livedesk 0.1.631 → 0.1.633

package/client/bin/livedesk-client.js

@@ -53,8 +53,9 @@ const EXIT_INVALID_PAIR_TOKEN = 23;
 const EXIT_CLIENT_UPDATE = 42;
 const SESSION_REFRESH_SKEW_SECONDS = 60;
 const SUPABASE_REQUEST_TIMEOUT_MS = 8_000;
-const HUB_TARGET_CACHE_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
-const HUB_TARGET_CACHE_FUTURE_SKEW_MS = 5 * 60 * 1000;
+const HUB_TARGET_CACHE_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1000;
+const HUB_TARGET_CACHE_FUTURE_SKEW_MS = 5 * 60 * 1000;
+const WORKSPACE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const WINDOWS_STARTUP_SCRIPT_NAME = 'VuvoDesk Desktop.vbs';
 const WINDOWS_STARTUP_LEGACY_DESKTOP_SCRIPT_NAME = 'LiveDesk Desktop.vbs';
 const WINDOWS_STARTUP_LEGACY_SCRIPT_NAME = 'LiveDesk Client.vbs';
@@ -1006,10 +1007,23 @@ function writeClientUpdateRuntimeStage(stage, details = {}) {
     }
 }
 
-function hubCacheOwnerForSession(session) {
-    const userId = String(session?.user?.id || '').trim();
-    return userId ? `user:${userId}` : '';
-}
+function normalizeWorkspaceId(value) {
+    const workspaceId = String(value || '').trim();
+    return WORKSPACE_ID_PATTERN.test(workspaceId) ? workspaceId : '';
+}
+
+export function hubCacheOwnerForSession(session, workspaceId = '') {
+    const userId = String(session?.user?.id || '').trim();
+    if (!userId) return '';
+    const normalizedWorkspaceId = normalizeWorkspaceId(workspaceId);
+    // Personal workspace ids intentionally equal auth.uid. Preserve the old
+    // cache owner key so every existing Personal installation keeps its
+    // verified Hub cache after this upgrade. Team caches carry the workspace
+    // id so switching between Personal and Team can never reuse a pair token.
+    return normalizedWorkspaceId && normalizedWorkspaceId !== userId
+        ? `user:${userId}:workspace:${normalizedWorkspaceId}`
+        : `user:${userId}`;
+}
 
 function hubCacheOwnerForPin(pin) {
     const normalizedPin = normalizePairingPin(pin);
@@ -1049,7 +1063,7 @@ export function normalizeCachedHubTarget(value, expectedOwnerKey, now = Date.now
     };
 }
 
-export function readCachedHubTarget(ownerKey) {
+export function readCachedHubTarget(ownerKey) {
     const paths = [...new Set([preferredClientAuthPath(), CLIENT_AUTH_PATH, UNIFIED_CLIENT_AUTH_PATH])];
     for (const path of paths) {
         try {
@@ -1062,10 +1076,43 @@ export function readCachedHubTarget(ownerKey) {
             // Try the next compatible state location.
         }
     }
-    return null;
-}
-
-export function writeCachedHubTarget(ownerKey, target) {
+    return null;
+}
+
+export function readCachedHubWorkspaceBinding(session, now = Date.now()) {
+    const userId = normalizeWorkspaceId(session?.user?.id);
+    if (!userId) return null;
+    const personalOwnerKey = `user:${userId}`;
+    const teamOwnerPrefix = `${personalOwnerKey}:workspace:`;
+    const paths = [...new Set([preferredClientAuthPath(), CLIENT_AUTH_PATH, UNIFIED_CLIENT_AUTH_PATH])];
+    for (const path of paths) {
+        try {
+            const state = JSON.parse(readFileSync(path, 'utf8'));
+            const raw = state?.[CLIENT_HUB_TARGET_CACHE_STORAGE_KEY];
+            const parsed = typeof raw === 'string' ? JSON.parse(raw) : raw;
+            const ownerKey = String(parsed?.ownerKey || '').trim();
+            let workspaceId = '';
+            if (ownerKey === personalOwnerKey) {
+                workspaceId = userId;
+            } else if (ownerKey.startsWith(teamOwnerPrefix)) {
+                workspaceId = normalizeWorkspaceId(ownerKey.slice(teamOwnerPrefix.length));
+            }
+            if (!workspaceId || !normalizeCachedHubTarget(parsed, ownerKey, now)) continue;
+            return { ownerKey, workspaceId };
+        } catch {
+            // Try the next compatible state location.
