livedesk 0.1.606 → 0.1.608

package/client/bin/livedesk-client.js

@@ -80,11 +80,12 @@ const RETIRED_CLIENT_MODEL_SINGLE_OPTIONS = new Set(['--ai', '--no-ai', '--fake-
 const RETIRED_CLIENT_MODEL_VALUE_OPTION = '--ai-model';
 let activeAgentProcess = null;
 let roleRestartRequest = null;
-let agentRestartRequest = null;
-let linuxVideoAccelerationStatus = null;
-let discoveryWakeController = new AbortController();
-let networkChangeMonitor = null;
-const sessionRefreshesInFlight = new WeakMap();
+let agentRestartRequest = null;
+let linuxVideoAccelerationStatus = null;
+let discoveryWakeController = new AbortController();
+let networkChangeMonitor = null;
+let desktopMainAuthSession = null;
+const sessionRefreshesInFlight = new WeakMap();
 const disposeAgentTerminationHandlers = installAgentTerminationHandlers({
     getAgentProcess: () => activeAgentProcess
 });
@@ -1097,8 +1098,11 @@ export function clearCachedHubTarget() {
     }
 }
 
-function readSavedSessionFromFile() {
-    for (const path of [preferredClientAuthPath(), CLIENT_AUTH_PATH, UNIFIED_CLIENT_AUTH_PATH]) {
+function readSavedSessionFromFile() {
+    if (isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) {
+        return desktopMainAuthSession;
+    }
+    for (const path of [preferredClientAuthPath(), CLIENT_AUTH_PATH, UNIFIED_CLIENT_AUTH_PATH]) {
         try {
             const state = JSON.parse(readFileSync(path, 'utf8'));
             const raw = state?.[CLIENT_AUTH_STORAGE_KEY];
@@ -1113,20 +1117,43 @@ function readSavedSessionFromFile() {
     return null;
 }
 
-function writeSavedSessionToFile(session) {
-    const normalized = normalizeRuntimeAuthSession(session, { requireRefreshToken: true });
-    if (!normalized.ok) {
-        return false;
-    }
-    const storage = createFileStorage(preferredClientAuthPath());
+function writeSavedSessionToFile(session) {
+    const normalized = normalizeRuntimeAuthSession(session, { requireRefreshToken: true });
+    if (!normalized.ok) {
+        return false;
+    }
+    if (isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) {
+        return Boolean(desktopMainAuthSession?.access_token);
+    }
+    const storage = createFileStorage(preferredClientAuthPath());
     storage.setItem(CLIENT_AUTH_STORAGE_KEY, JSON.stringify({ ...session, ...normalized.session }));
     return true;
 }
 
-function clearSavedSession() {
-    rmSync(CLIENT_AUTH_PATH, { force: true });
-    rmSync(UNIFIED_CLIENT_AUTH_PATH, { force: true });
-}
+function clearSavedSession() {
+    desktopMainAuthSession = null;
+    rmSync(CLIENT_AUTH_PATH, { force: true });
+    rmSync(UNIFIED_CLIENT_AUTH_PATH, { force: true });
+}
+
+export function acceptDesktopMainAuthSession(session) {
+    if (!isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) return null;
+    const normalized = normalizeRuntimeAuthSession(session, { requireRefreshToken: true });
+    if (!normalized.ok) return null;
+    desktopMainAuthSession = {
+        ...session,
+        ...normalized.session,
+        user: {
+            ...(session?.user && typeof session.user === 'object' ? session.user : {}),
+            ...normalized.session.user
+        }
+    };
+    return desktopMainAuthSession;
+}
+
+export function clearDesktopMainAuthSession() {
+    desktopMainAuthSession = null;
+}
 
 export async function fetchSupabaseWithDeadline(
     input,
@@ -1167,22 +1194,28 @@ export async function fetchSupabaseWithDeadline(
     }
 }
 
