livedesk 0.1.629 → 0.1.631

package/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/client",
-  "version": "0.1.266",
+  "version": "0.1.267",
   "description": "VuvoDesk local remote client",
   "type": "module",
   "bin": {
@@ -36,7 +36,7 @@
   "dependencies": {
     "@ffmpeg-installer/ffmpeg": "^1.1.0",
     "ffmpeg-static": "^5.3.0",
-    "@livedesk/runtime-core": "0.1.7",
+    "@livedesk/runtime-core": "0.1.8",
     "@supabase/supabase-js": "^2.110.0",
     "node-screenshots": "^0.2.8",
     "ws": "^8.18.3"

package/electron/before-pack.cjs

@@ -0,0 +1,129 @@
+const { createHash } = require('node:crypto');
+const { existsSync, readFileSync, readdirSync, statSync } = require('node:fs');
+const { isAbsolute, join, posix, relative, resolve, sep } = require('node:path');
+
+const EVIDENCE_FILE = 'livedesk-build-evidence.json';
+const EVIDENCE_KIND = 'livedesk-production-web-source-evidence';
+
+function fail(code, detail = '') {
+  throw new Error(`packaged-web-invalid:${code}${detail ? `:${detail}` : ''}`);
+}
+
+function readJson(filePath, label) {
+  try {
+    return JSON.parse(readFileSync(filePath, 'utf8'));
+  } catch (error) {
+    fail(`${label}-invalid`, error instanceof Error ? error.message : String(error));
+  }
+}
+
+function validateManifestPath(value) {
+  const manifestPath = String(value || '');
+  if (!manifestPath
+    || manifestPath.includes('\\')
+    || isAbsolute(manifestPath)
+    || posix.isAbsolute(manifestPath)
+    || posix.normalize(manifestPath) !== manifestPath
+    || manifestPath.split('/').some(segment => !segment || segment === '.' || segment === '..')) {
+    fail('manifest-path-unsafe', manifestPath || '(empty)');
+  }
+  return manifestPath;
+}
+
+function collectOutputFiles(directory, webRoot, output = []) {
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    const fullPath = join(directory, entry.name);
+    if (entry.isDirectory()) {
+      collectOutputFiles(fullPath, webRoot, output);
+      continue;
+    }
+    if (!entry.isFile()) fail('output-entry-not-file', relative(webRoot, fullPath));
+    const outputPath = relative(webRoot, fullPath).replaceAll('\\', '/');
+    if (outputPath !== EVIDENCE_FILE && !outputPath.endsWith('.tmp')) output.push(outputPath);
+  }
+  return output.sort((left, right) => left.localeCompare(right));
+}
+
+function validatePackagedWebOutput(webDirectory, expectedVersion) {
+  const webRoot = resolve(String(webDirectory || ''));
+  if (!webDirectory || !existsSync(webRoot)) fail('web-root-missing', webRoot);
+  const indexPath = join(webRoot, 'index.html');
+  const evidencePath = join(webRoot, EVIDENCE_FILE);
+  if (!existsSync(indexPath)) fail('index-missing', indexPath);
+  if (!existsSync(evidencePath)) fail('evidence-missing', evidencePath);
+
+  const evidence = readJson(evidencePath, 'evidence');
+  if (evidence?.schemaVersion !== 2) fail('evidence-schema', String(evidence?.schemaVersion));
+  if (evidence?.kind !== EVIDENCE_KIND) fail('evidence-kind', String(evidence?.kind));
+  if (!expectedVersion || evidence?.pwaRelease !== expectedVersion) {
+    fail('version-mismatch', `package=${expectedVersion || '(missing)'},web=${evidence?.pwaRelease || '(missing)'}`);
+  }
+  if (!Array.isArray(evidence.outputManifest) || evidence.outputManifest.length === 0) {
+    fail('manifest-empty');
+  }
+
+  const actualPaths = collectOutputFiles(webRoot, webRoot);
