From 1215b95df2f8b9a44a5fdc61f7d19e84da855719 Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Wed, 19 Aug 2026 21:14:55 +0000
Subject: [PATCH 01/22] docs: record APT security hardening baseline

---
 .../2026-08-19-apt-security-foundation.md     | 533 ++++++++++++++++++
 docs/security/2026-08-security-baseline.md    |  18 +
 2 files changed, 551 insertions(+)
 create mode 100644 docs/plans/2026-08-19-apt-security-foundation.md
 create mode 100644 docs/security/2026-08-security-baseline.md

diff --git a/docs/plans/2026-08-19-apt-security-foundation.md b/docs/plans/2026-08-19-apt-security-foundation.md
new file mode 100644
index 0000000..d2484a3
--- /dev/null
+++ b/docs/plans/2026-08-19-apt-security-foundation.md
@@ -0,0 +1,533 @@
+# Alta Proxy Tool Security Foundation and Product Roadmap Implementation Plan
+
+> **For Hermes:** Use subagent-driven-development skill to implement this plan task-by-task.
+
+**Goal:** Remove APT’s Critical/Important security and release blockers, establish a reproducible Windows baseline, recover the Mac implementation into source control, and only then open a controlled lane for new features.
+
+**Architecture:** Keep Electron’s renderer unprivileged. Move session credentials, URL validation, proxy launching, process ownership, and update verification into small main-process modules with narrow IPC contracts. Development occurs in an isolated GitPeji worktree; existing Tool Hub downloads and production surfaces remain unchanged until a fully tested, exact-commit release is approved.
+
+**Tech Stack:** Electron, Node.js built-in `node:test`, Chrome Manifest V3 extension APIs, Electron Builder, GitPeji/Gitea Actions, SHA-256 release manifests, Windows Authenticode when available.
+
+---
+
+## Executive sequencing
+
+### Phase A — Security containment and proof
+
+No feature work enters this phase. It must close:
+
+1. arbitrary-code self-updater;
+2. CR/LF batch command injection;
+3. renderer-controlled URL/cookie exfiltration;
+4. cookie leakage through logs, temporary files, command lines, and broad clipboard handling;
+5. stale/vulnerable Electron, Axios, and build dependencies.
+
+### Phase B — Product/release foundation
+
+1. canonical GitPeji source and exact tagged builds;
+2. automated tests and CI;
+3. reproducible Windows kit with helper provenance;
+4. recover Mac source, then separately decide Intel/Rosetta versus native Apple Silicon;
+5. safe, signed/digest-bound updater only after all earlier gates pass.
+
+### Phase C — New features
+
+Feature discovery begins only after Phase A passes independent security review and Phase B has a reproducible development build. New functions go into a written backlog with user value, permissions, data touched, risk, and acceptance tests before implementation.
+
+## Non-negotiable guardrails
+
+- GitPeji is the only source of truth. Do not fetch from, push to, publish on, or update from GitHub.
+- Use a fresh worktree from GitPeji `master` at `a80074ac57b7a4517837b5d95754f5e6433df3ac` or newer.
+- Preserve current Tool Hub downloads and production visibility until Zac approves replacement.
+- Do not use real Alta cookies in automated tests; use conspicuous synthetic sentinels.
+- Do not write cookies to logs, disk, command files, shell strings, crash reports, analytics, or test artifacts.
+- No production release until the exact candidate passes controller verification plus independent security and release reviews.
+- Mac distribution remains approval-gated under Kanban task `t_42bad4d3`.
+
+---
+
+## Milestone 0: Establish an isolated hardening lane
+
+### Task 1: Create the clean GitPeji worktree and baseline evidence
+
+**Objective:** Start from an exact, clean canonical source without modifying the archived checkout.
+
+**Files:**
+- Create worktree: `/home/peji/worktrees/apt-security-foundation`
+- Create: `docs/security/2026-08-security-baseline.md`
+- Reference: `/home/peji/.hermes/reports/alta-proxy-tool-full-review-2026-08-19.md`
+
+**Steps:**
+
+1. Fetch only GitPeji and verify `origin/master`.
+2. Create branch `hardening/security-foundation` in the isolated worktree.
+3. Record full starting SHA, remote, branch, clean status, dependency audit counts, current package version, and the review report path.
+4. Confirm the archived checkout and Tool Hub checkout remain clean.
+5. Commit only the baseline document.
+
+**Commands:**
+
+```bash
+git fetch origin master
+git worktree add -b hardening/security-foundation /home/peji/worktrees/apt-security-foundation origin/master
+git -C /home/peji/worktrees/apt-security-foundation status --short --branch
+```
+
+**Expected:** clean branch based on exact GitPeji `origin/master`; no GitHub remote used.
+
+**Commit:** `docs: record APT security hardening baseline`
+
+---
+
+## Milestone 1: Add a testable security boundary
+
+### Task 2: Introduce the smallest useful test harness
+
+**Objective:** Make security fixes test-first instead of relying on ad-hoc probes.
+
+**Files:**
+- Modify: `package.json`
+- Create: `test/url-policy.test.js`
+- Create: `test/error-redaction.test.js`
+- Create: `test/proxy-launch.test.js`
+- Create: `test/update-policy.test.js`
+- Create: `test/bridge-auth.test.js`
+- Create: `src/url-policy.js`
+- Create: `src/error-redaction.js`
+
+**Steps:**
+
+1. Add `npm test` using `node --test` and `npm run check` for syntax/tests.
+2. Write failing URL-policy tests for:
+   - HTTPS Alta subdomains accepted;
+   - HTTP rejected;
+   - non-Alta hosts rejected;
+   - userinfo, fragments, unexpected paths/ports, CR/LF, and malformed URLs rejected.
+3. Write failing error-redaction tests proving a synthetic `va=HERMES_SENTINEL_SECRET` never appears in formatted output.
+4. Implement minimal pure helpers.
+5. Run tests and syntax checks.
+
+**Commands:**
+
+```bash
+npm test
+npm run check
+```
+
+**Expected:** all tests pass; no source code needs Electron to test URL/redaction logic.
+
+**Commit:** `test: add APT security regression harness`
+
+---
+
+## Milestone 2: Remove the Critical updater path
+
+### Task 3: Disable executable self-update completely
+
+**Objective:** Remove the current arbitrary-native-code installation surface before redesigning updates.
+
+**Files:**
+- Modify: `main.js:454-630`
+- Modify: `preload.js:25-37`
+- Modify: `renderer.js:24-34,57-61,602-712,756-760`
+- Modify: `index.html:38-41,84-106`
+- Modify: `README.md:13,68-74,166`
+- Test: `test/update-policy.test.js`
+
+**Steps:**
+
+1. Write failing source/contract tests asserting no `download-and-install-update` IPC method is exposed and no executable replacement code remains.
+2. Remove updater IPC handlers, redirect downloader, executable overwrite batch script, progress event, and install controls.
+3. Replace the UI with either no update control or a safe informational link to an authenticated/internal release page; do not download or execute anything.
+4. Remove startup network update checks.
+5. Run tests and confirm the app still starts/builds.
+
+**Acceptance:** no renderer-to-main path can download, overwrite, or launch an executable.
+
+**Commit:** `fix: remove unsafe in-place updater`
+
+---
+
+## Milestone 3: Close command injection and process-control hazards
+
+### Task 4: Replace `.bat` construction with direct process spawning
+
+**Objective:** Eliminate command injection and plaintext cookie batch files.
+
+**Files:**
+- Create: `src/proxy-launch.js`
+- Modify: `main.js:26-31,274-387`
+- Test: `test/proxy-launch.test.js`
+
+**Steps:**
+
+1. Write failing tests for CR/LF, shell metacharacters, malformed UUIDs, invalid domains, oversized cookie values, and missing helper.
+2. Define strict input contracts:
+   - deployment host comes from validated main-process session state;
+   - device UUID matches the exact supported identifier shape;
+   - cookie length is bounded and never serialised into a command string;
+   - executable path is resolved from an approved fixed location.
+3. Spawn `aware-cam-proxy.exe` directly with an argument array and `shell: false`.
+4. Remove `sanitizeBatchInput()`, temporary `.bat` files, `cmd /c start`, and cookie-bearing echo output.
+5. Capture only process ID, device ID, start time, and safe status metadata.
+6. Add a Windows-specific smoke harness that substitutes a harmless fixture executable/script and records argv without exposing the cookie.
+
+**Acceptance:** the CR/LF reproducer is rejected; no batch/command file exists; cookie is not printed or persisted.
+
+**Commit:** `fix: launch proxy without shell command files`
+
+### Task 5: Stop only APT-owned proxy processes
+
+**Objective:** Prevent “Stop Proxy” from killing unrelated helper processes.
+
+**Files:**
+- Modify: `src/proxy-launch.js`
+- Modify: `main.js:389-452`
+- Modify: `renderer.js:147-177`
+- Test: `test/proxy-launch.test.js`
+
+**Steps:**
+
+1. Write a failing test proving only tracked child process IDs are terminated.
+2. Replace `taskkill /im aware-cam-proxy.exe` with tracked-process termination.
+3. Return per-device stop results and remove dead entries from the process map.
+4. Handle already-exited and permission-denied states honestly.
+5. Verify two fixture processes: stopping one leaves the other alive.
+
+**Commit:** `fix: scope proxy termination to APT processes`
+
+---
+
+## Milestone 4: Move trust and cookies into the main process
+
+### Task 6: Replace renderer-supplied URL/cookie IPC parameters
+
+**Objective:** Prevent a compromised renderer from sending Alta cookies to arbitrary destinations.
+
+**Files:**
+- Create: `src/session-store.js`
+- Create: `src/alta-client.js`
+- Modify: `main.js:192-272`
+- Modify: `preload.js:5-12`
+- Modify: `renderer.js:225-304,714-743`
+- Test: `test/url-policy.test.js`
+- Create: `test/alta-client.test.js`
+
+**Steps:**
+
+1. Write failing tests showing API methods reject renderer-provided URL/cookie fields.
+2. Store deployment origin and cookie only in main-process memory.
+3. Expose narrow IPC calls: `getDevices()`, `getDeviceSites()`, `getAuthInfo()`, `launchProxy(deviceId)`, `disconnect()`.
+4. Revalidate HTTPS Alta origin inside the main process before every request.
+5. Disable ambient proxy use for cookie-bearing requests unless a separately reviewed explicit enterprise-proxy configuration is later required.
+6. Disable cross-origin redirects or validate every redirect before forwarding credentials.
+7. Validate `event.senderFrame` against the app’s local file origin/window.
+8. On disconnect and app quit, overwrite references and clear session state.
+
+**Acceptance:** renderer messages cannot choose a destination or supply/receive the bearer cookie.
+
+**Commit:** `fix: keep Alta session authority in the main process`
+
+### Task 7: Redact all network and process errors
+
+**Objective:** Ensure failures cannot print cookies or secret-bearing request configuration.
+
+**Files:**
+- Modify: `src/error-redaction.js`
+- Modify: `src/alta-client.js`
+- Modify: `main.js`
+- Test: `test/error-redaction.test.js`
+
+**Steps:**
+
+1. Add synthetic Axios errors containing secrets in headers, URLs, nested config, causes, and response bodies.
+2. Format only bounded fields: operation, safe error code, HTTP status, timeout flag, and a sanitised message.
+3. Remove all full-object `console.error(..., error)` calls from credential-bearing paths.
+4. Add a source scan test for forbidden logging patterns.
+5. Run a sentinel failure probe and assert zero secret occurrences in stdout/stderr.
+
+**Commit:** `fix: redact credentials from APT errors`
+
+---
+
+## Milestone 5: Replace the public hard-coded bridge secret
+
+### Task 8: Add explicit extension pairing
+
+**Objective:** Stop treating `apt-local-bridge-token` as authentication.
+
+**Recommended v1 design:** keep loopback temporarily but pair the extension to the desktop app with a random per-install secret and a stable extension identity. Native Messaging is a later option if portability/setup proves acceptable.
+
+**Files:**
+- Create: `src/bridge-auth.js`
+- Modify: `main.js:12-145`
+- Modify: `chrome-extension/manifest.json`
+- Modify: `chrome-extension/popup.js`
+- Create: `chrome-extension/options.html`
+- Create: `chrome-extension/options.js`
+- Test: `test/bridge-auth.test.js`
+- Create: `test/extension-contract.test.js`
+
+**Steps:**
+
+1. Write failing tests for missing/wrong secret, unknown extension origin, replay/rotation, oversized body, slow body, and malformed JSON.
+2. Generate a cryptographically random pairing secret and store it with user-only permissions under Electron `userData`.
+3. Add a one-time pairing flow: desktop shows code; extension stores the resulting secret in `chrome.storage.local`.
+4. Give the extension a stable ID and accept only that exact extension origin.
+5. Compare secrets in constant time.
+6. Add request/body deadlines and bounded concurrency before body reads.
+7. Rotate/revoke pairing from the desktop UI.
+8. Remove `apt-local-bridge-token` from source.
+
+**Acceptance:** a different Chrome extension cannot submit data even when it knows the source code; pairing can be revoked without reinstalling APT.
+
+**Commit:** `feat: add paired authentication for the Chrome bridge`
+
+### Task 9: Make clipboard token copying explicitly guarded
+
+**Objective:** Retain Zac’s requested copy function without presenting it as harmless.
+
+**Files:**
+- Modify: `chrome-extension/popup.html`
+- Modify: `chrome-extension/popup.js`
+- Modify: `chrome-extension/popup.css`
+- Test: `test/extension-contract.test.js`
+
+**Steps:**
+
+1. Require a deliberate confirmation for copying the full bearer token.
+2. Show a concise warning that clipboard history/synchronisation may retain it.
+3. Never auto-copy.
+4. Clear extension references immediately after the operation.
+5. Test cancellation, permission denial, missing/expired cookie, and success messaging.
+
+**Commit:** `fix: guard VA token clipboard export`
+
+---
+
+## Milestone 6: Modernise dependencies and desktop hardening
+
+### Task 10: Upgrade Electron, Axios, and packaging dependencies
+
+**Objective:** Remove known dependency blockers without mixing in feature changes.
+
+**Files:**
+- Modify: `package.json`
+- Modify: `package-lock.json`
+- Modify: `main.js:148-167`
+- Remove dependency if unused: `crypto-js`
+- Remove/replace: `electron-packager`
+
+**Steps:**
+
+1. Create a dependency-upgrade branch commit separately from behaviour changes.
+2. Upgrade Electron to a currently supported major compatible with the target Windows estate.
+3. Upgrade Axios and transitive packages to patched releases.
+4. Remove unused `crypto-js` and deprecated `electron-packager` if source/runtime scans confirm no use.
+5. Enable explicit renderer sandboxing and deny unexpected navigation/window creation.
+6. Run full tests, `npm audit`, Electron smoke, and Windows package build.
+7. Do not accept Critical/High runtime findings; document any build-only exception with CVE reachability evidence.
+
+**Acceptance:** zero Critical/High production audit findings; supported Electron line; app smoke passes.
+
+**Commit:** `chore: modernize Electron runtime and dependencies`
+
+---
+
+## Milestone 7: Canonical source and reproducible releases
+
+### Task 11: Add helper provenance without committing the binary blindly
+
+**Objective:** Make the Windows kit reproducible and auditable while respecting vendor licensing.
+
+**Files:**
+- Create: `vendor/aware-cam-proxy/README.md`
+- Create: `vendor/aware-cam-proxy/checksums.json`
+- Modify: `build-kit.ps1`
+- Modify: `README.md`
+- Create: `LICENSE`
+- Create: `THIRD_PARTY_NOTICES.md`
+
+**Steps:**
+
+1. Confirm redistribution rights for Windows/macOS helper binaries; stop if unavailable.
+2. Record approved filename, platform, architecture, version/source owner, exact size, SHA-256, and acquisition procedure.
+3. Make the kit build reject any helper that does not match the approved manifest.
+4. Replace `author: "Your Name"` and add accurate project/third-party licensing.
+5. Add ZIP content, path-safety, extension-content, executable-presence, and checksum tests.
+
+**Commit:** `build: verify proxy helper provenance in release kits`
+
+### Task 12: Recover Mac implementation into GitPeji source
+
+**Objective:** Stop treating the Tool Hub Mac ZIP as source control.
+
+**Files:**
+- Recover into: `src/proxy-launch.js`
+- Modify: `package.json`
+- Modify: `README.md`
+- Create: `docs/platforms/macos.md`
+- Test: `test/proxy-launch.test.js`
+
+**Steps:**
+
+1. Extract and diff the current Tool Hub Mac `app.asar` against the hardened source.
+2. Port only reviewed platform logic; do not copy the stripped packaged `package.json` wholesale.
+3. Reuse the direct-spawn/no-shell/session rules from Windows.
+4. Add explicit x64 and arm64 packaging targets, but publish only architectures with a matching approved helper.
+5. Test on Intel/Rosetta and a current Apple Silicon Mac.
+6. Keep Kanban `t_42bad4d3` open until native Apple Silicon/helper support is proven or Zac explicitly accepts Rosetta-only scope.
+
+**Commit:** `feat: restore reviewed macOS source and build targets`
+
+### Task 13: Add GitPeji CI and exact-commit release evidence
+
+**Objective:** Build every release from one tagged GitPeji commit with retained evidence.
+
+**Files:**
+- Create: `.gitea/workflows/ci.yml`
+- Create: `.gitea/workflows/release.yml`
+- Remove or retire: `.github/workflows/deploy-pages.yml`
+- Modify: `docs/index.html`
+- Create: `scripts/verify-kit.js`
+
+**Steps:**
+
+1. CI gate: `npm ci`, syntax, tests, audit policy, Windows unpacked build, kit verification, secret scan.
+2. Release gate: tag/version match, clean source, approved helper checksum, exact artifact hashes, SBOM, checksums, retained logs.
+3. Point docs/downloads to GitPeji or the approved Tool Hub route, never GitHub.
+4. Publish no artifact automatically until the first manual release rehearsal passes.
+5. Rehearse on a non-production candidate tag and verify fresh download/extraction.
+
+**Commit:** `ci: add GitPeji build and release gates`
+
+---
+
+## Milestone 8: Reintroduce updates safely, if still worthwhile
+
+### Task 14: Decide whether APT actually needs in-place updates
+
+**Objective:** Avoid rebuilding a dangerous feature merely because it existed before.
+
+**Decision gate:**
+
+- Preferred simplest option: notify that a verified update exists and open the trusted Tool Hub/GitPeji release page; user installs it manually.
+- In-place update is allowed only if code signing, digest verification, rollback, and platform-specific testing are available.
+
+**Deliverable:** `docs/decisions/0001-update-strategy.md`
+
+**Commit:** `docs: decide APT update strategy`
+
+### Task 15: Implement a verified updater only if the decision approves it
+
+**Objective:** Bind installation to an exact trusted release.
+
+**Files:**
+- Create: `src/update-manifest.js`
+- Create: `src/updater.js`
+- Modify: `main.js`
+- Modify: `preload.js`
+- Test: `test/update-policy.test.js`
+
+**Required tests:** wrong host, redirect host change, wrong size, wrong SHA-256, wrong signature, downgrade, wrong platform/architecture, truncated body, oversized body, interrupted download, failed replacement, successful rollback.
+
+**Acceptance:** only a manifest-authenticated, platform-matched artifact can reach replacement code; failure leaves the installed executable intact.
+
+**Commit:** `feat: add manifest-verified GitPeji updates`
+
+---
+
+## Milestone 9: Closure and controlled release
+
+### Task 16: Run adversarial security closure review
+
+**Objective:** Independently prove every Critical/Important finding is closed.
+
+**Required probes:**
+
+- arbitrary updater URL cannot execute;
+- CR/LF proxy parameters cannot become commands;
+- renderer cannot choose request destination or supply cookies;
+- Axios failures contain no sentinel secret;
+- bridge rejects unknown extension/wrong secret/slow bodies;
+- cookies never appear in files, process command strings, logs, tests, ZIP metadata, or analytics;
+- stop affects only APT-owned child processes;
+- dependency audit and Electron support policy pass.
+
+**Output:** finding-to-fix closure matrix with exact tests and commit.
+
+### Task 17: Build a DEV release candidate and preserve production
+
+**Objective:** Give Zac a testable candidate without replacing current downloads.
+
+**Steps:**
+
+1. Query usage/confirm release lane before changing Tool Hub visibility.
+2. Build exact tagged candidate and record artifact SHA-256.
+3. Publish only to an isolated DEV/download location clearly marked pre-release.
+4. Run Windows app, extension pairing, device discovery, proxy launch/stop, disconnect, error, and update-notification workflows.
+5. Verify current production Tool Hub/download hashes did not change.
+6. Request Zac acceptance.
+
+### Task 18: Promote only the accepted exact artifact
+
+**Objective:** Replace the existing release safely and reversibly.
+
+**Steps:**
+
+1. Preserve current Windows/Mac kits and hashes as rollback artifacts.
+2. Promote the exact accepted candidate—do not rebuild.
+3. Verify GitPeji tag/release, Tool Hub route, download size/hash, extension contents, Windows smoke, and analytics.
+4. Keep Mac separate until its own acceptance gate passes.
+5. Remove temporary DEV artifacts only after production verification and rollback proof.
+
+---
+
+## Feature roadmap gate
+
+### Task 19: Capture and prioritise new functions with Zac
+
+**Objective:** Turn feature ideas into a safe, ordered backlog after the red flags are closed.
+
+For each feature record:
+
+- user/problem and field-engineer value;
+- exact user journey;
+- read versus write operations;
+- Alta endpoints/data required;
+- cookie/session impact;
+- local helper/process impact;
+- Windows/macOS parity expectation;
+- failure and offline behaviour;
+- acceptance tests;
+- release risk and whether it can remain DEV-only.
+
+**Suggested buckets for the discussion:**
+
+1. **Proxy workflow improvements:** multi-camera queue, per-camera status, retry/diagnostics, safe logs.
+2. **Commissioning:** thumbnail/stream health, recording/site checks, readiness report.
+3. **Troubleshooting:** streams debug, recent alerts, support bundle.
+4. **Operator UX:** saved non-secret deployment aliases, clearer helper detection, version/support panel.
+5. **Platform:** native Apple Silicon, managed extension packaging, enterprise deployment.
+
+Do not implement feature buckets during the hardening branch. Create separate feature branches from the accepted security foundation.
+
+---
+
+## Definition of “major red flags fixed”
+
+All must be true:
+
+- [ ] Unsafe updater removed or cryptographically verified.
+- [ ] No shell/batch construction from user or renderer data.
+- [ ] Main process owns deployment origin and cookies.
+- [ ] Privileged IPC validates sender and strict schemas.
+- [ ] No cookie in logs, files, command strings, or automatic clipboard actions.
+- [ ] Loopback bridge uses revocable pairing and exact extension identity.
+- [ ] Proxy stop is process-scoped.
+- [ ] Supported Electron/Axios versions; no Critical/High runtime audit findings.
+- [ ] Automated tests and GitPeji CI pass.
+- [ ] Windows kit is exact-commit reproducible with helper provenance.
+- [ ] Mac source is canonical or Mac distribution remains explicitly withheld.
+- [ ] Independent security closure review returns PASS.
+- [ ] Existing production/download state remains unchanged until Zac approves promotion.
diff --git a/docs/security/2026-08-security-baseline.md b/docs/security/2026-08-security-baseline.md
new file mode 100644
index 0000000..d85bfd4
--- /dev/null
+++ b/docs/security/2026-08-security-baseline.md
@@ -0,0 +1,18 @@
+# APT security hardening baseline
+
+- Canonical source: GitPeji `peji/Alta-Proxy-Tool`
+- Starting commit: `a80074ac57b7a4517837b5d95754f5e6433df3ac`
+- Branch: `hardening/security-foundation`
+- Original review: `/home/peji/.hermes/reports/alta-proxy-tool-full-review-2026-08-19.md`
+- Implementation plan: `docs/plans/2026-08-19-apt-security-foundation.md`
+- Starting package version: `1.0.0`
+- Starting audit: 25 findings (1 critical, 22 high, 2 moderate); production-only audit 3 findings (2 high, 1 moderate)
+- Starting release state: GitPeji/GitHub split-brain, no application CI, unsafe unsigned updater, no automated tests
+
+## Guardrails
+
+- GitPeji only; GitHub remote removed.
+- Production Tool Hub and existing downloads remain unchanged.
+- Synthetic sentinel credentials only in tests.
+- Work remains on the isolated hardening branch until review gates pass.
+- No feature additions until Critical/Important security closure.

From ceaa0bfdceb6f809c7a3be57c1edf22174113a51 Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Wed, 19 Aug 2026 21:18:18 +0000
Subject: [PATCH 02/22] feat: add safe GitPeji update checks

---
 src/update-policy.js       | 297 +++++++++++++++++++++++++++++++++++++
 test/update-policy.test.js | 190 ++++++++++++++++++++++++
 2 files changed, 487 insertions(+)
 create mode 100644 src/update-policy.js
 create mode 100644 test/update-policy.test.js

diff --git a/src/update-policy.js b/src/update-policy.js
new file mode 100644
index 0000000..b01a3a1
--- /dev/null
+++ b/src/update-policy.js
@@ -0,0 +1,297 @@
+'use strict';
+
+const https = require('node:https');
+
+const LATEST_RELEASE_URL = 'https://git.pejicorp.com/api/v1/repos/peji/Alta-Proxy-Tool/releases/latest';
+const RELEASES_PAGE_URL = 'https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases';
+const REQUEST_TIMEOUT_MS = 5000;
+const MAX_BODY_BYTES = 64 * 1024;
+const MAX_RELEASE_NAME_LENGTH = 200;
+
+// SemVer 2.0.0 without loose forms such as a leading "v" or omitted fields.
+const SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
+
+class UpdatePolicyError extends Error {
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = 'UpdatePolicyError';
+    this.code = code;
+  }
+}
+
+function policyError(code, message, cause) {
+  return new UpdatePolicyError(code, message, cause ? { cause } : undefined);
+}
+
+function parseSemver(version, errorCode = 'INVALID_VERSION') {
+  if (typeof version !== 'string') {
+    throw policyError(errorCode, 'Version must be a strict semantic version string');
+  }
+
+  const match = SEMVER_PATTERN.exec(version);
+  if (!match) {
+    throw policyError(errorCode, 'Version must use strict SemVer 2.0.0 syntax');
+  }
+
+  return {
+    major: BigInt(match[1]),
+    minor: BigInt(match[2]),
+    patch: BigInt(match[3]),
+    prerelease: match[4] === undefined ? null : match[4].split('.'),
+  };
+}
+
+function compareIdentifier(left, right) {
+  const leftNumeric = /^\d+$/.test(left);
+  const rightNumeric = /^\d+$/.test(right);
+
+  if (leftNumeric && rightNumeric) {
+    const leftNumber = BigInt(left);
+    const rightNumber = BigInt(right);
+    return leftNumber < rightNumber ? -1 : leftNumber > rightNumber ? 1 : 0;
+  }
+  if (leftNumeric !== rightNumeric) {
+    return leftNumeric ? -1 : 1;
+  }
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+function compareSemver(leftVersion, rightVersion) {
+  const left = parseSemver(leftVersion);
+  const right = parseSemver(rightVersion);
+
+  for (const key of ['major', 'minor', 'patch']) {
+    if (left[key] < right[key]) return -1;
+    if (left[key] > right[key]) return 1;
+  }
+
+  if (left.prerelease === null && right.prerelease === null) return 0;
+  if (left.prerelease === null) return 1;
+  if (right.prerelease === null) return -1;
+
+  const count = Math.max(left.prerelease.length, right.prerelease.length);
+  for (let index = 0; index < count; index += 1) {
+    if (left.prerelease[index] === undefined) return -1;
+    if (right.prerelease[index] === undefined) return 1;
+    const comparison = compareIdentifier(left.prerelease[index], right.prerelease[index]);
+    if (comparison !== 0) return comparison;
+  }
+  return 0;
+}
+
+function sanitizeText(value) {
+  return value
+    .trim()
+    .slice(0, MAX_RELEASE_NAME_LENGTH)
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;');
+}
+
+function validateRuntimeValue(value, field) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > 64 || !/^[a-zA-Z0-9_-]+$/.test(value)) {
+    throw policyError('INVALID_RUNTIME_METADATA', `Invalid ${field} metadata`);
+  }
+  return value;
+}
+
+function parseRelease(body) {
+  let release;
+  try {
+    release = JSON.parse(body.toString('utf8'));
+  } catch (error) {
+    throw policyError('INVALID_RESPONSE', 'Release response was not valid JSON', error);
+  }
+
+  if (!release || typeof release !== 'object' || Array.isArray(release)) {
+    throw policyError('INVALID_RESPONSE', 'Release response must be an object');
+  }
+  if (typeof release.tag_name !== 'string' || release.tag_name.length > 128) {
+    throw policyError('INVALID_RESPONSE', 'Release tag_name must be a bounded string');
+  }
+  if (release.name !== undefined && release.name !== null && typeof release.name !== 'string') {
+    throw policyError('INVALID_RESPONSE', 'Release name must be a string when provided');
+  }
+  if (typeof release.name === 'string' && release.name.length > 1000) {
+    throw policyError('INVALID_RESPONSE', 'Release name exceeds the schema limit');
+  }
+  if (release.published_at !== undefined && release.published_at !== null && typeof release.published_at !== 'string') {
+    throw policyError('INVALID_RESPONSE', 'Release published_at must be a string when provided');
+  }
+
+  let publishedAt;
+  if (typeof release.published_at === 'string') {
+    if (release.published_at.length > 64) {
+      throw policyError('INVALID_RESPONSE', 'Release published_at exceeds the schema limit');
+    }
+    const timestamp = new Date(release.published_at);
+    if (Number.isNaN(timestamp.getTime())) {
+      throw policyError('INVALID_RESPONSE', 'Release published_at must be a valid timestamp');
+    }
+    publishedAt = timestamp.toISOString();
+  }
+
+  return {
+    latestVersion: release.tag_name,
+    releaseName: sanitizeText(release.name || release.tag_name),
+    publishedAt,
+  };
+}
+
+function defaultRequest({ url, timeoutMs, maxBodyBytes }) {
+  if (url !== LATEST_RELEASE_URL) {
+    return Promise.reject(policyError('UNTRUSTED_REQUEST_URL', 'Update checks are restricted to GitPeji'));
+  }
+
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finishReject = (error) => {
+      if (!settled) {
+        settled = true;
+        reject(error);
+      }
+    };
+
+    const request = https.get(url, {
+      headers: {
+        accept: 'application/json',
+        'user-agent': 'Alta-Proxy-Tool-update-check',
+      },
+      agent: false,
+    }, (response) => {
+      const chunks = [];
+      let receivedBytes = 0;
+      const contentLength = Number(response.headers['content-length']);
+
+      if (Number.isFinite(contentLength) && contentLength > maxBodyBytes) {
+        response.destroy();
+        finishReject(policyError('RESPONSE_TOO_LARGE', 'Release response exceeded the size limit'));
+        return;
+      }
+
+      response.on('data', (chunk) => {
+        receivedBytes += chunk.length;
+        if (receivedBytes > maxBodyBytes) {
+          response.destroy();
+          finishReject(policyError('RESPONSE_TOO_LARGE', 'Release response exceeded the size limit'));
+          return;
+        }
+        chunks.push(chunk);
+      });
+      response.on('end', () => {
+        if (settled) return;
+        settled = true;
+        resolve({
+          statusCode: response.statusCode,
+          headers: response.headers,
+          body: Buffer.concat(chunks),
+          url,
+        });
+      });
+      response.on('error', finishReject);
+    });
+
+    request.setTimeout(timeoutMs, () => {
+      request.destroy(policyError('REQUEST_TIMEOUT', 'Release check timed out'));
+    });
+    request.on('error', (error) => {
+      if (error instanceof UpdatePolicyError) {
+        finishReject(error);
+      } else {
+        finishReject(policyError('REQUEST_FAILED', 'Release check failed', error));
+      }
+    });
+  });
+}
+
+async function checkForUpdate({
+  currentVersion,
+  request = defaultRequest,
+  platform = process.platform,
+  arch = process.arch,
+} = {}) {
+  parseSemver(currentVersion, 'INVALID_CURRENT_VERSION');
+  if (typeof request !== 'function') {
+    throw policyError('INVALID_REQUEST_ADAPTER', 'Request adapter must be a function');
+  }
+
+  const safePlatform = validateRuntimeValue(platform, 'platform');
+  const safeArch = validateRuntimeValue(arch, 'architecture');
+  const baseMetadata = {
+    currentVersion,
+    releasesPageUrl: RELEASES_PAGE_URL,
+    platform: safePlatform,
+    arch: safeArch,
+  };
+
+  const response = await request({
+    url: LATEST_RELEASE_URL,
+    timeoutMs: REQUEST_TIMEOUT_MS,
+    maxBodyBytes: MAX_BODY_BYTES,
+    redirects: 'error',
+  });
+
+  if (!response || typeof response !== 'object') {
+    throw policyError('INVALID_RESPONSE', 'Request adapter returned an invalid response');
+  }
+  if (response.url !== LATEST_RELEASE_URL) {
+    throw policyError('UNTRUSTED_RESPONSE_URL', 'Release response did not come from the exact GitPeji endpoint');
+  }
+
+  const statusCode = Number(response.statusCode);
+  if (statusCode >= 300 && statusCode < 400) {
+    throw policyError('REDIRECT_REJECTED', 'Release endpoint redirects are not allowed');
+  }
+  if (statusCode === 404) {
+    return { status: 'no-release', ...baseMetadata };
+  }
+  if (statusCode !== 200) {
+    throw policyError('HTTP_ERROR', `Release endpoint returned HTTP ${statusCode}`);
+  }
+
+  const contentType = response.headers && response.headers['content-type'];
+  if (typeof contentType !== 'string' || !/^application\/json(?:\s*;|$)/i.test(contentType)) {
+    throw policyError('INVALID_CONTENT_TYPE', 'Release endpoint did not return JSON');
+  }
+
+  const body = Buffer.isBuffer(response.body)
+    ? response.body
+    : typeof response.body === 'string'
+      ? Buffer.from(response.body)
+      : null;
+  if (!body) {
+    throw policyError('INVALID_RESPONSE', 'Release response body must be bytes or text');
+  }
+  if (body.length > MAX_BODY_BYTES) {
+    throw policyError('RESPONSE_TOO_LARGE', 'Release response exceeded the size limit');
+  }
+
+  const release = parseRelease(body);
+  parseSemver(release.latestVersion, 'INVALID_RELEASE_VERSION');
+
+  const metadata = {
+    status: compareSemver(release.latestVersion, currentVersion) > 0
+      ? 'update-available'
+      : 'up-to-date',
+    ...baseMetadata,
+    latestVersion: release.latestVersion,
+    releaseName: release.releaseName,
+  };
+  if (release.publishedAt !== undefined) {
+    metadata.publishedAt = release.publishedAt;
+  }
+  return metadata;
+}
+
+module.exports = {
+  LATEST_RELEASE_URL,
+  RELEASES_PAGE_URL,
+  REQUEST_TIMEOUT_MS,
+  MAX_BODY_BYTES,
+  UpdatePolicyError,
+  checkForUpdate,
+  compareSemver,
+  defaultRequest,
+};
diff --git a/test/update-policy.test.js b/test/update-policy.test.js
new file mode 100644
index 0000000..626ce3f
--- /dev/null
+++ b/test/update-policy.test.js
@@ -0,0 +1,190 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const test = require('node:test');
+
+const {
+  LATEST_RELEASE_URL,
+  RELEASES_PAGE_URL,
+  MAX_BODY_BYTES,
+  checkForUpdate,
+  compareSemver,
+} = require('../src/update-policy');
+
+function response(body, overrides = {}) {
+  return {
+    statusCode: 200,
+    headers: { 'content-type': 'application/json; charset=utf-8' },
+    body: Buffer.from(body),
+    url: LATEST_RELEASE_URL,
+    ...overrides,
+  };
+}
+
+async function rejectsWithCode(promise, code) {
+  await assert.rejects(promise, (error) => {
+    assert.equal(error.code, code);
+    return true;
+  });
+}
+
+test('valid update returns only sanitized, check-only metadata', async () => {
+  let requestOptions;
+  const request = async (options) => {
+    requestOptions = options;
+    return response(JSON.stringify({
+      id: 42,
+      tag_name: '1.2.3',
+      name: '  Security <Release>  ',
+      published_at: '2026-08-19T12:34:56Z',
+      body: 'untrusted release notes',
+      html_url: 'https://evil.example/download',
+      assets: [{ browser_download_url: 'https://evil.example/payload.exe' }],
+    }));
+  };
+
+  const result = await checkForUpdate({
+    currentVersion: '1.2.2',
+    request,
+    platform: 'win32',
+    arch: 'x64',
+  });
+
+  assert.deepEqual(requestOptions, {
+    url: LATEST_RELEASE_URL,
+    timeoutMs: 5000,
+    maxBodyBytes: MAX_BODY_BYTES,
+    redirects: 'error',
+  });
+  assert.deepEqual(result, {
+    status: 'update-available',
+    currentVersion: '1.2.2',
+    latestVersion: '1.2.3',
+    releaseName: 'Security &lt;Release&gt;',
+    publishedAt: '2026-08-19T12:34:56.000Z',
+    releasesPageUrl: RELEASES_PAGE_URL,
+    platform: 'win32',
+    arch: 'x64',
+  });
+  assert.equal(JSON.stringify(result).includes('payload.exe'), false);
+  assert.equal(JSON.stringify(result).includes('release notes'), false);
+});
+
+test('equal or older release is reported as up to date', async () => {
+  const request = async () => response(JSON.stringify({
+    tag_name: '2.0.0',
+    name: 'Current',
+    published_at: '2026-08-19T12:34:56Z',
+  }));
+
+  const result = await checkForUpdate({ currentVersion: '2.0.0', request });
+  assert.equal(result.status, 'up-to-date');
+  assert.equal(result.releasesPageUrl, RELEASES_PAGE_URL);
+});
+
+test('404 means there is no published release', async () => {
+  const request = async () => response('', { statusCode: 404 });
+  const result = await checkForUpdate({ currentVersion: '1.0.0', request });
+
+  assert.deepEqual(result, {
+    status: 'no-release',
+    currentVersion: '1.0.0',
+    releasesPageUrl: RELEASES_PAGE_URL,
+    platform: process.platform,
+    arch: process.arch,
+  });
+});
+
+test('malformed JSON and invalid response schema fail closed', async () => {
+  await rejectsWithCode(
+    checkForUpdate({ currentVersion: '1.0.0', request: async () => response('{') }),
+    'INVALID_RESPONSE',
+  );
+  await rejectsWithCode(
+    checkForUpdate({ currentVersion: '1.0.0', request: async () => response('[]') }),
+    'INVALID_RESPONSE',
+  );
+  await rejectsWithCode(
+    checkForUpdate({
+      currentVersion: '1.0.0',
+      request: async () => response(JSON.stringify({ tag_name: '1.1.0', name: 7 })),
+    }),
+    'INVALID_RESPONSE',
+  );
+});
+
+test('oversized bodies fail before parsing', async () => {
+  const oversized = Buffer.alloc(MAX_BODY_BYTES + 1, 0x20);
+  await rejectsWithCode(
+    checkForUpdate({
+      currentVersion: '1.0.0',
+      request: async () => response('', { body: oversized }),
+    }),
+    'RESPONSE_TOO_LARGE',
+  );
+});
+
+test('redirects and response host drift are rejected', async () => {
+  await rejectsWithCode(
+    checkForUpdate({
+      currentVersion: '1.0.0',
+      request: async () => response('', {
+        statusCode: 302,
+        headers: { location: 'https://evil.example/latest' },
+      }),
+    }),
+    'REDIRECT_REJECTED',
+  );
+
+  await rejectsWithCode(
+    checkForUpdate({
+      currentVersion: '1.0.0',
+      request: async () => response('{}', { url: 'https://evil.example/latest' }),
+    }),
+    'UNTRUSTED_RESPONSE_URL',
+  );
+});
+
+test('invalid or non-strict semver fails closed', async () => {
+  const invalidVersions = ['v1.2.3', '1.2', '01.2.3', '1.2.3.4', 'latest'];
+
+  for (const tag_name of invalidVersions) {
+    await rejectsWithCode(
+      checkForUpdate({
+        currentVersion: '1.0.0',
+        request: async () => response(JSON.stringify({ tag_name })),
+      }),
+      'INVALID_RELEASE_VERSION',
+    );
+  }
+
+  await rejectsWithCode(
+    checkForUpdate({ currentVersion: 'v1.0.0', request: async () => response('{}') }),
+    'INVALID_CURRENT_VERSION',
+  );
+});
+
+test('strict semver comparison handles prerelease precedence', () => {
+  assert.equal(compareSemver('1.0.0', '1.0.0'), 0);
+  assert.equal(compareSemver('1.0.1', '1.0.0'), 1);
+  assert.equal(compareSemver('1.0.0-alpha.2', '1.0.0-alpha.10'), -1);
+  assert.equal(compareSemver('1.0.0-rc.1', '1.0.0'), -1);
+  assert.equal(compareSemver('2.0.0+build.1', '2.0.0+build.2'), 0);
+});
+
+test('unexpected HTTP and content types fail closed', async () => {
+  await rejectsWithCode(
+    checkForUpdate({
+      currentVersion: '1.0.0',
+      request: async () => response('server error', { statusCode: 500 }),
+    }),
+    'HTTP_ERROR',
+  );
+  await rejectsWithCode(
+    checkForUpdate({
+      currentVersion: '1.0.0',
+      request: async () => response('{}', { headers: { 'content-type': 'text/html' } }),
+    }),
+    'INVALID_CONTENT_TYPE',
+  );
+});