+        }
+    }
+    return null;
+}
+
+export function hasClientWorkspaceCacheOwnerChanged(cachedBinding, session, freshWorkspaceId) {
+    const previousOwnerKey = String(cachedBinding?.ownerKey || '').trim();
+    if (!previousOwnerKey) return false;
+    return hubCacheOwnerForSession(session, freshWorkspaceId) !== previousOwnerKey;
+}
+
+export function writeCachedHubTarget(ownerKey, target) {
     const normalizedOwner = String(ownerKey || '').trim();
     const pair = String(target?.pair || '').trim();
     const endpointCandidates = normalizeEndpointCandidates({
@@ -4048,33 +4095,142 @@ function waitForDiscoveryTrigger(delayMs, wakePromise = null, shouldStop = () =>
     });
 }
 
-function normalizeEndpointCandidates(target) {
+function normalizeEndpointCandidates(target) {
     const rawCandidates = [
         target?.endpoint,
         ...(Array.isArray(target?.endpoint_candidates) ? target.endpoint_candidates : [])
     ];
-    return [...new Set(rawCandidates.map(value => String(value || '').trim()).filter(Boolean))];
-}
-
-export async function resolveManagerFromSupabase(supabase, options = {}) {
-    if (options.signal?.aborted) {
-        throw createHubDiscoveryError('hub-registry-aborted', 'VuvoDesk Hub registry lookup was cancelled.');
-    }
-    await refreshSessionIfNeeded(supabase);
+    return [...new Set(rawCandidates.map(value => String(value || '').trim()).filter(Boolean))];
+}
+
+function isLegacyWorkspaceSchemaError(error) {
+    const code = String(error?.code || '').trim().toUpperCase();
+    const message = String(error?.message || error || '');
+    return code === '42703'
+        || code === 'PGRST202'
+        || /workspace_id.*does not exist|current_livedesk_owner_workspace.*not found/i.test(message);
+}
+
+export async function resolveClientWorkspaceFromSupabase(supabase, options = {}) {
+    const deviceId = String(options.deviceId || '').trim();
+    const session = options.session?.access_token
+        ? options.session
+        : await refreshSessionIfNeeded(supabase);
+    const userId = normalizeWorkspaceId(session?.user?.id);
+    if (!userId) {
+        throw createHubDiscoveryError(
+            'workspace-session-required',
+            'A signed-in VuvoDesk account is required to resolve this Client workspace.'
+        );
+    }
+    if (!deviceId) {
+        throw createHubDiscoveryError(
+            'workspace-device-id-required',
+            'The VuvoDesk Client device identity is required to resolve its workspace.'
+        );
+    }
+
+    let query = supabase
+        .from('livedesk_devices')
+        .select('workspace_id, device_id, enabled')
+        .eq('account_id', userId)
+        .eq('device_id', deviceId)
+        .limit(2);
+    if (options.signal && typeof query.abortSignal === 'function') {
+        query = query.abortSignal(options.signal);
+    }
+    const { data, error } = await query;
+    if (error) {
+        // A pre-Team Supabase schema has only one possible Personal namespace,
+        // whose id is auth.uid. This fallback preserves deployed Personal
+        // Clients while never guessing after the workspace schema exists.