+  const recordedPaths = [];
+  const seenPaths = new Set();
+  const aggregateHash = createHash('sha256');
+  let outputBytes = 0;
+
+  for (const item of evidence.outputManifest) {
+    const outputPath = validateManifestPath(item?.path);
+    if (seenPaths.has(outputPath)) fail('manifest-path-duplicate', outputPath);
+    seenPaths.add(outputPath);
+    recordedPaths.push(outputPath);
+    if (!Number.isSafeInteger(item?.bytes) || item.bytes < 0) fail('manifest-size-invalid', outputPath);
+    if (!/^[a-f0-9]{64}$/.test(String(item?.sha256 || ''))) fail('manifest-hash-invalid', outputPath);
+
+    const filePath = resolve(webRoot, ...outputPath.split('/'));
+    const withinRoot = filePath.startsWith(`${webRoot}${sep}`);
+    if (!withinRoot) fail('manifest-path-unsafe', outputPath);
+    if (!existsSync(filePath) || !statSync(filePath).isFile()) fail('output-missing', outputPath);
+    const contents = readFileSync(filePath);
+    if (contents.byteLength !== item.bytes) fail('output-size-mismatch', outputPath);
+    const sha256 = createHash('sha256').update(contents).digest('hex');
+    if (sha256 !== item.sha256) fail('output-hash-mismatch', outputPath);
+
+    outputBytes += contents.byteLength;
+    aggregateHash.update(outputPath);
+    aggregateHash.update('\0');
+    aggregateHash.update(String(contents.byteLength));
+    aggregateHash.update('\0');
+    aggregateHash.update(contents);
+    aggregateHash.update('\0');
+  }
+
+  if (!seenPaths.has('index.html')) fail('index-not-recorded');
+  if (JSON.stringify(recordedPaths) !== JSON.stringify(actualPaths)) fail('manifest-file-set-mismatch');
+  if (evidence.outputFileCount !== recordedPaths.length) fail('output-count-mismatch');
+  if (evidence.outputBytes !== outputBytes) fail('output-bytes-mismatch');
+  if (evidence.outputHash !== aggregateHash.digest('hex')) fail('output-aggregate-hash-mismatch');
+
+  return {
+    webRoot,
+    version: expectedVersion,
+    outputFileCount: recordedPaths.length,
+    outputBytes
+  };
+}
+
+function validatePackagedWeb(appDir) {
+  const packageRoot = resolve(String(appDir || ''));
+  if (!appDir || !existsSync(packageRoot)) fail('app-dir-missing', packageRoot);
+  const packageInfo = readJson(join(packageRoot, 'package.json'), 'package-json');
+  return {
+    appDir: packageRoot,
+    ...validatePackagedWebOutput(join(packageRoot, 'web', 'dist'), packageInfo?.version)
+  };
+}
+
+async function beforePack(context) {
+  const appDir = context?.packager?.info?.appDir;
+  const result = validatePackagedWeb(appDir);
+  console.log(`Verified packaged VuvoDesk web UI ${result.version}: ${result.outputFileCount} files, ${result.outputBytes} bytes.`);
+}
+
+module.exports = beforePack;
+module.exports.validatePackagedWeb = validatePackagedWeb;
+module.exports.validatePackagedWebOutput = validatePackagedWebOutput;

package/electron/electron-builder.linux-x64.yml

@@ -14,7 +14,7 @@ files:
   - "!client/fast/win-x64/**"
   - "!client/fast/osx-x64/**"
   - "!client/fast/osx-arm64/**"
-asarUnpack:
+asarUnpack:
   - bin/**
   - bootstrap/**
   - client/**
@@ -23,7 +23,9 @@ asarUnpack:
   - electron/tray.*
   - hub/**
   - runtime-core/**
-  - web/**
+  - web/**
+  - node_modules/node-datachannel/**
+  - node_modules/@node-datachannel/linux-x64-gnu/**
 linux:
   icon: packages/livedesk/electron/icon.png
   category: Utility

