livedesk 0.1.613 → 0.1.614

package/bin/livedesk.js

@@ -5,8 +5,9 @@ import net from 'node:net';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { execFile, spawn } from 'node:child_process';
-import {
-  createWriteStream,
+import {
+  chmodSync,
+  createWriteStream,
   existsSync,
   mkdirSync,
   readFileSync,
@@ -597,12 +598,18 @@ function normalizePort(value, fallback) {
   return number;
 }
 
-function readStablePairToken() {
-  try {
-    const state = JSON.parse(readFileSync(MANAGER_STATE_PATH, 'utf8'));
-    const pairToken = String(state?.pairToken || '').trim();
-    if (pairToken.length >= 20) {
-      return pairToken;
+function readStablePairToken() {
+  try {
+    const state = JSON.parse(readFileSync(MANAGER_STATE_PATH, 'utf8'));
+    const pairToken = String(state?.pairToken || '').trim();
+    if (pairToken.length >= 20) {
+      try {
+        chmodSync(MANAGER_STATE_DIR, 0o700);
+        chmodSync(MANAGER_STATE_PATH, 0o600);
+      } catch {
+        // Windows and restricted filesystems may not expose POSIX modes.
+      }
+      return pairToken;
     }
   } catch {
     // A missing or unreadable state file is repaired below.
@@ -615,13 +622,19 @@ function getStablePairToken() {
   if (existing) {
     return existing;
   }
-  const pairToken = randomBytes(18).toString('hex');
-  try {
-    mkdirSync(MANAGER_STATE_DIR, { recursive: true });
-    writeFileSync(MANAGER_STATE_PATH, JSON.stringify({
-      pairToken,
-      createdAt: new Date().toISOString()
-    }, null, 2));
+  const pairToken = randomBytes(32).toString('hex');
+  try {
+    mkdirSync(MANAGER_STATE_DIR, { recursive: true, mode: 0o700 });
+    writeFileSync(MANAGER_STATE_PATH, JSON.stringify({
+      pairToken,
+      createdAt: new Date().toISOString()
+    }, null, 2), { encoding: 'utf8', mode: 0o600 });
+    try {
+      chmodSync(MANAGER_STATE_DIR, 0o700);
+      chmodSync(MANAGER_STATE_PATH, 0o600);
+    } catch {
+      // Windows and restricted filesystems may not expose POSIX modes.
+    }
   } catch {
     // If disk persistence is blocked, keep this manager process usable.
   }

package/client/bin/livedesk-client-node.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
-import net from 'net';
-import os from 'os';
+import os from 'os';
 import path from 'path';
 import crypto from 'crypto';
 import { existsSync, promises as fs, statfsSync } from 'fs';
 import { spawn } from 'child_process';
 import { createRequire } from 'node:module';
-import { fileURLToPath } from 'node:url';
-import { resolveAgentShellCommand } from '../src/runtime/agent-shell.js';
+import { fileURLToPath } from 'node:url';
+import { resolveAgentShellCommand } from '../src/runtime/agent-shell.js';
+import { connectSecureDirectSocket } from '../../runtime-core/src/direct-secure-transport.js';
 
 const require = createRequire(import.meta.url);
 const CLIENT_UPDATE_BOOTSTRAP_PATH = fileURLToPath(
@@ -488,21 +488,7 @@ function parseManagerAddress(value) {
     };
 }
 
-function isPrivateLanHost(host) {
-    const value = String(host || '').trim().toLowerCase().replace(/^\[|\]$/g, '');
-    if (!value || value === 'localhost' || value === '::1') return true;
-    if (net.isIPv4(value)) {
-        const octets = value.split('.').map(Number);
-        return octets[0] === 10
-            || (octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31)
-            || (octets[0] === 192 && octets[1] === 168)
-            || octets[0] === 127;
-    }
-    if (net.isIPv6(value)) return value.startsWith('fc') || value.startsWith('fd') || value.startsWith('fe80:');
-    return false;
-}
-
-function normalizeDeviceId(value) {
+function normalizeDeviceId(value) {
     return String(value || '').trim().replace(/[^a-zA-Z0-9_.:-]/g, '-').slice(0, 128);
 }
 