From f5cfdd8560a1926c1acfd1ea0eac7df87bef69ea Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Wed, 19 Aug 2026 21:19:20 +0000
Subject: [PATCH 03/22] fix: add shell-free proxy process manager

---
 src/proxy-launch.js       | 211 +++++++++++++++++++++++++
 test/proxy-launch.test.js | 318 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 529 insertions(+)
 create mode 100644 src/proxy-launch.js
 create mode 100644 test/proxy-launch.test.js

diff --git a/src/proxy-launch.js b/src/proxy-launch.js
new file mode 100644
index 0000000..aef53c2
--- /dev/null
+++ b/src/proxy-launch.js
@@ -0,0 +1,211 @@
+'use strict';
+
+const nodeFs = require('node:fs');
+const nodePath = require('node:path');
+const { spawn: nodeSpawn } = require('node:child_process');
+
+const HELPER_FILENAME = 'aware-cam-proxy.exe';
+const MAX_COOKIE_LENGTH = 4096;
+const MAX_HOST_LENGTH = 253;
+const DEVICE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const ALTA_SUFFIXES = ['.avasecurity.com', '.avigilon.com'];
+
+class ProxyLaunchError extends Error {
+  constructor(message, code) {
+    super(message);
+    this.name = 'ProxyLaunchError';
+    this.code = code;
+  }
+}
+
+function validateDeploymentHost(value) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_HOST_LENGTH) {
+    throw new ProxyLaunchError('Deployment host is invalid.', 'INVALID_DEPLOYMENT_HOST');
+  }
+
+  const host = value.toLowerCase();
+  const labels = host.split('.');
+  const hasAltaSuffix = ALTA_SUFFIXES.some((suffix) => host.endsWith(suffix));
+  if (!hasAltaSuffix || labels.some((label) => !DNS_LABEL_PATTERN.test(label))) {
+    throw new ProxyLaunchError('Deployment host is invalid.', 'INVALID_DEPLOYMENT_HOST');
+  }
+
+  return host;
+}
+
+function validateDeviceId(value) {
+  if (typeof value !== 'string' || value.length !== 36 || !DEVICE_ID_PATTERN.test(value)) {
+    throw new ProxyLaunchError('Device identifier is invalid.', 'INVALID_DEVICE_ID');
+  }
+  return value.toLowerCase();
+}
+
+function validateCookie(value) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_COOKIE_LENGTH) {
+    throw new ProxyLaunchError('Cookie is invalid.', 'INVALID_COOKIE');
+  }
+  if (/[\u0000-\u001f\u007f]/.test(value)) {
+    throw new ProxyLaunchError('Cookie must not contain control characters.', 'INVALID_COOKIE');
+  }
+  return value;
+}
+
+function redactMessage(error, secret) {
+  const source = error && typeof error.message === 'string' ? error.message : 'Unknown process error';
+  const withoutSecret = secret ? source.split(secret).join('[REDACTED]') : source;
+  return withoutSecret.replace(/[\u0000-\u001f\u007f]/g, ' ').slice(0, 512);
+}
+
+function safeMetadata(entry, status = entry.status) {
+  return {
+    processId: entry.processId,
+    deviceId: entry.deviceId,
+    startedAt: entry.startedAt,
+    status
+  };
+}
+
+function createProxyManager({
+  appDirectory,
+  fs = nodeFs,
+  spawn = nodeSpawn,
+  platform = process.platform,
+  now = Date.now
+} = {}) {
+  if (platform !== 'win32') {
+    throw new ProxyLaunchError('Proxy helper is supported only on the Windows platform.', 'UNSUPPORTED_PLATFORM');
+  }
+  if (typeof appDirectory !== 'string' || !nodePath.win32.isAbsolute(appDirectory)) {
+    throw new ProxyLaunchError('Approved application directory must be an absolute path.', 'INVALID_APP_DIRECTORY');
+  }
+  if (typeof fs.existsSync !== 'function' || typeof spawn !== 'function' || typeof now !== 'function') {
+    throw new TypeError('Invalid proxy manager dependency.');
+  }
+
+  const helperPath = nodePath.win32.join(appDirectory, HELPER_FILENAME);
+  const trackedChildren = new Map();
+
+  function removeIfOwned(processId, child) {
+    const current = trackedChildren.get(processId);
+    if (current && current.child === child) trackedChildren.delete(processId);
+  }
+
+  function launchProxy(request) {
+    if (!request || typeof request !== 'object' || Array.isArray(request)) {
+      throw new ProxyLaunchError('Proxy launch request is invalid.', 'INVALID_REQUEST');
+    }
+
+    const deploymentHost = validateDeploymentHost(request.deploymentHost);
+    const deviceId = validateDeviceId(request.deviceId);
+    const cookie = validateCookie(request.cookie);
+
+    if (!fs.existsSync(helperPath)) {
+      throw new ProxyLaunchError('Proxy helper was not found in the approved application directory.', 'HELPER_NOT_FOUND');
+    }
+
+    let child;
+    try {
+      child = spawn(
+        helperPath,
+        ['-a', deploymentHost, '-d', deviceId, '-k', cookie],
+        {
+          shell: false,
+          detached: false,
+          stdio: 'ignore',
+          windowsHide: false
+        }
+      );
+    } catch (error) {
+      throw new ProxyLaunchError(
+        `Failed to launch proxy helper: ${redactMessage(error, cookie)}`,
+        'SPAWN_FAILED'
+      );
+    }
+
+    if (!child || !Number.isSafeInteger(child.pid) || child.pid <= 0 || typeof child.kill !== 'function') {
+      throw new ProxyLaunchError('Proxy helper did not return a valid child process.', 'INVALID_CHILD_PROCESS');
+    }
+    if (trackedChildren.has(child.pid)) {
+      try {
+        child.kill('SIGTERM');
+      } catch {
+        // The new child is deliberately not tracked when its PID collides.
+      }
+      throw new ProxyLaunchError('Proxy helper returned a process identifier already in use.', 'DUPLICATE_PROCESS_ID');
+    }
+
+    const entry = {
+      child,
+      processId: child.pid,
+      deviceId,
+      startedAt: now(),
+      status: 'running'
+    };
+    trackedChildren.set(entry.processId, entry);
+
+    if (typeof child.once === 'function') {
+      child.once('exit', () => removeIfOwned(entry.processId, child));
+      child.once('error', () => removeIfOwned(entry.processId, child));
+    }
+
+    return { success: true, ...safeMetadata(entry) };
+  }
+
+  function stopProxy(processId) {
+    if (!Number.isSafeInteger(processId) || processId <= 0) {
+      throw new ProxyLaunchError('Process identifier is invalid.', 'INVALID_PROCESS_ID');
+    }
+
+    const entry = trackedChildren.get(processId);
+    if (!entry) return { success: false, processId, status: 'not-tracked' };
+
+    try {
+      const requested = entry.child.kill('SIGTERM');
+      if (!requested) {
+        removeIfOwned(processId, entry.child);
+        return {
+          success: true,
+          processId,
+          deviceId: entry.deviceId,
+          status: 'already-exited'
+        };
+      }
+
+      removeIfOwned(processId, entry.child);
+      return {
+        success: true,
+        processId,
+        deviceId: entry.deviceId,
+        status: 'stop-requested'
+      };
+    } catch (error) {
+      const permissionDenied = error && (error.code === 'EPERM' || error.code === 'EACCES');
+      return {
+        success: false,
+        processId,
+        deviceId: entry.deviceId,
+        status: permissionDenied ? 'permission-denied' : 'stop-failed',
+        message: permissionDenied
+          ? 'Unable to stop the tracked proxy process: permission denied.'
+          : 'Unable to stop the tracked proxy process.'
+      };
+    }
+  }
+
+  function listTrackedProxies() {
+    return Array.from(trackedChildren.values(), (entry) => safeMetadata(entry));
+  }
+
+  return Object.freeze({ launchProxy, stopProxy, listTrackedProxies });
+}
+
+module.exports = {
+  HELPER_FILENAME,
+  MAX_COOKIE_LENGTH,
+  ProxyLaunchError,
+  createProxyManager,
+  validateCookie,
+  validateDeploymentHost,
+  validateDeviceId
+};
diff --git a/test/proxy-launch.test.js b/test/proxy-launch.test.js
new file mode 100644
index 0000000..373e7ff
--- /dev/null
+++ b/test/proxy-launch.test.js
@@ -0,0 +1,318 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { EventEmitter } = require('node:events');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const MODULE_PATH = '../src/proxy-launch';
+const APPROVED_DIRECTORY = 'C:\\Program Files\\Alta Proxy Tool';
+const APPROVED_HELPER = 'C:\\Program Files\\Alta Proxy Tool\\aware-cam-proxy.exe';
+const VALID_HOST = 'tenant.avasecurity.com';
+const VALID_DEVICE_ID = '123e4567-e89b-42d3-a456-426614174000';
+const SYNTHETIC_COOKIE = 'va=HERMES_SENTINEL_SECRET';
+
+function loadModule() {
+  return require(MODULE_PATH);
+}
+
+class FakeChild extends EventEmitter {
+  constructor(pid, killResult = true) {
+    super();
+    this.pid = pid;
+    this.killResult = killResult;
+    this.killCalls = [];
+    this.killError = null;
+  }
+
+  kill(signal) {
+    this.killCalls.push(signal);
+    if (this.killError) throw this.killError;
+    return this.killResult;
+  }
+}
+
+function createHarness({ helperExists = true, children = [new FakeChild(4101)] } = {}) {
+  const calls = [];
+  let childIndex = 0;
+  const spawn = (...args) => {
+    calls.push(args);
+    return children[childIndex++];
+  };
+  const fsStub = { existsSync: (candidate) => helperExists && candidate === APPROVED_HELPER };
+  const { createProxyManager } = loadModule();
+  const manager = createProxyManager({
+    appDirectory: APPROVED_DIRECTORY,
+    fs: fsStub,
+    spawn,
+    platform: 'win32',
+    now: () => 1_777_777_777_777
+  });
+  return { manager, calls, children };
+}
+
+function validRequest(overrides = {}) {
+  return {
+    deploymentHost: VALID_HOST,
+    deviceId: VALID_DEVICE_ID,
+    cookie: SYNTHETIC_COOKIE,
+    ...overrides
+  };
+}
+
+test('exports the proxy manager module', () => {
+  assert.doesNotThrow(() => loadModule());
+});
+
+test('launches the approved helper directly with exact argv and shell disabled', () => {
+  const { manager, calls } = createHarness();
+
+  const result = manager.launchProxy(validRequest());
+
+  assert.deepEqual(calls, [[
+    APPROVED_HELPER,
+    ['-a', VALID_HOST, '-d', VALID_DEVICE_ID, '-k', SYNTHETIC_COOKIE],
+    {
+      shell: false,
+      detached: false,
+      stdio: 'ignore',
+      windowsHide: false
+    }
+  ]]);
+  assert.deepEqual(result, {
+    success: true,
+    processId: 4101,
+    deviceId: VALID_DEVICE_ID,
+    startedAt: 1_777_777_777_777,
+    status: 'running'
+  });
+});
+
+test('passes cookie metacharacters literally in argv without invoking a shell', () => {
+  const cookie = 'va=abc&whoami|calc.exe;<>()^%!"`$';
+  const { manager, calls } = createHarness();
+
+  manager.launchProxy(validRequest({ cookie }));
+
+  assert.equal(calls[0][1][5], cookie);
+  assert.equal(calls[0][2].shell, false);
+});
+
+test('rejects the CRLF calc.exe reproducer in every structured input', () => {
+  const { manager, calls } = createHarness();
+  const attacks = [
+    { deploymentHost: `${VALID_HOST}\r\ncalc.exe` },
+    { deviceId: `${VALID_DEVICE_ID}\r\ncalc.exe` },
+    { cookie: `${SYNTHETIC_COOKIE}\r\ncalc.exe` },
+    { cookie: `${SYNTHETIC_COOKIE}\0calc.exe` }
+  ];
+
+  for (const attack of attacks) {
+    assert.throws(() => manager.launchProxy(validRequest(attack)), /invalid|must not contain/i);
+  }
+  assert.equal(calls.length, 0);
+});
+
+test('rejects shell metacharacters in deployment hosts and device identifiers', () => {
+  const { manager, calls } = createHarness();
+  for (const deploymentHost of [
+    'tenant.avasecurity.com&calc.exe',
+    'tenant.avasecurity.com|calc.exe',
+    'https://tenant.avasecurity.com',
+    'tenant.avasecurity.com/path',
+    'tenant.avasecurity.com:443'
+  ]) {
+    assert.throws(() => manager.launchProxy(validRequest({ deploymentHost })), /deployment host/i);
+  }
+  for (const deviceId of [
+    `${VALID_DEVICE_ID}&calc.exe`,
+    `${VALID_DEVICE_ID}|calc.exe`,
+    '$(calc.exe)'
+  ]) {
+    assert.throws(() => manager.launchProxy(validRequest({ deviceId })), /device identifier/i);
+  }
+  assert.equal(calls.length, 0);
+});
+
+test('accepts only strict canonical UUID device identifiers', () => {
+  const invalidIds = [
+    '',
+    '123e4567-e89b-12d3-a456-42661417400',
+    '123e4567e89b42d3a456426614174000',
+    '123e4567-e89b-02d3-a456-426614174000',
+    '123e4567-e89b-42d3-c456-426614174000',
+    'g23e4567-e89b-42d3-a456-426614174000',
+    'a'.repeat(37)
+  ];
+
+  for (const deviceId of invalidIds) {
+    const { manager } = createHarness();
+    assert.throws(() => manager.launchProxy(validRequest({ deviceId })), /device identifier/i);
+  }
+});
+
+test('accepts only bounded Alta subdomain hostnames from trusted session state', () => {
+  const invalidHosts = [
+    '',
+    'avasecurity.com',
+    'avigilon.com',
+    'evil.example',
+    'tenant.avasecurity.com.evil.example',
+    '.avasecurity.com',
+    '-tenant.avasecurity.com',
+    'tenant..avasecurity.com',
+    'tenant_avasecurity.com',
+    `tenant.${'a'.repeat(240)}.avasecurity.com`
+  ];
+
+  for (const deploymentHost of invalidHosts) {
+    const { manager } = createHarness();
+    assert.throws(() => manager.launchProxy(validRequest({ deploymentHost })), /deployment host/i);
+  }
+});
+
+test('normalizes a valid Alta hostname to lowercase', () => {
+  const { manager, calls } = createHarness();
+  manager.launchProxy(validRequest({ deploymentHost: 'Tenant.AVIGILON.com' }));
+  assert.equal(calls[0][1][1], 'tenant.avigilon.com');
+});
+
+test('rejects empty, oversized, and control-character cookies', () => {
+  for (const cookie of ['', 'x'.repeat(4097), 'va=abc\nxyz', 'va=abc\rxyz', 'va=abc\0xyz']) {
+    const { manager } = createHarness();
+    assert.throws(() => manager.launchProxy(validRequest({ cookie })), /cookie/i);
+  }
+});
+
+test('fails closed when the fixed helper is missing and never spawns', () => {
+  const { manager, calls } = createHarness({ helperExists: false });
+  assert.throws(() => manager.launchProxy(validRequest()), /helper.*not found/i);
+  assert.equal(calls.length, 0);
+});
+
+test('requires an absolute approved application directory and Windows platform', () => {
+  const { createProxyManager } = loadModule();
+  const dependencies = { fs: { existsSync: () => true }, spawn: () => new FakeChild(1) };
+
+  assert.throws(
+    () => createProxyManager({ appDirectory: '..\\untrusted', platform: 'win32', ...dependencies }),
+    /absolute/i
+  );
+  assert.throws(
+    () => createProxyManager({ appDirectory: '/opt/apt', platform: 'linux', ...dependencies }),
+    /platform/i
+  );
+});
+
+test('redacts the cookie if spawn throws an error containing it', () => {
+  const { createProxyManager } = loadModule();
+  const manager = createProxyManager({
+    appDirectory: APPROVED_DIRECTORY,
+    fs: { existsSync: () => true },
+    platform: 'win32',
+    spawn: () => { throw new Error(`spawn failed for ${SYNTHETIC_COOKIE}`); }
+  });
+
+  assert.throws(
+    () => manager.launchProxy(validRequest()),
+    (error) => {
+      assert.match(error.message, /spawn failed/);
+      assert.match(error.message, /\[REDACTED\]/);
+      assert.doesNotMatch(error.message, /HERMES_SENTINEL_SECRET/);
+      return true;
+    }
+  );
+});
+
+test('tracks only safe process metadata and never exposes or persists cookies', () => {
+  const { manager } = createHarness();
+  manager.launchProxy(validRequest());
+
+  const tracked = manager.listTrackedProxies();
+  assert.deepEqual(tracked, [{
+    processId: 4101,
+    deviceId: VALID_DEVICE_ID,
+    startedAt: 1_777_777_777_777,
+    status: 'running'
+  }]);
+  assert.doesNotMatch(JSON.stringify(tracked), /HERMES_SENTINEL_SECRET/);
+});
+
+test('stopping one tracked process leaves the other tracked process alive', () => {
+  const first = new FakeChild(4101);
+  const second = new FakeChild(4102);
+  const { manager } = createHarness({ children: [first, second] });
+  manager.launchProxy(validRequest());
+  manager.launchProxy(validRequest({ deviceId: '123e4567-e89b-42d3-a456-426614174001' }));
+
+  const result = manager.stopProxy(4101);
+
+  assert.deepEqual(result, {
+    success: true,
+    processId: 4101,
+    deviceId: VALID_DEVICE_ID,
+    status: 'stop-requested'
+  });
+  assert.deepEqual(first.killCalls, ['SIGTERM']);
+  assert.deepEqual(second.killCalls, []);
+  assert.deepEqual(manager.listTrackedProxies().map((item) => item.processId), [4102]);
+});
+
+test('never stops an untracked PID', () => {
+  const child = new FakeChild(4101);
+  const { manager } = createHarness({ children: [child] });
+  manager.launchProxy(validRequest());
+
+  assert.deepEqual(manager.stopProxy(9999), {
+    success: false,
+    processId: 9999,
+    status: 'not-tracked'
+  });
+  assert.deepEqual(child.killCalls, []);
+});
+
+test('reports already-exited and permission-denied states honestly', () => {
+  const exited = new FakeChild(4101, false);
+  const denied = new FakeChild(4102);
+  denied.killError = Object.assign(new Error('operation not permitted'), { code: 'EPERM' });
+  const { manager } = createHarness({ children: [exited, denied] });
+  manager.launchProxy(validRequest());
+  manager.launchProxy(validRequest({ deviceId: '123e4567-e89b-42d3-a456-426614174001' }));
+
+  assert.deepEqual(manager.stopProxy(4101), {
+    success: true,
+    processId: 4101,
+    deviceId: VALID_DEVICE_ID,
+    status: 'already-exited'
+  });
+  assert.deepEqual(manager.stopProxy(4102), {
+    success: false,
+    processId: 4102,
+    deviceId: '123e4567-e89b-42d3-a456-426614174001',
+    status: 'permission-denied',
+    message: 'Unable to stop the tracked proxy process: permission denied.'
+  });
+  assert.deepEqual(manager.listTrackedProxies().map((item) => item.processId), [4102]);
+});
+
+test('exit events remove only the matching owned child', () => {
+  const original = new FakeChild(4101);
+  const replacement = new FakeChild(4101);
+  const { manager } = createHarness({ children: [original, replacement] });
+  manager.launchProxy(validRequest());
+  original.emit('exit', 0);
+  manager.launchProxy(validRequest({ deviceId: '123e4567-e89b-42d3-a456-426614174001' }));
+
+  original.emit('exit', 0);
+
+  assert.deepEqual(manager.listTrackedProxies().map((item) => item.processId), [4101]);
+});
+
+test('source contains no shell launchers, broad process killers, or persistence APIs', () => {
+  const source = fs.readFileSync(path.join(__dirname, '..', 'src', 'proxy-launch.js'), 'utf8');
+  assert.doesNotMatch(source, /\b(?:cmd(?:\.exe)?|powershell|taskkill|pkill|wmic)\b/i);
+  assert.doesNotMatch(source, /\.(?:bat|command)\b/i);
+  assert.doesNotMatch(source, /(?:writeFile|appendFile|mkdtemp|tmpdir)/);
+  assert.match(source, /shell:\s*false/);
+});

From b503b5777a7ac071d9c28118d83b422b53cdf85e Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Wed, 19 Aug 2026 21:22:17 +0000
Subject: [PATCH 04/22] fix: add main-process Alta session boundary

---
 src/alta-client.js           | 255 +++++++++++++++++++++++++++++++++++
 src/error-redaction.js       |  85 ++++++++++++
 src/session-store.js         |  81 +++++++++++
 src/url-policy.js            |  92 +++++++++++++
 test/alta-client.test.js     | 176 ++++++++++++++++++++++++
 test/error-redaction.test.js | 109 +++++++++++++++
 test/session-store.test.js   |  58 ++++++++
 test/url-policy.test.js      |  57 ++++++++
 8 files changed, 913 insertions(+)
 create mode 100644 src/alta-client.js
 create mode 100644 src/error-redaction.js
 create mode 100644 src/session-store.js
 create mode 100644 src/url-policy.js
 create mode 100644 test/alta-client.test.js
 create mode 100644 test/error-redaction.test.js
 create mode 100644 test/session-store.test.js
 create mode 100644 test/url-policy.test.js

