livedesk 0.1.606 → 0.1.607

package/client/bin/livedesk-client.js

@@ -80,11 +80,12 @@ const RETIRED_CLIENT_MODEL_SINGLE_OPTIONS = new Set(['--ai', '--no-ai', '--fake-
 const RETIRED_CLIENT_MODEL_VALUE_OPTION = '--ai-model';
 let activeAgentProcess = null;
 let roleRestartRequest = null;
-let agentRestartRequest = null;
-let linuxVideoAccelerationStatus = null;
-let discoveryWakeController = new AbortController();
-let networkChangeMonitor = null;
-const sessionRefreshesInFlight = new WeakMap();
+let agentRestartRequest = null;
+let linuxVideoAccelerationStatus = null;
+let discoveryWakeController = new AbortController();
+let networkChangeMonitor = null;
+let desktopMainAuthSession = null;
+const sessionRefreshesInFlight = new WeakMap();
 const disposeAgentTerminationHandlers = installAgentTerminationHandlers({
     getAgentProcess: () => activeAgentProcess
 });
@@ -1097,8 +1098,11 @@ export function clearCachedHubTarget() {
     }
 }
 
-function readSavedSessionFromFile() {
-    for (const path of [preferredClientAuthPath(), CLIENT_AUTH_PATH, UNIFIED_CLIENT_AUTH_PATH]) {
+function readSavedSessionFromFile() {
+    if (isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) {
+        return desktopMainAuthSession;
+    }
+    for (const path of [preferredClientAuthPath(), CLIENT_AUTH_PATH, UNIFIED_CLIENT_AUTH_PATH]) {
         try {
             const state = JSON.parse(readFileSync(path, 'utf8'));
             const raw = state?.[CLIENT_AUTH_STORAGE_KEY];
@@ -1113,20 +1117,43 @@ function readSavedSessionFromFile() {
     return null;
 }
 
-function writeSavedSessionToFile(session) {
-    const normalized = normalizeRuntimeAuthSession(session, { requireRefreshToken: true });
-    if (!normalized.ok) {
-        return false;
-    }
-    const storage = createFileStorage(preferredClientAuthPath());
+function writeSavedSessionToFile(session) {
+    const normalized = normalizeRuntimeAuthSession(session, { requireRefreshToken: true });
+    if (!normalized.ok) {
+        return false;
+    }
+    if (isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) {
+        return Boolean(desktopMainAuthSession?.access_token);
+    }
+    const storage = createFileStorage(preferredClientAuthPath());
     storage.setItem(CLIENT_AUTH_STORAGE_KEY, JSON.stringify({ ...session, ...normalized.session }));
     return true;
 }
 
-function clearSavedSession() {
-    rmSync(CLIENT_AUTH_PATH, { force: true });
-    rmSync(UNIFIED_CLIENT_AUTH_PATH, { force: true });
-}
+function clearSavedSession() {
+    desktopMainAuthSession = null;
+    rmSync(CLIENT_AUTH_PATH, { force: true });
+    rmSync(UNIFIED_CLIENT_AUTH_PATH, { force: true });
+}
+
+export function acceptDesktopMainAuthSession(session) {
+    if (!isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) return null;
+    const normalized = normalizeRuntimeAuthSession(session, { requireRefreshToken: true });
+    if (!normalized.ok) return null;
+    desktopMainAuthSession = {
+        ...session,
+        ...normalized.session,
+        user: {
+            ...(session?.user && typeof session.user === 'object' ? session.user : {}),
+            ...normalized.session.user
+        }
+    };
+    return desktopMainAuthSession;
+}
+
+export function clearDesktopMainAuthSession() {
+    desktopMainAuthSession = null;
+}
 
 export async function fetchSupabaseWithDeadline(
     input,
@@ -1167,22 +1194,28 @@ export async function fetchSupabaseWithDeadline(
     }
 }
 