-async function createSupabaseClient() {
-    const { createClient } = await import('@supabase/supabase-js');
-    return createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
-        global: {
-            fetch: fetchSupabaseWithDeadline
-        },
-        auth: {
-            autoRefreshToken: false,
-            persistSession: true,
-            detectSessionInUrl: false,
-            flowType: 'pkce',
-            storageKey: CLIENT_AUTH_STORAGE_KEY,
-            storage: createFileStorage(preferredClientAuthPath())
-        }
-    });
-}
+export async function createSupabaseClient() {
+    const { createClient } = await import('@supabase/supabase-js');
+    const desktopMainOwnsAuth = isTruthy(process.env.LIVEDESK_DESKTOP_HOST);
+    return createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
+        global: {
+            fetch: fetchSupabaseWithDeadline
+        },
+        ...(desktopMainOwnsAuth ? {
+            // Electron Main rotates and encrypts the refresh token. The local
+            // runtime receives only the current in-memory session and asks this
+            // client to attach its access token to database requests.
+            accessToken: async () => desktopMainAuthSession?.access_token || null
+        } : { auth: {
+            autoRefreshToken: false,
+            persistSession: true,
+            detectSessionInUrl: false,
+            flowType: 'pkce',
+            storageKey: CLIENT_AUTH_STORAGE_KEY,
+            storage: createFileStorage(preferredClientAuthPath())
+        } })
+    });
+}
 
 function getNestedErrorCode(error) {
     let cursor = error;
@@ -1313,8 +1346,12 @@ async function recoverRotatedSession(supabase, previousSession) {
     return null;
 }
 
-async function refreshSessionIfNeededCore(supabase) {
-    let existingSession = null;
+async function refreshSessionIfNeededCore(supabase) {
+    if (isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) {
+        const normalized = normalizeRuntimeAuthSession(desktopMainAuthSession, { requireRefreshToken: true });
+        return normalized.ok ? desktopMainAuthSession : null;
+    }
+    let existingSession = null;
     try {
         const { data: existing } = await supabase.auth.getSession();
         existingSession = existing?.session || null;
@@ -1382,12 +1419,17 @@ function openBrowser(url) {
     spawn(command, [launchUrl.toString()], { detached: true, stdio: 'ignore' }).unref();
 }
 
-async function activateSupabaseSession(supabase, session) {
-    const normalized = normalizeRuntimeAuthSession(session, { requireRefreshToken: true });
-    if (!normalized.ok) {
-        throw new Error(normalized.error);
-    }
-    const { data: current } = await supabase.auth.getSession();
+async function activateSupabaseSession(supabase, session) {
+    const normalized = normalizeRuntimeAuthSession(session, { requireRefreshToken: true });
+    if (!normalized.ok) {
+        throw new Error(normalized.error);
+    }
+    if (isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) {
+        const activeSession = acceptDesktopMainAuthSession(session);
+        if (!activeSession) throw new Error('desktop-main-session-required');
+        return activeSession;
+    }
+    const { data: current } = await supabase.auth.getSession();
     if (current?.session?.access_token === normalized.session.access_token) {
         const activeSession = current.session;
         if (!writeSavedSessionToFile(activeSession)) {
@@ -3173,7 +3215,7 @@ async function startConnectionChoiceServer(supabase, options = {}) {
 
             if (requestUrl.pathname === '/logout') {
                 try {
-                    await supabase.auth.signOut();
+                    await supabase.auth.signOut({ scope: 'local' });
                 } catch {
                 }
                 clearSavedSession();
@@ -3410,10 +3452,13 @@ async function chooseClientConnection(supabase, options = {}) {
             roleVersion: process.env.LIVEDESK_ROLE_VERSION,
             savedSession: options.savedSession,
             loadSavedSession: options.loadSavedSession,
-            initialChoice: options.initialChoice,
-            initialChoiceMessage: options.initialChoiceMessage,
-            beginGoogleSignIn: async redirectTo => {
-                const activeSupabase = await getSupabase();
+            initialChoice: options.initialChoice,
+            initialChoiceMessage: options.initialChoiceMessage,
+            onAuthSessionAccepted: acceptDesktopMainAuthSession,
+            onAuthSessionCleared: clearDesktopMainAuthSession,
+            beginGoogleSignIn: async redirectTo => {
+                if (isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) throw new Error('desktop-main-auth-required');
+                const activeSupabase = await getSupabase();
                 if (!activeSupabase?.auth) throw new Error('supabase-session-required');
                 const { data, error } = await activeSupabase.auth.signInWithOAuth({
                     provider: 'google',
@@ -3426,9 +3471,10 @@ async function chooseClientConnection(supabase, options = {}) {
                 if (error) throw error;
                 if (!data?.url) throw new Error('google-authorization-url-missing');
                 return { url: data.url };
-            },
-            exchangeGoogleCode: async code => {
-                const activeSupabase = await getSupabase();
+            },
+            exchangeGoogleCode: async code => {
+                if (isTruthy(process.env.LIVEDESK_DESKTOP_HOST)) throw new Error('desktop-main-auth-required');
+                const activeSupabase = await getSupabase();
                 if (!activeSupabase?.auth) throw new Error('supabase-session-required');
                 const { data, error } = await activeSupabase.auth.exchangeCodeForSession(code);
                 if (error) throw error;