diff --git a/src/alta-client.js b/src/alta-client.js
new file mode 100644
index 0000000..6ea04ce
--- /dev/null
+++ b/src/alta-client.js
@@ -0,0 +1,255 @@
+'use strict';
+
+const { canonicalizeAltaOrigin, assertSameAltaOrigin } = require('./url-policy');
+const { formatAltaError } = require('./error-redaction');
+
+const DEFAULT_TIMEOUT_MS = 10_000;
+const DEFAULT_MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+const DEFAULT_MAX_REDIRECTS = 3;
+const ENDPOINTS = Object.freeze({
+  getDevices: Object.freeze({ path: '/api/v1/devices', shape: 'array' }),
+  getDeviceSites: Object.freeze({ path: '/api/v1/deviceSites', shape: 'array' }),
+  getAuthInfo: Object.freeze({ path: '/api/v1/auth', shape: 'object' }),
+});
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+
+function altaError(code, message, extra = {}) {
+  const error = new Error(message);
+  error.code = code;
+  Object.assign(error, extra);
+  return error;
+}
+
+async function axiosTransport(options) {
+  // Lazy loading keeps pure/injected transport tests independent of installed
+  // runtime dependencies while production still uses the pinned Axios package.
+  const axios = require('axios');
+  return axios.request({
+    method: options.method,
+    url: options.url,
+    headers: options.headers,
+    timeout: options.timeout,
+    signal: options.signal,
+    proxy: false,
+    maxRedirects: 0,
+    maxContentLength: options.maxResponseBytes,
+    maxBodyLength: 0,
+    responseType: 'arraybuffer',
+    validateStatus: () => true,
+    transitional: { clarifyTimeoutError: true },
+  });
+}
+
+function normalizeHeaders(headers) {
+  if (!headers || typeof headers !== 'object') return Object.freeze({});
+  const normalized = {};
+  for (const [key, value] of Object.entries(headers)) {
+    normalized[String(key).toLowerCase()] = Array.isArray(value) ? value[0] : value;
+  }
+  return Object.freeze(normalized);
+}
+
+function measuredData(data) {
+  if (Buffer.isBuffer(data) || data instanceof Uint8Array) {
+    return { bytes: data.byteLength, raw: Buffer.from(data).toString('utf8') };
+  }
+  if (typeof data === 'string') {
+    return { bytes: Buffer.byteLength(data), raw: data };
+  }
+  if (data === undefined) {
+    throw altaError('INVALID_ALTA_RESPONSE', 'Alta transport returned no response data');
+  }
+  try {
+    const raw = JSON.stringify(data);
+    if (raw === undefined) throw new Error('not serializable');
+    return { bytes: Buffer.byteLength(raw), value: data };
+  } catch {
+    throw altaError('INVALID_ALTA_RESPONSE_DATA', 'Alta response data is malformed');
+  }
+}
+
+function parseData(data, maxBytes) {
+  const measured = measuredData(data);
+  if (measured.bytes > maxBytes) {
+    throw altaError('ALTA_RESPONSE_TOO_LARGE', 'Alta response exceeded the size limit');
+  }
+  if (Object.prototype.hasOwnProperty.call(measured, 'value')) return measured.value;
+  try {
+    return JSON.parse(measured.raw);
+  } catch {
+    throw altaError('INVALID_ALTA_RESPONSE_DATA', 'Alta response was not valid JSON');
+  }
+}
+
+function enforceResponseSize(data, headers, maxBytes) {
+  const contentLength = headers['content-length'];
+  if (contentLength !== undefined) {
+    const parsedLength = Number(contentLength);
+    if (!Number.isSafeInteger(parsedLength) || parsedLength < 0) {
+      throw altaError('INVALID_ALTA_RESPONSE', 'Alta response had an invalid content length');
+    }
+    if (parsedLength > maxBytes) {
+      throw altaError('ALTA_RESPONSE_TOO_LARGE', 'Alta response exceeded the size limit');
+    }
+  }
+  if (data !== undefined && measuredData(data).bytes > maxBytes) {
+    throw altaError('ALTA_RESPONSE_TOO_LARGE', 'Alta response exceeded the size limit');
+  }
+}
+
+function safeTransportError(operation, error, cookie) {
+  if (error && typeof error === 'object' && typeof error.code === 'string' && error.code.startsWith('ALTA_')) {
+    return error;
+  }
+  const formatted = formatAltaError(operation, error, { secrets: [cookie, `va=${cookie}`] });
+  const safe = altaError(formatted.code, formatted.message, {
+    status: formatted.status,
+    timeout: formatted.timeout,
+  });
+  return safe;
+}
+
+class AltaClient {
+  constructor({
+    sessionStore,
+    transport = axiosTransport,
+    timeoutMs = DEFAULT_TIMEOUT_MS,
+    maxResponseBytes = DEFAULT_MAX_RESPONSE_BYTES,
+    maxRedirects = DEFAULT_MAX_REDIRECTS,
+  } = {}) {
+    if (!sessionStore || typeof sessionStore.requireSession !== 'function') {
+      throw new TypeError('AltaClient requires a session store');
+    }
+    if (typeof transport !== 'function') throw new TypeError('AltaClient transport must be a function');
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > DEFAULT_TIMEOUT_MS) {
+      throw new RangeError('AltaClient timeout must be between 1 and 10000ms');
+    }
+    if (!Number.isInteger(maxResponseBytes) || maxResponseBytes < 1 || maxResponseBytes > DEFAULT_MAX_RESPONSE_BYTES) {
+      throw new RangeError('Invalid Alta response size limit');
+    }
+    if (!Number.isInteger(maxRedirects) || maxRedirects < 0 || maxRedirects > 5) {
+      throw new RangeError('Invalid Alta redirect limit');
+    }
+    this.sessionStore = sessionStore;
+    this.transport = transport;
+    this.timeoutMs = timeoutMs;
+    this.maxResponseBytes = maxResponseBytes;
+    this.maxRedirects = maxRedirects;
+  }
+
+  getDevices(...args) {
+    return this.#invoke('getDevices', args);
+  }
+
+  getDeviceSites(...args) {
+    return this.#invoke('getDeviceSites', args);
+  }
+
+  getAuthInfo(...args) {
+    return this.#invoke('getAuthInfo', args);
+  }
+
+  async #invoke(operation, args) {
+    if (args.length !== 0) {
+      throw altaError('INVALID_ALTA_ARGUMENTS', 'Alta API methods do not accept renderer parameters');
+    }
+    const endpoint = ENDPOINTS[operation];
+    const session = this.sessionStore.requireSession();
+    const origin = canonicalizeAltaOrigin(session.origin);
+    const cookie = session.cookie;
+    const deadline = Date.now() + this.timeoutMs;
+    const controller = new AbortController();
+
+    try {
+      const data = await this.#request(operation, `${origin}${endpoint.path}`, origin, cookie, deadline, controller, 0);
+      if (endpoint.shape === 'array' && !Array.isArray(data)) {
+        throw altaError('INVALID_ALTA_RESPONSE_DATA', 'Alta response did not contain an array');
+      }
+      if (endpoint.shape === 'object' && (!data || typeof data !== 'object' || Array.isArray(data))) {
+        throw altaError('INVALID_ALTA_RESPONSE_DATA', 'Alta response did not contain an object');
+      }
+      return data;
+    } catch (error) {
+      throw safeTransportError(operation, error, cookie);
+    } finally {
+      controller.abort();
+    }
+  }
+
+  async #request(operation, url, origin, cookie, deadline, controller, redirectCount) {
+    assertSameAltaOrigin(url, origin);
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw altaError('ALTA_TIMEOUT', 'Alta request timed out', { timeout: true });
+
+    let timer;
+    const timeoutPromise = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        reject(altaError('ALTA_TIMEOUT', 'Alta request timed out', { timeout: true }));
+      }, remaining);
+    });
+
+    let response;
+    try {
+      response = await Promise.race([
+        Promise.resolve(this.transport(Object.freeze({
+          method: 'GET',
+          url,
+          headers: Object.freeze({ Cookie: `va=${cookie}`, Accept: 'application/json' }),
+          timeout: remaining,
+          signal: controller.signal,
+          proxy: false,
+          maxRedirects: 0,
+          maxResponseBytes: this.maxResponseBytes,
+        }))),
+        timeoutPromise,
+      ]);
+    } finally {
+      clearTimeout(timer);
+    }
+
+    if (!response || typeof response !== 'object' || !Number.isInteger(response.status)) {
+      throw altaError('INVALID_ALTA_RESPONSE', 'Alta transport returned an invalid response');
+    }
+    const headers = normalizeHeaders(response.headers);
+    // Bound every response, including redirects and errors, before acting on it.
+    enforceResponseSize(response.data, headers, this.maxResponseBytes);
+
+    if (REDIRECT_STATUSES.has(response.status)) {
+      if (typeof headers.location !== 'string' || headers.location.length === 0) {
+        throw altaError('UNSAFE_ALTA_REDIRECT', 'Alta redirect did not contain a safe location');
+      }
+      if (redirectCount >= this.maxRedirects) {
+        throw altaError('TOO_MANY_ALTA_REDIRECTS', 'Alta response exceeded the redirect limit');
+      }
+      let target;
+      try {
+        target = new URL(headers.location, url);
+        assertSameAltaOrigin(target.href, origin);
+      } catch {
+        throw altaError('UNSAFE_ALTA_REDIRECT', 'Alta redirect changed the validated origin');
+      }
+      return this.#request(operation, target.href, origin, cookie, deadline, controller, redirectCount + 1);
+    }
+
+    if (response.status < 200 || response.status > 299) {
+      throw altaError('ALTA_HTTP_ERROR', 'Alta request returned an error status', { status: response.status });
+    }
+
+    return parseData(response.data, this.maxResponseBytes);
+  }
+}
+
+function createAltaClient(options) {
+  return new AltaClient(options);
+}
+
+module.exports = {
+  AltaClient,
+  DEFAULT_MAX_REDIRECTS,
+  DEFAULT_MAX_RESPONSE_BYTES,
+  DEFAULT_TIMEOUT_MS,
+  ENDPOINTS,
+  axiosTransport,
+  createAltaClient,
+};
diff --git a/src/error-redaction.js b/src/error-redaction.js
new file mode 100644
index 0000000..89a8bcf
--- /dev/null
+++ b/src/error-redaction.js
@@ -0,0 +1,85 @@
+'use strict';
+
+const MAX_OPERATION_LENGTH = 64;
+const MAX_CODE_LENGTH = 64;
+const MAX_MESSAGE_LENGTH = 240;
+const REDACTED = '[REDACTED]';
+
+function safeRead(object, key) {
+  try {
+    return object && typeof object === 'object' ? object[key] : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function redactKnownPatterns(message) {
+  return message
+    .replace(/\bauthorization\s*:\s*bearer\s+[^\s,;]+/gi, REDACTED)
+    .replace(/\bbearer\s+[^\s,;]+/gi, `Bearer ${REDACTED}`)
+    .replace(/\bcookie\s*:\s*[^\r\n]*/gi, REDACTED)
+    .replace(/\b(va\s*=\s*)[^\s;,]*/gi, `$1${REDACTED}`);
+}
+
+function sanitizeErrorMessage(value, options = {}) {
+  let message = typeof value === 'string' ? value : 'Alta request failed';
+  const secrets = Array.isArray(options.secrets) ? options.secrets : [];
+
+  for (const secret of secrets) {
+    if (typeof secret === 'string' && secret.length > 0) {
+      message = message.split(secret).join(REDACTED);
+    }
+  }
+
+  message = redactKnownPatterns(message)
+    .replace(/[\r\n\t]+/g, ' ')
+    .replace(/[\u0000-\u001f\u007f]/g, '')
+    .replace(/\s{2,}/g, ' ')
+    .trim();
+
+  if (!message) message = 'Alta request failed';
+  return message.slice(0, MAX_MESSAGE_LENGTH);
+}
+
+function includesSecret(value, secrets) {
+  return secrets.some((secret) => typeof secret === 'string' && secret.length > 0 && value.includes(secret));
+}
+
+function safeIdentifier(value, fallback, maxLength, secrets) {
+  if (typeof value !== 'string' || !/^[A-Za-z0-9_.:-]+$/.test(value)) return fallback;
+  if (includesSecret(value, secrets)) return fallback;
+  return value.slice(0, maxLength);
+}
+
+function safeStatus(error) {
+  const response = safeRead(error, 'response');
+  const candidate = safeRead(response, 'status') ?? safeRead(error, 'status');
+  return Number.isInteger(candidate) && candidate >= 100 && candidate <= 599 ? candidate : null;
+}
+
+function formatAltaError(operation, error, options = {}) {
+  const secrets = Array.isArray(options.secrets) ? options.secrets : [];
+  const rawMessage = safeRead(error, 'message');
+  const rawCode = safeRead(error, 'code');
+  const timeoutValue = safeRead(error, 'timeout');
+  const timeout = timeoutValue === true || rawCode === 'ECONNABORTED' || rawCode === 'ETIMEDOUT' || rawCode === 'ALTA_TIMEOUT';
+
+  // Deliberately construct a fresh allowlisted object. Never copy or spread the
+  // source error: Axios config/request/headers/data can carry the bearer cookie.
+  return Object.freeze({
+    operation: safeIdentifier(operation, 'altaRequest', MAX_OPERATION_LENGTH, secrets),
+    code: safeIdentifier(rawCode, 'ALTA_ERROR', MAX_CODE_LENGTH, secrets),
+    status: safeStatus(error),
+    timeout,
+    message: sanitizeErrorMessage(rawMessage, options),
+  });
+}
+
+module.exports = {
+  MAX_CODE_LENGTH,
+  MAX_MESSAGE_LENGTH,
+  MAX_OPERATION_LENGTH,
+  formatAltaError,
+  formatError: formatAltaError,
+  sanitizeErrorMessage,
+};
diff --git a/src/session-store.js b/src/session-store.js
new file mode 100644
index 0000000..5246930
--- /dev/null
+++ b/src/session-store.js
@@ -0,0 +1,81 @@
+'use strict';
+
+const { canonicalizeAltaOrigin } = require('./url-policy');
+
+const MAX_COOKIE_LENGTH = 4096;
+
+function sessionError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function validateCookie(cookie) {
+  if (
+    typeof cookie !== 'string' ||
+    cookie.length === 0 ||
+    cookie.length > MAX_COOKIE_LENGTH ||
+    /[;\r\n\0]/.test(cookie)
+  ) {
+    throw sessionError('INVALID_SESSION_COOKIE', 'Invalid Alta session cookie');
+  }
+  return cookie;
+}
+
+class SessionStore {
+  #origin = null;
+  #cookie = null;
+  #disposed = false;
+
+  establish(deploymentOrigin, cookie) {
+    if (this.#disposed) {
+      throw sessionError('SESSION_STORE_DISPOSED', 'Alta session store is disposed');
+    }
+
+    // Validate the complete replacement before dropping the current session.
+    const nextOrigin = canonicalizeAltaOrigin(deploymentOrigin);
+    const nextCookie = validateCookie(cookie);
+    this.#origin = nextOrigin;
+    this.#cookie = nextCookie;
+    return this.describe();
+  }
+
+  setSession(deploymentOrigin, cookie) {
+    return this.establish(deploymentOrigin, cookie);
+  }
+
+  requireSession() {
+    if (this.#disposed || this.#origin === null || this.#cookie === null) {
+      throw sessionError('NO_ALTA_SESSION', 'No active Alta session');
+    }
+    return Object.freeze({ origin: this.#origin, cookie: this.#cookie });
+  }
+
+  describe() {
+    return Object.freeze({
+      connected: !this.#disposed && this.#origin !== null && this.#cookie !== null,
+      origin: !this.#disposed ? this.#origin : null,
+    });
+  }
+
+  clear() {
+    this.#cookie = null;
+    this.#origin = null;
+  }
+
+  dispose() {
+    this.clear();
+    this.#disposed = true;
+  }
+}
+
+function createSessionStore() {
+  return new SessionStore();
+}
+
+module.exports = {
+  MAX_COOKIE_LENGTH,
+  SessionStore,
+  createSessionStore,
+  validateCookie,
+};
diff --git a/src/url-policy.js b/src/url-policy.js
new file mode 100644
index 0000000..c6b5709
--- /dev/null
+++ b/src/url-policy.js
@@ -0,0 +1,92 @@
+'use strict';
+
+const MAX_ORIGIN_LENGTH = 512;
+const ALTA_SUFFIXES = Object.freeze(['avasecurity.com', 'avigilon.com']);
+
+function policyError(message = 'Invalid Alta deployment origin') {
+  const error = new TypeError(message);
+  error.code = 'INVALID_ALTA_ORIGIN';
+  return error;
+}
+
+function canonicalizeAltaOrigin(value) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_ORIGIN_LENGTH) {
+    throw policyError();
+  }
+  if (value !== value.trim() || /[\u0000-\u0020\u007f]/.test(value)) {
+    throw policyError();
+  }
+
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw policyError();
+  }
+
+  if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.hash || parsed.search) {
+    throw policyError();
+  }
+  if (parsed.port && parsed.port !== '443') {
+    throw policyError();
+  }
+  if (parsed.pathname !== '/' && parsed.pathname !== '') {
+    throw policyError();
+  }
+
+  const hostname = parsed.hostname.toLowerCase();
+  const suffix = ALTA_SUFFIXES.find((candidate) => hostname.endsWith(`.${candidate}`));
+  if (!suffix) {
+    throw policyError();
+  }
+
+  const subdomain = hostname.slice(0, -(suffix.length + 1));
+  const labels = subdomain.split('.');
+  if (labels.some((label) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))) {
+    throw policyError();
+  }
+
+  return `https://${hostname}`;
+}
+
+function isAltaOrigin(value) {
+  try {
+    canonicalizeAltaOrigin(value);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function assertSameAltaOrigin(candidate, expectedOrigin) {
+  if (typeof candidate !== 'string' || /[\u0000-\u0020\u007f]/.test(candidate)) {
+    throw policyError('Invalid Alta request URL');
+  }
+  let target;
+  try {
+    target = new URL(candidate);
+  } catch {
+    throw policyError('Invalid Alta request URL');
+  }
+  const expected = canonicalizeAltaOrigin(expectedOrigin);
+  const actual = canonicalizeAltaOrigin(target.origin);
+  if (
+    actual !== expected ||
+    target.origin !== expected ||
+    target.username ||
+    target.password ||
+    target.hash
+  ) {
+    throw policyError('Alta request URL changed origin');
+  }
+  return target;
+}
+
+module.exports = {
+  ALTA_SUFFIXES,
+  MAX_ORIGIN_LENGTH,
+  assertSameAltaOrigin,
+  canonicalizeAltaOrigin,
+  isAltaOrigin,
+  validateAltaOrigin: canonicalizeAltaOrigin,
+};
diff --git a/test/alta-client.test.js b/test/alta-client.test.js
new file mode 100644
index 0000000..dfc5f1f
--- /dev/null
+++ b/test/alta-client.test.js
@@ -0,0 +1,176 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { SessionStore } = require('../src/session-store');
+const { AltaClient } = require('../src/alta-client');
+
+const ORIGIN = 'https://tenant.avasecurity.com';
+const SENTINEL = 'HERMES_SENTINEL_SECRET';
+
+function readyStore() {
+  const store = new SessionStore();
+  store.establish(ORIGIN, SENTINEL);
+  return store;
+}
+
+function response(data, overrides = {}) {
+  return { status: 200, headers: {}, data, ...overrides };
+}
+
+test('uses only stored authority, fixed endpoint paths and hardened transport options', async () => {
+  const calls = [];
+  const transport = async (options) => {
+    calls.push(options);
+    if (options.url.endsWith('/devices')) return response([]);
+    if (options.url.endsWith('/deviceSites')) return response([{ id: 'site-1' }]);
+    return response({ user: 'engineer' });
+  };
+  const client = new AltaClient({ sessionStore: readyStore(), transport });
+
+  assert.deepEqual(await client.getDevices(), []);
+  assert.deepEqual(await client.getDeviceSites(), [{ id: 'site-1' }]);
+  assert.deepEqual(await client.getAuthInfo(), { user: 'engineer' });
+
+  assert.deepEqual(calls.map((call) => call.url), [
+    `${ORIGIN}/api/v1/devices`,
+    `${ORIGIN}/api/v1/deviceSites`,
+    `${ORIGIN}/api/v1/auth`,
+  ]);
+  for (const call of calls) {
+    assert.equal(call.method, 'GET');
+    assert.equal(call.proxy, false);
+    assert.equal(call.maxRedirects, 0);
+    assert.match(call.headers.Cookie, /^va=HERMES_SENTINEL_SECRET$/);
+    assert.ok(call.timeout > 0 && call.timeout <= 10_000);
+    assert.ok(call.maxResponseBytes > 0);
+  }
+});
+
+test('rejects renderer-supplied URL/cookie parameters before transport', async () => {
+  let calls = 0;
+  const client = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async () => { calls += 1; return response([]); },
+  });
+
+  await assert.rejects(
+    client.getDevices({ deploymentUrl: 'https://evil.example', cookies: [SENTINEL] }),
+    { code: 'INVALID_ALTA_ARGUMENTS' },
+  );
+  await assert.rejects(client.getAuthInfo(SENTINEL), { code: 'INVALID_ALTA_ARGUMENTS' });
+  assert.equal(calls, 0);
+});
+
+test('allows only bounded exact-same-origin redirects', async () => {
+  const seen = [];
+  const transport = async (options) => {
+    seen.push(options.url);
+    if (seen.length === 1) {
+      return response('', { status: 307, headers: { location: '/api/v1/devices?cursor=next' } });
+    }
+    return response([]);
+  };
+  const client = new AltaClient({ sessionStore: readyStore(), transport });
+  assert.deepEqual(await client.getDevices(), []);
+  assert.deepEqual(seen, [
+    `${ORIGIN}/api/v1/devices`,
+    `${ORIGIN}/api/v1/devices?cursor=next`,
+  ]);
+
+  for (const location of [
+    'https://evil.example/steal',
+    'https://other.avasecurity.com/api/v1/devices',
+    'http://tenant.avasecurity.com/api/v1/devices',
+    '//evil.example/steal',
+    `https://user:pass@tenant.avasecurity.com/api/v1/devices`,
+    `${ORIGIN}/api/v1/devices#not-sent-to-server`,
+  ]) {
+    let count = 0;
+    const blocked = new AltaClient({
+      sessionStore: readyStore(),
+      transport: async () => {
+        count += 1;
+        return response('', { status: 302, headers: { location } });
+      },
+    });
+    await assert.rejects(blocked.getDevices(), { code: 'UNSAFE_ALTA_REDIRECT' });
+    assert.equal(count, 1, location);
+  }
+});
+
+test('enforces redirect limit and rejects redirects without locations', async () => {
+  const looping = new AltaClient({
+    sessionStore: readyStore(),
+    maxRedirects: 2,
+    transport: async () => response('', { status: 302, headers: { location: '/api/v1/devices' } }),
+  });
+  await assert.rejects(looping.getDevices(), { code: 'TOO_MANY_ALTA_REDIRECTS' });
+
+  const missing = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async () => response('', { status: 302, headers: {} }),
+  });
+  await assert.rejects(missing.getDevices(), { code: 'UNSAFE_ALTA_REDIRECT' });
+});
+
+test('enforces a total timeout even when injected transport does not cooperate', async () => {
+  const client = new AltaClient({
+    sessionStore: readyStore(),
+    timeoutMs: 25,
+    transport: async () => new Promise(() => {}),
+  });
+  await assert.rejects(client.getDevices(), { code: 'ALTA_TIMEOUT', timeout: true });
+});
+
+test('rejects oversized responses using content-length and actual data size', async () => {
+  const byHeader = new AltaClient({
+    sessionStore: readyStore(),
+    maxResponseBytes: 32,
+    transport: async () => response([], { headers: { 'content-length': '33' } }),
+  });
+  await assert.rejects(byHeader.getDevices(), { code: 'ALTA_RESPONSE_TOO_LARGE' });
+
+  const byBody = new AltaClient({
+    sessionStore: readyStore(),
+    maxResponseBytes: 32,
+    transport: async () => response(JSON.stringify([{ value: 'x'.repeat(40) }])),
+  });
+  await assert.rejects(byBody.getDevices(), { code: 'ALTA_RESPONSE_TOO_LARGE' });
+
+  for (const status of [302, 500]) {
+    const oversizedFailure = new AltaClient({
+      sessionStore: readyStore(),
+      maxResponseBytes: 32,
+      transport: async () => response('x'.repeat(33), {
+        status,
+        headers: status === 302 ? { location: '/api/v1/devices' } : {},
+      }),
+    });
+    await assert.rejects(oversizedFailure.getDevices(), { code: 'ALTA_RESPONSE_TOO_LARGE' });
+  }
+});
+
+test('rejects malformed response envelopes, JSON, status and endpoint data shapes', async () => {
+  const cases = [
+    [undefined, 'INVALID_ALTA_RESPONSE'],
+    [response('{broken'), 'INVALID_ALTA_RESPONSE_DATA'],
+    [response([], { status: 500 }), 'ALTA_HTTP_ERROR'],
+    [response({ not: 'an array' }), 'INVALID_ALTA_RESPONSE_DATA'],
+  ];
+  for (const [value, code] of cases) {
+    const client = new AltaClient({ sessionStore: readyStore(), transport: async () => value });
+    await assert.rejects(client.getDevices(), { code });
+  }
+
+  const authClient = new AltaClient({ sessionStore: readyStore(), transport: async () => response([]) });
+  await assert.rejects(authClient.getAuthInfo(), { code: 'INVALID_ALTA_RESPONSE_DATA' });
+});
+
+test('revalidates the stored origin before each request', async () => {
+  const store = { requireSession: () => Object.freeze({ origin: 'https://evil.example', cookie: SENTINEL }) };
+  let called = false;
+  const client = new AltaClient({ sessionStore: store, transport: async () => { called = true; } });
+  await assert.rejects(client.getDevices(), { code: 'INVALID_ALTA_ORIGIN' });
+  assert.equal(called, false);
+});
diff --git a/test/error-redaction.test.js b/test/error-redaction.test.js
new file mode 100644
index 0000000..bcedd6e
--- /dev/null
+++ b/test/error-redaction.test.js
@@ -0,0 +1,109 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const {
+  formatAltaError,
+  sanitizeErrorMessage,
+} = require('../src/error-redaction');
+
+const SENTINEL = 'HERMES_SENTINEL_SECRET';
+
+function assertNoSecret(value) {
+  const serialized = JSON.stringify(value);
+  assert.equal(serialized.includes(SENTINEL), false, serialized);
+  assert.equal(serialized.includes('Cookie'), false, serialized);
+  assert.equal(serialized.includes('Authorization'), false, serialized);
+}
+
+test('formats only an allowlist of bounded safe fields', () => {
+  const error = new Error('request failed safely');
+  error.code = 'ECONNRESET';
+  error.timeout = false;
+  error.response = { status: 502 };
+
+  const formatted = formatAltaError('getDevices', error, { secrets: [SENTINEL] });
+  assert.deepEqual(formatted, {
+    operation: 'getDevices',
+    code: 'ECONNRESET',
+    status: 502,
+    timeout: false,
+    message: 'request failed safely',
+  });
+  assert.deepEqual(Object.keys(formatted), ['operation', 'code', 'status', 'timeout', 'message']);
+});
+
+test('never serializes Axios config, request, headers, URL, body, cause or response data', () => {
+  const error = new Error(`failed with va=${SENTINEL}`);
+  error.code = 'ERR_BAD_RESPONSE';
+  error.config = {
+    url: `https://evil.example/?token=${SENTINEL}`,
+    headers: { Cookie: `va=${SENTINEL}`, Authorization: `Bearer ${SENTINEL}` },
+    data: { token: SENTINEL },
+  };
+  error.request = { rawHeaders: `Cookie: va=${SENTINEL}` };
+  error.response = {
+    status: 401,
+    headers: { 'set-cookie': `va=${SENTINEL}` },
+    data: { message: SENTINEL, nested: { secret: SENTINEL } },
+  };
+  error.cause = { message: SENTINEL, headers: { Cookie: SENTINEL } };
+
+  const formatted = formatAltaError('getDevices', error, { secrets: [SENTINEL] });
+  assertNoSecret(formatted);
+  assert.deepEqual(Object.keys(formatted), ['operation', 'code', 'status', 'timeout', 'message']);
+  assert.equal(formatted.message, 'failed with va=[REDACTED]');
+});
+
+test('redacts cookie and bearer patterns without needing the exact secret', () => {
+  for (const message of [
+    `Cookie: va=${SENTINEL}; other=value`,
+    `va=${SENTINEL}`,
+    `Authorization: Bearer ${SENTINEL}`,
+    `Bearer ${SENTINEL}`,
+  ]) {
+    const clean = sanitizeErrorMessage(message);
+    assertNoSecret({ message: clean });
+  }
+});
+
+test('bounds and sanitizes operation, code, status and message', () => {
+  const error = {
+    message: `line one\r\nCookie: va=${SENTINEL} ${'x'.repeat(1000)}`,
+    code: 'BAD CODE WITH SPACES AND SECRET_' + SENTINEL,
+    response: { status: 9999 },
+  };
+  const formatted = formatAltaError(`unsafe operation ${SENTINEL}`, error, { secrets: [SENTINEL] });
+
+  assertNoSecret(formatted);
+  assert.ok(formatted.operation.length <= 64);
+  assert.equal(formatted.code, 'ALTA_ERROR');
+  assert.equal(formatted.status, null);
+  assert.ok(formatted.message.length <= 240);
+  assert.equal(/[\r\n]/.test(formatted.message), false);
+});
+
+test('handles hostile accessors, cycles and non-error values without leaking or throwing', () => {
+  const hostile = {};
+  Object.defineProperty(hostile, 'message', { get() { throw new Error(SENTINEL); } });
+  Object.defineProperty(hostile, 'code', { get() { throw new Error(SENTINEL); } });
+  hostile.self = hostile;
+
+  const formatted = formatAltaError('request', hostile, { secrets: [SENTINEL] });
+  assertNoSecret(formatted);
+  assert.equal(formatted.message, 'Alta request failed');
+  assert.equal(formatted.code, 'ALTA_ERROR');
+
+  assertNoSecret(formatAltaError('request', SENTINEL, { secrets: [SENTINEL] }));
+  assertNoSecret(formatAltaError('request', null, { secrets: [SENTINEL] }));
+});
+
+test('does not leak a supplied secret through valid-looking operation or code fields', () => {
+  const formatted = formatAltaError(SENTINEL, {
+    code: SENTINEL,
+    message: 'failed',
+  }, { secrets: [SENTINEL] });
+  assertNoSecret(formatted);
+  assert.equal(formatted.operation, 'altaRequest');
+  assert.equal(formatted.code, 'ALTA_ERROR');
+});
diff --git a/test/session-store.test.js b/test/session-store.test.js
new file mode 100644
index 0000000..cd74ce5
--- /dev/null
+++ b/test/session-store.test.js
@@ -0,0 +1,58 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { SessionStore } = require('../src/session-store');
+
+const SENTINEL = 'HERMES_SENTINEL_SECRET';
+
+test('stores a canonical origin and cookie only in main-process memory', () => {
+  const store = new SessionStore();
+  store.establish('https://Tenant.AVASECURITY.com/', SENTINEL);
+
+  assert.deepEqual(store.describe(), {
+    connected: true,
+    origin: 'https://tenant.avasecurity.com',
+  });
+  assert.equal(JSON.stringify(store.describe()).includes(SENTINEL), false);
+
+  const session = store.requireSession();
+  assert.equal(session.origin, 'https://tenant.avasecurity.com');
+  assert.equal(session.cookie, SENTINEL);
+  assert.equal(Object.isFrozen(session), true);
+});
+
+test('rejects malformed and header-injecting cookies', () => {
+  const store = new SessionStore();
+  for (const cookie of ['', null, 12, 'secret\r\nX-Evil: yes', `x${'a'.repeat(4096)}`, 'abc\0def', 'token; injected=yes']) {
+    assert.throws(() => store.establish('https://tenant.avasecurity.com', cookie), {
+      code: 'INVALID_SESSION_COOKIE',
+    });
+  }
+  assert.equal(store.describe().connected, false);
+});
+
+test('does not replace a valid session when a new session is invalid', () => {
+  const store = new SessionStore();
+  store.establish('https://one.avasecurity.com', SENTINEL);
+  assert.throws(() => store.establish('https://evil.example', 'replacement'));
+  assert.equal(store.requireSession().origin, 'https://one.avasecurity.com');
+  assert.equal(store.requireSession().cookie, SENTINEL);
+});
+
+test('clear removes session references and dispose permanently closes the store', () => {
+  const store = new SessionStore();
+  store.establish('https://tenant.avigilon.com', SENTINEL);
+  store.clear();
+
+  assert.deepEqual(store.describe(), { connected: false, origin: null });
+  assert.throws(() => store.requireSession(), { code: 'NO_ALTA_SESSION' });
+
+  store.establish('https://tenant.avigilon.com', 'new-token');
+  store.dispose();
+  assert.deepEqual(store.describe(), { connected: false, origin: null });
+  assert.throws(() => store.establish('https://tenant.avigilon.com', 'again'), {
+    code: 'SESSION_STORE_DISPOSED',
+  });
+  assert.doesNotThrow(() => store.dispose());
+});
diff --git a/test/url-policy.test.js b/test/url-policy.test.js
new file mode 100644
index 0000000..5b4f1d7
--- /dev/null
+++ b/test/url-policy.test.js
@@ -0,0 +1,57 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const {
+  canonicalizeAltaOrigin,
+  isAltaOrigin,
+} = require('../src/url-policy');
+
+test('accepts and canonicalizes HTTPS Alta deployment subdomains', () => {
+  assert.equal(canonicalizeAltaOrigin('https://Example.AVASECURITY.com/'), 'https://example.avasecurity.com');
+  assert.equal(canonicalizeAltaOrigin('https://edge.eu.avigilon.com:443'), 'https://edge.eu.avigilon.com');
+  assert.equal(isAltaOrigin('https://tenant.avasecurity.com'), true);
+});
+
+test('rejects roots, lookalikes, HTTP, and arbitrary exfiltration destinations', () => {
+  for (const value of [
+    'https://avasecurity.com',
+    'https://avigilon.com',
+    'https://avasecurity.com.evil.example',
+    'https://tenant.avasecurity.com.evil.example',
+    'https://evilavasecurity.com',
+    'http://tenant.avasecurity.com',
+    'https://example.com',
+    'file:///etc/passwd',
+  ]) {
+    assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, value);
+  }
+});
+
+test('rejects authority tricks, fragments, paths, queries and non-default ports', () => {
+  for (const value of [
+    'https://user:pass@tenant.avasecurity.com',
+    'https://tenant.avasecurity.com/#fragment',
+    'https://tenant.avasecurity.com/api/v1/devices',
+    'https://tenant.avasecurity.com?next=https://evil.example',
+    'https://tenant.avasecurity.com:8443',
+    'https://tenant.avasecurity.com\\@evil.example',
+  ]) {
+    assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, value);
+  }
+});
+
+test('rejects CRLF, whitespace, non-strings, oversized and malformed values', () => {
+  for (const value of [
+    'https://tenant.avasecurity.com\r\nX-Test: injected',
+    ' https://tenant.avasecurity.com',
+    'https://tenant.avasecurity.com ',
+    'not a URL',
+    '',
+    null,
+    7,
+    `https://${'a'.repeat(513)}.avasecurity.com`,
+  ]) {
+    assert.throws(() => canonicalizeAltaOrigin(value), { code: 'INVALID_ALTA_ORIGIN' }, String(value));
+  }
+});

From b6df6f1a666da3beb5797c453c1b38cdde6a0411 Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Wed, 19 Aug 2026 21:23:03 +0000
Subject: [PATCH 05/22] feat: add paired Chrome bridge authentication

---
 chrome-extension/manifest.json  |   8 +-
 chrome-extension/options.css    |  83 ++++++++++
 chrome-extension/options.html   |  29 ++++
 chrome-extension/options.js     |  61 +++++++
 chrome-extension/popup.css      | 129 ++++++++-------
 chrome-extension/popup.html     |  14 +-
 chrome-extension/popup.js       | 282 +++++++++++++++++++-------------
 src/bridge-auth.js              | 250 ++++++++++++++++++++++++++++
 test/bridge-auth.test.js        | 115 +++++++++++++
 test/extension-contract.test.js | 179 ++++++++++++++++++++
 10 files changed, 968 insertions(+), 182 deletions(-)
 create mode 100644 chrome-extension/options.css
 create mode 100644 chrome-extension/options.html
 create mode 100644 chrome-extension/options.js
 create mode 100644 src/bridge-auth.js
 create mode 100644 test/bridge-auth.test.js
 create mode 100644 test/extension-contract.test.js

diff --git a/chrome-extension/manifest.json b/chrome-extension/manifest.json
index 7f457cb..fe64b1f 100644
--- a/chrome-extension/manifest.json
+++ b/chrome-extension/manifest.json
@@ -1,14 +1,16 @@
 {
   "manifest_version": 3,
   "name": "Alta Proxy Tool Bridge",
-  "version": "1.0.0",
-  "description": "Send Alta session cookies to the Alta Proxy Tool desktop app.",
-  "permissions": ["cookies", "activeTab", "clipboardWrite"],
+  "version": "1.1.0",
+  "description": "Send Alta session cookies to a paired Alta Proxy Tool desktop app.",
+  "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt4EZdkSgOsyiy5DRe0JkX+BpK94FpMjBU59NVIqDPO8QBDwvqNDWT/UjqHK/0aqSxzed5KibX6MdAvc495+u1sCybFdjDdXyBewEvg+PDqGiJketlZKC9dcR1RXHuPgAoM3NaNbMb3TqYcS9J4iGq0UwadxubkQrEcPiuyR6oriOkop8q9/5DWGb15wOGmiCuVmlXfUjNJIvNBm9P/ZHtgFBYDI2PuSSI5GI4j04VFpEyfNlFCrpi8GQ7bYZzezigZWXRjhhNwkx39bNHlkAWYa8XGZseCpKKvi0EaeCoBPjoYSAt161SM1dqX+/UC61/sLOU/SpDB1SYGTm5DC+7wIDAQAB",
+  "permissions": ["cookies", "activeTab", "clipboardWrite", "storage"],
   "host_permissions": [
     "https://*.avasecurity.com/*",
     "https://*.avigilon.com/*",
     "http://127.0.0.1:18247/*"
   ],
+  "options_page": "options.html",
   "action": {
     "default_popup": "popup.html",
     "default_icon": {
diff --git a/chrome-extension/options.css b/chrome-extension/options.css
new file mode 100644
index 0000000..51251b2
--- /dev/null
+++ b/chrome-extension/options.css
@@ -0,0 +1,83 @@
+:root {
+  color-scheme: dark;
+  font-family: 'Segoe UI', -apple-system, BlinkMacSystemFont, Roboto, sans-serif;
+}
+
+body {
+  margin: 0;
+  background: #1e1e1e;
+  color: #e0e0e0;
+}
+
+.options-card {
+  max-width: 560px;
+  margin: 48px auto;
+  padding: 28px;
+  border: 1px solid #3c3c3c;
+  border-radius: 8px;
+  background: #252526;
+  box-shadow: 0 12px 32px rgba(0, 0, 0, 0.25);
+}
+
+h1 { margin-top: 0; color: #75afff; }
+h2 { margin-bottom: 6px; font-size: 16px; }
+p { line-height: 1.5; }
+
+label {
+  display: block;
+  margin-bottom: 6px;
+  font-weight: 600;
+}
+
+input {
+  box-sizing: border-box;
+  width: 100%;
+  margin-bottom: 12px;
+  padding: 11px;
+  border: 1px solid #555;
+  border-radius: 4px;
+  background: #1e1e1e;
+  color: #fff;
+  font: inherit;
+}
+
+input:focus {
+  border-color: #0e7afe;
+  outline: 2px solid rgba(14, 122, 254, 0.3);
+}
+
+button {
+  padding: 10px 16px;
+  border-radius: 4px;
+  color: #fff;
+  cursor: pointer;
+  font: inherit;
+  font-weight: 700;
+}
+
+.primary-btn { border: 0; background: #0e7afe; }
+.danger-btn { border: 1px solid #f44336; background: transparent; color: #ff7b72; }
+button:disabled { cursor: not-allowed; opacity: 0.45; }
+
+.status {
+  min-height: 20px;
+  margin-top: 14px;
+  font-weight: 600;
+}
+
+.status.success,
+.paired { color: #7bd67e; }
+.status.error,
+.unpaired { color: #ffc36d; }
+
+.paired-controls {
+  margin-top: 24px;
+  padding-top: 14px;
+  border-top: 1px solid #3c3c3c;
+}
+
+.privacy-note {
+  margin-top: 24px;
+  color: #aaa;
+  font-size: 12px;
+}
diff --git a/chrome-extension/options.html b/chrome-extension/options.html
new file mode 100644
index 0000000..0879681
--- /dev/null
+++ b/chrome-extension/options.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'">
+  <title>Pair Alta Proxy Tool</title>
+  <link rel="stylesheet" href="options.css">
+</head>
+<body>
+  <main class="options-card">
+    <h1>Pair with Alta Proxy Tool</h1>
+    <p>In the desktop app, create a one-time pairing secret. Paste it below on this computer. Treat it like a password.</p>
+    <form id="pairingForm">
+      <label for="pairingSecret">One-time pairing secret</label>
+      <input id="pairingSecret" name="pairingSecret" type="password" inputmode="text" autocomplete="off" spellcheck="false" required>
+      <button type="submit" class="primary-btn">Pair extension</button>
+    </form>
+    <div id="pairingStatus" class="status" role="status" aria-live="polite"></div>
+    <section class="paired-controls">
+      <h2>Current pairing</h2>
+      <p id="currentState">Checking...</p>
+      <button id="forgetBtn" type="button" class="danger-btn" disabled>Forget pairing</button>
+    </section>
+    <p class="privacy-note">The secret is stored only in Chrome extension local storage. It is never displayed again or copied automatically.</p>
+  </main>
+  <script src="options.js"></script>
+</body>
+</html>
diff --git a/chrome-extension/options.js b/chrome-extension/options.js
new file mode 100644
index 0000000..30c7ce2
--- /dev/null
+++ b/chrome-extension/options.js
@@ -0,0 +1,61 @@
+'use strict';
+
+const PAIRING_STORAGE_KEY = 'aptPairingSecret';
+const PAIRING_SECRET_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+
+const pairingForm = document.getElementById('pairingForm');
+const pairingSecretInput = document.getElementById('pairingSecret');
+const pairingStatus = document.getElementById('pairingStatus');
+const currentState = document.getElementById('currentState');
+const forgetBtn = document.getElementById('forgetBtn');
+
+function setStatus(message, type) {
+  pairingStatus.textContent = message;
+  pairingStatus.className = `status ${type}`;
+}
+
+function renderPairingState(paired) {
+  currentState.textContent = paired ? 'Paired on this Chrome profile.' : 'Not paired.';
+  currentState.className = paired ? 'paired' : 'unpaired';
+  forgetBtn.disabled = !paired;
+}
+
+async function refreshPairingState() {
+  const stored = await chrome.storage.local.get(PAIRING_STORAGE_KEY);
+  const candidate = stored && stored[PAIRING_STORAGE_KEY];
+  renderPairingState(PAIRING_SECRET_PATTERN.test(typeof candidate === 'string' ? candidate : ''));
+}
+
+pairingForm.addEventListener('submit', async (event) => {
+  event.preventDefault();
+  const candidate = pairingSecretInput.value.trim();
+  pairingSecretInput.value = '';
+
+  if (!PAIRING_SECRET_PATTERN.test(candidate)) {
+    setStatus('That secret is not valid. Generate a new pairing secret in APT and paste it exactly.', 'error');
+    return;
+  }
+
+  try {
+    await chrome.storage.local.set({ [PAIRING_STORAGE_KEY]: candidate });
+    setStatus('Pairing saved. You can now use Send to APT from an Alta tab.', 'success');
+    renderPairingState(true);
+  } catch {
+    setStatus('Chrome could not save the pairing. Try again.', 'error');
+  }
+});
+
+forgetBtn.addEventListener('click', async () => {
+  try {
+    await chrome.storage.local.remove(PAIRING_STORAGE_KEY);
+    renderPairingState(false);
+    setStatus('Pairing forgotten. Revoke or rotate it in APT as well.', 'success');
+  } catch {
+    setStatus('Chrome could not forget the pairing. Try again.', 'error');
+  }
+});
+
+refreshPairingState().catch(() => {
+  renderPairingState(false);
+  setStatus('Chrome could not read pairing state.', 'error');
+});
diff --git a/chrome-extension/popup.css b/chrome-extension/popup.css
index e4c5e8d..6f4387b 100644
--- a/chrome-extension/popup.css
+++ b/chrome-extension/popup.css
@@ -2,120 +2,131 @@
 body {
   margin: 0;
   padding: 0;
-  font-family: 'Segoe UI', -apple-system, BlinkMacSystemFont, Roboto, sans-serif;
-  background: #1E1E1E;
-  color: #E0E0E0;
-  font-size: 14px;
-  min-width: 300px;
+  min-width: 320px;
+  background: #1e1e1e;
+  color: #e0e0e0;
+  font: 14px/1.4 'Segoe UI', -apple-system, BlinkMacSystemFont, Roboto, sans-serif;
 }
 