-async function createSupabaseClient() {
-    const { createClient } = await import('@supabase/supabase-js');
-    return createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
-        global: {
-            fetch: fetchSupabaseWithDeadline
-        },
-        auth: {
-            autoRefreshToken: false,
-            persistSession: true,
-            detectSessionInUrl: false,
-            flowType: 'pkce',
-            storageKey: CLIENT_AUTH_STORAGE_KEY,
-            storage: createFileStorage(preferredClientAuthPath())
-        }
-    });
-}
+export async function createSupabaseClient() {
+    const { createClient } = await import('@supabase/supabase-js');
+    const desktopMainOwnsAuth = isTruthy(process.env.LIVEDESK_DESKTOP_HOST);
+    return createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
+        global: {
+            fetch: fetchSupabaseWithDeadline
+        },
+        ...(desktopMainOwnsAuth ? {
+            // Electron Main rotates and encrypts the refresh token. The local
+            // runtime receives only the current in-memory session and asks this
+            // client to attach its access token to database requests.
+            accessToken: async () => desktopMainAuthSession?.access_token || null
+        } : { auth: {
+            autoRefreshToken: false,
+            persistSession: true,
+            detectSessionInUrl: false,
+            flowType: 'pkce',
+            storageKey: CLIENT_AUTH_STORAGE_KEY,
+            storage: createFileStorage(preferredClientAuthPath())
+        } })
+    });
+}
 
 function getNestedErrorCode(error) {
     let cursor = error;
@@ -1313,8 +1346,12 @@ async function recoverRotatedSession(supabase, previousSession) {
     return null;
 }
 
-async function refreshSessionIfNeededCore(supabase) {
-    let existingSession = null;
+async function refreshSessionIfNeededCore(supabase) {
+    if (isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) {
+        const normalized = normalizeRuntimeAuthSession(desktopMainAuthSession, { requireRefreshToken: true });
+        return normalized.ok ? desktopMainAuthSession : null;
+    }
+    let existingSession = null;
     try {
         const { data: existing } = await supabase.auth.getSession();
         existingSession = existing?.session || null;
@@ -1382,12 +1419,17 @@ function openBrowser(url) {
     spawn(command, [launchUrl.toString()], { detached: true, stdio: 'ignore' }).unref();
 }
 
-async function activateSupabaseSession(supabase, session) {
-    const normalized = normalizeRuntimeAuthSession(session, { requireRefreshToken: true });
-    if (!normalized.ok) {
-        throw new Error(normalized.error);
-    }
-    const { data: current } = await supabase.auth.getSession();
+async function activateSupabaseSession(supabase, session) {
+    const normalized = normalizeRuntimeAuthSession(session, { requireRefreshToken: true });
+    if (!normalized.ok) {
+        throw new Error(normalized.error);
+    }
+    if (isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) {
+        const activeSession = acceptDesktopMainAuthSession(session);
+        if (!activeSession) throw new Error('desktop-main-session-required');
+        return activeSession;
+    }
+    const { data: current } = await supabase.auth.getSession();
     if (current?.session?.access_token === normalized.session.access_token) {
         const activeSession = current.session;
         if (!writeSavedSessionToFile(activeSession)) {
@@ -3173,7 +3215,7 @@ async function startConnectionChoiceServer(supabase, options = {}) {
 