@@ -2005,18 +1991,24 @@ async function handleRemoteCommand(socket, options, message, nextFrameSeq, activ
     });
 }
 
-function connectOnce(options, deviceId) {
-    const manager = parseManagerAddress(options.manager);
-    if (!isPrivateLanHost(manager.host) && !isTruthy(process.env.LIVEDESK_ALLOW_UNENCRYPTED_LAN)) {
-        return Promise.reject(new Error('Plain TCP VuvoDesk connections are limited to loopback/private LAN. Use an encrypted endpoint for external connections.'));
-    }
-    return new Promise((resolve, reject) => {
-        const socket = net.createConnection({
-            host: manager.host,
-            port: manager.port
-        });
-
-        let buffer = '';
+async function connectOnce(options, deviceId) {
+    const manager = parseManagerAddress(options.manager);
+    let socket;
+    try {
+        socket = await connectSecureDirectSocket(
+            manager,
+            options.pair,
+            'control');
+    } catch (error) {
+        if ((error?.code === 'LIVEDESK_INVALID_PAIR_TOKEN'
+            || error?.message === 'invalid-pair-token')
+            && options.exitOnInvalidPair) {
+            error.exitCode = EXIT_INVALID_PAIR_TOKEN;
+        }
+        throw error;
+    }
+    return new Promise((resolve, reject) => {
+        let buffer = '';
         let heartbeatTimer = null;
         let resolved = false;
         let frameSeq = 0;
@@ -2050,47 +2042,7 @@ function connectOnce(options, deviceId) {
         socket.setNoDelay(true);
         socket.setKeepAlive(true, options.heartbeatMs);
 
-        socket.once('connect', () => {
-            writeJsonLine(socket, {
-                type: 'hello',
-                pairToken: options.pair,
-                deviceId,
-                deviceName: options.name,
-                slotNumber: options.slotNumber || undefined,
-                hostname: os.hostname(),
-                platform: os.platform(),
-                arch: os.arch(),
-                pid: process.pid,
-                agentVersion: AGENT_VERSION,
-                productVersion: PRODUCT_VERSION,
-                capabilities: {
-                    status: true,
-                    thumbnail: options.thumbnailEnabled,
-                    liveStream: options.liveEnabled,
-                    monitorSelection: true,
-                    screenCount: 1,
-                    monitorCount: 1,
-                    control: false,
-                    audio: false,
-                    remoteAudio: false,
-                    fileTransfer: true,
-                    remoteFiles: true,
-                    fileTransferMaxBytes: MAX_FILE_TRANSFER_BYTES,
-                    computerAgent: options.taskEnabled,
-                    taskDispatch: options.taskEnabled,
-                    clientUpdate: true,
-                    clientUpdateVerifiedProof: true,
-                    productVersion: PRODUCT_VERSION,
-                    agentApproval: options.taskEnabled,
-                    agentAudit: options.taskEnabled,
-                    agentTools: [...NODE_AGENT_OPERATIONS],
-                    elevation: typeof process.getuid === 'function' ? process.getuid() === 0 : false,
-                    externalEffects: options.taskEnabled
-                }
-            });
-        });
-
-        socket.on('data', chunk => {
+        socket.on('data', chunk => {
             buffer += chunk;
             let newlineIndex = buffer.indexOf('\n');
             while (newlineIndex >= 0) {
@@ -2157,10 +2109,47 @@ function connectOnce(options, deviceId) {
             }
         });
 