-.popup-container {
-  padding: 16px;
-}
+.popup-container { padding: 16px; }
 
 h1 {
+  margin: 0 0 12px;
+  color: #0e7afe;
   font-size: 16px;
   font-weight: 600;
-  color: #0E7AFE;
-  margin: 0 0 12px 0;
+  letter-spacing: 0.5px;
   text-align: center;
   text-transform: uppercase;
-  letter-spacing: 0.5px;
 }
 
-.tab-info {
-  background: #2D2D30;
-  border: 1px solid #3C3C3C;
+.tab-info,
+.pairing-info {
+  margin-bottom: 10px;
+  padding: 9px 11px;
+  border: 1px solid #3c3c3c;
   border-radius: 4px;
-  padding: 10px 12px;
-  margin-bottom: 12px;
+  background: #2d2d30;
+  color: #aaa;
   font-size: 13px;
-  color: #999999;
-  word-break: break-all;
+  overflow-wrap: anywhere;
 }
 
-.tab-info.detected {
-  color: #4CAF50;
-  border-color: #4CAF50;
+.tab-info.detected,
+.pairing-info.paired {
+  border-color: #4caf50;
+  color: #7bd67e;
 }
 
-.tab-info.not-detected {
-  color: #F44336;
-  border-color: #F44336;
+.tab-info.not-detected,
+.pairing-info.unpaired {
+  border-color: #f0a33a;
+  color: #ffc36d;
 }
 
-.action-buttons {
-  display: grid;
-  gap: 8px;
-}
+.action-buttons { display: grid; gap: 8px; }
 
 .primary-btn,
-.secondary-btn {
-  display: block;
+.secondary-btn,
+.link-btn {
   width: 100%;
   padding: 10px 16px;
-  font-family: inherit;
-  font-size: 14px;
-  font-weight: bold;
-  color: white;
-  background: #0E7AFE;
-  border: none;
   border-radius: 4px;
   cursor: pointer;
-  transition: background 0.2s ease;
+  font-family: inherit;
+  font-size: 14px;
+  font-weight: 700;
 }
 
 .primary-btn {
-  background: #0E7AFE;
+  border: 0;
+  background: #0e7afe;
+  color: #fff;
 }
 
 .secondary-btn {
-  background: #2D2D30;
-  border: 1px solid #0E7AFE;
-  color: #E0E0E0;
+  border: 1px solid #0e7afe;
+  background: #2d2d30;
+  color: #e0e0e0;
 }
 
-.primary-btn:hover:not(:disabled) {
-  background: #0A5FD9;
+.link-btn {
+  margin: -2px 0 10px;
+  padding: 5px;
+  border: 0;
+  background: transparent;
+  color: #75afff;
+  text-decoration: underline;
 }
 
-.secondary-btn:hover:not(:disabled) {
-  background: #0E7AFE;
-}
+.primary-btn:hover:not(:disabled) { background: #0a5fd9; }
+.secondary-btn:hover:not(:disabled) { background: #0e7afe; }
 
 .primary-btn:disabled,
 .secondary-btn:disabled {
-  opacity: 0.5;
   cursor: not-allowed;
+  opacity: 0.45;
+}
+
+.copy-warning {
+  margin: 10px 0 0;
+  padding: 8px 10px;
+  border-left: 3px solid #f0a33a;
+  background: rgba(240, 163, 58, 0.08);
+  color: #d7c29f;
+  font-size: 12px;
 }
 
 .status-msg {
+  display: none;
   margin-top: 10px;
   padding: 8px 12px;
+  border: 1px solid transparent;
   border-radius: 4px;
   font-size: 13px;
-  font-weight: bold;
-  display: none;
-  border: 1px solid transparent;
+  font-weight: 700;
 }
 
+.status-msg.success,
+.status-msg.error,
+.status-msg.info { display: block; }
+
 .status-msg.success {
-  display: block;
+  border-color: #4caf50;
   background: rgba(76, 175, 80, 0.1);
-  color: #4CAF50;
-  border-color: #4CAF50;
+  color: #7bd67e;
 }
 
 .status-msg.error {
-  display: block;
+  border-color: #f44336;
   background: rgba(244, 67, 54, 0.1);
-  color: #F44336;
-  border-color: #F44336;
+  color: #ff7b72;
 }
 
 .status-msg.info {
-  display: block;
+  border-color: #0e7afe;
   background: rgba(14, 122, 254, 0.1);
-  color: #0E7AFE;
-  border-color: #0E7AFE;
+  color: #75afff;
 }
+
+[hidden] { display: none !important; }
diff --git a/chrome-extension/popup.html b/chrome-extension/popup.html
index a1e04a2..a859867 100644
--- a/chrome-extension/popup.html
+++ b/chrome-extension/popup.html
@@ -3,19 +3,23 @@
 <head>
   <meta charset="UTF-8">
   <meta http-equiv="Content-Security-Policy" content="default-src 'self'; connect-src http://127.0.0.1:18247;">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>Alta Proxy Tool Bridge</title>
   <link rel="stylesheet" href="popup.css">
 </head>
 <body>
-  <div class="popup-container">
+  <main class="popup-container">
     <h1>Alta Proxy Tool</h1>
+    <div id="pairingInfo" class="pairing-info">Checking pairing...</div>
+    <button id="openOptionsBtn" class="link-btn" type="button" hidden>Open pairing settings</button>
     <div id="tabInfo" class="tab-info">Checking tab...</div>
     <div class="action-buttons">
-      <button id="sendBtn" class="primary-btn" disabled>Send to APT</button>
-      <button id="copyBtn" class="secondary-btn" disabled>Copy VA Token</button>
+      <button id="sendBtn" class="primary-btn" type="button" disabled>Send to APT</button>
+      <button id="copyBtn" class="secondary-btn" type="button" disabled>Copy VA Token</button>
     </div>
-    <div id="statusMsg" class="status-msg"></div>
-  </div>
+    <p id="copyWarning" class="copy-warning">Copying exposes the full bearer token. Clipboard history or sync may retain it. A confirmation is required.</p>
+    <div id="statusMsg" class="status-msg" role="status" aria-live="polite"></div>
+  </main>
   <script src="popup.js"></script>
 </body>
 </html>
diff --git a/chrome-extension/popup.js b/chrome-extension/popup.js
index a43bb5d..35f7719 100644
--- a/chrome-extension/popup.js
+++ b/chrome-extension/popup.js
@@ -1,130 +1,182 @@
+'use strict';
+
 const APT_URL = 'http://127.0.0.1:18247/cookie';
-const APT_TOKEN = 'apt-local-bridge-token';
+const PAIRING_STORAGE_KEY = 'aptPairingSecret';
+const PAIRING_SECRET_PATTERN = /^[A-Za-z0-9_-]{43}$/;
 
-const tabInfo = document.getElementById('tabInfo');
-const sendBtn = document.getElementById('sendBtn');
-const copyBtn = document.getElementById('copyBtn');
-const statusMsg = document.getElementById('statusMsg');
-
-let detectedOrigin = null;
-
-function showStatus(message, type) {
-  statusMsg.textContent = message;
-  statusMsg.className = 'status-msg ' + type;
-}
-
-function setActionButtonsDisabled(disabled) {
-  sendBtn.disabled = disabled;
-  copyBtn.disabled = disabled;
-}
-
-async function getVaCookieValue() {
-  if (!detectedOrigin) {
-    throw new Error('No Alta deployment detected.');
-  }
-
-  const cookie = await chrome.cookies.get({ url: detectedOrigin, name: 'va' });
-
-  if (!cookie || !cookie.value) {
-    throw new Error('No "va" session cookie found. Are you logged in?');
-  }
-
-  if (cookie.expirationDate && cookie.expirationDate < Date.now() / 1000) {
-    throw new Error('Session cookie has expired. Please log in again.');
-  }
-
-  return cookie.value;
-}
-
-// Check the active tab on popup open
-chrome.tabs.query({ active: true, currentWindow: true }, (tabs) => {
-  if (!tabs || tabs.length === 0) {
-    tabInfo.textContent = 'No active tab found.';
-    tabInfo.className = 'tab-info not-detected';
-    return;
-  }
-
-  const tab = tabs[0];
-  let url;
+function isSupportedDeploymentUrl(value) {
   try {
-    url = new URL(tab.url);
+    const url = new URL(value);
+    const host = url.hostname.toLowerCase();
+    return url.protocol === 'https:' &&
+      (host.endsWith('.avasecurity.com') || host.endsWith('.avigilon.com'));
   } catch {
-    tabInfo.textContent = 'Cannot read this tab URL.';
-    tabInfo.className = 'tab-info not-detected';
-    return;
+    return false;
+  }
+}
+
+function createPopupController({
+  chromeApi,
+  documentApi,
+  navigatorApi,
+  fetchImpl,
+  confirmCopy
+}) {
+  const tabInfo = documentApi.getElementById('tabInfo');
+  const pairingInfo = documentApi.getElementById('pairingInfo');
+  const sendBtn = documentApi.getElementById('sendBtn');
+  const copyBtn = documentApi.getElementById('copyBtn');
+  const copyWarning = documentApi.getElementById('copyWarning');
+  const statusMsg = documentApi.getElementById('statusMsg');
+  const openOptionsBtn = documentApi.getElementById('openOptionsBtn');
+
+  let detectedOrigin = null;
+  let pairingSecret = null;
+  let busy = false;
+
+  function showStatus(message, type) {
+    statusMsg.textContent = message;
+    statusMsg.className = `status-msg ${type}`;
   }
 
-  const hostname = url.hostname;
-  const isAlta = hostname.endsWith('.avasecurity.com') || hostname.endsWith('.avigilon.com');
-
-  if (!isAlta) {
-    tabInfo.textContent = 'This tab is not an Alta deployment.';
-    tabInfo.className = 'tab-info not-detected';
-    return;
+  function updateActions() {
+    const disabled = busy || !detectedOrigin || !pairingSecret;
+    sendBtn.disabled = disabled;
+    copyBtn.disabled = disabled;
   }
 
-  detectedOrigin = url.origin;
-  tabInfo.textContent = 'Detected: ' + hostname;
-  tabInfo.className = 'tab-info detected';
-  setActionButtonsDisabled(false);
-});
+  function setBusy(value) {
+    busy = value;
+    updateActions();
+  }
 
-// Send cookie on button click
-sendBtn.addEventListener('click', async () => {
-  if (!detectedOrigin) return;
-
-  setActionButtonsDisabled(true);
-  showStatus('Retrieving VA token...', 'info');
-
-  try {
-    const cookieValue = await getVaCookieValue();
-
-    showStatus('Sending to Alta Proxy Tool...', 'info');
-
-    const response = await fetch(APT_URL, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'X-APT-Token': APT_TOKEN
-      },
-      body: JSON.stringify({
-        deploymentUrl: detectedOrigin,
-        cookieValue
-      })
-    });
-
-    const data = await response.json();
-
-    if (data.success) {
-      showStatus('VA token sent successfully!', 'success');
-    } else {
-      showStatus('Error: ' + (data.message || 'Unknown error'), 'error');
+  async function getVaCookieValue() {
+    if (!detectedOrigin) throw new Error('NO_DEPLOYMENT');
+    const cookie = await chromeApi.cookies.get({ url: detectedOrigin, name: 'va' });
+    if (!cookie || !cookie.value) throw new Error('MISSING_COOKIE');
+    if (cookie.expirationDate && cookie.expirationDate < Date.now() / 1000) {
+      throw new Error('EXPIRED_COOKIE');
     }
-  } catch (err) {
-    if (err.message && err.message.includes('Failed to fetch')) {
-      showStatus('Alta Proxy Tool is not running.', 'error');
+    return cookie.value;
+  }
+
+  function showCookieError(error, copyOperation = false) {
+    if (error && error.message === 'MISSING_COOKIE') {
+      showStatus('No VA token found. Log in to Alta and try again.', 'error');
+    } else if (error && error.message === 'EXPIRED_COOKIE') {
+      showStatus('The VA token has expired. Log in to Alta again.', 'error');
+    } else if (copyOperation) {
+      showStatus('Could not copy the VA token. Check clipboard permission.', 'error');
     } else {
-      showStatus('Error: ' + err.message, 'error');
+      showStatus('Could not reach Alta Proxy Tool on this computer.', 'error');
     }
-  } finally {
-    setActionButtonsDisabled(false);
   }
-});
 
-// Copy VA token on button click
-copyBtn.addEventListener('click', async () => {
-  if (!detectedOrigin) return;
-
-  setActionButtonsDisabled(true);
-  showStatus('Retrieving VA token...', 'info');
-
-  try {
-    const cookieValue = await getVaCookieValue();
-    await navigator.clipboard.writeText(cookieValue);
-    showStatus('VA token copied to clipboard!', 'success');
-  } catch (err) {
-    showStatus('Error: ' + err.message, 'error');
-  } finally {
-    setActionButtonsDisabled(false);
+  async function sendToApt() {
+    if (!detectedOrigin || !pairingSecret || busy) return;
+    setBusy(true);
+    let cookieValue = null;
+    try {
+      showStatus('Sending to Alta Proxy Tool...', 'info');
+      cookieValue = await getVaCookieValue();
+      const response = await fetchImpl(APT_URL, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          'X-APT-Pairing-Secret': pairingSecret
+        },
+        body: JSON.stringify({ deploymentUrl: detectedOrigin, cookieValue })
+      });
+      const data = await response.json();
+      if (!response.ok || !data || data.success !== true) throw new Error('BRIDGE_REJECTED');
+      showStatus('VA token sent successfully.', 'success');
+    } catch (error) {
+      showCookieError(error);
+    } finally {
+      cookieValue = null;
+      setBusy(false);
+    }
   }
-});
+
+  async function copyToken() {
+    if (!detectedOrigin || !pairingSecret || busy) return;
+    const confirmed = confirmCopy(
+      'Copy the full VA bearer token? Clipboard history or sync may retain it. Continue only if you will paste it into a trusted destination.'
+    );
+    if (!confirmed) {
+      showStatus('Copy cancelled. The VA token was not read.', 'info');
+      return;
+    }
+
+    setBusy(true);
+    let cookieValue = null;
+    try {
+      cookieValue = await getVaCookieValue();
+      await navigatorApi.clipboard.writeText(cookieValue);
+      showStatus('VA token copied. Clear your clipboard after use.', 'success');
+    } catch (error) {
+      showCookieError(error, true);
+    } finally {
+      cookieValue = null;
+      setBusy(false);
+    }
+  }
+
+  async function init() {
+    copyWarning.textContent = 'Copying exposes the full bearer token. Clipboard history or sync may retain it. A confirmation is required.';
+    sendBtn.addEventListener('click', sendToApt);
+    copyBtn.addEventListener('click', copyToken);
+    openOptionsBtn.addEventListener('click', () => chromeApi.runtime.openOptionsPage());
+
+    const stored = await chromeApi.storage.local.get(PAIRING_STORAGE_KEY);
+    const candidate = stored && stored[PAIRING_STORAGE_KEY];
+    if (PAIRING_SECRET_PATTERN.test(typeof candidate === 'string' ? candidate : '')) {
+      pairingSecret = candidate;
+      pairingInfo.textContent = 'Paired with Alta Proxy Tool';
+      pairingInfo.className = 'pairing-info paired';
+      openOptionsBtn.hidden = true;
+    } else {
+      pairingInfo.textContent = 'Not paired. Add the one-time secret from APT.';
+      pairingInfo.className = 'pairing-info unpaired';
+      openOptionsBtn.hidden = false;
+    }
+
+    const tabs = await chromeApi.tabs.query({ active: true, currentWindow: true });
+    const tab = tabs && tabs[0];
+    if (!tab || !isSupportedDeploymentUrl(tab.url)) {
+      tabInfo.textContent = 'This tab is not an Alta deployment.';
+      tabInfo.className = 'tab-info not-detected';
+      updateActions();
+      return;
+    }
+
+    const url = new URL(tab.url);
+    detectedOrigin = url.origin;
+    tabInfo.textContent = `Detected: ${url.hostname}`;
+    tabInfo.className = 'tab-info detected';
+    updateActions();
+  }
+
+  return { copyToken, init, sendToApt };
+}
+
+if (typeof module !== 'undefined' && module.exports) {
+  module.exports = {
+    APT_URL,
+    PAIRING_STORAGE_KEY,
+    createPopupController,
+    isSupportedDeploymentUrl
+  };
+} else {
+  createPopupController({
+    chromeApi: chrome,
+    documentApi: document,
+    navigatorApi: navigator,
+    fetchImpl: fetch,
+    confirmCopy: (message) => window.confirm(message)
+  }).init().catch(() => {
+    const status = document.getElementById('statusMsg');
+    status.textContent = 'Extension initialization failed. Open pairing settings and try again.';
+    status.className = 'status-msg error';
+  });
+}
diff --git a/src/bridge-auth.js b/src/bridge-auth.js
new file mode 100644
index 0000000..25f889e
--- /dev/null
+++ b/src/bridge-auth.js
@@ -0,0 +1,250 @@
+'use strict';
+
+const crypto = require('node:crypto');
+
+const DEFAULT_SECRET_BYTES = 32;
+const DEFAULT_MAX_BODY_BYTES = 64 * 1024;
+const DEFAULT_BODY_DEADLINE_MS = 2_000;
+const APT_EXTENSION_ID = 'onbkfpbggekakjddomjjnboippimlmch';
+const APT_EXTENSION_ORIGIN = `chrome-extension://${APT_EXTENSION_ID}`;
+const SECRET_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const EXTENSION_ORIGIN_PATTERN = /^chrome-extension:\/\/[a-p]{32}$/;
+
+class BridgeAuthError extends Error {
+  constructor(code, message, statusCode = 400) {
+    super(message);
+    this.name = 'BridgeAuthError';
+    this.code = code;
+    this.statusCode = statusCode;
+  }
+}
+
+function dependencies(overrides = {}) {
+  return {
+    randomBytes: overrides.randomBytes || crypto.randomBytes,
+    scryptSync: overrides.scryptSync || crypto.scryptSync,
+    timingSafeEqual: overrides.timingSafeEqual || crypto.timingSafeEqual,
+    setTimeout: overrides.setTimeout || setTimeout,
+    clearTimeout: overrides.clearTimeout || clearTimeout
+  };
+}
+
+function generatePairingSecret(options = {}) {
+  const deps = dependencies(options);
+  const byteCount = options.byteCount || DEFAULT_SECRET_BYTES;
+  if (!Number.isSafeInteger(byteCount) || byteCount < DEFAULT_SECRET_BYTES) {
+    throw new BridgeAuthError('INVALID_SECRET_SIZE', 'Pairing secrets must contain at least 32 random bytes.');
+  }
+  return deps.randomBytes(byteCount).toString('base64url');
+}
+
+function assertPairingSecret(secret) {
+  if (typeof secret !== 'string' || !SECRET_PATTERN.test(secret)) {
+    throw new BridgeAuthError('INVALID_PAIRING_SECRET', 'The pairing secret has an invalid format.');
+  }
+}
+
+function hashPairingSecret(secret, options = {}) {
+  assertPairingSecret(secret);
+  const deps = dependencies(options);
+  const salt = deps.randomBytes(16);
+  const digest = deps.scryptSync(secret, salt, 32);
+  return Object.freeze({
+    version: 1,
+    algorithm: 'scrypt',
+    salt: salt.toString('base64url'),
+    digest: Buffer.from(digest).toString('base64url')
+  });
+}
+
+function isValidEnvelope(envelope) {
+  return Boolean(
+    envelope &&
+    envelope.version === 1 &&
+    envelope.algorithm === 'scrypt' &&
+    typeof envelope.salt === 'string' &&
+    /^[A-Za-z0-9_-]{22}$/.test(envelope.salt) &&
+    typeof envelope.digest === 'string' &&
+    /^[A-Za-z0-9_-]{43}$/.test(envelope.digest)
+  );
+}
+
+function verifyPairingSecret(secret, envelope, options = {}) {
+  if (!SECRET_PATTERN.test(typeof secret === 'string' ? secret : '') || !isValidEnvelope(envelope)) {
+    return false;
+  }
+
+  try {
+    const deps = dependencies(options);
+    const salt = Buffer.from(envelope.salt, 'base64url');
+    const expected = Buffer.from(envelope.digest, 'base64url');
+    const actual = Buffer.from(deps.scryptSync(secret, salt, expected.length));
+    return actual.length === expected.length && deps.timingSafeEqual(actual, expected);
+  } catch {
+    return false;
+  }
+}
+
+function assertExtensionOrigin(origin) {
+  if (typeof origin !== 'string' || !EXTENSION_ORIGIN_PATTERN.test(origin)) {
+    throw new BridgeAuthError(
+      'INVALID_EXTENSION_ORIGIN',
+      'Expected an exact stable chrome-extension origin.'
+    );
+  }
+}
+
+class BridgeAuth {
+  constructor({ expectedOrigin = APT_EXTENSION_ORIGIN, envelope = null, ...injected } = {}) {
+    assertExtensionOrigin(expectedOrigin);
+    if (expectedOrigin !== APT_EXTENSION_ORIGIN) {
+      throw new BridgeAuthError(
+        'INVALID_EXTENSION_ORIGIN',
+        'The bridge only accepts the committed Alta Proxy Tool extension origin.'
+      );
+    }
+    if (envelope !== null && !isValidEnvelope(envelope)) {
+      throw new BridgeAuthError('INVALID_SECRET_ENVELOPE', 'The persisted pairing envelope is invalid.');
+    }
+    this.expectedOrigin = expectedOrigin;
+    this._envelope = envelope ? Object.freeze({ ...envelope }) : null;
+    this._dependencies = dependencies(injected);
+  }
+
+  get envelope() {
+    return this._envelope ? { ...this._envelope } : null;
+  }
+
+  rotate() {
+    const secret = generatePairingSecret(this._dependencies);
+    this._envelope = hashPairingSecret(secret, this._dependencies);
+    return { secret, envelope: this.envelope };
+  }
+
+  revoke() {
+    this._envelope = null;
+  }
+
+  authenticate({ origin, secret } = {}) {
+    if (origin !== this.expectedOrigin || !this._envelope) return false;
+    return verifyPairingSecret(secret, this._envelope, this._dependencies);
+  }
+
+  authenticateRequest(request) {
+    if (!request || typeof request !== 'object') return false;
+    const headers = request.headers || {};
+    const secret = headers['x-apt-pairing-secret'];
+    return this.authenticate({ origin: headers.origin, secret });
+  }
+}
+
+function readJsonBody(stream, options = {}) {
+  const maxBytes = options.maxBytes ?? DEFAULT_MAX_BODY_BYTES;
+  const deadlineMs = options.deadlineMs ?? DEFAULT_BODY_DEADLINE_MS;
+  const deps = dependencies(options);
+
+  if (!stream || typeof stream.on !== 'function') {
+    return Promise.reject(new BridgeAuthError('INVALID_BODY_STREAM', 'A readable request body is required.'));
+  }
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) {
+    return Promise.reject(new BridgeAuthError('INVALID_BODY_LIMIT', 'Body limit must be a positive integer.'));
+  }
+  if (!Number.isSafeInteger(deadlineMs) || deadlineMs < 1) {
+    return Promise.reject(new BridgeAuthError('INVALID_BODY_DEADLINE', 'Body deadline must be a positive integer.'));
+  }
+
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let total = 0;
+    let settled = false;
+
+    const cleanup = () => {
+      deps.clearTimeout(timer);
+      stream.removeListener('data', onData);
+      stream.removeListener('end', onEnd);
+      stream.removeListener('error', onError);
+    };
+    const fail = (error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      if (typeof stream.pause === 'function') stream.pause();
+      reject(error);
+    };
+    const onData = (chunk) => {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      total += buffer.length;
+      if (total > maxBytes) {
+        fail(new BridgeAuthError('BODY_TOO_LARGE', 'Request body exceeds the configured limit.', 413));
+        return;
+      }
+      chunks.push(buffer);
+    };
+    const onError = () => fail(new BridgeAuthError('BODY_READ_ERROR', 'Could not read the request body.'));
+    const onEnd = () => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      let parsed;
+      try {
+        parsed = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+      } catch {
+        reject(new BridgeAuthError('MALFORMED_JSON', 'Request body must be valid JSON.'));
+        return;
+      }
+      if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        reject(new BridgeAuthError('INVALID_JSON_BODY', 'Request body must be a JSON object.'));
+        return;
+      }
+      resolve(parsed);
+    };
+
+    const timer = deps.setTimeout(
+      () => fail(new BridgeAuthError('BODY_DEADLINE_EXCEEDED', 'Request body deadline exceeded.', 408)),
+      deadlineMs
+    );
+    stream.on('data', onData);
+    stream.on('end', onEnd);
+    stream.on('error', onError);
+  });
+}
+
+function createRequestLimiter({ maxConcurrent = 4 } = {}) {
+  if (!Number.isSafeInteger(maxConcurrent) || maxConcurrent < 1) {
+    throw new BridgeAuthError('INVALID_CONCURRENCY_LIMIT', 'Concurrency limit must be a positive integer.');
+  }
+  let active = 0;
+  return {
+    get active() { return active; },
+    async run(work) {
+      if (typeof work !== 'function') {
+        throw new BridgeAuthError('INVALID_REQUEST_WORK', 'Request work must be a function.');
+      }
+      if (active >= maxConcurrent) {
+        throw new BridgeAuthError('TOO_MANY_REQUESTS', 'Too many bridge requests are active.', 429);
+      }
+      active += 1;
+      try {
+        return await work();
+      } finally {
+        active -= 1;
+      }
+    }
+  };
+}
+
+module.exports = {
+  APT_EXTENSION_ID,
+  APT_EXTENSION_ORIGIN,
+  BridgeAuth,
+  BridgeAuthError,
+  DEFAULT_BODY_DEADLINE_MS,
+  DEFAULT_MAX_BODY_BYTES,
+  EXTENSION_ORIGIN_PATTERN,
+  SECRET_PATTERN,
+  createRequestLimiter,
+  generatePairingSecret,
+  hashPairingSecret,
+  readJsonBody,
+  verifyPairingSecret
+};
diff --git a/test/bridge-auth.test.js b/test/bridge-auth.test.js
new file mode 100644
index 0000000..6c535b3
--- /dev/null
+++ b/test/bridge-auth.test.js
@@ -0,0 +1,115 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { PassThrough, Readable } = require('node:stream');
+
+const {
+  BridgeAuth,
+  BridgeAuthError,
+  generatePairingSecret,
+  hashPairingSecret,
+  verifyPairingSecret,
+  readJsonBody,
+  createRequestLimiter
+} = require('../src/bridge-auth');
+
+const EXTENSION_ORIGIN = 'chrome-extension://onbkfpbggekakjddomjjnboippimlmch';
+
+test('pairing secrets are random, URL-safe, and stored as a hash envelope', () => {
+  const first = generatePairingSecret();
+  const second = generatePairingSecret();
+  assert.match(first, /^[A-Za-z0-9_-]{43}$/);
+  assert.notEqual(first, second);
+
+  const envelope = hashPairingSecret(first);
+  assert.equal(envelope.version, 1);
+  assert.equal(envelope.algorithm, 'scrypt');
+  assert.equal(Object.values(envelope).includes(first), false);
+  assert.equal(verifyPairingSecret(first, envelope), true);
+  assert.equal(verifyPairingSecret(second, envelope), false);
+  assert.equal(verifyPairingSecret('', envelope), false);
+  assert.equal(verifyPairingSecret(null, envelope), false);
+});
+
+test('auth rejects missing/wrong secrets and unknown or malformed origins', () => {
+  const auth = new BridgeAuth({ expectedOrigin: EXTENSION_ORIGIN });
+  const { secret } = auth.rotate();
+
+  assert.equal(auth.authenticate({ origin: EXTENSION_ORIGIN, secret }), true);
+  assert.equal(auth.authenticate({ origin: EXTENSION_ORIGIN }), false);
+  assert.equal(auth.authenticate({ origin: EXTENSION_ORIGIN, secret: 'wrong' }), false);
+  assert.equal(auth.authenticate({ origin: 'chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', secret }), false);
+  assert.equal(auth.authenticate({ origin: `${EXTENSION_ORIGIN}/`, secret }), false);
+  assert.equal(auth.authenticate({ origin: `${EXTENSION_ORIGIN}\r\nX-Evil: yes`, secret }), false);
+  assert.equal(auth.authenticate({ origin: EXTENSION_ORIGIN, secret: `${secret}\r\n` }), false);
+});
+
+test('rotation invalidates the previous secret and revoke invalidates the current secret', () => {
+  const auth = new BridgeAuth({ expectedOrigin: EXTENSION_ORIGIN });
+  const first = auth.rotate().secret;
+  const second = auth.rotate().secret;
+
+  assert.equal(auth.authenticate({ origin: EXTENSION_ORIGIN, secret: first }), false);
+  assert.equal(auth.authenticate({ origin: EXTENSION_ORIGIN, secret: second }), true);
+  auth.revoke();
+  assert.equal(auth.authenticate({ origin: EXTENSION_ORIGIN, secret: second }), false);
+  assert.equal(auth.envelope, null);
+});
+
+test('an envelope can be safely persisted and loaded by a future desktop wiring', () => {
+  const first = new BridgeAuth({ expectedOrigin: EXTENSION_ORIGIN });
+  const { secret, envelope } = first.rotate();
+  const persisted = JSON.parse(JSON.stringify(envelope));
+  const restored = new BridgeAuth({ expectedOrigin: EXTENSION_ORIGIN, envelope: persisted });
+
+  assert.equal(restored.authenticate({ origin: EXTENSION_ORIGIN, secret }), true);
+  assert.throws(
+    () => new BridgeAuth({ expectedOrigin: 'https://example.test' }),
+    (error) => error instanceof BridgeAuthError && error.code === 'INVALID_EXTENSION_ORIGIN'
+  );
+  assert.throws(
+    () => new BridgeAuth({ expectedOrigin: 'chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' }),
+    (error) => error instanceof BridgeAuthError && error.code === 'INVALID_EXTENSION_ORIGIN'
+  );
+});
+
+test('readJsonBody accepts a bounded JSON object and rejects malformed or oversized input', async () => {
+  assert.deepEqual(
+    await readJsonBody(Readable.from(['{"ok":true}']), { maxBytes: 64 }),
+    { ok: true }
+  );
+
+  await assert.rejects(
+    readJsonBody(Readable.from(['{"nope"']), { maxBytes: 64 }),
+    (error) => error.code === 'MALFORMED_JSON'
+  );
+  await assert.rejects(
+    readJsonBody(Readable.from(['{"value":"', 'x'.repeat(100), '"}']), { maxBytes: 32 }),
+    (error) => error.code === 'BODY_TOO_LARGE'
+  );
+  await assert.rejects(
+    readJsonBody(Readable.from(['[]']), { maxBytes: 64 }),
+    (error) => error.code === 'INVALID_JSON_BODY'
+  );
+});
+
+test('readJsonBody aborts a slow body at its deadline', async () => {
+  const stream = new PassThrough();
+  const pending = readJsonBody(stream, { maxBytes: 64, deadlineMs: 15 });
+  stream.write('{');
+  await assert.rejects(pending, (error) => error.code === 'BODY_DEADLINE_EXCEEDED');
+});
+
+test('request limiter rejects excess concurrent bodies before work begins', async () => {
+  const limiter = createRequestLimiter({ maxConcurrent: 1 });
+  let release;
+  const active = limiter.run(() => new Promise((resolve) => { release = resolve; }));
+  await assert.rejects(
+    limiter.run(async () => 'never'),
+    (error) => error.code === 'TOO_MANY_REQUESTS'
+  );
+  release('done');
+  assert.equal(await active, 'done');
+  assert.equal(limiter.active, 0);
+});
diff --git a/test/extension-contract.test.js b/test/extension-contract.test.js
new file mode 100644
index 0000000..368dbd3
--- /dev/null
+++ b/test/extension-contract.test.js
@@ -0,0 +1,179 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { APT_EXTENSION_ID, APT_EXTENSION_ORIGIN } = require('../src/bridge-auth');
+
+const ROOT = path.join(__dirname, '..');
+const EXTENSION = path.join(ROOT, 'chrome-extension');
+const OLD_TOKEN = 'apt-local-' + 'bridge-token';
+const EXPECTED_ID = 'onbkfpbggekakjddomjjnboippimlmch';
+
+function read(name) {
+  return fs.readFileSync(path.join(EXTENSION, name), 'utf8');
+}
+
+function extensionIdFromKey(key) {
+  const digest = crypto.createHash('sha256').update(Buffer.from(key, 'base64')).digest().subarray(0, 16);
+  return [...digest].map((byte) =>
+    String.fromCharCode(97 + (byte >> 4), 97 + (byte & 0x0f))
+  ).join('');
+}
+
+function makeElement() {
+  const listeners = {};
+  return {
+    textContent: '',
+    className: '',
+    disabled: false,
+    hidden: false,
+    checked: false,
+    value: '',
+    addEventListener(type, listener) { listeners[type] = listener; },
+    async dispatch(type) { return listeners[type]?.({ preventDefault() {} }); }
+  };
+}
+
+function makePopupHarness({ paired = true, confirmCopy = false, clipboardReject = null } = {}) {
+  const elements = Object.fromEntries(
+    ['tabInfo', 'pairingInfo', 'sendBtn', 'copyBtn', 'statusMsg', 'copyWarning', 'confirmCopy', 'openOptionsBtn']
+      .map((id) => [id, makeElement()])
+  );
+  const clipboardWrites = [];
+  const fetchCalls = [];
+  let cookieReads = 0;
+  const chromeApi = {
+    storage: { local: { get: async () => paired ? { aptPairingSecret: 'A'.repeat(43) } : {} } },
+    tabs: { query: async () => [{ url: 'https://customer.avasecurity.com/devices' }] },
+    cookies: { get: async () => { cookieReads += 1; return { value: 'sensitive-va-token' }; } },
+    runtime: { openOptionsPage() {} }
+  };
+  const navigatorApi = {
+    clipboard: {
+      async writeText(value) {
+        if (clipboardReject) throw clipboardReject;
+        clipboardWrites.push(value);
+      }
+    }
+  };
+  const documentApi = { getElementById: (id) => elements[id] };
+  const { createPopupController } = require('../chrome-extension/popup.js');
+  const controller = createPopupController({
+    chromeApi,
+    documentApi,
+    navigatorApi,
+    confirmCopy: () => confirmCopy,
+    fetchImpl: async (...args) => {
+      fetchCalls.push(args);
+      return { ok: true, json: async () => ({ success: true }) };
+    }
+  });
+  return { controller, elements, clipboardWrites, fetchCalls, get cookieReads() { return cookieReads; } };
+}
+
+test('manifest commits only a public key, stable ID, local storage, and exact loopback host access', () => {
+  const manifest = JSON.parse(read('manifest.json'));
+  assert.equal(extensionIdFromKey(manifest.key), EXPECTED_ID);
+  assert.equal(APT_EXTENSION_ID, EXPECTED_ID);
+  assert.equal(APT_EXTENSION_ORIGIN, `chrome-extension://${EXPECTED_ID}`);
+  assert.ok(manifest.permissions.includes('storage'));
+  assert.equal(manifest.options_page, 'options.html');
+  assert.ok(manifest.host_permissions.includes('http://127.0.0.1:18247/*'));
+  assert.equal(manifest.host_permissions.some((entry) => entry.includes('localhost')), false);
+  assert.equal(/PRIVATE KEY/.test(manifest.key), false);
+});
+
+test('extension source contains no old token and sends only to the exact bridge endpoint', () => {
+  const sources = ['manifest.json', 'popup.js', 'popup.html', 'options.js', 'options.html']
+    .map(read).join('\n');
+  assert.equal(sources.includes(OLD_TOKEN), false);
+  assert.match(read('popup.js'), /http:\/\/127\.0\.0\.1:18247\/cookie/);
+  assert.doesNotMatch(sources, /http:\/\/(?:localhost|\[::1\]|0\.0\.0\.0):18247/);
+  assert.doesNotMatch(sources, /console\.(?:log|debug|info)\s*\(/);
+});
+
+test('popup stays disabled while unpaired and directs the user to pairing options', async () => {
+  const harness = makePopupHarness({ paired: false });
+  await harness.controller.init();
+  assert.equal(harness.elements.sendBtn.disabled, true);
+  assert.equal(harness.elements.copyBtn.disabled, true);
+  assert.match(harness.elements.pairingInfo.textContent, /Not paired/i);
+  assert.equal(harness.elements.openOptionsBtn.hidden, false);
+});
+
+test('paired popup enables preserved actions only on a supported Alta HTTPS tab', async () => {
+  const harness = makePopupHarness({ paired: true });
+  await harness.controller.init();
+  assert.equal(harness.elements.sendBtn.textContent || 'Send to APT', 'Send to APT');
+  assert.equal(harness.elements.copyBtn.textContent || 'Copy VA Token', 'Copy VA Token');
+  assert.equal(harness.elements.sendBtn.disabled, false);
+  assert.equal(harness.elements.copyBtn.disabled, false);
+  assert.match(harness.elements.pairingInfo.textContent, /Paired/i);
+});
+
+test('deployment detection rejects non-HTTPS, bare, and lookalike Alta hosts', () => {
+  const { isSupportedDeploymentUrl } = require('../chrome-extension/popup.js');
+  assert.equal(isSupportedDeploymentUrl('https://customer.avasecurity.com/path'), true);
+  assert.equal(isSupportedDeploymentUrl('http://customer.avasecurity.com/path'), false);
+  assert.equal(isSupportedDeploymentUrl('https://avasecurity.com/path'), false);
+  assert.equal(isSupportedDeploymentUrl('https://customer.avasecurity.com.evil.test/path'), false);
+});
+
+test('Send to APT uses the paired secret header and exact endpoint', async () => {
+  const harness = makePopupHarness({ paired: true });
+  await harness.controller.init();
+  await harness.controller.sendToApt();
+  assert.equal(harness.fetchCalls.length, 1);
+  const [url, request] = harness.fetchCalls[0];
+  assert.equal(url, 'http://127.0.0.1:18247/cookie');
+  assert.equal(request.headers['X-APT-Pairing-Secret'], 'A'.repeat(43));
+  assert.deepEqual(JSON.parse(request.body), {
+    deploymentUrl: 'https://customer.avasecurity.com',
+    cookieValue: 'sensitive-va-token'
+  });
+});
+
+test('copy cancellation occurs before cookie access and never writes the token', async () => {
+  const harness = makePopupHarness({ paired: true, confirmCopy: false });
+  await harness.controller.init();
+  await harness.controller.copyToken();
+  assert.equal(harness.cookieReads, 0);
+  assert.deepEqual(harness.clipboardWrites, []);
+  assert.match(harness.elements.statusMsg.textContent, /cancelled/i);
+});
+
+test('confirmed copy warns about clipboard history and reports success without exposing token', async () => {
+  const harness = makePopupHarness({ paired: true, confirmCopy: true });
+  await harness.controller.init();
+  assert.match(harness.elements.copyWarning.textContent, /clipboard (?:history|sync)/i);
+  await harness.controller.copyToken();
+  assert.deepEqual(harness.clipboardWrites, ['sensitive-va-token']);
+  assert.match(harness.elements.statusMsg.textContent, /copied/i);
+  assert.equal(harness.elements.statusMsg.textContent.includes('sensitive-va-token'), false);
+});
+
+test('clipboard permission denial is handled without leaking the token', async () => {
+  const harness = makePopupHarness({
+    paired: true,
+    confirmCopy: true,
+    clipboardReject: new Error('NotAllowedError')
+  });
+  await harness.controller.init();
+  await harness.controller.copyToken();
+  assert.match(harness.elements.statusMsg.textContent, /could not copy/i);
+  assert.equal(harness.elements.statusMsg.textContent.includes('sensitive-va-token'), false);
+});
+
+test('options UI stores a validated pairing secret locally and can forget pairing', () => {
+  const html = read('options.html');
+  const js = read('options.js');
+  assert.match(html, /pairingSecret/);
+  assert.match(html, /type="password"/);
+  assert.match(js, /chrome\.storage\.local\.set/);
+  assert.match(js, /chrome\.storage\.local\.remove/);
+  assert.match(js, /aptPairingSecret/);
+  assert.doesNotMatch(js, /console\./);
+});