             if (requestUrl.pathname === '/logout') {
                 try {
-                    await supabase.auth.signOut();
+                    await supabase.auth.signOut({ scope: 'local' });
                 } catch {
                 }
                 clearSavedSession();
@@ -3410,10 +3452,13 @@ async function chooseClientConnection(supabase, options = {}) {
             roleVersion: process.env.LIVEDESK_ROLE_VERSION,
             savedSession: options.savedSession,
             loadSavedSession: options.loadSavedSession,
-            initialChoice: options.initialChoice,
-            initialChoiceMessage: options.initialChoiceMessage,
-            beginGoogleSignIn: async redirectTo => {
-                const activeSupabase = await getSupabase();
+            initialChoice: options.initialChoice,
+            initialChoiceMessage: options.initialChoiceMessage,
+            onAuthSessionAccepted: acceptDesktopMainAuthSession,
+            onAuthSessionCleared: clearDesktopMainAuthSession,
+            beginGoogleSignIn: async redirectTo => {
+                if (isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) throw new Error('desktop-main-auth-required');
+                const activeSupabase = await getSupabase();
                 if (!activeSupabase?.auth) throw new Error('supabase-session-required');
                 const { data, error } = await activeSupabase.auth.signInWithOAuth({
                     provider: 'google',
@@ -3426,9 +3471,10 @@ async function chooseClientConnection(supabase, options = {}) {
                 if (error) throw error;
                 if (!data?.url) throw new Error('google-authorization-url-missing');
                 return { url: data.url };
-            },
-            exchangeGoogleCode: async code => {
-                const activeSupabase = await getSupabase();
+            },
+            exchangeGoogleCode: async code => {
+                if (isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) throw new Error('desktop-main-auth-required');
+                const activeSupabase = await getSupabase();
                 if (!activeSupabase?.auth) throw new Error('supabase-session-required');
                 const { data, error } = await activeSupabase.auth.exchangeCodeForSession(code);
                 if (error) throw error;

package/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/client",
-  "version": "0.1.261",
+  "version": "0.1.262",
   "description": "VuvoDesk local remote client",
   "type": "module",
   "bin": {

package/client/src/runtime/client-runtime-server.js

@@ -979,9 +979,13 @@ function writeSavedSession(session) {
   return true;
 }
 
-function clearSavedSession() {
-  writePrivateJsonAtomic(CLIENT_AUTH_PATH, {});
-}
+function clearSavedSession() {
+  if (process.env.LIVEDESK_DESKTOP_HOST === '1') {
+    rmSync(CLIENT_AUTH_PATH, { force: true });
+    return;
+  }
+  writePrivateJsonAtomic(CLIENT_AUTH_PATH, {});
+}
 
 function readBody(req) {
   return new Promise((resolveBody, reject) => {
@@ -1316,8 +1320,11 @@ export function createClientRuntimeServer(options = {}) {
     runtime.emit('client.auth.session', { result: state.auth.lastResult, error: message });
   };
 
-  const complete = (choice, message = 'Client credentials accepted. Finding the Hub.') => {
-    lastChoice = choice || lastChoice;
+  const complete = (choice, message = 'Client credentials accepted. Finding the Hub.') => {
+    if (choice?.session?.access_token) {
+      options.onAuthSessionAccepted?.(choice.session);
+    }
+    lastChoice = choice || lastChoice;
     if (completed) {
       if (choice?.session?.access_token) {
         const accountProfile = readClientAccountProfile(choice.session);
@@ -1634,9 +1641,10 @@ export function createClientRuntimeServer(options = {}) {
       respondJson(200, { ok: true, authenticated: true, persisted: true, role: 'client' });
       return;
     }
-    if (pathname === '/api/auth/session' && req.method === 'DELETE') {
-      clearSavedSession();
-      loggedOut = true;
+    if (pathname === '/api/auth/session' && req.method === 'DELETE') {
+      clearSavedSession();
+      options.onAuthSessionCleared?.();
+      loggedOut = true;
       completed = false;
       lastChoice = null;
       state.manager = '';