+        if (isLegacyWorkspaceSchemaError(error)) return userId;
+        throw error;
+    }
+
+    const rows = Array.isArray(data) ? data : [];
+    const workspaceIds = [...new Set(rows
+        .map(row => normalizeWorkspaceId(row?.workspace_id))
+        .filter(Boolean))];
+    if (workspaceIds.length > 1) {
+        throw createHubDiscoveryError(
+            'workspace-binding-conflict',
+            'This VuvoDesk Client device is bound to more than one workspace.'
+        );
+    }
+    if (rows.length > 0 && workspaceIds.length !== 1) {
+        throw createHubDiscoveryError(
+            'workspace-binding-invalid',
+            'This VuvoDesk Client device has an invalid workspace binding.'
+        );
+    }
+    if (rows.some(row => row?.enabled === false)) {
+        throw createHubDiscoveryError(
+            'workspace-device-disabled',
+            'This VuvoDesk Client device is disabled.'
+        );
+    }
+    if (workspaceIds.length === 1) {
+        return workspaceIds[0];
+    }
+
+    const { data: currentWorkspace, error: currentWorkspaceError } = await supabase.rpc(
+        'current_livedesk_owner_workspace'
+    );
+    if (currentWorkspaceError) {
+        if (isLegacyWorkspaceSchemaError(currentWorkspaceError)) return userId;
+        throw currentWorkspaceError;
+    }
+    const currentValue = Array.isArray(currentWorkspace)
+        ? currentWorkspace[0]?.current_livedesk_owner_workspace ?? currentWorkspace[0]
+        : currentWorkspace?.current_livedesk_owner_workspace ?? currentWorkspace;
+    const workspaceId = normalizeWorkspaceId(currentValue);
+    if (!workspaceId) {
+        throw createHubDiscoveryError(
+            'workspace-current-missing',
+            'No current VuvoDesk workspace is available for this new Client installation.'
+        );
+    }
+    return workspaceId;
+}
+
+export async function resolveManagerFromSupabase(supabase, options = {}) {
     if (options.signal?.aborted) {
         throw createHubDiscoveryError('hub-registry-aborted', 'VuvoDesk Hub registry lookup was cancelled.');
     }
-    let query = supabase
-        .from('livedesk_remote_host_targets')
-        .select('node_id, endpoint, endpoint_candidates, pair_token, active, expires_at, updated_at, manager_version')
-        .eq('product_key', 'livedesk');
-    if (options.signal && typeof query.abortSignal === 'function') {
-        query = query.abortSignal(options.signal);
-    }
-    const { data, error } = await query.maybeSingle();
-    if (error) {
-        throw error;
-    }
+    const session = await refreshSessionIfNeeded(supabase);
+    if (options.signal?.aborted) {
+        throw createHubDiscoveryError('hub-registry-aborted', 'VuvoDesk Hub registry lookup was cancelled.');
+    }
+    const workspaceId = normalizeWorkspaceId(options.workspaceId)
+        || await resolveClientWorkspaceFromSupabase(supabase, {
+            deviceId: options.deviceId,
+            session,
+            signal: options.signal
+        });
+    let query = supabase.rpc('get_livedesk_workspace_remote_host_target', {
+        p_workspace_id: workspaceId
+    });
+    if (options.signal && typeof query.abortSignal === 'function') {
+        query = query.abortSignal(options.signal);
+    }
+    const { data: responseData, error } = await query;
+    if (error) {
+        throw error;
+    }
+    const data = Array.isArray(responseData) ? responseData[0] : responseData;
+    if (data?.ok === false) {
+        throw createHubDiscoveryError(
+            String(data.reason || 'workspace-host-target-access-denied'),
+            'The VuvoDesk Client could not read this workspace Hub target.'
+        );
+    }
+    if (data?.workspace_id && normalizeWorkspaceId(data.workspace_id) !== workspaceId) {
+        throw createHubDiscoveryError(
+            'workspace-target-mismatch',
+            'The VuvoDesk Hub registry returned a different workspace.'