From 2f492b662d70c8b68935b2467470b96f9aad58d4 Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Wed, 19 Aug 2026 21:36:24 +0000
Subject: [PATCH 06/22] fix: integrate hardened APT security boundary

---
 CLAUDE.md                       |  130 ++--
 README.md                       |  215 ++-----
 chrome-extension/popup.js       |    2 +-
 docs/index.html                 |   11 +-
 index.html                      |   74 +--
 main.js                         |  735 +++++-----------------
 package.json                    |    2 +
 preload.js                      |   56 +-
 renderer.js                     | 1014 +++++++++----------------------
 src/bridge-auth.js              |    2 +-
 src/electron-runtime.js         |  300 +++++++++
 styles.css                      |   92 ++-
 test/extension-contract.test.js |    2 +-
 test/runtime-contract.test.js   |  208 +++++++
 14 files changed, 1113 insertions(+), 1730 deletions(-)
 create mode 100644 src/electron-runtime.js
 create mode 100644 test/runtime-contract.test.js

diff --git a/CLAUDE.md b/CLAUDE.md
index 2b2a0cb..0444294 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,112 +1,50 @@
 # CLAUDE.md
 
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+## Project
 
-## Project Overview
+Alta Proxy Tool (APT) is a Windows-only Electron app. Its source of record and releases are on GitPeji:
 
-Alta Proxy Tool (APT) — an Electron desktop app that authenticates with Avigilon Alta Video deployments via a companion Chrome extension, discovers cameras, and launches `aware-cam-proxy.exe` to establish camera connections. Authentication uses cookie import from Chrome — no username/password login flow. Windows-only due to the proxy executable.
+- Repository: `https://git.pejicorp.com/peji/Alta-Proxy-Tool`
+- Releases: `https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases`
 
-## Repository
-
-- **GitHub**: https://github.com/PageZ948/Alta-Proxy-Tool (private)
-- **Branch**: master
-- **Git identity**: Zac <zpage948@gmail.com> (repo-local config)
+The app imports an Alta Video session through a stable-ID paired Chrome extension, discovers cameras, and directly launches the fixed `aware-cam-proxy.exe` helper.
 
 ## Commands
 
 ```bash
-npm start          # Run the app
-npm run dev        # Run with DevTools open (--dev flag)
-npm run build      # Build portable Windows .exe (output: dist/)
-npm run build-test # Build to directory without packaging
+npm start
+npm run dev
+npm test
+npm run check
+npm run build-test
+npm run build
 ```
 
-No test framework is configured. No linter is configured.
+## Required security architecture
 
-## Architecture
+- Main owns `SessionStore`, `AltaClient`, `ProxyProcessManager`, bridge authentication, and safe update checking.
+- Renderer/preload contracts must never carry the Alta deployment credential or cookie.
+- IPC methods are narrow and sender-validated against the main local file frame.
+- Bridge is exactly `127.0.0.1:18247`, exact committed extension origin, and `X-APT-Pairing` authenticated.
+- Persist only the pairing hash envelope under Electron `userData`; plaintext is shown once after first run/rotation.
+- Proxy helper launches directly with `shell: false`; stop only app-owned child processes.
+- Update behavior is check-only against the exact GitPeji API. The only follow-up action opens the fixed GitPeji releases page externally.
+- Never add download/install/replace logic, arbitrary URLs, redirect following, shell scripts, broad process killing, hardcoded bridge secrets, or credential-bearing renderer state.
+- Synthetic tests only: never use a real tenant or Alta session.
 
-This is a vanilla Electron app (no React/Vue/framework). Core files:
+## File map
 
-```
-main.js      → Electron main process: IPC handlers, API calls (axios),
-                cookie proxy process spawning, local HTTP cookie server
-preload.js   → contextBridge exposing window.electronAPI with IPC wrappers
-renderer.js  → All UI logic: DOM manipulation, state management, event handlers
-index.html   → Static HTML shell, no inline scripts (CSP enforced)
-styles.css   → Dark theme using CSS custom properties
-```
+- `main.js`: Electron adapter, lifecycle, trusted IPC registration, fixed bridge listener
+- `src/electron-runtime.js`: runtime orchestration, pairing persistence, bridge request contract
+- `src/session-store.js`: in-memory credential boundary
+- `src/alta-client.js`: bounded same-origin Alta API client
+- `src/proxy-launch.js`: Windows direct-spawn owned-child manager
+- `src/update-policy.js`: GitPeji check-only policy
+- `src/bridge-auth.js`: stable extension origin, scrypt pairing, limits/deadlines
+- `preload.js`: narrow methods and event payload stripping
+- `renderer.js`: non-secret connection/device/proxy/pairing/update UI
+- `test/runtime-contract.test.js`: integration and forbidden-source policy
 
-A companion Chrome extension lives in `chrome-extension/`:
+## Scope
 
-```
-chrome-extension/
-  manifest.json  → Manifest V3, cookies + activeTab permissions
-  popup.html     → Extension popup UI
-  popup.css      → Dark theme matching the Electron app
-  popup.js       → Tab detection, cookie retrieval, POST to localhost
-  icon*.png      → Placeholder icons
-```
-
-### Authentication Flow
-
-There is no login form or profile system. Authentication works exclusively through the Chrome extension cookie bridge:
-
-1. User logs into Alta deployment in Chrome
-2. Clicks the Chrome extension popup → "Send Cookie to APT"
-3. Extension POSTs `{deploymentUrl, cookieValue}` to `http://127.0.0.1:18247/cookie` with `X-APT-Token` header
-4. `main.js` HTTP server validates and forwards via IPC push to renderer
-5. `renderer.js` `handleExtensionCookie()` sets session state, auto-populates cookie key, fetches devices
-
-The extension is loaded unpacked via `chrome://extensions/` → Developer mode → Load unpacked → select `chrome-extension/`.
-
-### IPC Communication Pattern
-
-Most cross-process communication follows the request/response pattern:
-1. `main.js` registers handler: `ipcMain.handle('channel-name', async (event, params) => { ... })`
-2. `preload.js` exposes it: `channelName: (params) => ipcRenderer.invoke('channel-name', params)`
-3. `renderer.js` calls it: `const result = await window.electronAPI.channelName(params)`
-
-All handlers return `{ success: boolean, message?: string, ...data }`.
-
-There is one **push-pattern** channel for the Chrome extension cookie bridge:
-- `main.js` sends: `mainWindow.webContents.send('extension-cookie-received', data)`
-- `preload.js` bridges: `ipcRenderer.on('extension-cookie-received', callback)`
-- `renderer.js` listens via `window.electronAPI.onExtensionCookie(callback)`
-
-### IPC Channels
-
-| Channel | Purpose |
-|---------|---------|
-| `api-get-devices` | GET /api/v1/devices with cookie auth |
-| `api-get-auth-info` | GET /api/v1/auth to verify session |
-| `camera-proxy-cookie-launch` | Spawns aware-cam-proxy.exe (cookie method) |
-| `camera-proxy-stop` | Kills all proxy processes via taskkill/powershell |
-| `extension-cookie-received` | Push channel: cookie data from Chrome extension → renderer |
-
-### State Management (renderer.js)
-
-All connection state lives in the `sessionData` object (deploymentUrl, cookies, isConnected). There is no separate `isConnected` flag — always use `sessionData.isConnected`.
-
-Active cookie proxy processes are tracked in `activeCookieProxyConnections` Map, keyed by device GUID.
-
-### Security Model
-
-- Context isolation enabled, nodeIntegration disabled
-- CSP meta tag: `script-src 'self'` — no inline scripts or onclick handlers allowed
-- Batch file inputs are sanitized via `sanitizeBatchInput()` to prevent command injection
-- Local HTTP cookie server (port 18247) bound to `127.0.0.1` only
-- Cookie server validates: shared token header, CORS restricted to `chrome-extension://` origins, deployment URL must be `*.avasecurity.com` or `*.avigilon.com` over HTTPS, type/length limits on all inputs, 64KB body size limit
-
-## Key Conventions
-
-- No inline event handlers in HTML — all use `addEventListener` in renderer.js
-- All user-provided content rendered to DOM must go through `escapeHtml()` (XSS prevention)
-- External processes spawned with `detached: true` + `unref()` so they survive if the app closes
-- Device list filters out cloud cameras (`capabilities.localStorage === false` only)
-- `clearDeviceList()` must NOT clear proxy connection Maps (proxies may still be running)
-
-## External Executable
-
-- `aware-cam-proxy.exe` — cookie-based auth proxy (required)
-
-Not bundled via npm. Must be in the app root directory. Gitignored along with `*.pdf`, `node_modules/`, and `dist/`.
+Windows is the current supported runtime because `aware-cam-proxy.exe` is Windows-specific. Do not upgrade dependencies or change production/Tool Hub as part of runtime hardening unless explicitly requested.
diff --git a/README.md b/README.md
index 51b085b..6fdd720 100644
--- a/README.md
+++ b/README.md
@@ -1,186 +1,65 @@
-#  Alta Video Camera Proxy
+# Alta Video Camera Proxy
 
-An Electron desktop application for managing Alta Video camera proxy connections. Authenticates via a companion Chrome extension that imports your existing Alta session cookie, discovers cameras, and launches proxy connections.
+APT is a Windows Electron desktop app that imports an existing Alta Video session through its paired Chrome extension, discovers local cameras, and launches `aware-cam-proxy.exe` without exposing Alta credentials to the renderer.
 
-## Features
+## Security boundary
 
-- **Chrome Extension Authentication**: Import your Alta session cookie from Chrome with one click — no manual login
-- **API Integration**: Device discovery via Alta Video API using cookie auth
-- **Camera Proxy Management**: Launch and manage camera proxy connections
-- **Device Filtering**: Automatically filters to show only local (non-cloud) cameras
-- **Device Search**: Quick search functionality to find cameras by name, ID, IP, or model
-- **Real-time Status**: Live connection status and device online/offline indicators
-- **Auto-Update**: Checks for updates on startup via GitHub Releases, with one-click in-place update
-- **Modern Dark UI**: Professional dark-mode interface with responsive design
+- `main.js` owns the in-memory `SessionStore`, `AltaClient`, `ProxyProcessManager`, bridge pairing envelope, and update checker.
+- The renderer receives only connection origin/state, device/site/auth responses, and owned proxy metadata. It never receives or supplies the Alta session value.
+- The bridge listens only on `127.0.0.1:18247`, accepts only the committed extension origin, requires the `X-APT-Pairing` secret, limits concurrent/body/deadline work, and validates an exact canonical Alta HTTPS origin.
+- The pairing envelope is a scrypt hash stored atomically under Electron `userData` with restrictive permissions. The plaintext secret is shown once on first run or rotation. Revoke invalidates it.
+- Proxy launch is a direct `spawn` of the fixed helper with `shell: false`; stop actions can target only children owned by this app.
+- Updates are **check-only**. APT checks the exact GitPeji release API and can open only `https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases` in the system browser. It never downloads, replaces, or executes an update.
 
-## Prerequisites
+## Requirements
 
-- **Node.js** (version 14 or higher)
-- **npm** (comes with Node.js)
-- **Google Chrome** (for the authentication extension)
-- **Windows OS** (required for camera proxy executable)
-- **aware-cam-proxy.exe** (camera proxy executable) — must be placed in the application directory
-- **An active Alta Video session** in Chrome (logged in to your deployment)
+- Windows (current supported runtime scope)
+- Node.js and npm for development
+- Chrome with the bundled extension loaded unpacked
+- `aware-cam-proxy.exe` beside the development app or packaged portable executable
+- An active Alta Video login in Chrome
 
-## Installation
-
-1. Clone or download this project
-2. Install dependencies:
-   ```bash
-   npm install
-   ```
-3. Place `aware-cam-proxy.exe` in the project root directory
-
-### Chrome Extension Setup
-
-1. Open Chrome and navigate to `chrome://extensions/`
-2. Enable **Developer mode** (toggle in top-right)
-3. Click **Load unpacked**
-4. Select the `chrome-extension/` folder from this project
-5. The extension icon will appear in the Chrome toolbar
-
-## Usage
-
-### Starting the Application
+## Setup and pairing
 
 ```bash
+npm install
 npm start
 ```
 
-Or for development mode with DevTools:
-```bash
-npm run dev
-```
+1. Open `chrome://extensions`, enable Developer mode, and load `chrome-extension/` unpacked.
+2. Start APT. Under **Bridge Pairing**, copy the one-time secret.
+3. Open the extension pairing settings, paste the secret, and save it.
+4. Visit your Alta deployment in Chrome and use **Send to APT**.
+5. Select a local camera and choose **Start Proxy**.
 
-### Connecting to Alta
+Use **Generate / Rotate** if a pairing may have been exposed, then update the extension. Use **Revoke** to immediately disable bridge authentication.
 
-1. **Log into your Alta deployment** in Chrome (e.g., `https://your-site.eu1.aware.avasecurity.com`)
-2. **Click the extension icon** in Chrome — it will detect the Alta tab
-3. **Click "Send Cookie to APT"** — the app will connect and load devices automatically
-
-### Launching Camera Proxy
-
-1. **Connect via Chrome extension** (above)
-2. **Select a device** from the left sidebar
-3. **Click "Start Camera Proxy"**
-4. A command prompt window will open with the proxy connection
-
-### Updating
-
-The app checks for updates automatically 2 seconds after launch. If a newer version is available on GitHub Releases, the "Check for Updates" button in the header will show a green badge.
-
-- **Manual check**: Click "Check for Updates" in the top-right corner
-- **Install**: The update modal shows release notes — click "Install Update" to download and replace the current executable
-- The app will quit, swap the `.exe`, and relaunch automatically
-
-## API Endpoints Used
-
-- **Device List**: `GET /api/v1/devices` — Retrieve all devices
-- **Auth Info**: `GET /api/v1/auth` — Verify authentication status
-
-## How It Works
-
-```
-Chrome Extension (popup click)
-  → POST http://127.0.0.1:18247/cookie
-  → Electron app HTTP server receives cookie
-  → Sets session state, fetches devices
-  → User selects device → launches aware-cam-proxy.exe
-```
-
-The Electron app runs a local HTTP server on port 18247 that only accepts requests from Chrome extensions with a shared token. The Chrome extension reads the `va` session cookie from the active Alta tab and sends it to the app.
-
-## Security
-
-- **Context Isolation**: Renderer process is isolated from Node.js APIs
-- **Preload Script**: Secure IPC communication between main and renderer processes
-- **CSP Enforced**: `script-src 'self'` — no inline scripts allowed
-- **Localhost Only**: Cookie server binds to `127.0.0.1`, not accessible from network
-- **CORS Restricted**: Only `chrome-extension://` origins accepted
-- **Domain Validation**: Only `*.avasecurity.com` and `*.avigilon.com` URLs accepted
-- **Input Sanitization**: Batch file inputs sanitized to prevent command injection
-- **Size Limits**: 64KB body limit on cookie server, type/length validation on all inputs
-
-## File Structure
-
-```
-├── main.js              # Main process (IPC, API calls, proxy spawning, cookie server)
-├── renderer.js          # Renderer process (UI logic, state management)
-├── preload.js           # Secure IPC bridge (contextBridge)
-├── index.html           # Static HTML shell (CSP enforced)
-├── styles.css           # Dark theme styling
-├── package.json         # Dependencies and build config
-├── chrome-extension/    # Chrome extension for cookie import
-│   ├── manifest.json    # Manifest V3
-│   ├── popup.html       # Extension popup UI
-│   ├── popup.css        # Dark theme styling
-│   ├── popup.js         # Tab detection, cookie retrieval
-│   └── icon*.png        # Extension icons
-├── assets/
-│   └── icon.png         # Application icon
-├── CLAUDE.md            # Claude Code project instructions
-└── README.md            # This file
-```
-
-**External executable** (not included in repo):
-- `aware-cam-proxy.exe` — cookie-based auth proxy (required, place in app root)
-
-## Troubleshooting
-
-### Connection Issues
-- Ensure you are **logged into Alta in Chrome** before clicking the extension
-- Verify the extension shows "Detected: [hostname]" in green
-- If extension shows "Alta Proxy Tool is not running" — start the Electron app first
-- If "Session cookie has expired" — log into Alta again in Chrome
-- Check that the app console shows "Cookie server listening on http://127.0.0.1:18247"
-
-### Camera Proxy Issues
-- **Executable not found**: Ensure `aware-cam-proxy.exe` is in the application directory
-- **Proxy won't start**: Check that you're connected and have selected a device
-- **Command window closes immediately**: Check network connectivity to the deployment
-
-### Device List Issues
-- Ensure you're connected via the Chrome extension first
-- Check that your user account has permissions to view devices
-- **No devices shown**: You may only have cloud cameras which are filtered out
-- Use the search box to find specific devices
-
-## Building for Distribution
+## Development and verification
+
+```bash
+npm test          # Node test suite, including synthetic runtime contracts
+npm run check     # Syntax checks plus tests
+npm run build-test
+```
+
+Tests use synthetic sessions/transports/processes only. Never add a real Alta tenant URL or session value to fixtures, logs, screenshots, or commits.
+
+Core files:
+
+- `main.js` — Electron lifecycle, trusted-sender IPC, fixed loopback server
+- `src/electron-runtime.js` — pairing persistence, bridge handler, narrow runtime orchestration
+- `src/session-store.js`, `src/alta-client.js` — main-only Alta session and requests
+- `src/proxy-launch.js` — fixed shell-free helper process management
+- `src/update-policy.js` — exact GitPeji check-only release policy
+- `preload.js` — narrow context bridge
+- `renderer.js`, `index.html`, `styles.css` — non-secret UI
+- `chrome-extension/` — stable-ID paired cookie sender
+- `test/` — pure and end-to-end contract tests
+
+## Building
 
 ```bash
-# Build portable Windows executable
 npm run build
-
-# Output: dist/AltaCameraProxy-1.0.0-portable.exe
 ```
 
-**Important**: Copy `aware-cam-proxy.exe` to the same directory as the built executable before distribution.
-
-## Limitations
-
-- **Windows Only**: Camera proxy executable is Windows-specific
-- **Chrome Required**: Authentication requires the Chrome extension
-- **Local Cameras Only**: Automatically filters out cloud-based cameras
-- **No Session Refresh**: Sessions may expire and require re-import from Chrome
-- **Executable Required**: `aware-cam-proxy.exe` must be obtained separately
-- **Update Requires Write Access**: Self-update needs write permission to the directory containing the `.exe`
-
-## Development
-
-To modify or extend this application:
-
-1. **Main Process** ([main.js](main.js)): App lifecycle, API requests, proxy spawning, cookie server
-2. **Renderer Process** ([renderer.js](renderer.js)): UI interactions and state management
-3. **Preload Script** ([preload.js](preload.js)): Secure IPC bridge with context isolation
-4. **Chrome Extension** ([chrome-extension/](chrome-extension/)): Cookie import from browser
-5. **Styling** ([styles.css](styles.css)): Dark mode theme and responsive design
-
-### Adding New IPC Endpoints
-
-1. Add handler in [main.js](main.js) using `ipcMain.handle()`
-2. Expose method in [preload.js](preload.js) via `contextBridge.exposeInMainWorld()`
-3. Call from [renderer.js](renderer.js) using `window.electronAPI.yourMethod()`
-
-## License
-
-MIT License - Feel free to modify and distribute as needed.
+The output remains Windows-only because the external camera helper is Windows-specific. Copy `aware-cam-proxy.exe` beside the portable APT executable before use. Dependencies are intentionally unchanged in this hardening release.
diff --git a/chrome-extension/popup.js b/chrome-extension/popup.js
index 35f7719..55a1832 100644
--- a/chrome-extension/popup.js
+++ b/chrome-extension/popup.js
@@ -83,7 +83,7 @@ function createPopupController({
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',
-          'X-APT-Pairing-Secret': pairingSecret
+          'X-APT-Pairing': pairingSecret
         },
         body: JSON.stringify({ deploymentUrl: detectedOrigin, cookieValue })
       });
diff --git a/docs/index.html b/docs/index.html
index f307442..13c756a 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html lang="en">
 <head>
-    <!-- GitHub Pages rebuild marker: 2026-05-22 -->
+
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Alta Proxy Tool</title>
@@ -303,7 +303,7 @@
                 <img src="icon.png" alt="Alta Proxy Tool">
                 <span>Alta Proxy Tool</span>
             </div>
-            <a href="https://github.com/PageZ948/Alta-Proxy-Tool" class="header-link">GitHub</a>
+            <a href="https://git.pejicorp.com/peji/Alta-Proxy-Tool" class="header-link">GitPeji</a>
         </div>
     </header>
 
@@ -313,7 +313,7 @@
             <div class="hero">
                 <img src="icon.png" alt="" class="hero-icon">
                 <h1>Alta Proxy Tool</h1>
-                <a href="https://github.com/PageZ948/Alta-Proxy-Tool/releases/latest/download/AltaProxyToolKit.zip" class="btn-download">Download Kit for Windows</a>
+                <a href="https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases" class="btn-download">View Windows Releases</a>
             </div>
 
             <section class="setup">
@@ -321,8 +321,9 @@
                 <ol class="setup-steps">
                     <li>Extract the zip to any folder</li>
                     <li>Load <code>chrome-extension/</code> in Chrome via <code>chrome://extensions</code> (Developer mode)</li>
+                    <li>Start APT and paste its one-time pairing secret into the extension settings</li>
                     <li>Log into your Alta deployment in Chrome</li>
-                    <li>Click the extension icon and send cookies to the app</li>
+                    <li>Click the extension icon and securely send the session to the app</li>
                     <li>Run <strong>AltaCameraProxy.exe</strong> and start proxying</li>
                 </ol>
                 <p class="setup-note">Requires Windows 10+, Google Chrome, and an Avigilon Alta account.</p>
@@ -333,7 +334,7 @@
 
     <footer class="footer">
         <div class="container">
-            <a href="https://github.com/PageZ948/Alta-Proxy-Tool">Alta Proxy Tool on GitHub</a>
+            <a href="https://git.pejicorp.com/peji/Alta-Proxy-Tool">Alta Proxy Tool on GitPeji</a>
         </div>
     </footer>
 
diff --git a/index.html b/index.html
index f1b9b6e..9ff6456 100644
--- a/index.html
+++ b/index.html
@@ -3,45 +3,35 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;">
-    <title>Alta Video Camera Proxy with API</title>
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'none';">
+    <title>Alta Video Camera Proxy</title>
     <link rel="stylesheet" href="styles.css">
 </head>
 <body>
     <div class="app-container">
-        <!-- Main Content Layout -->
         <div class="main-layout">
-            <!-- Left Sidebar - Available Devices -->
             <aside class="devices-sidebar">
-                <div class="sidebar-header">
-                    <h2>Available Devices</h2>
-                </div>
-
+                <div class="sidebar-header"><h2>Available Devices</h2></div>
                 <div id="deviceStatus" class="status-message"></div>
-
-                <!-- Device Search -->
                 <div class="device-search-container">
-                    <input type="text" id="deviceSearch" placeholder="Search devices..." class="device-search-input">
+                    <input type="text" id="deviceSearch" placeholder="Search devices..." class="device-search-input" autocomplete="off">
                 </div>
-
                 <div class="device-list-container">
                     <div id="deviceList" class="device-list">
-                        <p class="placeholder-text">Connect to API to load devices</p>
+                        <p class="placeholder-text">Connect through the paired Chrome extension to load devices</p>
                     </div>
                 </div>
             </aside>
 
-            <!-- Main Content Area -->
             <main class="main-content">
                 <div class="content-header">
                     <h1>Alta Video Camera Proxy</h1>
-                    <button type="button" id="checkUpdateBtn" class="btn-update" title="Check for Updates">
+                    <button type="button" id="checkUpdateBtn" class="btn-update" title="Securely check GitPeji for a newer release">
                         <span class="update-icon">&#x21bb;</span>
                         <span class="update-text">Check for Updates</span>
                     </button>
                 </div>
 
-                <!-- API Connection Section -->
                 <section class="content-section">
                     <h2>API Connection</h2>
                     <div class="connection-status">
@@ -59,21 +49,34 @@
                     <div id="connectionStatus" class="status-message"></div>
                 </section>
 
-                <!-- Cookie-Based Camera Proxy Section -->
+                <section class="content-section pairing-section">
+                    <h2>Bridge Pairing</h2>
+                    <p class="section-help">Only the committed APT Chrome extension can send a session. Pair it with a one-time secret.</p>
+                    <div class="status-row">
+                        <label>Pairing:</label>
+                        <span id="pairingState" class="unpaired">Checking...</span>
+                    </div>
+                    <div id="pairingSecretRow" class="pairing-secret-row" style="display: none;">
+                        <label for="pairingSecret">One-time secret:</label>
+                        <input type="text" id="pairingSecret" readonly autocomplete="off" spellcheck="false">
+                        <small>Paste this into the extension pairing settings now. APT will not show it again.</small>
+                    </div>
+                    <div class="proxy-buttons">
+                        <button type="button" id="rotatePairingBtn" class="btn-primary">Generate / Rotate</button>
+                        <button type="button" id="revokePairingBtn" class="btn-outline">Revoke</button>
+                    </div>
+                </section>
+
                 <section class="content-section">
                     <h2>Camera Proxy</h2>
                     <div class="proxy-controls">
                         <div class="input-row">
-                            <label for="cookieDeviceUUID">Device UUID:</label>
-                            <input type="text" id="cookieDeviceUUID" placeholder="(Auto-filled when you select a device from the list)" readonly>
-                        </div>
-                        <div class="input-row" style="display: none;">
-                            <label for="cookieKey">Cookie Key:</label>
-                            <input type="text" id="cookieKey" placeholder="Paste your cookie key here">
+                            <label for="selectedDeviceId">Device UUID:</label>
+                            <input type="text" id="selectedDeviceId" placeholder="Select a device from the list" readonly>
                         </div>
                         <div class="proxy-buttons">
-                            <button type="button" id="startCookieProxyBtn" class="btn-primary" disabled>Start Proxy</button>
-                            <button type="button" id="stopCookieProxyBtn" class="btn-outline" disabled>Stop Proxy</button>
+                            <button type="button" id="startProxyBtn" class="btn-primary" disabled>Start Proxy</button>
+                            <button type="button" id="stopProxyBtn" class="btn-outline" disabled>Stop Proxy</button>
                         </div>
                     </div>
                 </section>
@@ -81,26 +84,15 @@
         </div>
     </div>
 
-    <!-- Update Modal -->
-    <div id="updateModalOverlay" class="update-modal-overlay" style="display: none;">
+    <div id="updateNotice" class="update-modal-overlay" style="display: none;">
         <div class="update-modal-card">
-            <div class="update-modal-header">
-                <h3>Update Available</h3>
-                <button type="button" id="updateModalCloseBtn" class="update-modal-close">&times;</button>
-            </div>
+            <div class="update-modal-header"><h3>Update Available</h3></div>
             <div class="update-modal-body">
-                <p id="updateModalMessage" class="update-modal-message"></p>
-                <div id="updateModalNotes" class="update-modal-notes"></div>
-                <div id="updateProgressContainer" class="update-progress-container" style="display: none;">
-                    <div class="update-progress-track">
-                        <div id="updateProgressFill" class="update-progress-fill" style="width: 0%"></div>
-                    </div>
-                    <span id="updateProgressText" class="update-progress-text">0%</span>
-                </div>
+                <p id="updateMessage" class="update-modal-message"></p>
             </div>
             <div class="update-modal-footer">
-                <button type="button" id="updateInstallBtn" class="btn-primary">Install Update</button>
-                <button type="button" id="updateLaterBtn" class="btn-outline">Later</button>
+                <button type="button" id="openReleasesBtn" class="btn-primary">Open GitPeji Releases</button>
+                <button type="button" id="dismissUpdateBtn" class="btn-outline">Later</button>
             </div>
         </div>
     </div>
diff --git a/main.js b/main.js
index 4bb5acd..284e159 100644
--- a/main.js
+++ b/main.js
@@ -1,631 +1,170 @@
+'use strict';
+
 const { app, BrowserWindow, ipcMain, shell } = require('electron');
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-const axios = require('axios');
-const https = require('https');
-const { spawn } = require('child_process');
-const http = require('http');
+const http = require('node:http');
+const path = require('node:path');
+const { pathToFileURL } = require('node:url');
+const { createSessionStore } = require('./src/session-store');
+const { createAltaClient } = require('./src/alta-client');
+const { createProxyManager } = require('./src/proxy-launch');
+const { checkForUpdate } = require('./src/update-policy');
+const {
+  AppRuntime,
+  PAIRING_ENVELOPE_FILENAME,
+  PairingController,
+  createBridgeHandler,
+} = require('./src/electron-runtime');
 
-let mainWindow;
-let activeProxyProcesses = new Map(); // Track active camera proxy processes
-let cookieServer = null;
-const COOKIE_SERVER_PORT = 18247;
-const COOKIE_SERVER_TOKEN = 'apt-local-bridge-token';
+const BRIDGE_HOST = '127.0.0.1';
+const BRIDGE_PORT = 18247;
+
+let mainWindow = null;
+let bridgeServer = null;
+let runtime = null;
+let pairingController = null;
+let firstRunPairingSecret = null;
 