package/electron/main.mjs

@@ -6,7 +6,7 @@ import { spawn } from 'node:child_process';
 import { createRequire } from 'node:module';
 import { createProductUpdateManager } from './update-manager.mjs';
 import { createRecurringProductUpdateOwner } from './recurring-update-owner.mjs';
-import { createPkceAuthorizationUrl, exchangePkceCode, fetchSupabaseUser, parsePkceCallbackUrl, refreshSupabaseSession } from './oauth-pkce.mjs';
+import { AUTH_REQUEST_TIMEOUT_MS, createPkceAuthorizationUrl, exchangePkceCode, fetchSupabaseUser, parsePkceCallbackUrl, refreshSupabaseSession } from './oauth-pkce.mjs';
 import { getRuntimeAuthEnvironment, resolveDesktopAuthConfig, resolveDesktopBuildFlavor } from './auth-config.mjs';
 import { createBoundedDesktopLogger } from './bounded-desktop-log.mjs';
 import {
@@ -671,46 +671,59 @@ async function prepareRuntimeForUpdateInstall() {
     throw new Error('desktop-update-install-already-started');
   }
   updateInstallSequenceStarted = true;
-  isQuitting = true;
-  recurringProductUpdates?.stop();
-  try {
-    await stopRuntime();
-  } catch (error) {
-    updateInstallSequenceStarted = false;
-    isQuitting = false;
-    throw error;
-  }
+  isQuitting = true;
+  recurringProductUpdates?.stop();
+  try {
+    await quiesceDesktopAuthOwner('desktop-update-install');
+    await stopRuntime();
+  } catch (error) {
+    updateInstallSequenceStarted = false;
+    isQuitting = false;
+    scheduleDesktopAuthRefresh(readEncryptedSession());
+    throw error;
+  }
 }
 
 async function recoverRuntimeAfterUpdateInstallError(error) {
   log(`desktop update install launch failed after runtime drain: ${error?.message || error}`);
-  updateInstallSequenceStarted = false;
-  isQuitting = false;
-  if (!runtimeChild) {
+  updateInstallSequenceStarted = false;
+  isQuitting = false;
+  scheduleDesktopAuthRefresh(readEncryptedSession());
+  if (!runtimeChild) {
     startRuntime();
     const ready = await waitForRuntime();
     if (ready) mainWindow?.loadURL(LOCAL_RUNTIME_URL);
   }
 }
 
-async function syncSessionToRuntime(session) {
-  const normalized = normalizeSession(session);
-  if (!normalized) throw new Error('oauth-session-invalid');
-  const csrfToken = await getRuntimeCsrfToken();
-  const response = await fetch(`${LOCAL_RUNTIME_URL}api/auth/session`, {
-    method: 'POST',
-    headers: {
-      'Content-Type': 'application/json',
-      ...(csrfToken ? { 'X-LiveDesk-CSRF': csrfToken } : {})
-    },
-    body: JSON.stringify({
-      accessToken: normalized.access_token,
-      refreshToken: normalized.refresh_token,
-      expiresAt: normalized.expires_at,
-      userId: normalized.user?.id,
-      user: { id: normalized.user?.id, email: normalized.user?.email }
-    })
-  });
+async function syncSessionToRuntime(session) {
+  const normalized = normalizeSession(session);
+  if (!normalized) throw new Error('oauth-session-invalid');
+  const deadline = Date.now() + AUTH_REQUEST_TIMEOUT_MS + 2_500;
+  const csrfToken = await getRuntimeCsrfToken(Math.min(deadline, Date.now() + 2_500));
+  const response = await fetchBeforeRuntimeDeadline(
+    fetch,
+    `${LOCAL_RUNTIME_URL}api/auth/session`,
+    {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        ...(csrfToken ? { 'X-LiveDesk-CSRF': csrfToken } : {})
+      },
+      body: JSON.stringify({
+        accessToken: normalized.access_token,
+        refreshToken: normalized.refresh_token,
+        expiresAt: normalized.expires_at,
+        userId: normalized.user?.id,
+        user: { id: normalized.user?.id, email: normalized.user?.email }
+      })
+    },
+    {
+      deadline,
+      maxDurationMs: Math.min(AUTH_REQUEST_TIMEOUT_MS, remainingRuntimeDeadlineMs(deadline)),
+      label: 'runtime-auth-sync-deadline'
+    }
+  );
   if (!response.ok) {
     const payload = await response.json().catch(() => ({}));
     throw new Error(String(payload?.error || `runtime-session-sync-failed:${response.status}`));
@@ -854,18 +867,29 @@ async function restoreEncryptedSessionOwned({ syncRuntime = true } = {}) {
   return session;
 }
 