-        socket.once('error', err => finish(err));
-        socket.once('close', () => finish());
-    });
-}
+        socket.once('error', err => finish(err));
+        socket.once('close', () => finish());
+        writeJsonLine(socket, {
+            type: 'hello',
+            pairToken: options.pair,
+            deviceId,
+            deviceName: options.name,
+            slotNumber: options.slotNumber || undefined,
+            hostname: os.hostname(),
+            platform: os.platform(),
+            arch: os.arch(),
+            pid: process.pid,
+            agentVersion: AGENT_VERSION,
+            productVersion: PRODUCT_VERSION,
+            capabilities: {
+                status: true,
+                thumbnail: options.thumbnailEnabled,
+                liveStream: options.liveEnabled,
+                monitorSelection: true,
+                screenCount: 1,
+                monitorCount: 1,
+                control: false,
+                audio: false,
+                remoteAudio: false,
+                fileTransfer: true,
+                remoteFiles: true,
+                fileTransferMaxBytes: MAX_FILE_TRANSFER_BYTES,
+                computerAgent: options.taskEnabled,
+                taskDispatch: options.taskEnabled,
+                clientUpdate: true,
+                clientUpdateVerifiedProof: true,
+                productVersion: PRODUCT_VERSION,
+                agentApproval: options.taskEnabled,
+                agentAudit: options.taskEnabled,
+                agentTools: [...NODE_AGENT_OPERATIONS],
+                elevation: typeof process.getuid === 'function' ? process.getuid() === 0 : false,
+                externalEffects: options.taskEnabled
+            }
+        });
+    });
+}
 
 async function connectWithRetry(options) {
     if (!options.pair) {

package/client/bin/livedesk-client.js

@@ -25,8 +25,9 @@ import {
     inspectLinuxVideoAcceleration,
     installLinuxVideoAcceleration
 } from '../src/runtime/linux-video-acceleration.js';
-import { normalizeRuntimeAuthSession } from '../../runtime-core/src/auth-session.js';
-import { startRoleTransitionSupervisor } from '../../runtime-core/src/role-transition-supervisor.js';
+import { normalizeRuntimeAuthSession } from '../../runtime-core/src/auth-session.js';
+import { startRoleTransitionSupervisor } from '../../runtime-core/src/role-transition-supervisor.js';
+import { connectSecureDirectSocket } from '../../runtime-core/src/direct-secure-transport.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const require = createRequire(import.meta.url);
@@ -3674,7 +3675,7 @@ export function shouldSkipAutomaticDirectProbe(endpoint, options = {}) {
         && !isEndpointOnLocalNetwork(endpoint, options.networkInterfaces);
 }
 
-function requestHubSlotAssignment({ manager, pairToken, deviceId, slotNumber, timeoutMs = 5000 }) {
+async function requestHubSlotAssignment({ manager, pairToken, deviceId, slotNumber, timeoutMs = 5000 }) {
     const endpoint = parseManagerEndpoint(manager);
     const normalizedPairToken = String(pairToken || '').trim();
     const normalizedDeviceId = String(deviceId || '').trim();
@@ -3692,9 +3693,19 @@ function requestHubSlotAssignment({ manager, pairToken, deviceId, slotNumber, ti
         return Promise.resolve({ ok: false, error: 'invalid-slot-number' });
     }
 
-    return new Promise(resolveAssignment => {
-        const socket = net.createConnection(endpoint);
-        let settled = false;
+    let socket;
+    try {
+        socket = await connectSecureDirectSocket(
+            endpoint,
+            normalizedPairToken,
+            'control',
+            { connectTimeoutMs: timeoutMs, handshakeTimeoutMs: timeoutMs });
+    } catch (error) {
+        return { ok: false, error: error?.message || 'hub-slot-secure-connection-failed' };
+    }
+
+    return new Promise(resolveAssignment => {
+        let settled = false;
         let buffer = '';
         const settle = result => {
             if (settled) return;
@@ -3705,15 +3716,7 @@ function requestHubSlotAssignment({ manager, pairToken, deviceId, slotNumber, ti
         };
         socket.setEncoding('utf8');
         socket.setTimeout(timeoutMs);
-        socket.once('connect', () => {
-            socket.write(`${JSON.stringify({
-                type: 'slot.assign',
-                pairToken: normalizedPairToken,
-                deviceId: normalizedDeviceId,
-                slotNumber: Number(normalizedSlot)
-            })}\n`);
-        });
-        socket.on('data', chunk => {
+        socket.on('data', chunk => {
             buffer += chunk;
             const newlineIndex = buffer.indexOf('\n');
             if (newlineIndex < 0) return;
@@ -3730,11 +3733,17 @@ function requestHubSlotAssignment({ manager, pairToken, deviceId, slotNumber, ti
         });
         socket.once('timeout', () => settle({ ok: false, error: 'hub-slot-request-timeout' }));
         socket.once('error', error => settle({ ok: false, error: error?.message || 'hub-slot-request-failed' }));
-        socket.once('close', () => {
-            if (!settled) settle({ ok: false, error: 'hub-slot-response-missing' });
-        });
-    });
-}
+        socket.once('close', () => {
+            if (!settled) settle({ ok: false, error: 'hub-slot-response-missing' });
+        });
+        socket.write(`${JSON.stringify({
+            type: 'slot.assign',
+            pairToken: normalizedPairToken,
+            deviceId: normalizedDeviceId,
+            slotNumber: Number(normalizedSlot)
+        })}\n`);
+    });
+}
 