-// Get the directory where the user-facing executable resides.
-// In portable builds, __dirname points to a temp extraction directory,
-// so we use the actual .exe location instead.
 function getAppDirectory() {
-  if (app.isPackaged) {
-    return path.dirname(process.env.PORTABLE_EXECUTABLE_FILE || app.getPath('exe'));
+  return app.isPackaged
+    ? path.dirname(process.env.PORTABLE_EXECUTABLE_FILE || app.getPath('exe'))
+    : __dirname;
+}
+
+function sendConnectionState() {
+  if (mainWindow && !mainWindow.isDestroyed() && runtime) {
+    mainWindow.webContents.send('connection-state-changed', runtime.getConnectionState());
   }
-  return __dirname;
-}
-
-// Sanitize strings before embedding in batch files to prevent command injection
-function sanitizeBatchInput(input) {
-  if (typeof input !== 'string') return '';
-  // Remove characters that have special meaning in batch/cmd: & | < > ^ % " ` !
-  return input.replace(/[&|<>^%"`!]/g, '');
-}
-
-function startCookieServer() {
-  cookieServer = http.createServer((req, res) => {
-    // CORS headers — only allow Chrome extension origins
-    const origin = req.headers.origin || '';
-    if (origin.startsWith('chrome-extension://')) {
-      res.setHeader('Access-Control-Allow-Origin', origin);
-    }
-    res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-APT-Token');
-
-    // Handle preflight
-    if (req.method === 'OPTIONS') {
-      res.writeHead(204);
-      res.end();
-      return;
-    }
-
-    // Only accept POST /cookie
-    if (req.method !== 'POST' || req.url !== '/cookie') {
-      res.writeHead(404, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ success: false, message: 'Not found' }));
-      return;
-    }
-
-    // Verify shared token
-    if (req.headers['x-apt-token'] !== COOKIE_SERVER_TOKEN) {
-      res.writeHead(403, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify({ success: false, message: 'Forbidden' }));
-      return;
-    }
-
-    // Read body with 64KB size limit
-    let body = '';
-    let bodySize = 0;
-    const MAX_BODY_SIZE = 65536;
-
-    req.on('data', (chunk) => {
-      bodySize += chunk.length;
-      if (bodySize > MAX_BODY_SIZE) {
-        res.writeHead(413, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ success: false, message: 'Payload too large' }));
-        req.destroy();
-        return;
-      }
-      body += chunk;
-    });
-
-    req.on('end', () => {
-      try {
-        const data = JSON.parse(body);
-        const { deploymentUrl, cookieValue } = data;
-
-        if (!deploymentUrl || !cookieValue) {
-          res.writeHead(400, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ success: false, message: 'Missing deploymentUrl or cookieValue' }));
-          return;
-        }
-
-        // Validate types and lengths
-        if (typeof deploymentUrl !== 'string' || typeof cookieValue !== 'string' ||
-            deploymentUrl.length > 512 || cookieValue.length > 4096) {
-          res.writeHead(400, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ success: false, message: 'Invalid parameter types or lengths' }));
-          return;
-        }
-
-        // Validate deployment URL is an Alta domain
-        try {
-          const parsed = new URL(deploymentUrl);
-          const isAltaDomain = parsed.hostname.endsWith('.avasecurity.com') ||
-                               parsed.hostname.endsWith('.avigilon.com');
-          if (!isAltaDomain || parsed.protocol !== 'https:') {
-            res.writeHead(400, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ success: false, message: 'Invalid deployment URL domain' }));
-            return;
-          }
-        } catch {
-          res.writeHead(400, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ success: false, message: 'Invalid deployment URL' }));
-          return;
-        }
-
-        if (mainWindow && !mainWindow.isDestroyed()) {
-          const cookies = ['va=' + cookieValue];
-          mainWindow.webContents.send('extension-cookie-received', {
-            deploymentUrl: deploymentUrl.replace(/\/$/, ''),
-            cookies,
-            cookieValue
-          });
-          res.writeHead(200, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ success: true, message: 'Cookie received' }));
-        } else {
-          res.writeHead(503, { 'Content-Type': 'application/json' });
-          res.end(JSON.stringify({ success: false, message: 'Application window not available' }));
-        }
-      } catch (e) {
-        res.writeHead(400, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ success: false, message: 'Invalid JSON' }));
-      }
-    });
-  });
-
-  cookieServer.listen(COOKIE_SERVER_PORT, '127.0.0.1', () => {
-    console.log(`Cookie server listening on http://127.0.0.1:${COOKIE_SERVER_PORT}`);
-  });
-
-  cookieServer.on('error', (err) => {
-    if (err.code === 'EADDRINUSE') {
-      console.error(`Cookie server error: Port ${COOKIE_SERVER_PORT} is already in use`);
-    } else {
-      console.error('Cookie server error:', err.message);
-    }
-  });
 }
 
 function createWindow() {
   mainWindow = new BrowserWindow({
     width: 1400,
     height: 900,
+    icon: path.join(__dirname, 'assets', 'icon.png'),
+    title: 'Alta Video Camera Proxy',
     webPreferences: {
       nodeIntegration: false,
       contextIsolation: true,
-      preload: path.join(__dirname, 'preload.js')
+      sandbox: true,
+      preload: path.join(__dirname, 'preload.js'),
     },
-    icon: path.join(__dirname, 'assets', 'icon.png'), // Optional icon
-    title: 'Alta Video Camera Proxy with API'
   });
 
-  mainWindow.loadFile('index.html');
+  mainWindow.webContents.setWindowOpenHandler(() => ({ action: 'deny' }));
+  mainWindow.webContents.on('will-navigate', (event) => event.preventDefault());
+  mainWindow.loadFile(path.join(__dirname, 'index.html'));
+  if (process.argv.includes('--dev')) mainWindow.webContents.openDevTools();
+}
 
-  // Open DevTools in development
-  if (process.argv.includes('--dev')) {
-    mainWindow.webContents.openDevTools();
-  }
+function isTrustedSender(event) {
+  if (!mainWindow || mainWindow.isDestroyed() || !event) return false;
+  const webContents = mainWindow.webContents;
+  const frame = event.senderFrame;
+  const expectedUrl = pathToFileURL(path.join(__dirname, 'index.html')).href;
+  return event.sender === webContents &&
+    frame === webContents.mainFrame &&
+    frame.url === expectedUrl;
+}
+
+function registerIpc(channel, handler) {
+  ipcMain.handle(channel, async (event, ...args) => {
+    if (!isTrustedSender(event)) throw new Error('Forbidden IPC sender');
+    return handler(...args);
+  });
+}
+
+function registerIpcHandlers() {
+  registerIpc('get-devices', () => runtime.getDevices());
+  registerIpc('get-device-sites', () => runtime.getDeviceSites());
+  registerIpc('get-auth-info', () => runtime.getAuthInfo());
+  registerIpc('launch-proxy', (deviceId) => runtime.launchProxy(deviceId));
+  registerIpc('stop-proxy', async (key) => {
+    const result = await runtime.stopProxy(key);
+    sendConnectionState();
+    return result;
+  });
+  registerIpc('disconnect', () => {
+    const state = runtime.disconnect();
+    sendConnectionState();
+    return state;
+  });
+  registerIpc('get-connection-state', () => runtime.getConnectionState());
+  registerIpc('check-for-updates', () => runtime.checkForUpdates());
+  registerIpc('open-fixed-releases-page', () => runtime.openFixedReleasesPage());
+  registerIpc('rotate-pairing', () => {
+    firstRunPairingSecret = null;
+    return pairingController.rotate();
+  });
+  registerIpc('revoke-pairing', () => {
+    firstRunPairingSecret = null;
+    return pairingController.revoke();
+  });
+  registerIpc('get-pairing-status', () => {
+    const result = pairingController.getStatus();
+    if (firstRunPairingSecret) {
+      result.secret = firstRunPairingSecret;
+      firstRunPairingSecret = null;
+    }
+    return result;
+  });
+}
+
+function startBridgeServer() {
+  const handler = createBridgeHandler({
+    bridgeAuth: pairingController.bridgeAuth,
+    sessionStore: runtime.sessionStore,
+    onConnectionStateChanged: sendConnectionState,
+  });
+  bridgeServer = http.createServer((request, response) => {
+    handler(request, response).catch(() => {
+      if (!response.writableEnded) {
+        response.writeHead(500, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+        response.end(JSON.stringify({ success: false, message: 'Bridge request failed' }));
+      }
+    });
+  });
+  bridgeServer.on('clientError', (_error, socket) => socket.destroy());
+  bridgeServer.on('error', (error) => {
+    console.error(`Bridge server unavailable (${error.code || 'UNKNOWN'}).`);
+  });
+  bridgeServer.listen(BRIDGE_PORT, BRIDGE_HOST);
 }
 
 app.whenReady().then(() => {
+  const sessionStore = createSessionStore();
+  const altaClient = createAltaClient({ sessionStore });
+  const proxyManager = createProxyManager({ appDirectory: getAppDirectory() });
+  pairingController = new PairingController({
+    envelopePath: path.join(app.getPath('userData'), PAIRING_ENVELOPE_FILENAME),
+  });
+  const pairingState = pairingController.initialize();
+  firstRunPairingSecret = pairingState.secret || null;
+  runtime = new AppRuntime({
+    sessionStore,
+    altaClient,
+    proxyManager,
+    checkForUpdate,
+    currentVersion: app.getVersion(),
+    openExternal: (url) => shell.openExternal(url),
+  });
+
+  registerIpcHandlers();
   createWindow();
-  startCookieServer();
+  startBridgeServer();
 });
 
 app.on('before-quit', () => {
-  if (cookieServer) {
-    cookieServer.close();
+  if (bridgeServer) bridgeServer.close();
+  if (runtime) {
+    for (const proxy of runtime.getConnectionState().activeProxies) runtime.stopProxy(proxy.processId);
+    runtime.sessionStore.dispose();
   }
 });
 
 app.on('window-all-closed', () => {
-  if (process.platform !== 'darwin') {
-    app.quit();
-  }
+  if (process.platform !== 'darwin') app.quit();
 });
 
 app.on('activate', () => {
-  if (BrowserWindow.getAllWindows().length === 0) {
-    createWindow();
-  }
+  if (BrowserWindow.getAllWindows().length === 0 && runtime) createWindow();
 });
-
-// IPC handlers for API communication
-ipcMain.handle('api-get-devices', async (event, { deploymentUrl, cookies }) => {
-  try {
-    const devicesUrl = `${deploymentUrl}/api/v1/devices`;
-    
-    // Create axios instance with cookies
-    const axiosInstance = axios.create({
-      timeout: 10000,
-      headers: {
-        'Cookie': cookies ? cookies.join('; ') : ''
-      }
-    });
-
-    const response = await axiosInstance.get(devicesUrl);
-    
-    return {
-      success: true,
-      devices: response.data,
-      message: `Found ${response.data.length} devices`
-    };
-  } catch (error) {
-    console.error('Get devices error:', error);
-    return {
-      success: false,
-      message: error.response?.data?.message || error.message || 'Failed to get devices'
-    };
-  }
-});
-
-ipcMain.handle('api-get-device-sites', async (event, { deploymentUrl, cookies }) => {
-  try {
-    const sitesUrl = `${deploymentUrl}/api/v1/deviceSites`;
-
-    const axiosInstance = axios.create({
-      timeout: 10000,
-      headers: {
-        'Cookie': cookies ? cookies.join('; ') : ''
-      }
-    });
-
-    const response = await axiosInstance.get(sitesUrl);
-
-    return {
-      success: true,
-      sites: response.data
-    };
-  } catch (error) {
-    console.error('Get device sites error:', error);
-    return {
-      success: false,
-      sites: [],
-      message: error.response?.data?.message || error.message || 'Failed to get device sites'
-    };
-  }
-});
-
-ipcMain.handle('api-get-auth-info', async (event, { deploymentUrl, cookies }) => {
-  try {
-    const authUrl = `${deploymentUrl}/api/v1/auth`;
-    
-    const axiosInstance = axios.create({
-      timeout: 10000,
-      headers: {
-        'Cookie': cookies ? cookies.join('; ') : ''
-      }
-    });
-
-    const response = await axiosInstance.get(authUrl);
-    
-    return {
-      success: true,
-      authInfo: response.data
-    };
-  } catch (error) {
-    console.error('Get auth info error:', error);
-    return {
-      success: false,
-      message: error.response?.data?.message || error.message || 'Failed to get auth info'
-    };
-  }
-});
-
-// Cookie-based camera proxy functionality
-ipcMain.handle('camera-proxy-cookie-launch', async (event, { deploymentUrl, cookieKey, deviceUuid }) => {
-  try {
-    // Path to the cookie-based camera proxy executable
-    const proxyExePath = path.join(getAppDirectory(), 'aware-cam-proxy.exe');
-    
-    // Check if the executable exists
-    if (!fs.existsSync(proxyExePath)) {
-      return {
-        success: false,
-        message: 'Cookie-based camera proxy executable not found. Please ensure aware-cam-proxy.exe is in the application directory.'
-      };
-    }
-    
-    // Extract the domain from the deployment URL
-    let domain = deploymentUrl;
-    if (domain.startsWith('https://')) {
-      domain = domain.substring(8);
-    } else if (domain.startsWith('http://')) {
-      domain = domain.substring(7);
-    }
-    // Remove trailing path segments
-    domain = domain.split('/')[0];
-
-    // Sanitize all inputs before embedding in batch file
-    const safeDomain = sanitizeBatchInput(domain);
-    const safeDeviceUuid = sanitizeBatchInput(deviceUuid);
-    const safeCookieKey = sanitizeBatchInput(cookieKey);
-
-    if (!safeDomain || !safeDeviceUuid || !safeCookieKey) {
-      return {
-        success: false,
-        message: 'Invalid characters detected in connection parameters.'
-      };
-    }
-
-    // Create a batch file to launch the cookie-based camera proxy
-    const truncatedKey = safeCookieKey.length > 20 ? safeCookieKey.substring(0, 20) + '...' : safeCookieKey;
-    const batchContent = `@echo off
-title APT-Proxy-${safeDeviceUuid}
-echo Launching Alta Video Camera Proxy (Cookie Method)...
-echo Domain: ${safeDomain}
-echo Device UUID: ${safeDeviceUuid}
-echo Cookie Key: ${truncatedKey}
-echo.
-"${proxyExePath}" -a "${safeDomain}" -d "${safeDeviceUuid}" -k "${safeCookieKey}"
-echo.
-echo Cookie-based camera proxy has finished. Press any key to close this window.
-pause >nul`;
-    
-    const tempDir = os.tmpdir();
-    const batchPath = path.join(tempDir, `cookie-proxy-${Date.now()}.bat`);
-    
-    // Write the batch file
-    fs.writeFileSync(batchPath, batchContent);
-    
-    console.log('Launching cookie-based camera proxy via batch file:', batchPath);
-    console.log('Command will be: aware-cam-proxy.exe -a', safeDomain, '-d', safeDeviceUuid, '-k [REDACTED]');
-
-    // Launch the batch file in a new command prompt window with unique title
-    const windowTitle = `APT-Proxy-${safeDeviceUuid}`;
-    const cmdProcess = spawn('cmd', ['/c', 'start', `"${windowTitle}"`, 'cmd', '/c', batchPath], {
-      detached: true,
-      stdio: 'ignore'
-    });
-
-    // Store the process information for later termination
-    const processInfo = {
-      process: cmdProcess,
-      batchPath: batchPath,
-      deviceUuid: safeDeviceUuid,
-      startTime: Date.now(),
-      cookieKey: truncatedKey,
-      domain: safeDomain,
-      windowTitle: windowTitle, // Store window title for targeted cleanup
-      type: 'cookie' // Mark as cookie-based proxy
-    };
-
-    activeProxyProcesses.set(cmdProcess.pid, processInfo);
-    
-    // Clean up the batch file after a delay
-    setTimeout(() => {
-      try {
-        if (fs.existsSync(batchPath)) {
-          fs.unlinkSync(batchPath);
-        }
-      } catch (error) {
-        console.log('Could not clean up cookie proxy batch file:', error.message);
-      }
-    }, 60000); // Clean up after 1 minute
-    
-    cmdProcess.unref(); // Allow the parent process to exit independently
-    
-    // Clean up process tracking when it exits
-    cmdProcess.on('exit', () => {
-      activeProxyProcesses.delete(cmdProcess.pid);
-    });
-    
-    return {
-      success: true,
-      message: `Cookie-based camera proxy launched for ${deviceUuid}!`,
-      processId: cmdProcess.pid,
-      deviceUuid: deviceUuid,
-      type: 'cookie'
-    };
-    
-  } catch (error) {
-    console.error('Failed to launch cookie-based camera proxy:', error);
-    return {
-      success: false,
-      message: `Failed to launch cookie-based camera proxy: ${error.message}`
-    };
-  }
-});
-
-// Stop camera proxy functionality
-ipcMain.handle('camera-proxy-stop', async (event, { processId }) => {
-  try {
-    console.log('Attempting to stop camera proxy processes...');
-
-    return new Promise((resolve) => {
-      // Kill all aware-cam-proxy.exe processes by name
-      const killProxy = spawn('taskkill', ['/f', '/im', 'aware-cam-proxy.exe'], {
-        stdio: ['ignore', 'pipe', 'pipe']
-      });
-
-      let proxyOutput = '';
-      let proxyError = '';
-
-      killProxy.stdout.on('data', (data) => {
-        proxyOutput += data.toString();
-      });
-
-      killProxy.stderr.on('data', (data) => {
-        proxyError += data.toString();
-      });
-
-      killProxy.on('close', (code) => {
-        // Clean up our process tracking
-        activeProxyProcesses.clear();
-
-        if (code === 0 || proxyOutput.includes('SUCCESS')) {
-          console.log('Camera proxy processes terminated successfully');
-          resolve({
-            success: true,
-            message: 'Camera proxy processes stopped successfully'
-          });
-        } else if (proxyError.includes('not found') || proxyError.includes('No tasks')) {
-          console.log('No camera proxy processes were running');
-          resolve({
-            success: true,
-            message: 'No camera proxy processes were running'
-          });
-        } else {
-          resolve({
-            success: true,
-            message: 'Attempted to stop all camera proxy processes'
-          });
-        }
-      });
-
-      killProxy.on('error', (error) => {
-        console.error('Error with taskkill by name:', error);
-        activeProxyProcesses.clear();
-        resolve({
-          success: false,
-          message: `Failed to stop camera proxy: ${error.message}`
-        });
-      });
-    });
-
-  } catch (error) {
-    console.error('Failed to stop camera proxy:', error);
-    return {
-      success: false,
-      message: `Failed to stop camera proxy: ${error.message}`
-    };
-  }
-});
-
-// --- Self-Update Functionality ---
-
-// Compare semver versions: returns -1 if a < b, 0 if equal, 1 if a > b
-function compareVersions(a, b) {
-  // Strip pre-release tags (e.g. "1.2.3-beta.1" → "1.2.3")
-  const cleanA = a.replace(/-.*$/, '');
-  const cleanB = b.replace(/-.*$/, '');
-  const partsA = cleanA.split('.').map(Number);
-  const partsB = cleanB.split('.').map(Number);
-  for (let i = 0; i < 3; i++) {
-    const numA = partsA[i] || 0;
-    const numB = partsB[i] || 0;
-    if (numA < numB) return -1;
-    if (numA > numB) return 1;
-  }
-  return 0;
-}
-
-// Follow HTTPS redirects and return the final response (for GitHub asset downloads)
-function httpsGetFollowRedirects(url, callback, redirectCount = 0) {
-  if (redirectCount >= 5) {
-    return callback(null, new Error('Too many redirects'));
-  }
-  const parsed = new URL(url);
-  if (parsed.protocol !== 'https:') {
-    return callback(null, new Error('Only HTTPS URLs are allowed'));
-  }
-  https.get(url, { headers: { 'User-Agent': 'Alta-Proxy-Tool' } }, (res) => {
-    if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
-      const redirectUrl = new URL(res.headers.location, url).href;
-      httpsGetFollowRedirects(redirectUrl, callback, redirectCount + 1);
-    } else {
-      callback(res);
-    }
-  }).on('error', (err) => {
-    callback(null, err);
-  });
-}
-
-ipcMain.handle('get-current-version', async () => {
-  return { success: true, version: app.getVersion() };
-});
-
-ipcMain.handle('check-for-updates', async () => {
-  try {
-    const response = await axios.get(
-      'https://api.github.com/repos/PageZ948/Alta-Proxy-Tool/releases/latest',
-      {
-        timeout: 10000,
-        headers: { 'User-Agent': 'Alta-Proxy-Tool', 'Accept': 'application/vnd.github.v3+json' }
-      }
-    );
-
-    const release = response.data;
-    const latestVersion = release.tag_name.replace(/^v/, '');
-    const currentVersion = app.getVersion();
-
-    const updateAvailable = compareVersions(currentVersion, latestVersion) < 0;
-
-    // Find the portable .exe asset
-    const exeAsset = release.assets.find(a => /AltaCameraProxy-.*-portable\.exe$/i.test(a.name));
-    const downloadUrl = exeAsset ? exeAsset.browser_download_url : null;
-
-    return {
-      success: true,
-      updateAvailable,
-      currentVersion,
-      latestVersion,
-      downloadUrl,
-      releaseNotes: release.body || '',
-      releaseName: release.name || `v${latestVersion}`
-    };
-  } catch (error) {
-    if (error.response && error.response.status === 404) {
-      return { success: true, updateAvailable: false, currentVersion: app.getVersion(), message: 'No releases available yet' };
-    }
-    if (error.response && error.response.status === 403) {
-      return { success: false, message: 'GitHub API rate limit exceeded. Try again later.' };
-    }
-    console.error('Check for updates error:', error.message);
-    return { success: false, message: error.message || 'Failed to check for updates' };
-  }
-});
-
-ipcMain.handle('download-and-install-update', async (event, { downloadUrl }) => {
-  try {
-    // Determine the path to the currently running executable
-    const currentExePath = process.env.PORTABLE_EXECUTABLE_FILE || app.getPath('exe');
-    const currentDir = getAppDirectory();
-    const currentExeName = path.basename(currentExePath);
-
-    // Check write permission on the app directory
-    try {
-      fs.accessSync(currentDir, fs.constants.W_OK);
-    } catch {
-      return { success: false, message: 'No write permission to the application directory. Try running as administrator.' };
-    }
-
-    const tempDir = os.tmpdir();
-    const tempExePath = path.join(tempDir, `AltaCameraProxy-update-${Date.now()}.exe`);
-
-    // Download the file with progress reporting
-    await new Promise((resolve, reject) => {
-      httpsGetFollowRedirects(downloadUrl, (res, err) => {
-        if (err) return reject(err);
-        if (res.statusCode !== 200) {
-          res.resume();
-          return reject(new Error(`Download failed with status ${res.statusCode}`));
-        }
-
-        const totalSize = parseInt(res.headers['content-length'], 10) || 0;
-        let downloadedSize = 0;
-        const fileStream = fs.createWriteStream(tempExePath);
-
-        res.on('data', (chunk) => {
-          downloadedSize += chunk.length;
-          if (totalSize > 0 && mainWindow && !mainWindow.isDestroyed()) {
-            const percent = Math.round((downloadedSize / totalSize) * 100);
-            mainWindow.webContents.send('update-download-progress', { percent, downloadedSize, totalSize });
-          }
-        });
-
-        res.pipe(fileStream);
-
-        fileStream.on('finish', () => {
-          fileStream.close();
-          resolve();
-        });
-
-        fileStream.on('error', (err) => {
-          fs.unlink(tempExePath, () => {});
-          reject(err);
-        });
-      });
-    });
-
-    // Verify downloaded file size (sanity check: > 10MB for an Electron portable exe)
-    const stats = fs.statSync(tempExePath);
-    if (stats.size < 10 * 1024 * 1024) {
-      fs.unlinkSync(tempExePath);
-      return { success: false, message: 'Downloaded file is too small — update may be corrupt.' };
-    }
-
-    // Create batch script to replace the exe after this process exits
-    const batchPath = path.join(tempDir, `apt-update-${Date.now()}.bat`);
-    const pid = process.pid;
-    const batchContent = `@echo off\r\ntitle APT-Updater\r\necho Waiting for Alta Proxy Tool to close...\r\n:waitloop\r\ntasklist /fi "PID eq ${pid}" 2>nul | find "${pid}" >nul\r\nif not errorlevel 1 (\r\n  timeout /t 1 /nobreak >nul\r\n  goto waitloop\r\n)\r\necho Applying update...\r\ncopy /y "${tempExePath}" "${path.join(currentDir, currentExeName)}"\r\nif errorlevel 1 (\r\n  echo Update failed! Could not copy new version.\r\n  pause\r\n  del "${tempExePath}" >nul 2>&1\r\n  del "%~f0" >nul 2>&1\r\n  exit /b 1\r\n)\r\necho Update complete. Launching new version...\r\nstart "" "${path.join(currentDir, currentExeName)}"\r\ndel "${tempExePath}" >nul 2>&1\r\ndel "%~f0" >nul 2>&1\r\n`;
-
-    fs.writeFileSync(batchPath, batchContent);
-
-    // Spawn the updater batch script detached
-    let updater;
-    try {
-      updater = spawn('cmd', ['/c', batchPath], {
-        detached: true,
-        stdio: 'ignore',
-        windowsHide: true
-      });
-      updater.unref();
-    } catch (spawnError) {
-      console.error('Failed to spawn updater:', spawnError);
-      try { fs.unlinkSync(tempExePath); } catch {}
-      try { fs.unlinkSync(batchPath); } catch {}
-      return { success: false, message: 'Failed to start updater process.' };
-    }
-
-    // Quit the app after a delay to let the IPC response return to renderer
-    setTimeout(() => {
-      app.quit();
-    }, 1500);
-
-    return { success: true, message: 'Update is being installed. The app will restart shortly.' };
-  } catch (error) {
-    console.error('Download and install update error:', error);
-    return { success: false, message: error.message || 'Failed to download and install update' };
-  }
-});
-
diff --git a/package.json b/package.json
index 7cd11d3..712ee0c 100644
--- a/package.json
+++ b/package.json
@@ -6,6 +6,8 @@
   "scripts": {
     "start": "electron .",
     "dev": "electron . --dev",
+    "test": "node --test test/*.test.js",
+    "check": "node --check main.js && node --check preload.js && node --check renderer.js && node --check src/electron-runtime.js && node --check chrome-extension/popup.js && npm test",
     "build": "electron-builder --win --publish=never",
     "build-test": "electron-builder --win --dir",
     "build-kit": "powershell -ExecutionPolicy Bypass -File build-kit.ps1",
diff --git a/preload.js b/preload.js
index bc3131e..56855af 100644
--- a/preload.js
+++ b/preload.js
@@ -1,38 +1,26 @@
+'use strict';
+
 const { contextBridge, ipcRenderer } = require('electron');
 
-// Expose protected methods that allow the renderer process to use
-// the ipcRenderer without exposing the entire object
-contextBridge.exposeInMainWorld('electronAPI', {
-  getDevices: (params) => ipcRenderer.invoke('api-get-devices', params),
-  getDeviceSites: (params) => ipcRenderer.invoke('api-get-device-sites', params),
-  getAuthInfo: (params) => ipcRenderer.invoke('api-get-auth-info', params),
+function onConnectionStateChanged(callback) {
+  if (typeof callback !== 'function') return () => {};
+  const listener = (_event, state) => callback(state);
+  ipcRenderer.on('connection-state-changed', listener);
+  return () => ipcRenderer.removeListener('connection-state-changed', listener);
+}
 
-  // Camera proxy functionality
-  launchCookieCameraProxy: (params) => ipcRenderer.invoke('camera-proxy-cookie-launch', params),
-  stopCameraProxy: (processId) => ipcRenderer.invoke('camera-proxy-stop', { processId }),
-
-  // Extension cookie bridge (push from main process)
-  onExtensionCookie: (callback) => {
-    ipcRenderer.on('extension-cookie-received', (event, data) => {
-      try {
-        callback(data);
-      } catch (error) {
-        console.error('Extension cookie handler error:', error);
-      }
-    });
-  },
-
-  // Self-update functionality
+contextBridge.exposeInMainWorld('electronAPI', Object.freeze({
+  getDevices: () => ipcRenderer.invoke('get-devices'),
+  getDeviceSites: () => ipcRenderer.invoke('get-device-sites'),
+  getAuthInfo: () => ipcRenderer.invoke('get-auth-info'),
+  launchProxy: (deviceId) => ipcRenderer.invoke('launch-proxy', deviceId),
+  stopProxy: (key) => ipcRenderer.invoke('stop-proxy', key),
+  disconnect: () => ipcRenderer.invoke('disconnect'),
+  getConnectionState: () => ipcRenderer.invoke('get-connection-state'),
   checkForUpdates: () => ipcRenderer.invoke('check-for-updates'),
-  downloadAndInstallUpdate: (params) => ipcRenderer.invoke('download-and-install-update', params),
-  getCurrentVersion: () => ipcRenderer.invoke('get-current-version'),
-  onUpdateDownloadProgress: (callback) => {
-    ipcRenderer.on('update-download-progress', (event, data) => {
-      try {
-        callback(data);
-      } catch (error) {
-        console.error('Update download progress handler error:', error);
-      }
-    });
-  }
-});
\ No newline at end of file
+  openFixedReleasesPage: () => ipcRenderer.invoke('open-fixed-releases-page'),
+  rotatePairing: () => ipcRenderer.invoke('rotate-pairing'),
+  revokePairing: () => ipcRenderer.invoke('revoke-pairing'),
+  getPairingStatus: () => ipcRenderer.invoke('get-pairing-status'),
+  onConnectionStateChanged,
+}));
diff --git a/renderer.js b/renderer.js
index 2ee09b7..8b45106 100644
--- a/renderer.js
+++ b/renderer.js
@@ -1,764 +1,308 @@
-// Global variables to store session data
-let sessionData = {
-    deploymentUrl: '',
-    cookies: null,
-    isConnected: false
-};
+'use strict';
 
-// DOM elements
 const connectionStatus = document.getElementById('connectionStatus');
 const deviceStatus = document.getElementById('deviceStatus');
 const deviceList = document.getElementById('deviceList');
 const statusIndicator = document.getElementById('statusIndicator');
 const deviceSearch = document.getElementById('deviceSearch');
-
-// Connection buttons
 const disconnectBtn = document.getElementById('disconnectBtn');
-
-// Cookie proxy elements
-const cookieDeviceUUID = document.getElementById('cookieDeviceUUID');
-const cookieKey = document.getElementById('cookieKey');
-const startCookieProxyBtn = document.getElementById('startCookieProxyBtn');
-const stopCookieProxyBtn = document.getElementById('stopCookieProxyBtn');
-
-// Update elements
+const selectedDeviceId = document.getElementById('selectedDeviceId');
+const startProxyBtn = document.getElementById('startProxyBtn');
+const stopProxyBtn = document.getElementById('stopProxyBtn');
 const checkUpdateBtn = document.getElementById('checkUpdateBtn');
-const updateModalOverlay = document.getElementById('updateModalOverlay');
-const updateModalCloseBtn = document.getElementById('updateModalCloseBtn');
-const updateModalMessage = document.getElementById('updateModalMessage');
-const updateModalNotes = document.getElementById('updateModalNotes');
-const updateProgressContainer = document.getElementById('updateProgressContainer');
-const updateProgressFill = document.getElementById('updateProgressFill');
-const updateProgressText = document.getElementById('updateProgressText');
-const updateInstallBtn = document.getElementById('updateInstallBtn');
-const updateLaterBtn = document.getElementById('updateLaterBtn');
+const updateNotice = document.getElementById('updateNotice');
+const updateMessage = document.getElementById('updateMessage');
+const openReleasesBtn = document.getElementById('openReleasesBtn');
+const dismissUpdateBtn = document.getElementById('dismissUpdateBtn');
+const pairingState = document.getElementById('pairingState');
+const pairingSecret = document.getElementById('pairingSecret');
+const pairingSecretRow = document.getElementById('pairingSecretRow');
+const rotatePairingBtn = document.getElementById('rotatePairingBtn');
+const revokePairingBtn = document.getElementById('revokePairingBtn');
 
-// Track selected device
+let connection = { connected: false, origin: null, activeProxies: [] };
 let selectedDevice = null;
-let activeCookieProxyConnections = new Map(); // Track cookie-based proxy connections
-let allDevices = []; // Store all devices for search functionality
-let allSites = {}; // Store site id → site name mapping
-let collapsedSites = new Set(); // Track which site groups are collapsed
-let pendingUpdateInfo = null; // Store update info for install action
+let allDevices = [];
+let allSites = {};
+let collapsedSites = new Set();
+let loadingDevices = false;
 