package/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/client",
-  "version": "0.1.261",
+  "version": "0.1.262",
   "description": "VuvoDesk local remote client",
   "type": "module",
   "bin": {

package/client/src/runtime/client-runtime-server.js

@@ -979,9 +979,13 @@ function writeSavedSession(session) {
   return true;
 }
 
-function clearSavedSession() {
-  writePrivateJsonAtomic(CLIENT_AUTH_PATH, {});
-}
+function clearSavedSession() {
+  if (process.env.LIVEDESK_DESKTOP_HOST === '1') {
+    rmSync(CLIENT_AUTH_PATH, { force: true });
+    return;
+  }
+  writePrivateJsonAtomic(CLIENT_AUTH_PATH, {});
+}
 
 function readBody(req) {
   return new Promise((resolveBody, reject) => {
@@ -1316,8 +1320,11 @@ export function createClientRuntimeServer(options = {}) {
     runtime.emit('client.auth.session', { result: state.auth.lastResult, error: message });
   };
 
-  const complete = (choice, message = 'Client credentials accepted. Finding the Hub.') => {
-    lastChoice = choice || lastChoice;
+  const complete = (choice, message = 'Client credentials accepted. Finding the Hub.') => {
+    if (choice?.session?.access_token) {
+      options.onAuthSessionAccepted?.(choice.session);
+    }
+    lastChoice = choice || lastChoice;
     if (completed) {
       if (choice?.session?.access_token) {
         const accountProfile = readClientAccountProfile(choice.session);
@@ -1634,9 +1641,10 @@ export function createClientRuntimeServer(options = {}) {
       respondJson(200, { ok: true, authenticated: true, persisted: true, role: 'client' });
       return;
     }
-    if (pathname === '/api/auth/session' && req.method === 'DELETE') {
-      clearSavedSession();
-      loggedOut = true;
+    if (pathname === '/api/auth/session' && req.method === 'DELETE') {
+      clearSavedSession();
+      options.onAuthSessionCleared?.();
+      loggedOut = true;
       completed = false;
       lastChoice = null;
       state.manager = '';