+        );
+    }
     if (!data?.active) {
         throw createHubDiscoveryError(
             'hub-registry-missing',
@@ -4110,8 +4266,9 @@ export async function resolveManagerFromSupabase(supabase, options = {}) {
             `No reachable VuvoDesk Hub endpoint yet. Checked ${endpointCandidates.join(', ')}.`
         );
     }
-    return {
-        manager: target.manager,
+    return {
+        workspaceId,
+        manager: target.manager,
         pair: data.pair_token,
         hubDeviceId: String(data.node_id || '').trim(),
         endpointCandidates,
@@ -4119,23 +4276,61 @@ export async function resolveManagerFromSupabase(supabase, options = {}) {
         connectionTransport: target.connectionTransport,
         directProbeSkipped: target.directProbeSkipped === true,
         directProbeSkipReason: String(target.directProbeSkipReason || '')
-    };
-}
-
-async function registerClientDeviceWithSupabase(supabase, options = {}) {
+    };
+}
+
+function readClientInstallationId(deviceId) {
+    const expectedDeviceId = String(deviceId || '').trim();
+    if (!expectedDeviceId) return '';
+    for (const path of [
+        join(UNIFIED_CLIENT_STATE_DIR, 'device.json'),
+        join(CLIENT_STATE_DIR, 'device.json')
+    ]) {
+        try {
+            const identity = JSON.parse(readFileSync(path, 'utf8'));
+            if (String(identity?.deviceId || '').trim() !== expectedDeviceId) continue;
+            const installationId = String(identity?.installationId || '').trim();
+            if (installationId) return installationId.slice(0, 128);
+        } catch {
+            // Try the compatible legacy identity path next.
+        }
+    }
+    return '';
+}
+
+async function registerClientDeviceWithSupabase(supabase, options = {}) {
     if (!options.deviceId || !options.session?.access_token) {
         return null;
-    }
-    try {
-        const { data, error } = await supabase.rpc('register_livedesk_device', {
-            p_device_id: options.deviceId,
-            p_device_name: options.deviceName || os.hostname(),
-            p_role: 'client',
-            p_assigned_hub_id: options.assignedHubId || null,
-            p_platform: os.platform(),
-            p_os_version: os.release(),
-            p_app_version: readPackageVersion()
-        });
+    }
+    try {
+        const workspaceId = normalizeWorkspaceId(options.workspaceId);
+        const installationId = readClientInstallationId(options.deviceId);
+        const exactWorkspaceRegistration = Boolean(workspaceId && installationId);
+        if (workspaceId
+            && workspaceId !== normalizeWorkspaceId(options.session?.user?.id)
+            && !installationId) {
+            console.warn('[VuvoDesk Client] Team device registration was skipped because the exact installation identity is unavailable.');
+            return null;
+        }
+        const { data, error } = exactWorkspaceRegistration
+            ? await supabase.rpc('resolve_or_register_livedesk_workspace_device', {
+                p_workspace_id: workspaceId,
+                p_device_id: options.deviceId,
+                p_device_name: options.deviceName || os.hostname(),
+                p_installation_id: installationId,
+                p_platform: os.platform(),
+                p_os_version: os.release(),
+                p_app_version: readPackageVersion()
+            })
+            : await supabase.rpc('register_livedesk_device', {
+                p_device_id: options.deviceId,
+                p_device_name: options.deviceName || os.hostname(),
+                p_role: 'client',
+                p_assigned_hub_id: options.assignedHubId || null,
+                p_platform: os.platform(),
+                p_os_version: os.release(),
+                p_app_version: readPackageVersion()
+            });
         const result = Array.isArray(data) ? data[0] : data;
         if (error || result?.ok === false) {
             console.warn(`[VuvoDesk Client] Device role registration unavailable: ${error?.message || result?.reason || 'unknown-error'}`);
@@ -4147,27 +4342,148 @@ async function registerClientDeviceWithSupabase(supabase, options = {}) {
     }
 }
 
-export async function waitForManagerFromSupabase(supabase, options = {}) {
+export async function waitForManagerFromSupabase(supabase, options = {}) {
     const configuredIntervalMs = Number(options.intervalMs || 0);
     const shouldStop = typeof options.shouldStop === 'function' ? options.shouldStop : () => false;