package/electron/electron-builder.mac-arm64.yml

@@ -13,7 +13,7 @@ files:
   - "!client/fast/win-x64/**"
   - "!client/fast/linux-x64/**"
   - "!client/fast/osx-x64/**"
-asarUnpack:
+asarUnpack:
   - bin/**
   - bootstrap/**
   - client/**
@@ -22,7 +22,9 @@ asarUnpack:
   - electron/tray.*
   - hub/**
   - runtime-core/**
-  - web/**
+  - web/**
+  - node_modules/node-datachannel/**
+  - node_modules/@node-datachannel/darwin-arm64/**
 mac:
   icon: packages/livedesk/electron/icon.icns
   category: public.app-category.utilities

package/electron/electron-builder.mac-x64.yml

@@ -13,7 +13,7 @@ files:
   - "!client/fast/win-x64/**"
   - "!client/fast/linux-x64/**"
   - "!client/fast/osx-arm64/**"
-asarUnpack:
+asarUnpack:
   - bin/**
   - bootstrap/**
   - client/**
@@ -22,7 +22,9 @@ asarUnpack:
   - electron/tray.*
   - hub/**
   - runtime-core/**
-  - web/**
+  - web/**
+  - node_modules/node-datachannel/**
+  - node_modules/@node-datachannel/darwin-x64/**
 mac:
   icon: packages/livedesk/electron/icon.icns
   category: public.app-category.utilities

package/electron/electron-builder.win.yml

@@ -13,7 +13,7 @@ files:
   - "!client/fast/linux-x64/**"
   - "!client/fast/osx-x64/**"
   - "!client/fast/osx-arm64/**"
-asarUnpack:
+asarUnpack:
   - bin/**
   - bootstrap/**
   - client/**
@@ -22,7 +22,9 @@ asarUnpack:
   - electron/tray.*
   - hub/**
   - runtime-core/**
-  - web/**
+  - web/**
+  - node_modules/node-datachannel/**
+  - node_modules/@node-datachannel/win32-x64-msvc/**
 win:
   icon: packages/livedesk/electron/icon.ico
   target:

package/electron/electron-builder.yml

@@ -1,7 +1,8 @@
 appId: com.livedesk.desktop
 productName: VuvoDesk
 artifactName: VuvoDesk-${version}-${arch}.${ext}
-asar: true
-directories:
-  app: packages/livedesk
+asar: true
+beforePack: packages/livedesk/electron/before-pack.cjs
+directories:
+  app: packages/livedesk
   output: dist/desktop

package/hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livedesk/hub",
-  "version": "0.1.56",
+  "version": "0.1.57",
   "description": "VuvoDesk local Hub API and browser frame bridge",
   "type": "module",
   "main": "src/server.js",
@@ -11,15 +11,16 @@
   "scripts": {
     "dev": "node src/server.js",
     "start": "node src/server.js",
-    "check": "node --check src/server.js && node --check src/remote-hub.js && node --check src/remote-clipboard-contract.mjs && node --check src/console-relay.js",
+    "check": "node --check src/server.js && node --check src/remote-hub.js && node --check src/remote-clipboard-contract.mjs && node --check src/console-direct.js",
     "prepublishOnly": "node ../../scripts/livedesk-release-git-gate.mjs"
   },
   "dependencies": {
     "@ffmpeg-installer/ffmpeg": "^1.1.0",
-    "@livedesk/runtime-core": "0.1.7",
+    "@livedesk/runtime-core": "0.1.8",
     "@openai/codex-sdk": "0.145.0",
     "cors": "^2.8.5",
     "express": "^4.21.2",
+    "node-datachannel": "0.33.0",
     "path-to-regexp": "0.1.13",
     "ws": "^8.18.3"
   },