-async function restoreEncryptedSession(options = {}) {
-  if (desktopSessionRestorePromise) return desktopSessionRestorePromise;
-  const operation = restoreEncryptedSessionOwned(options);
+async function restoreEncryptedSession(options = {}) {
+  if (desktopSessionRestorePromise) return desktopSessionRestorePromise;
+  if (isQuitting) return readEncryptedSession();
+  const operation = restoreEncryptedSessionOwned(options);
   desktopSessionRestorePromise = operation;
   try {
     return await operation;
   } finally {
     if (desktopSessionRestorePromise === operation) desktopSessionRestorePromise = null;
-  }
-}
-
-async function signOutDesktopSession() {
+  }
+}
+
+async function quiesceDesktopAuthOwner(reason = 'application-exit') {
+  clearDesktopAuthRefreshTimer();
+  while (desktopSessionRestorePromise) {
+    const pending = desktopSessionRestorePromise;
+    log(`waiting for secure auth owner before ${reason}`);
+    await pending;
+    if (desktopSessionRestorePromise === pending) break;
+  }
+}
+
+async function signOutDesktopSession() {
   desktopSessionEpoch += 1;
   desktopAuthInvalidationGuard.observeSuccess();
   clearEncryptedSession();
@@ -1071,19 +1095,21 @@ function registerIpc() {
     if (quitSequenceStarted || updateInstallSequenceStarted) {
       return { ok: false, error: 'application-exit-already-started' };
     }
-    quitSequenceStarted = true;
-    isQuitting = true;
-    try {
-      await stopRuntime();
+    quitSequenceStarted = true;
+    isQuitting = true;
+    try {
+      await quiesceDesktopAuthOwner('application-restart');
+      await stopRuntime();
       await desktopClipboardOwner?.close();
       await closeDesktopLog();
       app.relaunch();
       app.exit(0);
       return { ok: true };
-    } catch (error) {
-      isQuitting = false;
-      quitSequenceStarted = false;
-      updateTray('Runtime cleanup blocked');
+    } catch (error) {
+      isQuitting = false;
+      quitSequenceStarted = false;
+      scheduleDesktopAuthRefresh(readEncryptedSession());
+      updateTray('Runtime cleanup blocked');
       log(`runtime cleanup blocked application restart: ${error?.message || error}`);
       if (!runtimeChild) {
         startRuntime();
@@ -1277,19 +1303,22 @@ if (!app.requestSingleInstanceLock()) {
     if (quitSequenceStarted) return;
     event.preventDefault();
     recurringProductUpdates?.stop();
-    quitSequenceStarted = true;
-    isQuitting = true;
-    void stopRuntime().then(() => {
-      return desktopClipboardOwner?.close();
+    quitSequenceStarted = true;
+    isQuitting = true;
+    void quiesceDesktopAuthOwner('application-quit').then(() => {
+      return stopRuntime();
+    }).then(() => {
+      return desktopClipboardOwner?.close();
     }).then(() => {
       return closeDesktopLog();
     }).then(() => {
       app.quit();
     }).catch(error => {
-      isQuitting = false;
-      quitSequenceStarted = false;
-      updateInstallSequenceStarted = false;
-      updateTray('Runtime cleanup blocked');
+      isQuitting = false;
+      quitSequenceStarted = false;
+      updateInstallSequenceStarted = false;
+      scheduleDesktopAuthRefresh(readEncryptedSession());
+      updateTray('Runtime cleanup blocked');
       log(`runtime cleanup blocked application quit: ${error?.message || error}`);
     });
   });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "livedesk",
-  "version": "0.1.606",
-  "livedeskClientVersion": "0.1.261",
+  "version": "0.1.607",
+  "livedeskClientVersion": "0.1.262",
   "buildFlavor": "production",
   "description": "VuvoDesk Hub and client launcher",
   "type": "module",

package/web/dist/app.webmanifest

@@ -4,7 +4,7 @@
   "short_name": "VuvoDesk",
   "description": "Monitor and control your VuvoDesk computers from your phone.",
   "lang": "en",
-  "start_url": "/app?pwa=0.1.606",
+  "start_url": "/app?pwa=0.1.607",
   "scope": "/",
   "display": "standalone",
   "orientation": "any",