     const createWakeListener = typeof options.createWakeListener === 'function'
         ? options.createWakeListener
         : createHubWakeListener;
     let attempts = 0;
-    let lastMessage = '';
-    let wakeListener = null;
-    let initialError = options.initialError || null;
-    console.log('Waiting for a VuvoDesk Hub. VuvoDesk is listening for Hub-online events with adaptive registry retries as a fallback.');
-    try {
-        while (true) {
-            if (shouldStop()) {
-                return null;
-            }
-            if (!wakeListener) {
-                try {
-                    wakeListener = await createWakeListener({
-                        getAccessToken: async () => (await refreshSessionIfNeeded(supabase))?.access_token || ''
-                    });
+    let lastMessage = '';
+    let wakeListener = null;
+    let initialError = options.initialError || null;
+    let workspaceId = normalizeWorkspaceId(options.workspaceId);
+    const memberUserId = String(options.memberUserId || '').trim();
+    let workspaceOwnerGeneration = workspaceId ? 1 : 0;
+    const resolveWorkspace = typeof options.resolveWorkspace === 'function'
+        ? options.resolveWorkspace
+        : refreshOptions => resolveClientWorkspaceFromSupabase(supabase, refreshOptions);
+    const requestedWorkspaceRefreshIntervalMs = Number(options.workspaceRefreshIntervalMs || 15_000);
+    const workspaceRefreshIntervalMs = Number.isFinite(requestedWorkspaceRefreshIntervalMs)
+        ? Math.max(25, requestedWorkspaceRefreshIntervalMs)
+        : 15_000;
+    let workspaceRefreshPromise = null;
+    let lastWorkspaceRefreshAt = 0;
+
+    const refreshWorkspaceBinding = async ({ force = false } = {}) => {
+        if (!String(options.deviceId || '').trim()) return false;
+        const now = Date.now();
+        // Even a forced registry-missing refresh is rate bounded. This keeps a
+        // deleted/expired target from turning into an unbounded device lookup.
+        if (lastWorkspaceRefreshAt > 0
+            && now - lastWorkspaceRefreshAt < workspaceRefreshIntervalMs) {
+            return false;
+        }
+        if (!force && attempts === 0) return false;
+        if (workspaceRefreshPromise) return workspaceRefreshPromise;
+
+        lastWorkspaceRefreshAt = now;
+        workspaceRefreshPromise = (async () => {
+            try {
+                const nextWorkspaceId = normalizeWorkspaceId(await resolveWorkspace({
+                    deviceId: options.deviceId
+                }));
+                if (!nextWorkspaceId || nextWorkspaceId === workspaceId) return false;
+
+                const previousWorkspaceId = workspaceId;
+                workspaceOwnerGeneration += 1;
+                wakeListener?.close();
+                wakeListener = null;
+                workspaceId = nextWorkspaceId;
+                initialError = null;
+                lastMessage = '';
+                console.log(`[VuvoDesk Client] Workspace binding moved from ${previousWorkspaceId || 'unbound'} to ${workspaceId}. Rebinding Hub discovery without restarting.`);
+                return true;
+            } catch (error) {
+                if (force && attempts === 0) {
+                    console.warn(`[VuvoDesk Client] Workspace move check unavailable; continuing the exact current workspace: ${error?.message || error}`);
+                }
+                return false;
+            } finally {
+                workspaceRefreshPromise = null;
+            }
+        })();
+        return workspaceRefreshPromise;
+    };
+
+    const shouldRefreshWorkspaceAfterRegistryError = error => {
+        const code = String(error?.code || '').trim().toLowerCase();
+        return code === 'hub-registry-missing'
+            || code === 'workspace-target-mismatch';
+    };
+    console.log('Waiting for a VuvoDesk Hub. VuvoDesk is listening for Hub-online events with adaptive registry retries as a fallback.');
+    try {
+        while (true) {
+            if (shouldStop()) {
+                return null;
+            }
+            if (!workspaceId) {
+                try {
+                    const resolvedWorkspaceId = normalizeWorkspaceId(await resolveWorkspace({
+                        deviceId: options.deviceId
+                    }));
+                    if (!resolvedWorkspaceId) {
+                        throw createHubDiscoveryError(
+                            'workspace-current-missing',
+                            'No current VuvoDesk workspace is available for this Client.'
