipcRenderer.invoke('auth:sign-in-google'),
+    signOut: () => ipcRenderer.invoke('auth:sign-out'),
+    getSession: () => ipcRenderer.invoke('auth:get-session'),
     persistSession: session => ipcRenderer.invoke('auth:persist-session', session),
     onComplete: callback => {
       const listener = (_event, payload) => callback(payload);
@@ -31,6 +31,11 @@ contextBridge.exposeInMainWorld('liveDesk', {
   updates: {
     getStatus: () => ipcRenderer.invoke('updates:get-status'),
     check: () => ipcRenderer.invoke('updates:check'),
-    install: () => ipcRenderer.invoke('updates:install')
+    install: () => ipcRenderer.invoke('updates:install'),
+    onStatus: callback => {
+      const listener = (_event, payload) => callback(payload);
+      ipcRenderer.on('updates:status', listener);
+      return () => ipcRenderer.removeListener('updates:status', listener);
+    }
   }
 });

package/electron/update-feed-resolver.mjs

@@ -0,0 +1,65 @@
+const LOCAL_HTTP_HOSTS = new Set(['127.0.0.1', 'localhost', '[::1]']);
+const CHANNEL_PATTERN = /^[a-z0-9][a-z0-9-]{0,31}$/;
+const SEGMENT_PATTERN = /^[a-z0-9][a-z0-9/-]{0,127}$/;
+
+function normalizeUrl(value) {
+  return String(value || '').trim().replace(/\/+$/, '');
+}
+
+function validateFeedUrl(value) {
+  const normalized = normalizeUrl(value);
+  if (!normalized) return { url: '', error: 'desktop-update-feed-not-configured' };
+  let parsed;
+  try {
+    parsed = new URL(normalized);
+  } catch {
+    return { url: '', error: 'desktop-update-feed-invalid' };
+  }
+  const localHttp = parsed.protocol === 'http:' && LOCAL_HTTP_HOSTS.has(parsed.hostname);
+  if (parsed.protocol !== 'https:' && !localHttp) {
+    return { url: '', error: 'desktop-update-feed-insecure' };
+  }
+  if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+    return { url: '', error: 'desktop-update-feed-invalid' };
+  }
+  return { url: normalizeUrl(parsed.toString()), error: '' };
+}
+
+export function resolveDesktopUpdateFeed({
+  config = {},
+  overrideUrl = '',
+  platform = process.platform,
+  arch = process.arch
+} = {}) {
+  const exactOverride = validateFeedUrl(overrideUrl);
+  if (String(overrideUrl || '').trim()) {
+    return {
+      ...exactOverride,
+      configured: Boolean(exactOverride.url),
+      platform,
+      arch,
+      channel: 'override'
+    };
+  }
+
+  const channel = String(config?.channel || 'stable').trim().toLowerCase();
+  const pathSegment = String(config?.paths?.[platform]?.[arch] || '').trim().replace(/^\/+|\/+$/g, '');
+  if (!CHANNEL_PATTERN.test(channel)) {
+    return { url: '', configured: false, error: 'desktop-update-channel-invalid', platform, arch, channel };
+  }
+  if (!SEGMENT_PATTERN.test(pathSegment)) {
+    return { url: '', configured: false, error: 'desktop-update-platform-unsupported', platform, arch, channel };
+  }
+  const base = validateFeedUrl(config?.baseUrl);
+  if (!base.url) {
+    return { ...base, configured: false, platform, arch, channel };
+  }
+  return {
+    url: `${base.url}/${channel}/${pathSegment}`,
+    configured: true,
+    error: '',
+    platform,
+    arch,
+    channel
+  };
+}

package/electron/update-feed.json

@@ -1,4 +1,17 @@
 {
   "provider": "generic",
-  "url": ""
+  "baseUrl": "https://livedesk-desktop-updates.lovecrdm.workers.dev",
+  "channel": "stable",
+  "paths": {
+    "win32": {
+      "x64": "windows/x64"
+    },
+    "darwin": {
+      "x64": "macos/x64",
+      "arm64": "macos/arm64"
+    },
+    "linux": {
+      "x64": "linux/x64"
+    }
+  }
 }