package/electron/installer-quit-gate.mjs

@@ -0,0 +1,183 @@
+export const DEFAULT_INSTALLER_QUIT_CONFIRMATION_MS = 1_000;
+
+export const InstallerQuitDecision = Object.freeze({
+  NORMAL: 'normal-quit',
+  HOLD: 'hold-update-quit',
+  BLOCK: 'block-stale-update-quit',
+  ALLOW: 'allow-update-quit'
+});
+
+function normalizeDelay(value) {
+  const milliseconds = Number(value);
+  return Number.isFinite(milliseconds) && milliseconds >= 0
+    ? Math.round(milliseconds)
+    : DEFAULT_INSTALLER_QUIT_CONFIRMATION_MS;
+}
+
+/**
+ * electron-updater reports that it intends to quit before the Windows NSIS
+ * spawn promise has necessarily rejected. This gate holds the first quit for
+ * a short error window without importing Electron, so its race is executable
+ * in a plain Node regression test.
+ */
+export function createInstallerQuitGate({
+  requestQuit,
+  confirmationDelayMs = DEFAULT_INSTALLER_QUIT_CONFIRMATION_MS,
+  setTimer = setTimeout,
+  clearTimer = clearTimeout
+} = {}) {
+  if (typeof requestQuit !== 'function') {
+    throw new TypeError('installer-quit-gate-request-quit-required');
+  }
+
+  const confirmationDelay = normalizeDelay(confirmationDelayMs);
+  let generation = 0;
+  let attempt = null;
+
+  const clearConfirmationTimer = ownedAttempt => {
+    if (!ownedAttempt || ownedAttempt.confirmationTimer === null) return;
+    clearTimer(ownedAttempt.confirmationTimer);
+    ownedAttempt.confirmationTimer = null;
+  };
+
+  const snapshot = () => {
+    if (!attempt) {
+      return {
+        generation,
+        state: 'idle',
+        intentObserved: false,
+        failed: false,
+        firstQuitHeld: false,
+        quitReissueRequested: false,
+        staleQuitBlocked: false,
+        error: ''
+      };
+    }
+    return {
+      generation: attempt.generation,
+      state: attempt.state,
+      intentObserved: attempt.intentObserved,
+      failed: attempt.failed,
+      firstQuitHeld: attempt.firstQuitHeld,
+      quitReissueRequested: attempt.quitReissueRequested,
+      staleQuitBlocked: attempt.staleQuitBlocked,
+      error: attempt.error
+    };
+  };
+
+  const beginInstall = () => {
+    clearConfirmationTimer(attempt);
+    attempt = {
+      generation: ++generation,
+      state: 'preparing',
+      intentObserved: false,
+      failed: false,
+      firstQuitHeld: false,
+      quitReissueRequested: false,
+      staleQuitBlocked: false,
+      error: '',
+      confirmationTimer: null
+    };
+    return attempt.generation;
+  };
+
+  const noteBeforeQuitForUpdate = () => {
+    if (!attempt) return false;
+    attempt.intentObserved = true;
+    if (attempt.failed) {
+      attempt.state = 'failed-update-quit-intent';
+    } else if (!attempt.firstQuitHeld) {
+      attempt.state = 'update-quit-intent';
+    }
+    return true;
+  };
+
+  const failInstall = error => {
+    if (!attempt) return false;
+    attempt.failed = true;
+    attempt.error = String(error?.message || error || 'desktop-update-installer-launch-failed');
+    clearConfirmationTimer(attempt);
+
+    if (attempt.firstQuitHeld && !attempt.quitReissueRequested) {
+      // The updater-owned quit was already intercepted. There is no later quit
+      // to consume, so a user's subsequent normal quit must remain available.
+      attempt.intentObserved = false;
+      attempt.state = 'failed-after-held-quit';
+    } else if (attempt.intentObserved) {
+      // The updater has announced a quit, or our delayed reissue is in flight.
+      // Consume that one stale quit before returning to normal quit handling.
+      attempt.state = 'failed-update-quit-pending';
+    } else {
+      // electron-updater can dispatch its spawn error before its queued
+      // before-quit-for-update event. Retain the failed attempt for that event.
+      attempt.state = 'failed-awaiting-update-quit-intent';
+    }
+    return true;
+  };
+
+  const scheduleConfirmedQuit = ownedAttempt => {
+    if (ownedAttempt.confirmationTimer !== null) return;
+    const fire = () => {
+      ownedAttempt.confirmationTimer = null;
+      if (
+        attempt !== ownedAttempt
+        || ownedAttempt.failed
+        || !ownedAttempt.intentObserved
+        || ownedAttempt.quitReissueRequested
+      ) {
+        return;
+      }
+      ownedAttempt.quitReissueRequested = true;
+      ownedAttempt.state = 'reissuing-update-quit';
+      try {
+        requestQuit();
+      } catch (error) {
+        ownedAttempt.failed = true;
+        ownedAttempt.intentObserved = false;
+        ownedAttempt.error = String(error?.message || error);
+        ownedAttempt.state = 'quit-reissue-failed';
+      }
+    };
+    ownedAttempt.confirmationTimer = setTimer(fire, confirmationDelay);
+    ownedAttempt.confirmationTimer?.unref?.();
+  };
+
+  const handleBeforeQuit = () => {
+    const ownedAttempt = attempt;
+    if (!ownedAttempt?.intentObserved) return InstallerQuitDecision.NORMAL;
+
+    if (ownedAttempt.failed) {
+      ownedAttempt.intentObserved = false;
+      ownedAttempt.staleQuitBlocked = true;
+      ownedAttempt.state = 'failed-update-quit-blocked';
+      return InstallerQuitDecision.BLOCK;
+    }
+
+    if (ownedAttempt.quitReissueRequested) {
+      ownedAttempt.intentObserved = false;
+      ownedAttempt.state = 'update-quit-allowed';
+      return InstallerQuitDecision.ALLOW;
+    }
+
+    if (!ownedAttempt.firstQuitHeld) {
+      ownedAttempt.firstQuitHeld = true;
+      ownedAttempt.state = 'holding-update-quit';
+      scheduleConfirmedQuit(ownedAttempt);
+    }
+    return InstallerQuitDecision.HOLD;
+  };
+
+  const dispose = () => {
+    clearConfirmationTimer(attempt);
+    attempt = null;
+  };
+
+  return {
+    beginInstall,
+    noteBeforeQuitForUpdate,
+    failInstall,
+    handleBeforeQuit,
+    getState: snapshot,
+    dispose
+  };
+}