+                        );
+                    }
+                    workspaceId = resolvedWorkspaceId;
+                    workspaceOwnerGeneration += 1;
+                } catch (error) {
+                    attempts += 1;
+                    const message = formatDiscoveryError(error);
+                    if (message !== lastMessage || attempts === 1 || attempts % 6 === 0) {
+                        const suffix = attempts === 1 ? '' : ` attempt ${attempts}`;
+                        console.log(`Still waiting for VuvoDesk workspace${suffix}: ${message}`);
+                        lastMessage = message;
+                    }
+                    await waitForDiscoveryTrigger(
+                        getDiscoveryRetryDelay(attempts, configuredIntervalMs),
+                        null,
+                        shouldStop
+                    );
+                    continue;
+                }
+            }
+            if (await refreshWorkspaceBinding()) {
+                continue;
+            }
+            if (!wakeListener) {
+                try {
+                    const listenerWorkspaceId = workspaceId;
+                    const listenerOwnerGeneration = workspaceOwnerGeneration;
+                    wakeListener = await createWakeListener({
+                        workspaceId: listenerWorkspaceId,
+                        memberUserId,
+                        ownerGeneration: listenerOwnerGeneration,
+                        getAccessContext: async expected => {
+                            if (workspaceId !== listenerWorkspaceId
+                                || workspaceOwnerGeneration !== listenerOwnerGeneration
+                                || expected?.workspaceId !== listenerWorkspaceId
+                                || String(expected?.memberUserId || '') !== memberUserId
+                                || String(expected?.ownerGeneration ?? '') !== String(listenerOwnerGeneration)) {
+                                return null;
+                            }
+                            const session = await refreshSessionIfNeeded(supabase);
+                            const refreshedMemberUserId = String(session?.user?.id || '').trim();
+                            const accessToken = String(session?.access_token || '').trim();
+                            if (!accessToken
+                                || !refreshedMemberUserId
+                                || refreshedMemberUserId !== memberUserId
+                                || workspaceId !== listenerWorkspaceId
+                                || workspaceOwnerGeneration !== listenerOwnerGeneration) {
+                                return null;
+                            }
+                            return {
+                                accessToken,
+                                workspaceId: listenerWorkspaceId,
+                                memberUserId,
+                                ownerGeneration: listenerOwnerGeneration,
+                                connectionGeneration: expected.connectionGeneration
+                            };
+                        }
+                    });
                 } catch (error) {
                     if (attempts === 0) {
                         console.warn(`[VuvoDesk Client] Hub-online event channel unavailable; adaptive registry retries remain active: ${error?.message || error}`);
@@ -4182,11 +4498,12 @@ export async function waitForManagerFromSupabase(supabase, options = {}) {
                     throw error;
                 }
                 const outcome = await runFreshHubRegistryLookup(
-                    signal => resolveManagerFromSupabase(supabase, {
-                        allowRelayFallback: options.allowRelayFallback === true,
-                        probeEndpoint: options.probeEndpoint,
-                        signal
-                    }),
+                    signal => resolveManagerFromSupabase(supabase, {
+                        allowRelayFallback: options.allowRelayFallback === true,
+                        probeEndpoint: options.probeEndpoint,
+                        workspaceId,
+                        signal
+                    }),
                     {
                         timeoutMs: options.freshTimeoutMs,
                         wakePromise: wakeListener?.promise
@@ -4199,8 +4516,12 @@ export async function waitForManagerFromSupabase(supabase, options = {}) {
                     continue;
                 }
                 return outcome.target;
-            } catch (err) {
-                const message = formatDiscoveryError(err);
+            } catch (err) {
+                if (shouldRefreshWorkspaceAfterRegistryError(err)
+                    && await refreshWorkspaceBinding({ force: true })) {
+                    continue;
+                }
+                const message = formatDiscoveryError(err);
                 if (message !== lastMessage || attempts === 1 || attempts % 6 === 0) {
                     const suffix = attempts === 1 ? '' : ` attempt ${attempts}`;
                     console.log(`Still waiting for VuvoDesk Hub${suffix}: ${message}`);
@@ -4327,54 +4648,83 @@ async function prepareLoginConnection(parsed, existingConnectionPage = null, get
             console.log(connectionTransport === 'relay-fallback'
                 ? 'VuvoDesk PIN accepted. Direct TCP is unavailable; starting encrypted relay fallback.'