-// Event listeners
-disconnectBtn.addEventListener('click', handleDisconnect);
-
-// Cookie proxy event listeners
-startCookieProxyBtn.addEventListener('click', handleStartCookieProxy);
-stopCookieProxyBtn.addEventListener('click', handleStopCookieProxy);
-
-// Cookie key input listener to update button states
-cookieKey.addEventListener('input', updateCookieProxyButtonStates);
-
-// Device search event listener
-deviceSearch.addEventListener('input', handleDeviceSearch);
-
-// Update event listeners
-checkUpdateBtn.addEventListener('click', handleCheckForUpdates);
-updateInstallBtn.addEventListener('click', handleInstallUpdate);
-updateLaterBtn.addEventListener('click', closeUpdateModal);
-updateModalCloseBtn.addEventListener('click', closeUpdateModal);
-
-// Handle disconnect
-function handleDisconnect() {
-    sessionData.isConnected = false;
-    sessionData.cookies = null;
-    sessionData.deploymentUrl = '';
-    selectedDevice = null;
-    activeCookieProxyConnections.clear();
-    allDevices = []; // Clear stored devices
-    allSites = {}; // Clear site data
-    collapsedSites.clear();
-
-    updateConnectionStatus(false);
-    updateButtonStates();
-    clearDeviceList();
-    cookieDeviceUUID.value = '';
-    cookieKey.value = '';
-    deviceSearch.value = ''; // Clear search input
-
-    // Clear device status message
-    deviceStatus.style.display = 'none';
-    deviceStatus.textContent = '';
-
-    showStatus(connectionStatus, 'Disconnected from API', 'info');
-}
-
-// Handle start cookie proxy
-async function handleStartCookieProxy() {
-    if (!selectedDevice) {
-        showStatus(connectionStatus, 'Please select a device first', 'error');
-        return;
-    }
-
-    const cookieKeyValue = cookieKey.value.trim();
-    if (!cookieKeyValue) {
-        showStatus(connectionStatus, 'Please enter a cookie key', 'error');
-        return;
-    }
-
-    if (!sessionData.deploymentUrl) {
-        showStatus(connectionStatus, 'Please connect to API first to get deployment URL', 'error');
-        return;
-    }
-
-    // Check if this device already has an active cookie connection
-    const deviceId = selectedDevice.guid || selectedDevice.id;
-    if (activeCookieProxyConnections.has(deviceId)) {
-        showStatus(connectionStatus, `Cookie proxy already running for device ${selectedDevice.name}`, 'warning');
-        return;
-    }
-
-    // Disable button during launch
-    startCookieProxyBtn.disabled = true;
-    showStatus(connectionStatus, `Starting cookie proxy for device ${selectedDevice.name}...`, 'info');
-
-    try {
-        const result = await window.electronAPI.launchCookieCameraProxy({
-            deploymentUrl: sessionData.deploymentUrl,
-            cookieKey: cookieKeyValue,
-            deviceUuid: deviceId
-        });
-
-        if (result.success) {
-            // Track this connection
-            activeCookieProxyConnections.set(deviceId, {
-                processId: result.processId,
-                deviceName: selectedDevice.name,
-                deviceId: deviceId,
-                startTime: Date.now(),
-                type: 'cookie'
-            });
-
-            updateCookieProxyButtonStates();
-            showStatus(connectionStatus, `${result.message} (Cookie proxy active for ${selectedDevice.name})`, 'success');
-        } else {
-            showStatus(connectionStatus, `Failed to start cookie proxy: ${result.message}`, 'error');
-        }
-    } catch (error) {
-        console.error('Cookie proxy launch error:', error);
-        showStatus(connectionStatus, `Error launching cookie proxy: ${error.message}`, 'error');
-    } finally {
-        startCookieProxyBtn.disabled = false;
-    }
-}
-
-// Handle stop cookie proxy
-async function handleStopCookieProxy() {
-    if (activeCookieProxyConnections.size === 0) {
-        showStatus(connectionStatus, 'No active cookie proxy connections found', 'warning');
-        return;
-    }
-
-    showStatus(connectionStatus, 'Stopping cookie proxy connections...', 'info');
-
-    try {
-        const result = await window.electronAPI.stopCameraProxy(null); // Stop all processes
-
-        if (result.success) {
-            activeCookieProxyConnections.clear();
-            showStatus(connectionStatus, 'Cookie proxy connections stopped successfully', 'success');
-
-            // Update visual indicators for all devices
-            const deviceItems = deviceList.querySelectorAll('.device-item');
-            deviceItems.forEach(item => {
-                item.classList.remove('cookie-proxy-active');
-            });
-        } else {
-            showStatus(connectionStatus, `Failed to stop cookie proxy: ${result.message}`, 'warning');
-        }
-    } catch (error) {
-        console.error('Stop cookie proxy error:', error);
-        showStatus(connectionStatus, 'Error stopping cookie proxy', 'error');
-    }
-
-    updateCookieProxyButtonStates();
-}
-
-// Update cookie proxy button states
-function updateCookieProxyButtonStates() {
-    const hasSelectedDevice = selectedDevice !== null;
-    const hasCookieKey = cookieKey.value.trim().length > 0;
-    const hasActiveConnection = activeCookieProxyConnections.size > 0;
-
-    if (sessionData.isConnected && hasSelectedDevice && hasCookieKey) {
-        const deviceId = selectedDevice.guid || selectedDevice.id;
-        const isThisDeviceActive = activeCookieProxyConnections.has(deviceId);
-
-        startCookieProxyBtn.disabled = isThisDeviceActive;
-        stopCookieProxyBtn.disabled = !hasActiveConnection;
-    } else {
-        startCookieProxyBtn.disabled = true;
-        stopCookieProxyBtn.disabled = !hasActiveConnection;
-    }
-}
-
-// Update connection status indicator
-function updateConnectionStatus(connected) {
-    const statusDot = statusIndicator.querySelector('.status-dot');
-    const statusText = statusIndicator.querySelector('.status-text');
-
-    if (connected) {
-        statusDot.className = 'status-dot online';
-        statusText.textContent = 'Connected';
-    } else {
-        statusDot.className = 'status-dot offline';
-        statusText.textContent = 'Disconnected';
-    }
-}
-
-// Update button states based on connection status
-function updateButtonStates() {
-    if (sessionData.isConnected) {
-        disconnectBtn.disabled = false;
-    } else {
-        disconnectBtn.disabled = true;
-        startCookieProxyBtn.disabled = true;
-        stopCookieProxyBtn.disabled = true;
-    }
-
-    // Always update cookie proxy button states
-    updateCookieProxyButtonStates();
-}
-
-// Fetch device sites and build id → name map
-async function fetchDeviceSites() {
-    try {
-        const result = await window.electronAPI.getDeviceSites({
-            deploymentUrl: sessionData.deploymentUrl,
-            cookies: sessionData.cookies
-        });
-
-        if (result.success && Array.isArray(result.sites)) {
-            allSites = {};
-            result.sites.forEach(site => {
-                if (site.id) {
-                    allSites[site.id] = site.name || 'Unnamed Site';
-                }
-            });
-        }
-    } catch (error) {
-        console.log('Could not fetch device sites:', error.message);
-        allSites = {};
-    }
-}
-
-// Handle get devices (now called automatically)
-async function handleGetDevices() {
-    if (!sessionData.isConnected) {
-        showStatus(deviceStatus, 'Please connect to the API first', 'error');
-        return;
-    }
-
-    showStatus(deviceStatus, 'Fetching devices...', 'info');
-    clearDeviceList();
-
-    try {
-        // Fetch devices and sites in parallel
-        const [devicesResult] = await Promise.all([
-            window.electronAPI.getDevices({
-                deploymentUrl: sessionData.deploymentUrl,
-                cookies: sessionData.cookies
-            }),
-            fetchDeviceSites()
-        ]);
-
-        if (devicesResult.success) {
-            // Filter devices to only show non-cloud cameras (localStorage = false)
-            const filteredDevices = devicesResult.devices.filter(device => {
-                // Check if device has capabilities and localStorage property
-                if (device.capabilities && device.capabilities.localStorage !== undefined) {
-                    // Only show devices where localStorage is false (non-cloud cameras)
-                    return device.capabilities.localStorage === false;
-                }
-                // If no capabilities or localStorage property, include the device (fallback)
-                return true;
-            });
-
-            const totalDevices = devicesResult.devices.length;
-            const filteredCount = filteredDevices.length;
-            const cloudDevicesHidden = totalDevices - filteredCount;
-
-            const siteCount = Object.keys(allSites).length;
-            let statusMessage = `Found ${filteredCount} local camera${filteredCount !== 1 ? 's' : ''}`;
-            if (siteCount > 0) {
-                statusMessage += ` across ${siteCount} site${siteCount !== 1 ? 's' : ''}`;
-            }
-            if (cloudDevicesHidden > 0) {
-                statusMessage += ` (${cloudDevicesHidden} cloud camera${cloudDevicesHidden !== 1 ? 's' : ''} hidden)`;
-            }
-
-            showStatus(deviceStatus, statusMessage, 'success');
-
-            // Store all devices for search functionality
-            allDevices = filteredDevices;
-            displayDevices(filteredDevices);
-        } else {
-            showStatus(deviceStatus, `Failed to get devices: ${devicesResult.message}`, 'error');
-        }
-    } catch (error) {
-        console.error('Get devices error:', error);
-        showStatus(deviceStatus, `Error getting devices: ${error.message}`, 'error');
-    }
-}
-
-// Helper function to determine device status from API data
-function getDeviceStatus(device) {
-    // Check for live.display_status first (Alta API standard)
-    if (device.live && device.live.display_status) {
-        const status = device.live.display_status.toLowerCase();
-
-        // Handle color-based status responses from Alta API
-        if (status === 'green') {
-            return {
-                isOnline: true,
-                statusText: 'Online'
-            };
-        } else if (status === 'red') {
-            return {
-                isOnline: false,
-                statusText: 'Offline'
-            };
-        } else if (status === 'yellow' || status === 'orange') {
-            return {
-                isOnline: false,
-                statusText: 'Warning'
-            };
-        }
-
-        // Handle text-based status responses
-        return {
-            isOnline: status === 'online' || status === 'live' || status === 'connected',
-            statusText: status === 'online' || status === 'live' || status === 'connected' ? 'Online' : 'Offline'
-        };
-    }
-
-    // Fallback to other possible status fields
-    if (device.online !== undefined) {
-        return {
-            isOnline: device.online,
-            statusText: device.online ? 'Online' : 'Offline'
-        };
-    }
-
-    if (device.status) {
-        const status = device.status.toLowerCase();
-
-        // Handle color-based status in other fields
-        if (status === 'green') {
-            return {
-                isOnline: true,
-                statusText: 'Online'
-            };
-        } else if (status === 'red') {
-            return {
-                isOnline: false,
-                statusText: 'Offline'
-            };
-        }
-
-        return {
-            isOnline: status === 'online' || status === 'live' || status === 'connected',
-            statusText: status === 'online' || status === 'live' || status === 'connected' ? 'Online' : 'Offline'
-        };
-    }
-
-    // Default to offline if no status information available
-    return {
-        isOnline: false,
-        statusText: 'Offline'
-    };
-}
-
-// Handle device search
-function handleDeviceSearch() {
-    const searchTerm = deviceSearch.value.toLowerCase().trim();
-
-    if (!searchTerm) {
-        // Show all devices if search is empty
-        displayDevices(allDevices);
-        return;
-    }
-
-    // Filter devices based on search term (includes site name)
-    const filteredDevices = allDevices.filter(device => {
-        const deviceName = (device.name || '').toLowerCase();
-        const deviceId = (device.guid || device.id || '').toLowerCase();
-        const deviceType = (device.type || '').toLowerCase();
-        const deviceModel = (device.model || '').toLowerCase();
-        const deviceIp = (device.ipAddress || '').toLowerCase();
-        const siteName = (device.server_group_id && allSites[device.server_group_id] || '').toLowerCase();
-
-        return deviceName.includes(searchTerm) ||
-               deviceId.includes(searchTerm) ||
-               deviceType.includes(searchTerm) ||
-               deviceModel.includes(searchTerm) ||
-               deviceIp.includes(searchTerm) ||
-               siteName.includes(searchTerm);
-    });
-
-    displayDevices(filteredDevices);
-}
-
-// Group devices by their site using server_group_id → allSites mapping
-function groupDevicesBySite(devices) {
-    const groups = {};
-    const ungrouped = [];
-
-    devices.forEach(device => {
-        const siteId = device.server_group_id;
-        const siteName = siteId && allSites[siteId] ? allSites[siteId] : null;
-
-        if (siteName) {
-            if (!groups[siteId]) {
-                groups[siteId] = { name: siteName, devices: [] };
-            }
-            groups[siteId].devices.push(device);
-        } else {
-            ungrouped.push(device);
-        }
-    });
-
-    return { groups, ungrouped };
-}
-
-// Create a device item DOM element
-function createDeviceItem(device, index) {
-    const deviceItem = document.createElement('div');
-    deviceItem.className = 'device-item';
-    deviceItem.dataset.deviceIndex = index;
-    deviceItem.dataset.deviceId = device.guid || device.id;
-
-    const status = getDeviceStatus(device);
-    const deviceId = device.guid || device.id;
-    const isCookieProxyActive = activeCookieProxyConnections.has(deviceId);
-
-    if (isCookieProxyActive) {
-        deviceItem.classList.add('cookie-proxy-active');
-    }
-
-    deviceItem.innerHTML = `
-        <div class="device-name">${escapeHtml(device.name || 'Unnamed Device')}</div>
-        <div class="device-status-dot ${status.isOnline ? 'online' : 'offline'}"></div>
-    `;
-
-    deviceItem.addEventListener('click', () => selectDevice(device, deviceItem));
-    return deviceItem;
-}
-
-// Display devices in the UI, grouped by site
-function displayDevices(devices) {
-    clearDeviceList();
-
-    if (!devices || devices.length === 0) {
-        const searchTerm = deviceSearch.value.toLowerCase().trim();
-        const message = searchTerm ? 'No devices match your search' : 'No devices found';
-        deviceList.innerHTML = `<p class="no-devices">${message}</p>`;
-        return;
-    }
-
-    const hasSites = Object.keys(allSites).length > 0;
-
-    // If no sites were fetched, fall back to flat list
-    if (!hasSites) {
-        devices.forEach((device, index) => {
-            deviceList.appendChild(createDeviceItem(device, index));
-        });
-        updateCookieProxyButtonStates();
-        return;
-    }
-
-    const { groups, ungrouped } = groupDevicesBySite(devices);
-
-    // Sort site groups alphabetically by name
-    const sortedSiteIds = Object.keys(groups).sort((a, b) =>
-        groups[a].name.localeCompare(groups[b].name)
-    );
-
-    let globalIndex = 0;
-
-    sortedSiteIds.forEach(siteId => {
-        const group = groups[siteId];
-        const isCollapsed = collapsedSites.has(siteId);
-
-        // Site header
-        const siteHeader = document.createElement('div');
-        siteHeader.className = 'site-group-header' + (isCollapsed ? ' collapsed' : '');
-        siteHeader.innerHTML = `
-            <span class="site-group-arrow">${isCollapsed ? '\u25B6' : '\u25BC'}</span>
-            <span class="site-group-name">${escapeHtml(group.name)}</span>
-            <span class="site-group-count">${group.devices.length}</span>
-        `;
-
-        siteHeader.addEventListener('click', () => {
-            if (collapsedSites.has(siteId)) {
-                collapsedSites.delete(siteId);
-            } else {
-                collapsedSites.add(siteId);
-            }
-            // Re-render with current search filter
-            const searchTerm = deviceSearch.value.toLowerCase().trim();
-            if (searchTerm) {
-                handleDeviceSearch();
-            } else {
-                displayDevices(allDevices);
-            }
-        });
-
-        deviceList.appendChild(siteHeader);
-
-        // Device items (hidden if collapsed)
-        if (!isCollapsed) {
-            group.devices.forEach(device => {
-                deviceList.appendChild(createDeviceItem(device, globalIndex++));
-            });
-        }
-    });
-
-    // Ungrouped devices at the bottom
-    if (ungrouped.length > 0) {
-        if (sortedSiteIds.length > 0) {
-            const ungroupedHeader = document.createElement('div');
-            ungroupedHeader.className = 'site-group-header' + (collapsedSites.has('__ungrouped') ? ' collapsed' : '');
-            ungroupedHeader.innerHTML = `
-                <span class="site-group-arrow">${collapsedSites.has('__ungrouped') ? '\u25B6' : '\u25BC'}</span>
-                <span class="site-group-name">Ungrouped</span>
-                <span class="site-group-count">${ungrouped.length}</span>
-            `;
-
-            ungroupedHeader.addEventListener('click', () => {
-                if (collapsedSites.has('__ungrouped')) {
-                    collapsedSites.delete('__ungrouped');
-                } else {
-                    collapsedSites.add('__ungrouped');
-                }
-                const searchTerm = deviceSearch.value.toLowerCase().trim();
-                if (searchTerm) {
-                    handleDeviceSearch();
-                } else {
-                    displayDevices(allDevices);
-                }
-            });
-
-            deviceList.appendChild(ungroupedHeader);
-        }
-
-        if (!collapsedSites.has('__ungrouped') || sortedSiteIds.length === 0) {
-            ungrouped.forEach(device => {
-                deviceList.appendChild(createDeviceItem(device, globalIndex++));
-            });
-        }
-    }
-
-    updateCookieProxyButtonStates();
-}
-
-// Handle device selection
-function selectDevice(device, deviceElement) {
-    // Remove previous selection
-    const previousSelected = deviceList.querySelector('.device-item.selected');
-    if (previousSelected) {
-        previousSelected.classList.remove('selected');
-    }
-
-    // Select current device
-    deviceElement.classList.add('selected');
-    selectedDevice = device;
-
-    // Auto-populate cookie device UUID field
-    const uuid = device.guid || device.id || '';
-    cookieDeviceUUID.value = uuid;
-
-    // Show device selection feedback with connection status
-    if (uuid) {
-        const isCookieActive = activeCookieProxyConnections.has(uuid);
-        const cookieStatusText = isCookieActive ? ' (COOKIE PROXY ACTIVE)' : '';
-        showStatus(connectionStatus, `Selected device: ${device.name || 'Unnamed Device'} (UUID: ${uuid})${cookieStatusText}`, 'info');
-    }
-
-    updateCookieProxyButtonStates();
-}
-
-// Utility functions
 function showStatus(element, message, type) {
-    element.textContent = message;
-    element.className = `status-message ${type}`;
-    element.style.display = 'block';
+  element.textContent = message;
+  element.className = `status-message ${type}`;
+  element.style.display = 'block';
+}
+
+function activeDeviceIds() {
+  return new Set((connection.activeProxies || []).map((proxy) => proxy.deviceId));
+}
+
+function renderConnectionState(state) {
+  connection = {
+    connected: state && state.connected === true,
+    origin: state && typeof state.origin === 'string' ? state.origin : null,
+    activeProxies: state && Array.isArray(state.activeProxies) ? state.activeProxies : [],
+  };
+  const dot = statusIndicator.querySelector('.status-dot');
+  const text = statusIndicator.querySelector('.status-text');
+  dot.className = `status-dot ${connection.connected ? 'online' : 'offline'}`;
+  text.textContent = connection.connected ? 'Connected' : 'Disconnected';
+  disconnectBtn.disabled = !connection.connected;
+  updateProxyButtons();
+}
+
+function updateProxyButtons() {
+  const id = selectedDevice && (selectedDevice.guid || selectedDevice.id);
+  const active = id ? activeDeviceIds().has(id.toLowerCase()) : false;
+  startProxyBtn.disabled = !connection.connected || !id || active;
+  stopProxyBtn.disabled = !id || !active;
 }
 
 function clearDeviceList() {
-    deviceList.innerHTML = '<p class="placeholder-text">Connect to API to load devices</p>';
-    selectedDevice = null;
+  deviceList.textContent = '';
+  const placeholder = document.createElement('p');
+  placeholder.className = 'placeholder-text';
+  placeholder.textContent = connection.connected ? 'Loading devices...' : 'Connect through the paired Chrome extension to load devices';
+  deviceList.appendChild(placeholder);
+  selectedDevice = null;
+  selectedDeviceId.value = '';
+  updateProxyButtons();
 }
 
-function escapeHtml(text) {
-    if (typeof text !== 'string') return text;
-    const div = document.createElement('div');
-    div.textContent = text;
-    return div.innerHTML;
+function deviceStatusFor(device) {
+  const raw = device && device.live && device.live.display_status !== undefined
+    ? device.live.display_status
+    : device && device.status !== undefined
+      ? device.status
+      : device && device.online;
+  const value = String(raw ?? '').toLowerCase();
+  return ['green', 'online', 'live', 'connected', 'true'].includes(value);
 }
 
-// --- Self-Update Functions ---
-
-async function handleCheckForUpdates() {
-    checkUpdateBtn.disabled = true;
-
-    try {
-        const result = await window.electronAPI.checkForUpdates();
-
-        if (!result.success) {
-            showStatus(connectionStatus, result.message || 'Failed to check for updates', 'error');
-            return;
-        }
-
-        if (result.message === 'No releases available yet') {
-            showStatus(connectionStatus, 'No releases available yet', 'info');
-            return;
-        }
-
-        if (result.updateAvailable) {
-            showUpdateModal(result);
-        } else {
-            showStatus(connectionStatus, `You're on the latest version (v${result.currentVersion})`, 'success');
-        }
-    } catch (error) {
-        console.error('Check for updates error:', error);
-        showStatus(connectionStatus, 'Could not check for updates. Check your internet connection.', 'error');
-    } finally {
-        checkUpdateBtn.disabled = false;
-    }
+function selectDevice(device, item) {
+  const previous = deviceList.querySelector('.device-item.selected');
+  if (previous) previous.classList.remove('selected');
+  item.classList.add('selected');
+  selectedDevice = device;
+  const id = device.guid || device.id || '';
+  selectedDeviceId.value = id;
+  showStatus(connectionStatus, `Selected device: ${device.name || 'Unnamed Device'}`, 'info');
+  updateProxyButtons();
 }
 
-function showUpdateModal(updateInfo) {
-    pendingUpdateInfo = updateInfo;
-    updateModalMessage.textContent = `A new version is available: v${updateInfo.latestVersion} (current: v${updateInfo.currentVersion})`;
-    updateModalNotes.textContent = updateInfo.releaseNotes || '';
-
-    // Reset progress state
-    updateProgressContainer.style.display = 'none';
-    updateProgressFill.style.width = '0%';
-    updateProgressText.textContent = '0%';
-
-    // Reset button states
-    updateInstallBtn.disabled = !updateInfo.downloadUrl;
-    updateLaterBtn.disabled = false;
-    updateInstallBtn.textContent = 'Install Update';
-
-    if (!updateInfo.downloadUrl) {
-        updateModalMessage.textContent += '\n(No downloadable asset found for this release)';
-    }
-
-    updateModalOverlay.style.display = 'flex';
+function createDeviceItem(device) {
+  const item = document.createElement('div');
+  const id = device.guid || device.id || '';
+  item.className = 'device-item';
+  item.dataset.deviceId = id;
+  if (activeDeviceIds().has(String(id).toLowerCase())) item.classList.add('proxy-active');
+  const name = document.createElement('div');
+  name.className = 'device-name';
+  name.textContent = device.name || 'Unnamed Device';
+  const dot = document.createElement('div');
+  dot.className = `device-status-dot ${deviceStatusFor(device) ? 'online' : 'offline'}`;
+  item.append(name, dot);
+  item.addEventListener('click', () => selectDevice(device, item));
+  return item;
 }
 
-async function handleInstallUpdate() {
-    if (!pendingUpdateInfo || !pendingUpdateInfo.downloadUrl) return;
-
-    // Disable controls during download
-    updateInstallBtn.disabled = true;
-    updateInstallBtn.textContent = 'Downloading...';
-    updateLaterBtn.disabled = true;
-    updateModalCloseBtn.style.display = 'none';
-    updateProgressContainer.style.display = 'flex';
-
-    try {
-        const result = await window.electronAPI.downloadAndInstallUpdate({
-            downloadUrl: pendingUpdateInfo.downloadUrl
-        });
-
-        if (result.success) {
-            updateInstallBtn.textContent = 'Restarting...';
-            updateProgressFill.style.width = '100%';
-            updateProgressText.textContent = '100%';
-        } else {
-            showStatus(connectionStatus, `Update failed: ${result.message}`, 'error');
-            closeUpdateModal();
-        }
-    } catch (error) {
-        console.error('Install update error:', error);
-        showStatus(connectionStatus, 'Update failed. Please try again.', 'error');
-        closeUpdateModal();
-    }
+function groupDevicesBySite(devices) {
+  const groups = new Map();
+  for (const device of devices) {
+    const siteId = device.server_group_id;
+    const siteName = siteId && allSites[siteId];
+    const key = siteName ? siteId : '__ungrouped';
+    if (!groups.has(key)) groups.set(key, { name: siteName || 'Ungrouped', devices: [] });
+    groups.get(key).devices.push(device);
+  }
+  return [...groups.entries()].sort((left, right) => left[1].name.localeCompare(right[1].name));
 }
 
-function closeUpdateModal() {
-    updateModalOverlay.style.display = 'none';
-    pendingUpdateInfo = null;
-    updateProgressContainer.style.display = 'none';
-    updateProgressFill.style.width = '0%';
-    updateProgressText.textContent = '0%';
-    updateInstallBtn.textContent = 'Install Update';
-    updateInstallBtn.disabled = false;
-    updateLaterBtn.disabled = false;
-    updateModalCloseBtn.style.display = '';
-}
+function displayDevices(devices) {
+  deviceList.textContent = '';
+  if (!devices.length) {
+    const empty = document.createElement('p');
+    empty.className = 'no-devices';
+    empty.textContent = deviceSearch.value.trim() ? 'No devices match your search' : 'No local cameras found';
+    deviceList.appendChild(empty);
+    return;
+  }
 
-async function checkForUpdatesOnStartup() {
-    try {
-        const result = await window.electronAPI.checkForUpdates();
+  const grouped = Object.keys(allSites).length > 0;
+  if (!grouped) {
+    for (const device of devices) deviceList.appendChild(createDeviceItem(device));
+    return;
+  }
 
-        if (result.success && result.updateAvailable) {
-            checkUpdateBtn.classList.add('update-available');
-            checkUpdateBtn.title = `Update available: v${result.latestVersion}`;
-            showStatus(connectionStatus, `Update available: v${result.latestVersion}`, 'info');
-            // Store for quick modal open
-            pendingUpdateInfo = result;
-        }
-    } catch (error) {
-        // Silent fail on startup check
-        console.log('Startup update check failed:', error.message);
-    }
-}
-
-// Handle cookie received from Chrome extension via local HTTP bridge
-async function handleExtensionCookie(data) {
-    const { deploymentUrl, cookies, cookieValue } = data;
-
-    // If already connected, disconnect first
-    if (sessionData.isConnected) {
-        handleDisconnect();
-    }
-
-    // Set session state from extension cookie
-    sessionData.deploymentUrl = deploymentUrl;
-    sessionData.cookies = cookies;
-    sessionData.isConnected = true;
-
-    showStatus(connectionStatus, `Connected via Chrome extension to ${deploymentUrl}`, 'success');
-    updateConnectionStatus(true);
-    updateButtonStates();
-
-    // Auto-populate cookie key
-    cookieKey.value = cookieValue;
-    updateCookieProxyButtonStates();
-
-    // Fetch devices
-    try {
-        await handleGetDevices();
-    } catch (err) {
-        console.error('Failed to fetch devices after extension cookie:', err);
-        showStatus(deviceStatus, 'Connected, but failed to load devices.', 'warning');
-    }
-}
-
-// Initialize the app
-document.addEventListener('DOMContentLoaded', async () => {
-    console.log('Alta Video Camera Proxy loaded');
-
-    // Initialize connection status
-    updateConnectionStatus(false);
-    updateButtonStates();
-
-    // Listen for cookies pushed from Chrome extension
-    window.electronAPI.onExtensionCookie(handleExtensionCookie);
-
-    // Listen for update download progress
-    window.electronAPI.onUpdateDownloadProgress((data) => {
-        updateProgressFill.style.width = `${data.percent}%`;
-        updateProgressText.textContent = `${data.percent}%`;
+  for (const [siteId, group] of groupDevicesBySite(devices)) {
+    const header = document.createElement('div');
+    const collapsed = collapsedSites.has(siteId);
+    header.className = `site-group-header${collapsed ? ' collapsed' : ''}`;
+    const arrow = document.createElement('span');
+    arrow.className = 'site-group-arrow';
+    arrow.textContent = collapsed ? '\u25B6' : '\u25BC';
+    const name = document.createElement('span');
+    name.className = 'site-group-name';
+    name.textContent = group.name;
+    const count = document.createElement('span');
+    count.className = 'site-group-count';
+    count.textContent = String(group.devices.length);
+    header.append(arrow, name, count);
+    header.addEventListener('click', () => {
+      if (collapsedSites.has(siteId)) collapsedSites.delete(siteId);
+      else collapsedSites.add(siteId);
+      filterDevices();
     });
+    deviceList.appendChild(header);
+    if (!collapsed) for (const device of group.devices) deviceList.appendChild(createDeviceItem(device));
+  }
+}
 
-    // Auto-check for updates after 2 seconds
-    setTimeout(checkForUpdatesOnStartup, 2000);
-});
+function filterDevices() {
+  const query = deviceSearch.value.toLowerCase().trim();
+  if (!query) {
+    displayDevices(allDevices);
+    return;
+  }
+  displayDevices(allDevices.filter((device) => {
+    const values = [
+      device.name, device.guid, device.id, device.type, device.model, device.ipAddress,
+      device.server_group_id && allSites[device.server_group_id],
+    ];
+    return values.some((value) => String(value || '').toLowerCase().includes(query));
+  }));
+}
+
+async function loadDevices() {
+  if (!connection.connected || loadingDevices) return;
+  loadingDevices = true;
+  showStatus(deviceStatus, 'Fetching devices...', 'info');
+  try {
+    const [devicesResult, sitesResult] = await Promise.all([
+      window.electronAPI.getDevices(),
+      window.electronAPI.getDeviceSites(),
+    ]);
+    allSites = {};
+    if (sitesResult.success && Array.isArray(sitesResult.sites)) {
+      for (const site of sitesResult.sites) if (site.id) allSites[site.id] = site.name || 'Unnamed Site';
+    }
+    if (!devicesResult.success) {
+      allDevices = [];
+      showStatus(deviceStatus, devicesResult.message || 'Failed to load devices', 'error');
+      clearDeviceList();
+      return;
+    }
+    allDevices = devicesResult.devices.filter((device) =>
+      !device.capabilities || device.capabilities.localStorage === undefined || device.capabilities.localStorage === false
+    );
+    showStatus(deviceStatus, `Found ${allDevices.length} local camera${allDevices.length === 1 ? '' : 's'}`, 'success');
+    filterDevices();
+  } catch {
+    showStatus(deviceStatus, 'Could not load devices.', 'error');
+  } finally {
+    loadingDevices = false;
+  }
+}
+
+async function handleDisconnect() {
+  const state = await window.electronAPI.disconnect();
+  renderConnectionState(state);
+  allDevices = [];
+  allSites = {};
+  collapsedSites.clear();
+  clearDeviceList();
+  showStatus(connectionStatus, 'Disconnected from Alta.', 'info');
+}
+
+async function handleStartProxy() {
+  const id = selectedDevice && (selectedDevice.guid || selectedDevice.id);
+  if (!id) return;
+  startProxyBtn.disabled = true;
+  showStatus(connectionStatus, `Starting proxy for ${selectedDevice.name || 'selected device'}...`, 'info');
+  const result = await window.electronAPI.launchProxy(id);
+  if (result.success) {
+    connection = await window.electronAPI.getConnectionState();
+    renderConnectionState(connection);
+    filterDevices();
+    showStatus(connectionStatus, 'Camera proxy started.', 'success');
+  } else {
+    showStatus(connectionStatus, result.message || 'Failed to start camera proxy.', 'error');
+    updateProxyButtons();
+  }
+}
+
+async function handleStopProxy() {
+  const id = selectedDevice && (selectedDevice.guid || selectedDevice.id);
+  if (!id) return;
+  stopProxyBtn.disabled = true;
+  const result = await window.electronAPI.stopProxy(id);
+  connection = await window.electronAPI.getConnectionState();
+  renderConnectionState(connection);
+  filterDevices();
+  showStatus(connectionStatus, result.success ? 'Camera proxy stopped.' : result.message || 'Failed to stop camera proxy.', result.success ? 'success' : 'error');
+}
+
+async function checkForUpdates(showCurrent = true) {
+  checkUpdateBtn.disabled = true;
+  try {
+    const result = await window.electronAPI.checkForUpdates();
+    if (!result.success) {
+      if (showCurrent) showStatus(connectionStatus, result.message, 'error');
+      return;
+    }
+    if (result.status === 'update-available') {
+      updateMessage.textContent = `${result.releaseName || `Version ${result.latestVersion}`} is available. APT will not download or run updates; review it on GitPeji.`;
+      updateNotice.style.display = 'flex';
+      checkUpdateBtn.classList.add('update-available');
+    } else if (showCurrent) {
+      const message = result.status === 'no-release'
+        ? 'No published release is available on GitPeji.'
+        : `You are on the latest version (v${result.currentVersion}).`;
+      showStatus(connectionStatus, message, 'success');
+    }
+  } finally {
+    checkUpdateBtn.disabled = false;
+  }
+}
+
+function renderPairingStatus(result) {
+  pairingState.textContent = result.paired ? 'Paired' : 'Revoked / not paired';
+  pairingState.className = result.paired ? 'paired' : 'unpaired';
+  revokePairingBtn.disabled = !result.paired;
+  if (result.secret) {
+    pairingSecret.value = result.secret;
+    pairingSecretRow.style.display = 'block';
+    showStatus(connectionStatus, 'One-time bridge pairing secret generated. Paste it into the extension now; it will not be shown again.', 'info');
+  } else {
+    pairingSecret.value = '';
+    pairingSecretRow.style.display = 'none';
+  }
+}
+
+async function initialize() {
+  renderConnectionState(await window.electronAPI.getConnectionState());
+  renderPairingStatus(await window.electronAPI.getPairingStatus());
+  if (connection.connected) await loadDevices();
+  window.electronAPI.onConnectionStateChanged(async (state) => {
+    renderConnectionState(state);
+    if (state.connected) {
+      allDevices = [];
+      allSites = {};
+      clearDeviceList();
+      showStatus(connectionStatus, `Connected to ${state.origin}`, 'success');
+      await loadDevices();
+    }
+  });
+  setTimeout(() => checkForUpdates(false), 2000);
+}
+
+disconnectBtn.addEventListener('click', handleDisconnect);
+startProxyBtn.addEventListener('click', handleStartProxy);
+stopProxyBtn.addEventListener('click', handleStopProxy);
+deviceSearch.addEventListener('input', filterDevices);
+checkUpdateBtn.addEventListener('click', () => checkForUpdates(true));
+openReleasesBtn.addEventListener('click', () => window.electronAPI.openFixedReleasesPage());
+dismissUpdateBtn.addEventListener('click', () => { updateNotice.style.display = 'none'; });
+rotatePairingBtn.addEventListener('click', async () => renderPairingStatus(await window.electronAPI.rotatePairing()));
+revokePairingBtn.addEventListener('click', async () => renderPairingStatus(await window.electronAPI.revokePairing()));
+document.addEventListener('DOMContentLoaded', () => { initialize().catch(() => showStatus(connectionStatus, 'Application initialization failed.', 'error')); });
diff --git a/src/bridge-auth.js b/src/bridge-auth.js
index 25f889e..2adf53e 100644
--- a/src/bridge-auth.js
+++ b/src/bridge-auth.js
@@ -133,7 +133,7 @@ class BridgeAuth {
   authenticateRequest(request) {
     if (!request || typeof request !== 'object') return false;
     const headers = request.headers || {};
-    const secret = headers['x-apt-pairing-secret'];
+    const secret = headers['x-apt-pairing'];
     return this.authenticate({ origin: headers.origin, secret });
   }
 }
diff --git a/src/electron-runtime.js b/src/electron-runtime.js
new file mode 100644
index 0000000..37af5cb
--- /dev/null
+++ b/src/electron-runtime.js
@@ -0,0 +1,300 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const {
+  APT_EXTENSION_ORIGIN,
+  BridgeAuth,
+  BridgeAuthError,
+  createRequestLimiter,
+  readJsonBody,
+} = require('./bridge-auth');
+const { RELEASES_PAGE_URL } = require('./update-policy');
+const { validateDeviceId } = require('./proxy-launch');
+
+const PAIRING_ENVELOPE_FILENAME = 'bridge-pairing.json';
+
+function safeErrorMessage(error, fallback) {
+  const allowed = new Set([
+    'NO_ALTA_SESSION', 'INVALID_ALTA_ARGUMENTS', 'ALTA_TIMEOUT', 'ALTA_HTTP_ERROR',
+    'INVALID_ALTA_RESPONSE', 'INVALID_ALTA_RESPONSE_DATA', 'ALTA_RESPONSE_TOO_LARGE',
+    'UNSAFE_ALTA_REDIRECT', 'TOO_MANY_ALTA_REDIRECTS', 'HELPER_NOT_FOUND',
+    'UNSUPPORTED_PLATFORM', 'INVALID_DEVICE_ID', 'SPAWN_FAILED',
+  ]);
+  return error && allowed.has(error.code) && typeof error.message === 'string'
+    ? error.message
+    : fallback;
+}
+
+function loadPairingEnvelope(envelopePath) {
+  if (!fs.existsSync(envelopePath)) return null;
+  const bytes = fs.readFileSync(envelopePath);
+  if (bytes.length === 0 || bytes.length > 4096) throw new Error('Invalid pairing envelope file');
+  const parsed = JSON.parse(bytes.toString('utf8'));
+  // BridgeAuth performs the authoritative envelope schema validation.
+  return new BridgeAuth({ envelope: parsed }).envelope;
+}
+
+function atomicWritePairingEnvelope(envelopePath, envelope) {
+  const directory = path.dirname(envelopePath);
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const temporaryPath = `${envelopePath}.${process.pid}.${Date.now()}.tmp`;
+  const payload = `${JSON.stringify(envelope)}\n`;
+  try {
+    fs.writeFileSync(temporaryPath, payload, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    fs.renameSync(temporaryPath, envelopePath);
+    fs.chmodSync(envelopePath, 0o600);
+  } catch (error) {
+    try { fs.unlinkSync(temporaryPath); } catch {}
+    throw error;
+  }
+}
+
+class PairingController {
+  constructor({ envelopePath, bridgeAuth } = {}) {
+    if (typeof envelopePath !== 'string' || envelopePath.length === 0) {
+      throw new TypeError('PairingController requires an envelope path');
+    }
+    this.envelopePath = envelopePath;
+    if (bridgeAuth) {
+      this.bridgeAuth = bridgeAuth;
+    } else {
+      let envelope = null;
+      try {
+        envelope = loadPairingEnvelope(envelopePath);
+      } catch {
+        try { fs.unlinkSync(envelopePath); } catch {}
+      }
+      this.bridgeAuth = new BridgeAuth({ envelope });
+    }
+  }
+
+  initialize() {
+    if (this.bridgeAuth.envelope) return { paired: true };
+    return this.rotate();
+  }
+
+  rotate() {
+    const { secret, envelope } = this.bridgeAuth.rotate();
+    try {
+      atomicWritePairingEnvelope(this.envelopePath, envelope);
+    } catch (error) {
+      this.bridgeAuth.revoke();
+      throw error;
+    }
+    return { paired: true, secret };
+  }
+
+  revoke() {
+    this.bridgeAuth.revoke();
+    try {
+      fs.unlinkSync(this.envelopePath);
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+    }
+    return { paired: false };
+  }
+
+  getStatus() {
+    return { paired: Boolean(this.bridgeAuth.envelope) };
+  }
+}
+
+function writeJson(response, statusCode, payload) {
+  if (response.writableEnded) return;
+  response.writeHead(statusCode, {
+    'Content-Type': 'application/json',
+    'Cache-Control': 'no-store',
+    'X-Content-Type-Options': 'nosniff',
+  });
+  response.end(JSON.stringify(payload));
+}
+
+function createBridgeHandler({
+  bridgeAuth,
+  sessionStore,
+  onConnectionStateChanged = () => {},
+  limiter = createRequestLimiter({ maxConcurrent: 4 }),
+  maxBodyBytes,
+  deadlineMs,
+} = {}) {
+  if (!bridgeAuth || typeof bridgeAuth.authenticateRequest !== 'function') {
+    throw new TypeError('Bridge handler requires bridge authentication');
+  }
+  if (!sessionStore || typeof sessionStore.establish !== 'function') {
+    throw new TypeError('Bridge handler requires a session store');
+  }
+
+  return async function handleBridgeRequest(request, response) {
+    const origin = request && request.headers && request.headers.origin;
+    if (origin !== APT_EXTENSION_ORIGIN) {
+      writeJson(response, 403, { success: false, message: 'Forbidden' });
+      return;
+    }
+
+    response.setHeader('Access-Control-Allow-Origin', APT_EXTENSION_ORIGIN);
+    response.setHeader('Vary', 'Origin');
+    response.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+    response.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-APT-Pairing');
+    response.setHeader('Access-Control-Max-Age', '600');
+
+    if (request.method === 'OPTIONS') {
+      response.writeHead(204, { 'Cache-Control': 'no-store' });
+      response.end();
+      return;
+    }
+    if (request.method !== 'POST' || request.url !== '/cookie') {
+      writeJson(response, 404, { success: false, message: 'Not found' });
+      return;
+    }
+    if (!bridgeAuth.authenticateRequest(request)) {
+      writeJson(response, 403, { success: false, message: 'Forbidden' });
+      return;
+    }
+
+    try {
+      await limiter.run(async () => {
+        const data = await readJsonBody(request, { maxBytes: maxBodyBytes, deadlineMs });
+        const state = sessionStore.establish(data.deploymentUrl, data.cookieValue);
+        onConnectionStateChanged({ connected: state.connected, origin: state.origin });
+      });
+      writeJson(response, 200, { success: true, message: 'Session received' });
+    } catch (error) {
+      const statusCode = error instanceof BridgeAuthError
+        ? error.statusCode
+        : error && error.code === 'INVALID_SESSION_COOKIE'
+          ? 400
+          : 400;
+      writeJson(response, statusCode, { success: false, message: statusCode === 429 ? 'Too many requests' : 'Invalid request' });
+    }
+  };
+}
+
+class AppRuntime {
+  constructor({
+    sessionStore,
+    altaClient,
+    proxyManager,
+    checkForUpdate,
+    currentVersion,
+    openExternal,
+  } = {}) {
+    this.sessionStore = sessionStore;
+    this.altaClient = altaClient;
+    this.proxyManager = proxyManager;
+    this.checkForUpdatePolicy = checkForUpdate;
+    this.currentVersion = currentVersion;
+    this.openExternal = openExternal;
+    this.allowedDeviceIds = new Set();
+    this.proxyByDevice = new Map();
+  }
+
+  async getDevices() {
+    try {
+      const devices = await this.altaClient.getDevices();
+      this.allowedDeviceIds = new Set();
+      for (const device of devices) {
+        const candidate = device && (device.guid || device.id);
+        try { this.allowedDeviceIds.add(validateDeviceId(candidate)); } catch {}
+      }
+      return { success: true, devices };
+    } catch (error) {
+      return { success: false, devices: [], message: safeErrorMessage(error, 'Failed to get devices') };
+    }
+  }
+
+  async getDeviceSites() {
+    try {
+      return { success: true, sites: await this.altaClient.getDeviceSites() };
+    } catch (error) {
+      return { success: false, sites: [], message: safeErrorMessage(error, 'Failed to get device sites') };
+    }
+  }
+
+  async getAuthInfo() {
+    try {
+      return { success: true, authInfo: await this.altaClient.getAuthInfo() };
+    } catch (error) {
+      return { success: false, message: safeErrorMessage(error, 'Failed to get authentication information') };
+    }
+  }
+
+  async launchProxy(deviceId) {
+    try {
+      const validatedId = validateDeviceId(deviceId);
+      if (!this.allowedDeviceIds.has(validatedId)) {
+        return { success: false, message: 'Select a device from the current Alta device list.' };
+      }
+      if (this.proxyByDevice.has(validatedId)) {
+        return { success: false, message: 'A proxy is already running for this device.' };
+      }
+      const session = this.sessionStore.requireSession();
+      const result = this.proxyManager.launchProxy({
+        deploymentHost: new URL(session.origin).hostname,
+        cookie: session.cookie,
+        deviceId: validatedId,
+      });
+      this.proxyByDevice.set(validatedId, result.processId);
+      return { success: true, processId: result.processId, deviceId: validatedId, status: result.status };
+    } catch (error) {
+      return { success: false, message: safeErrorMessage(error, 'Failed to launch proxy') };
+    }
+  }
+
+  async stopProxy(key) {
+    let deviceId = null;
+    let processId = null;
+    if (typeof key === 'string') {
+      try { deviceId = validateDeviceId(key); } catch { return { success: false, message: 'Invalid proxy key.' }; }
+      processId = this.proxyByDevice.get(deviceId);
+    } else if (Number.isSafeInteger(key) && key > 0) {
+      processId = key;
+      for (const [candidateDeviceId, candidateProcessId] of this.proxyByDevice) {
+        if (candidateProcessId === processId) deviceId = candidateDeviceId;
+      }
+    }
+    if (!processId || !deviceId) return { success: false, message: 'Proxy process is not owned by this app.' };
+
+    const result = this.proxyManager.stopProxy(processId);
+    if (result.success) this.proxyByDevice.delete(deviceId);
+    return { ...result, deviceId };
+  }
+
+  disconnect() {
+    this.sessionStore.clear();
+    this.allowedDeviceIds.clear();
+    return this.getConnectionState();
+  }
+
+  getConnectionState() {
+    const state = this.sessionStore.describe();
+    return {
+      connected: state.connected,
+      origin: state.origin,
+      activeProxies: Array.from(this.proxyByDevice, ([deviceId, processId]) => ({ deviceId, processId })),
+    };
+  }
+
+  async checkForUpdates() {
+    try {
+      const result = await this.checkForUpdatePolicy({ currentVersion: this.currentVersion });
+      return { success: true, ...result };
+    } catch {
+      return { success: false, message: 'Could not securely check for updates.' };
+    }
+  }
+
+  async openFixedReleasesPage() {
+    await this.openExternal(RELEASES_PAGE_URL);
+    return { success: true };
+  }
+}
+
+module.exports = {
+  AppRuntime,
+  PAIRING_ENVELOPE_FILENAME,
+  PairingController,
+  atomicWritePairingEnvelope,
+  createBridgeHandler,
+  loadPairingEnvelope,
+};
diff --git a/styles.css b/styles.css
index 4012ae0..83958c4 100644
--- a/styles.css
+++ b/styles.css
@@ -532,7 +532,47 @@ button:disabled {
     to { transform: rotate(360deg); }
 }
 