 export function canConnectToEndpoint(endpoint, timeoutMs = ENDPOINT_PROBE_TIMEOUT_MS) {
     const parsedEndpoint = parseManagerEndpoint(endpoint);

package/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/client",
-  "version": "0.1.263",
+  "version": "0.1.264",
   "description": "VuvoDesk local remote client",
   "type": "module",
   "bin": {
@@ -36,16 +36,16 @@
   "dependencies": {
     "@ffmpeg-installer/ffmpeg": "^1.1.0",
     "ffmpeg-static": "^5.3.0",
-    "@livedesk/runtime-core": "0.1.6",
+    "@livedesk/runtime-core": "0.1.7",
     "@supabase/supabase-js": "^2.110.0",
     "node-screenshots": "^0.2.8",
     "ws": "^8.18.3"
   },
   "optionalDependencies": {
-    "@livedesk/fast-linux-x64": "0.1.459",
-    "@livedesk/fast-osx-arm64": "0.1.459",
-    "@livedesk/fast-osx-x64": "0.1.459",
-    "@livedesk/fast-win-x64": "0.1.459"
+    "@livedesk/fast-linux-x64": "0.1.460",
+    "@livedesk/fast-osx-arm64": "0.1.460",
+    "@livedesk/fast-osx-x64": "0.1.460",
+    "@livedesk/fast-win-x64": "0.1.460"
   },
   "publishConfig": {
     "access": "public"

package/hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.54",
+  "version": "0.1.55",
   "description": "VuvoDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",
@@ -16,7 +16,7 @@
   },
   "dependencies": {
     "@ffmpeg-installer/ffmpeg": "^1.1.0",
-    "@livedesk/runtime-core": "0.1.6",
+    "@livedesk/runtime-core": "0.1.7",
     "@openai/codex-sdk": "0.145.0",
     "cors": "^2.8.5",
     "express": "^4.21.2",