                 : 'Connected by VuvoDesk PIN.');
-        } else {
-            const cacheOwnerKey = hubCacheOwnerForSession(choice.session);
-            let session = choice.session;
-            let initialDiscoveryError = null;
-            let resolved = null;
-            try {
-                resolved = await resolveManagerWithCachedRecovery(cacheOwnerKey, {
-                    allowRelayFallback,
-                    relayEndpoint: parsed.relay,
-                    resolveFreshTarget: async signal => {
-                        // The signed registry is authoritative for Hub replacement
-                        // and pair-token rotation. Cache direct/relay recovery is
-                        // considered only after this one current lookup reports
-                        // an explicitly recoverable availability failure.
-                        try {
-                            session = await activateSupabaseSession(supabase, choice.session);
-                        } catch (error) {
-                            if (!isRefreshTokenAlreadyUsedError(error)) throw error;
-                            session = readSavedSessionFromFile() || choice.session;
-                            console.warn('[VuvoDesk Client] Another auth owner rotated the refresh token. Keeping the runtime alive while the saved session catches up.');
-                        }
-                        return await resolveManagerFromSupabase(supabase, {
-                            allowRelayFallback,
-                            signal
-                        });
-                    }
-                });
+        } else {
+            let session = choice.session;
+            const cachedWorkspaceBinding = readCachedHubWorkspaceBinding(session);
+            let workspaceId = cachedWorkspaceBinding?.workspaceId || '';
+            let cacheOwnerKey = cachedWorkspaceBinding?.ownerKey
+                || hubCacheOwnerForSession(session, session?.user?.id);
+            let initialDiscoveryError = null;
+            let resolved = null;
+            try {
+                resolved = await resolveManagerWithCachedRecovery(cacheOwnerKey, {
+                    allowRelayFallback,
+                    relayEndpoint: parsed.relay,
+                    resolveFreshTarget: async signal => {
+                        // The signed registry is authoritative for Hub replacement
+                        // and pair-token rotation. Cache direct/relay recovery is
+                        // considered only after this one current lookup reports
+                        // an explicitly recoverable availability failure.