package/hub/src/remote-hub.js

@@ -1,7 +1,14 @@
-import net from 'net';
-import os from 'os';
-import crypto from 'crypto';
-import { createHubRelayControl } from './transport/relay-hub-control.js';
+import net from 'net';
+import os from 'os';
+import crypto from 'crypto';
+import {
+    acceptSecureDirectSocket,
+    isDirectSecureChannel,
+    isLoopbackSocketAddress,
+    isPrivateSocketAddress,
+    isSecureDirectHandshakeStart
+} from '../../runtime-core/src/direct-secure-transport.js';
+import { createHubRelayControl } from './transport/relay-hub-control.js';
 import { parseExactLiveStreamMonitorIndex } from './live-stream-monitor-contract.js';
 import {
     BoundedSegmentedBuffer,
@@ -2397,9 +2404,12 @@ export function createRemoteHub(options = {}) {
     const hostInstanceId = safeString(options.hostInstanceId ?? env.LIVEDESK_HUB_INSTANCE_ID ?? env.MINDEXEC_BRIDGE_INSTANCE_ID ?? crypto.randomUUID(), 128) || crypto.randomUUID();
     const publicEndpoint = safeString(env.LIVEDESK_REMOTE_PUBLIC_ENDPOINT || env.MINDEXEC_REMOTE_PUBLIC_ENDPOINT || env.REMOTE_HUB_PUBLIC_ENDPOINT, 256);
     const publicHost = safeString(env.LIVEDESK_REMOTE_PUBLIC_HOST || env.MINDEXEC_REMOTE_PUBLIC_HOST || env.REMOTE_HUB_PUBLIC_HOST, 128);
-    const pairToken = safeString(
-        options.pairToken || env.REMOTE_HUB_PAIR_TOKEN || env.LIVEDESK_CLIENT_PAIR_TOKEN || env.MINDEXEC_REMOTE_PAIR_TOKEN || crypto.randomBytes(6).toString('hex'),
-        256);
+    const pairToken = safeString(
+        options.pairToken || env.REMOTE_HUB_PAIR_TOKEN || env.LIVEDESK_CLIENT_PAIR_TOKEN || env.MINDEXEC_REMOTE_PAIR_TOKEN || crypto.randomBytes(32).toString('hex'),
+        256);
+    const allowInsecurePrivateDirect = isEnabledValue(
+        options.allowInsecureDirect ?? env.LIVEDESK_ALLOW_INSECURE_DIRECT,
+        false);
     const relayControl = options.relayControl && typeof options.relayControl === 'object'
         ? options.relayControl
         : createHubRelayControl({
@@ -7949,10 +7959,24 @@ export function createRemoteHub(options = {}) {
     function handleAgentMessage(socket, state, message) {
         if (!message || typeof message !== 'object') {
             return;
-        }
-
-        if (!state.authenticated) {
-            if (message.type === 'hello' && socket.__liveDeskRelayControl === true) {
+        }
+
+        if (!state.authenticated) {
+            if (socket.__liveDeskSecureDirect === true) {
+                const applicationChannel = message.type === 'slot.assign'
+                    ? 'control'
+                    : message.type === 'hello'
+                        ? (safeString(message.channel || message.Channel, 40).toLowerCase() || 'control')
+                        : '';
+                if (applicationChannel
+                    && (!isDirectSecureChannel(applicationChannel)
+                        || applicationChannel !== socket.__liveDeskSecureChannel)) {
+                    writeJsonLine(socket, { type: 'error', error: 'direct-secure-channel-mismatch' });
+                    socket.end();
+                    return;
+                }
+            }
+            if (message.type === 'hello' && socket.__liveDeskRelayControl === true) {
                 message = {
                     ...message,
                     capabilities: {
@@ -7988,7 +8012,7 @@ export function createRemoteHub(options = {}) {
                 return;
             }
 
-            const channel = safeString(message.channel || message.Channel, 40).toLowerCase();
+            const channel = safeString(message.channel || message.Channel, 40).toLowerCase() || 'control';
             if (channel === 'input') {
                 const device = attachInputSocket(socket, message);
                 if (!device) {
@@ -8538,18 +8562,60 @@ export function createRemoteHub(options = {}) {
         if (firstChunk) {
             processData(firstChunk);
         }
-    }
-
-    function handleSocket(socket) {
-        socket.once('data', chunk => {
-            const firstChunk = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-            if (isRemoteHubWebSocketUpgradeStart(firstChunk)) {
-                handleWebSocketUpgradeSocket(socket, firstChunk);
-                return;
-            }
-
-            handleTcpAgentSocket(socket, firstChunk);
-        });
+    }
+
+    function handleSocket(socket) {
+        allSockets.add(socket);
+        const prefaceTimer = setTimeout(() => {
+            if (!socket.destroyed) socket.destroy();
+        }, 10_000);
+        prefaceTimer.unref?.();
+        socket.once('close', () => {
+            clearTimeout(prefaceTimer);
+            allSockets.delete(socket);
+        });
+        socket.once('data', chunk => {
+            clearTimeout(prefaceTimer);
+            const firstChunk = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            if (isSecureDirectHandshakeStart(firstChunk)) {
+                void acceptSecureDirectSocket(socket, firstChunk, pairToken)
+                    .then(secureSocket => {
+                        allSockets.delete(socket);
+                        handleTcpAgentSocket(secureSocket);
+                    })
+                    .catch(error => {
+                        if (socket.destroyed) return;
+                        if (error?.code === 'LIVEDESK_INVALID_PAIR_TOKEN_REJECTED') {
+                            const forcedCloseTimer = setTimeout(() => socket.destroy(), 1_000);
+                            forcedCloseTimer.unref?.();
+                            socket.once('close', () => clearTimeout(forcedCloseTimer));
+                            if (typeof socket.destroySoon === 'function') socket.destroySoon();
+                            else socket.end();
+                            return;
+                        }
+                        socket.destroy();
+                    });
+                return;
+            }
+
+            const remoteAddress = socket.remoteAddress;
+            const allowLegacyPlaintext = isLoopbackSocketAddress(remoteAddress)
+                || (allowInsecurePrivateDirect && isPrivateSocketAddress(remoteAddress));
+            if (isRemoteHubWebSocketUpgradeStart(firstChunk)) {
+                if (!allowLegacyPlaintext) {
+                    socket.destroy();
+                    return;
+                }
+                handleWebSocketUpgradeSocket(socket, firstChunk);
+                return;
+            }
+
+            if (!allowLegacyPlaintext) {
+                socket.destroy();
+                return;
+            }
+            handleTcpAgentSocket(socket, firstChunk);
+        });
 
         socket.once('error', () => {
             // The transport-specific handler owns logging after the first byte.
@@ -8571,10 +8637,10 @@ export function createRemoteHub(options = {}) {
                 started = true;
                 boundPort = candidateServer.address()?.port || port;
                 lastError = '';
-                logEvent('remote', `VuvoDesk Hub client endpoint listening on tcp://${host}:${boundPort}`, 'success');
-                if (host === '0.0.0.0' || host === '::') {
-                    logWarn('remote', 'VuvoDesk Hub client endpoint is externally reachable. Use a strong pairing token and trusted network.');
-                }
+                logEvent('remote', `VuvoDesk Hub client endpoint listening on tcp://${host}:${boundPort}`, 'success');
+                if (host === '0.0.0.0' || host === '::') {
+                    logWarn('remote', 'VuvoDesk Hub client endpoint is externally reachable. Non-loopback Direct connections require authenticated encryption.');
+                }
                 emitRemoteEvent('RemoteHubStarted', null);
                 resolve();
             });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "livedesk",
-  "version": "0.1.613",
-  "livedeskClientVersion": "0.1.263",
+  "version": "0.1.614",
+  "livedeskClientVersion": "0.1.264",
   "buildFlavor": "production",
   "description": "VuvoDesk Hub and client launcher",
   "type": "module",
@@ -51,10 +51,10 @@
     "ws": "^8.18.3"
   },
   "optionalDependencies": {
-    "@livedesk/fast-linux-x64": "0.1.459",
-    "@livedesk/fast-osx-arm64": "0.1.459",
-    "@livedesk/fast-osx-x64": "0.1.459",
-    "@livedesk/fast-win-x64": "0.1.459"
+    "@livedesk/fast-linux-x64": "0.1.460",
+    "@livedesk/fast-osx-arm64": "0.1.460",
+    "@livedesk/fast-osx-x64": "0.1.460",
+    "@livedesk/fast-win-x64": "0.1.460"
   },
   "publishConfig": {
     "access": "public"

package/runtime-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/runtime-core",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Shared VuvoDesk runtime role and lifecycle contracts",
   "type": "module",
   "main": "src/index.js",
@@ -8,7 +8,7 @@
     "src/"
   ],
   "scripts": {
-    "check": "node --check src/index.js",
+    "check": "node --check src/index.js && node --check src/direct-secure-transport.js",
     "prepublishOnly": "node ../../scripts/livedesk-release-git-gate.mjs"
   },
   "engines": {