+                        try {
+                            session = await activateSupabaseSession(supabase, choice.session);
+                        } catch (error) {
+                            if (!isRefreshTokenAlreadyUsedError(error)) throw error;
+                            session = readSavedSessionFromFile() || choice.session;
+                            console.warn('[VuvoDesk Client] Another auth owner rotated the refresh token. Keeping the runtime alive while the saved session catches up.');
+                        }
+                        const freshWorkspaceId = await resolveClientWorkspaceFromSupabase(supabase, {
+                            deviceId: parsed.deviceId,
+                            session,
+                            signal
+                        });
+                        const freshCacheOwnerKey = hubCacheOwnerForSession(session, freshWorkspaceId);
+                        const cacheWorkspaceChanged = hasClientWorkspaceCacheOwnerChanged(
+                            cachedWorkspaceBinding,
+                            session,
+                            freshWorkspaceId
+                        );
+                        workspaceId = freshWorkspaceId;
+                        cacheOwnerKey = freshCacheOwnerKey;
+                        try {
+                            return await resolveManagerFromSupabase(supabase, {
+                                allowRelayFallback,
+                                workspaceId,
+                                signal
+                            });
+                        } catch (error) {
+                            if (!cacheWorkspaceChanged) throw error;
+                            throw createHubDiscoveryError(
+                                'workspace-cache-owner-changed',
+                                'The Client workspace changed, so the previous workspace Hub cache was rejected.',
+                                error
+                            );
+                        }
+                    }
+                });
             } catch (error) {
                 initialDiscoveryError = error;
             }
             discoverySource = resolved?.discoverySource || 'supabase';
             if (resolved?.discoverySource === 'cache') {
                 writeSavedSessionToFile(session);
-                console.log(resolved.connectionTransport === 'relay-fallback'
-                    ? `Fresh Hub registry lookup was unavailable; using saved account-bound Hub identity ${resolved.hubDeviceId} for the bounded encrypted relay path.`
-                    : `Fresh Hub registry lookup was unavailable; using the responding saved direct Hub endpoint ${resolved.manager}.`);
+                console.log(resolved.connectionTransport === 'relay-fallback'
+                    ? `Fresh Hub registry lookup was unavailable; using saved workspace-bound Hub identity ${resolved.hubDeviceId} for the bounded encrypted relay path.`
+                    : `Fresh Hub registry lookup was unavailable; using the responding saved direct Hub endpoint ${resolved.manager}.`);
             }
             choice.session = session;
             const email = session?.user?.email ? ` as ${session.user.email}` : '';
             console.log(`Signed in to VuvoDesk${email}.`);
             if (!resolved) {
-                resolved = await waitForManagerFromSupabase(supabase, {
-                    allowRelayFallback,
-                    initialError: initialDiscoveryError,
-                    shouldStop: () => Boolean(roleRestartRequest?.role)
-                });
-                discoverySource = 'supabase';
-            }
+                resolved = await waitForManagerFromSupabase(supabase, {
+                    allowRelayFallback,
+                    initialError: initialDiscoveryError,
+                    workspaceId,
+                    deviceId: parsed.deviceId,
+                    memberUserId: session?.user?.id,
+                    shouldStop: () => Boolean(roleRestartRequest?.role)
+                });
+                discoverySource = 'supabase';
+            }
             if (!resolved && roleRestartRequest?.role) {
                 return {
                     ...parsed,
@@ -4386,15 +4736,18 @@ async function prepareLoginConnection(parsed, existingConnectionPage = null, get
                     rediscoverOnDisconnect: shouldLogin,
                     rediscoverOnInvalidPair: shouldLogin
                 };
-            }
-            if (discoverySource === 'supabase') {
-                writeCachedHubTarget(cacheOwnerKey, resolved);
-                const registration = await registerClientDeviceWithSupabase(supabase, {
-                    deviceId: parsed.deviceId,
-                    deviceName: os.hostname(),
-                    assignedHubId: resolved.hubDeviceId,
-                    session
-                });
+            }
+            workspaceId = normalizeWorkspaceId(resolved.workspaceId) || workspaceId;
+            cacheOwnerKey = hubCacheOwnerForSession(session, workspaceId) || cacheOwnerKey;
+            if (discoverySource === 'supabase') {
+                writeCachedHubTarget(cacheOwnerKey, resolved);
+                const registration = await registerClientDeviceWithSupabase(supabase, {
+                    deviceId: parsed.deviceId,
+                    deviceName: os.hostname(),
+                    assignedHubId: resolved.hubDeviceId,
+                    workspaceId,
+                    session
+                });
                 if (Number.isInteger(registration?.role_version)) {
                     connectionPage?.update({ roleVersion: registration.role_version });
                 }