-/* Update Modal */
+/* Bridge pairing */
+.section-help {
+    color: var(--text-secondary);
+    font-size: 13px;
+    margin: 0 0 14px;
+}
+
+.pairing-section .paired {
+    color: var(--success);
+    font-weight: 600;
+}
+
+.pairing-section .unpaired {
+    color: var(--warning);
+    font-weight: 600;
+}
+
+.pairing-secret-row {
+    margin: 14px 0;
+}
+
+.pairing-secret-row label,
+.pairing-secret-row small {
+    display: block;
+    color: var(--text-secondary);
+    margin-bottom: 6px;
+}
+
+.pairing-secret-row input {
+    width: 100%;
+    box-sizing: border-box;
+    font-family: monospace;
+    background: var(--bg-primary);
+    color: var(--text-primary);
+    border: 1px solid var(--border);
+    border-radius: 4px;
+    padding: 10px;
+    margin-bottom: 6px;
+}
+
+/* Update notification */
 .update-modal-overlay {
     position: fixed;
     top: 0;
@@ -595,55 +635,7 @@ button:disabled {
 .update-modal-message {
     font-size: 14px;
     color: var(--text-primary);
-    margin: 0 0 12px 0;
-}
-
-.update-modal-notes {
-    font-size: 13px;
-    color: var(--text-secondary);
-    line-height: 1.5;
-    white-space: pre-wrap;
-    max-height: 200px;
-    overflow-y: auto;
-    padding: 12px;
-    background: var(--bg-primary);
-    border-radius: 4px;
-    border: 1px solid var(--border);
-}
-
-.update-modal-notes:empty {
-    display: none;
-}
-
-.update-progress-container {
-    margin-top: 16px;
-    display: flex;
-    align-items: center;
-    gap: 12px;
-}
-
-.update-progress-track {
-    flex: 1;
-    height: 8px;
-    background: var(--bg-primary);
-    border-radius: 4px;
-    overflow: hidden;
-    border: 1px solid var(--border);
-}
-
-.update-progress-fill {
-    height: 100%;
-    background: var(--accent-primary);
-    border-radius: 4px;
-    transition: width 0.3s ease;
-}
-
-.update-progress-text {
-    font-size: 12px;
-    font-weight: bold;
-    color: var(--text-secondary);
-    min-width: 36px;
-    text-align: right;
+    margin: 0;
 }
 
 .update-modal-footer {
diff --git a/test/extension-contract.test.js b/test/extension-contract.test.js
index 368dbd3..871a2df 100644
--- a/test/extension-contract.test.js
+++ b/test/extension-contract.test.js
@@ -129,7 +129,7 @@ test('Send to APT uses the paired secret header and exact endpoint', async () =>
   assert.equal(harness.fetchCalls.length, 1);
   const [url, request] = harness.fetchCalls[0];
   assert.equal(url, 'http://127.0.0.1:18247/cookie');
-  assert.equal(request.headers['X-APT-Pairing-Secret'], 'A'.repeat(43));
+  assert.equal(request.headers['X-APT-Pairing'], 'A'.repeat(43));
   assert.deepEqual(JSON.parse(request.body), {
     deploymentUrl: 'https://customer.avasecurity.com',
     cookieValue: 'sensitive-va-token'
diff --git a/test/runtime-contract.test.js b/test/runtime-contract.test.js
new file mode 100644
index 0000000..9a98262
--- /dev/null
+++ b/test/runtime-contract.test.js
@@ -0,0 +1,208 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { PassThrough } = require('node:stream');
+
+const {
+  AppRuntime,
+  PairingController,
+  createBridgeHandler,
+  loadPairingEnvelope,
+} = require('../src/electron-runtime');
+const { APT_EXTENSION_ORIGIN, BridgeAuth } = require('../src/bridge-auth');
+const { createSessionStore } = require('../src/session-store');
+
+const ROOT = path.join(__dirname, '..');
+const read = (name) => fs.readFileSync(path.join(ROOT, name), 'utf8');
+
+function responseHarness() {
+  return {
+    statusCode: 0,
+    headers: {},
+    body: '',
+    setHeader(name, value) { this.headers[name.toLowerCase()] = value; },
+    writeHead(statusCode, headers = {}) {
+      this.statusCode = statusCode;
+      for (const [name, value] of Object.entries(headers)) this.setHeader(name, value);
+    },
+    end(chunk = '') { this.body += chunk; },
+  };
+}
+
+function requestHarness({ method = 'POST', origin = APT_EXTENSION_ORIGIN, secret, body = '{}' } = {}) {
+  const request = new PassThrough();
+  request.method = method;
+  request.url = '/cookie';
+  request.headers = { origin };
+  if (secret !== undefined) request.headers['x-apt-pairing'] = secret;
+  process.nextTick(() => request.end(body));
+  return request;
+}
+
+test('runtime keeps Alta credentials in main-owned modules and exposes only non-secret state', async () => {
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'top-secret-cookie');
+  const calls = [];
+  const proxyManager = {
+    launchProxy(request) { calls.push(request); return { success: true, processId: 91, deviceId: request.deviceId, status: 'running' }; },
+    stopProxy(processId) { calls.push({ processId }); return { success: true, processId, status: 'stop-requested' }; },
+    listTrackedProxies() { return []; },
+  };
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: {
+      getDevices: async () => [{ guid: '550e8400-e29b-41d4-a716-446655440000' }],
+      getDeviceSites: async () => [],
+      getAuthInfo: async () => ({ user: 'safe' }),
+    },
+    proxyManager,
+    checkForUpdate: async ({ currentVersion }) => ({ status: 'up-to-date', currentVersion }),
+    currentVersion: '1.0.0',
+    openExternal: async () => {},
+  });
+
+  assert.deepEqual(await runtime.getDevices(), { success: true, devices: [{ guid: '550e8400-e29b-41d4-a716-446655440000' }] });
+  const launched = await runtime.launchProxy('550e8400-e29b-41d4-a716-446655440000');
+  assert.equal(launched.success, true);
+  assert.deepEqual(calls[0], {
+    deploymentHost: 'customer.avasecurity.com',
+    cookie: 'top-secret-cookie',
+    deviceId: '550e8400-e29b-41d4-a716-446655440000',
+  });
+  assert.deepEqual(runtime.getConnectionState(), {
+    connected: true,
+    origin: 'https://customer.avasecurity.com',
+    activeProxies: [{ deviceId: '550e8400-e29b-41d4-a716-446655440000', processId: 91 }],
+  });
+  assert.equal(JSON.stringify(launched).includes('top-secret-cookie'), false);
+  assert.equal(JSON.stringify(runtime.getConnectionState()).includes('top-secret-cookie'), false);
+
+  assert.equal((await runtime.stopProxy('550e8400-e29b-41d4-a716-446655440000')).success, true);
+  assert.deepEqual(calls[1], { processId: 91 });
+  assert.equal((await runtime.stopProxy(999)).success, false);
+});
+
+test('bridge rejects unknown preflight and unauthenticated requests before reading their body', async () => {
+  const auth = new BridgeAuth();
+  const secret = auth.rotate().secret;
+  const sessionStore = createSessionStore();
+  let stateNotifications = 0;
+  const handler = createBridgeHandler({
+    bridgeAuth: auth,
+    sessionStore,
+    onConnectionStateChanged: () => { stateNotifications += 1; },
+  });
+
+  const unknownPreflight = requestHarness({ method: 'OPTIONS', origin: 'chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' });
+  const unknownResponse = responseHarness();
+  await handler(unknownPreflight, unknownResponse);
+  assert.equal(unknownResponse.statusCode, 403);
+  assert.equal(unknownResponse.headers['access-control-allow-origin'], undefined);
+
+  const unauthenticated = requestHarness({ body: '{'.repeat(1000) });
+  let dataRead = false;
+  unauthenticated.on('data', () => { dataRead = true; });
+  const unauthenticatedResponse = responseHarness();
+  await handler(unauthenticated, unauthenticatedResponse);
+  assert.equal(unauthenticatedResponse.statusCode, 403);
+  assert.equal(dataRead, false);
+
+  const allowedPreflight = requestHarness({ method: 'OPTIONS', secret });
+  const allowedResponse = responseHarness();
+  await handler(allowedPreflight, allowedResponse);
+  assert.equal(allowedResponse.statusCode, 204);
+  assert.equal(allowedResponse.headers['access-control-allow-origin'], APT_EXTENSION_ORIGIN);
+  assert.match(allowedResponse.headers['access-control-allow-headers'], /X-APT-Pairing/);
+
+  const accepted = requestHarness({
+    secret,
+    body: JSON.stringify({ deploymentUrl: 'https://customer.avasecurity.com', cookieValue: 'valid-cookie' }),
+  });
+  const acceptedResponse = responseHarness();
+  await handler(accepted, acceptedResponse);
+  assert.equal(acceptedResponse.statusCode, 200);
+  assert.deepEqual(sessionStore.describe(), { connected: true, origin: 'https://customer.avasecurity.com' });
+  assert.equal(stateNotifications, 1);
+  assert.equal(acceptedResponse.body.includes('valid-cookie'), false);
+});
+
+test('pairing envelope persists with restrictive permissions and secrets are returned once', () => {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-pairing-'));
+  const envelopePath = path.join(directory, 'bridge-pairing.json');
+  const controller = new PairingController({ envelopePath });
+
+  const first = controller.initialize();
+  assert.equal(first.paired, true);
+  assert.match(first.secret, /^[A-Za-z0-9_-]{43}$/);
+  assert.deepEqual(controller.getStatus(), { paired: true });
+  const persisted = loadPairingEnvelope(envelopePath);
+  assert.equal(Object.values(persisted).includes(first.secret), false);
+  if (process.platform !== 'win32') assert.equal(fs.statSync(envelopePath).mode & 0o777, 0o600);
+
+  const rotated = controller.rotate();
+  assert.match(rotated.secret, /^[A-Za-z0-9_-]{43}$/);
+  assert.notEqual(rotated.secret, first.secret);
+  assert.deepEqual(controller.getStatus(), { paired: true });
+  controller.revoke();
+  assert.deepEqual(controller.getStatus(), { paired: false });
+  assert.equal(fs.existsSync(envelopePath), false);
+});
+
+test('update runtime is check-only and opens only the fixed GitPeji releases page', async () => {
+  const opened = [];
+  const runtime = new AppRuntime({
+    sessionStore: createSessionStore(),
+    altaClient: {},
+    proxyManager: {},
+    checkForUpdate: async ({ currentVersion }) => ({ status: 'update-available', currentVersion, latestVersion: '1.1.0' }),
+    currentVersion: '1.0.0',
+    openExternal: async (url) => { opened.push(url); },
+  });
+  assert.deepEqual(await runtime.checkForUpdates(), {
+    success: true,
+    status: 'update-available',
+    currentVersion: '1.0.0',
+    latestVersion: '1.1.0',
+  });
+  assert.deepEqual(await runtime.openFixedReleasesPage(), { success: true });
+  assert.deepEqual(opened, ['https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases']);
+});
+
+test('preload and renderer expose only narrow, credential-free contracts', () => {
+  const preload = read('preload.js');
+  const renderer = read('renderer.js');
+  const html = read('index.html');
+  const expectedMethods = [
+    'getDevices', 'getDeviceSites', 'getAuthInfo', 'launchProxy', 'stopProxy', 'disconnect',
+    'getConnectionState', 'checkForUpdates', 'openFixedReleasesPage', 'rotatePairing',
+    'revokePairing', 'getPairingStatus', 'onConnectionStateChanged',
+  ];
+  for (const method of expectedMethods) assert.match(preload, new RegExp(`\\b${method}\\b`));
+  assert.doesNotMatch(preload, /downloadAndInstall|download-and-install|onUpdateDownloadProgress|onExtensionCookie/);
+  assert.doesNotMatch(renderer, /cookieValue|sessionData\.cookies|cookies\s*:/);
+  assert.doesNotMatch(html, /id="cookieKey"|updateProgress|Install Update/);
+  assert.match(renderer, /openFixedReleasesPage/);
+  assert.match(html, /Bridge Pairing/);
+});
+
+test('source policy removes legacy credential IPC, shell launch, broad kill, and executable updater', () => {
+  const production = ['main.js', 'preload.js', 'renderer.js', 'index.html', 'src/electron-runtime.js']
+    .map(read).join('\n');
+  const forbidden = [
+    /sanitizeBatchInput/, /taskkill/i, /\.bat\b/i, /download-and-install-update/,
+    /httpsGetFollowRedirects/, /api\.github\.com/i, /github releases/i,
+    /apt-local-bridge-token/, /X-APT-Token/, /cookie-proxy-/,
+  ];
+  for (const pattern of forbidden) assert.doesNotMatch(production, pattern);
+  assert.doesNotMatch(read('main.js'), /axios/);
+  assert.match(read('main.js'), /event\.sender === webContents/);
+  assert.match(read('main.js'), /frame === webContents\.mainFrame/);
+  assert.match(read('main.js'), /pathToFileURL\(path\.join\(__dirname, 'index\.html'\)\)/);
+  assert.match(read('main.js'), /127\.0\.0\.1/);
+  assert.match(read('main.js'), /18247/);
+  assert.match(read('main.js'), /shell\.openExternal/);
+});

From cf75ea9bc242622b308612b25170ae689f6ef525 Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Wed, 19 Aug 2026 21:59:19 +0000
Subject: [PATCH 07/22] fix: close APT adversarial runtime gaps

---
 chrome-extension/popup.js       |  76 +++++++++-
 main.js                         |  17 ++-
 src/bridge-auth.js              | 257 ++++++++++++++++++++------------
 src/electron-runtime.js         |  85 ++++++++---
 src/update-policy.js            |  31 +++-
 test/bridge-auth.test.js        | 199 +++++++++++++++++--------
 test/extension-contract.test.js |  47 ++++--
 test/runtime-contract.test.js   | 175 ++++++++++++++++++----
 test/update-policy.test.js      |  34 +++++
 9 files changed, 688 insertions(+), 233 deletions(-)

diff --git a/chrome-extension/popup.js b/chrome-extension/popup.js
index 55a1832..9af6a92 100644
--- a/chrome-extension/popup.js
+++ b/chrome-extension/popup.js
@@ -1,8 +1,26 @@
 'use strict';
 
 const APT_URL = 'http://127.0.0.1:18247/cookie';
+const CHALLENGE_URL = 'http://127.0.0.1:18247/challenge';
 const PAIRING_STORAGE_KEY = 'aptPairingSecret';
 const PAIRING_SECRET_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const NONCE_PATTERN = PAIRING_SECRET_PATTERN;
+const BRIDGE_DEADLINE_MS = 3000;
+
+function base64Url(bytes) {
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+}
+
+async function hmacBase64Url(cryptoApi, secret, value) {
+  const encoder = new TextEncoder();
+  const key = await cryptoApi.subtle.importKey(
+    'raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']
+  );
+  const signature = await cryptoApi.subtle.sign('HMAC', key, encoder.encode(value));
+  return base64Url(new Uint8Array(signature));
+}
 
 function isSupportedDeploymentUrl(value) {
   try {
@@ -20,7 +38,8 @@ function createPopupController({
   documentApi,
   navigatorApi,
   fetchImpl,
-  confirmCopy
+  confirmCopy,
+  cryptoApi
 }) {
   const tabInfo = documentApi.getElementById('tabInfo');
   const pairingInfo = documentApi.getElementById('pairingInfo');
@@ -34,6 +53,16 @@ function createPopupController({
   let pairingSecret = null;
   let busy = false;
 
+  async function bridgeFetch(url, options) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), BRIDGE_DEADLINE_MS);
+    try {
+      return await fetchImpl(url, { ...options, signal: controller.signal });
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
   function showStatus(message, type) {
     statusMsg.textContent = message;
     statusMsg.className = `status-msg ${type}`;
@@ -77,15 +106,45 @@ function createPopupController({
     setBusy(true);
     let cookieValue = null;
     try {
+      showStatus('Authenticating Alta Proxy Tool...', 'info');
+      if (!cryptoApi || !cryptoApi.subtle || typeof cryptoApi.getRandomValues !== 'function') {
+        throw new Error('CRYPTO_UNAVAILABLE');
+      }
+      const clientNonce = base64Url(cryptoApi.getRandomValues(new Uint8Array(32)));
+      const challengeResponse = await bridgeFetch(CHALLENGE_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ clientNonce })
+      });
+      const challenge = await challengeResponse.json();
+      if (!challengeResponse.ok || !challenge || challenge.success !== true ||
+          !NONCE_PATTERN.test(challenge.serverNonce) || !NONCE_PATTERN.test(challenge.serverProof)) {
+        throw new Error('BRIDGE_REJECTED');
+      }
+      const expectedServerProof = await hmacBase64Url(
+        cryptoApi,
+        pairingSecret,
+        JSON.stringify(['apt-server-challenge-v1', clientNonce, challenge.serverNonce])
+      );
+      if (challenge.serverProof !== expectedServerProof) throw new Error('BRIDGE_AUTH_FAILED');
+
       showStatus('Sending to Alta Proxy Tool...', 'info');
       cookieValue = await getVaCookieValue();
-      const response = await fetchImpl(APT_URL, {
+      const cookieRequest = {
+        clientNonce,
+        serverNonce: challenge.serverNonce,
+        deploymentUrl: detectedOrigin,
+        cookieValue
+      };
+      cookieRequest.proof = await hmacBase64Url(
+        cryptoApi,
+        pairingSecret,
+        JSON.stringify(['apt-cookie-request-v1', clientNonce, challenge.serverNonce, detectedOrigin, cookieValue])
+      );
+      const response = await bridgeFetch(APT_URL, {
         method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          'X-APT-Pairing': pairingSecret
-        },
-        body: JSON.stringify({ deploymentUrl: detectedOrigin, cookieValue })
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(cookieRequest)
       });
       const data = await response.json();
       if (!response.ok || !data || data.success !== true) throw new Error('BRIDGE_REJECTED');
@@ -173,7 +232,8 @@ if (typeof module !== 'undefined' && module.exports) {
     documentApi: document,
     navigatorApi: navigator,
     fetchImpl: fetch,
-    confirmCopy: (message) => window.confirm(message)
+    confirmCopy: (message) => window.confirm(message),
+    cryptoApi: crypto
   }).init().catch(() => {
     const status = document.getElementById('statusMsg');
     status.textContent = 'Extension initialization failed. Open pairing settings and try again.';
diff --git a/main.js b/main.js
index 284e159..f2dfea9 100644
--- a/main.js
+++ b/main.js
@@ -1,6 +1,6 @@
 'use strict';
 
-const { app, BrowserWindow, ipcMain, shell } = require('electron');
+const { app, BrowserWindow, ipcMain, safeStorage, shell } = require('electron');
 const http = require('node:http');
 const path = require('node:path');
 const { pathToFileURL } = require('node:url');
@@ -110,6 +110,7 @@ function registerIpcHandlers() {
 }
 
 function startBridgeServer() {
+  if (!pairingController.bridgeAuth) return;
   const handler = createBridgeHandler({
     bridgeAuth: pairingController.bridgeAuth,
     sessionStore: runtime.sessionStore,
@@ -134,8 +135,11 @@ app.whenReady().then(() => {
   const sessionStore = createSessionStore();
   const altaClient = createAltaClient({ sessionStore });
   const proxyManager = createProxyManager({ appDirectory: getAppDirectory() });
+  const secureStorageAvailable = safeStorage && safeStorage.isEncryptionAvailable();
   pairingController = new PairingController({
     envelopePath: path.join(app.getPath('userData'), PAIRING_ENVELOPE_FILENAME),
+    protect: secureStorageAvailable ? (value) => safeStorage.encryptString(value) : undefined,
+    unprotect: secureStorageAvailable ? (value) => safeStorage.decryptString(value) : undefined,
   });
   const pairingState = pairingController.initialize();
   firstRunPairingSecret = pairingState.secret || null;
@@ -153,12 +157,17 @@ app.whenReady().then(() => {
   startBridgeServer();
 });
 
-app.on('before-quit', () => {
-  if (bridgeServer) bridgeServer.close();
+app.on('before-quit', (event) => {
   if (runtime) {
-    for (const proxy of runtime.getConnectionState().activeProxies) runtime.stopProxy(proxy.processId);
+    const state = runtime.disconnect();
+    if (state.activeProxies.length > 0) {
+      event.preventDefault();
+      sendConnectionState();
+      return;
+    }
     runtime.sessionStore.dispose();
   }
+  if (bridgeServer) bridgeServer.close();
 });
 
 app.on('window-all-closed', () => {
diff --git a/src/bridge-auth.js b/src/bridge-auth.js
index 2adf53e..5c3c804 100644
--- a/src/bridge-auth.js
+++ b/src/bridge-auth.js
@@ -5,10 +5,16 @@ const crypto = require('node:crypto');
 const DEFAULT_SECRET_BYTES = 32;
 const DEFAULT_MAX_BODY_BYTES = 64 * 1024;
 const DEFAULT_BODY_DEADLINE_MS = 2_000;
+const DEFAULT_CHALLENGE_TTL_MS = 5_000;
+const DEFAULT_MAX_CHALLENGES = 64;
 const APT_EXTENSION_ID = 'onbkfpbggekakjddomjjnboippimlmch';
 const APT_EXTENSION_ORIGIN = `chrome-extension://${APT_EXTENSION_ID}`;
 const SECRET_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const NONCE_PATTERN = SECRET_PATTERN;
+const PROOF_PATTERN = SECRET_PATTERN;
 const EXTENSION_ORIGIN_PATTERN = /^chrome-extension:\/\/[a-p]{32}$/;
+const SERVER_PROOF_DOMAIN = 'apt-server-challenge-v1';
+const COOKIE_PROOF_DOMAIN = 'apt-cookie-request-v1';
 
 class BridgeAuthError extends Error {
   constructor(code, message, statusCode = 400) {
@@ -22,10 +28,12 @@ class BridgeAuthError extends Error {
 function dependencies(overrides = {}) {
   return {
     randomBytes: overrides.randomBytes || crypto.randomBytes,
-    scryptSync: overrides.scryptSync || crypto.scryptSync,
     timingSafeEqual: overrides.timingSafeEqual || crypto.timingSafeEqual,
+    createHmac: overrides.createHmac || crypto.createHmac,
+    createHash: overrides.createHash || crypto.createHash,
     setTimeout: overrides.setTimeout || setTimeout,
-    clearTimeout: overrides.clearTimeout || clearTimeout
+    clearTimeout: overrides.clearTimeout || clearTimeout,
+    now: overrides.now || Date.now
   };
 }
 
@@ -44,71 +52,98 @@ function assertPairingSecret(secret) {
   }
 }
 
-function hashPairingSecret(secret, options = {}) {
+function canonicalServerProof(clientNonce, serverNonce) {
+  return JSON.stringify([SERVER_PROOF_DOMAIN, clientNonce, serverNonce]);
+}
+
+function canonicalCookieProof({ clientNonce, serverNonce, deploymentUrl, cookieValue } = {}) {
+  return JSON.stringify([COOKIE_PROOF_DOMAIN, clientNonce, serverNonce, deploymentUrl, cookieValue]);
+}
+
+function computeHmac(secret, message, options = {}) {
   assertPairingSecret(secret);
-  const deps = dependencies(options);
-  const salt = deps.randomBytes(16);
-  const digest = deps.scryptSync(secret, salt, 32);
-  return Object.freeze({
-    version: 1,
-    algorithm: 'scrypt',
-    salt: salt.toString('base64url'),
-    digest: Buffer.from(digest).toString('base64url')
-  });
+  return dependencies(options).createHmac('sha256', secret).update(message, 'utf8').digest('base64url');
+}
+
+function computeServerProof(secret, clientNonce, serverNonce, options = {}) {
+  return computeHmac(secret, canonicalServerProof(clientNonce, serverNonce), options);
+}
+
+function computeCookieProof(secret, request, options = {}) {
+  return computeHmac(secret, canonicalCookieProof(request), options);
 }
 
 function isValidEnvelope(envelope) {
   return Boolean(
     envelope &&
-    envelope.version === 1 &&
-    envelope.algorithm === 'scrypt' &&
-    typeof envelope.salt === 'string' &&
-    /^[A-Za-z0-9_-]{22}$/.test(envelope.salt) &&
+    envelope.version === 2 &&
+    envelope.algorithm === 'electron-safe-storage' &&
+    typeof envelope.ciphertext === 'string' &&
+    /^[A-Za-z0-9+/]+={0,2}$/.test(envelope.ciphertext) &&
+    envelope.ciphertext.length >= 16 && envelope.ciphertext.length <= 8192 &&
     typeof envelope.digest === 'string' &&
-    /^[A-Za-z0-9_-]{43}$/.test(envelope.digest)
+    PROOF_PATTERN.test(envelope.digest)
   );
 }
 
-function verifyPairingSecret(secret, envelope, options = {}) {
-  if (!SECRET_PATTERN.test(typeof secret === 'string' ? secret : '') || !isValidEnvelope(envelope)) {
-    return false;
-  }
-
-  try {
-    const deps = dependencies(options);
-    const salt = Buffer.from(envelope.salt, 'base64url');
-    const expected = Buffer.from(envelope.digest, 'base64url');
-    const actual = Buffer.from(deps.scryptSync(secret, salt, expected.length));
-    return actual.length === expected.length && deps.timingSafeEqual(actual, expected);
-  } catch {
-    return false;
+function assertExtensionOrigin(origin) {
+  if (typeof origin !== 'string' || !EXTENSION_ORIGIN_PATTERN.test(origin) || origin !== APT_EXTENSION_ORIGIN) {
+    throw new BridgeAuthError('INVALID_EXTENSION_ORIGIN', 'The bridge only accepts the committed Alta Proxy Tool extension origin.');
   }
 }
 
-function assertExtensionOrigin(origin) {
-  if (typeof origin !== 'string' || !EXTENSION_ORIGIN_PATTERN.test(origin)) {
-    throw new BridgeAuthError(
-      'INVALID_EXTENSION_ORIGIN',
-      'Expected an exact stable chrome-extension origin.'
-    );
-  }
+function safeEqualText(left, right, deps) {
+  if (typeof left !== 'string' || typeof right !== 'string') return false;
+  const leftBytes = Buffer.from(left, 'utf8');
+  const rightBytes = Buffer.from(right, 'utf8');
+  return leftBytes.length === rightBytes.length && deps.timingSafeEqual(leftBytes, rightBytes);
 }
 
 class BridgeAuth {
-  constructor({ expectedOrigin = APT_EXTENSION_ORIGIN, envelope = null, ...injected } = {}) {
+  constructor({
+    expectedOrigin = APT_EXTENSION_ORIGIN,
+    envelope = null,
+    protect,
+    unprotect,
+    maxChallenges = DEFAULT_MAX_CHALLENGES,
+    challengeTtlMs = DEFAULT_CHALLENGE_TTL_MS,
+    ...injected
+  } = {}) {
     assertExtensionOrigin(expectedOrigin);
-    if (expectedOrigin !== APT_EXTENSION_ORIGIN) {
-      throw new BridgeAuthError(
-        'INVALID_EXTENSION_ORIGIN',
-        'The bridge only accepts the committed Alta Proxy Tool extension origin.'
-      );
+    if (typeof protect !== 'function' || typeof unprotect !== 'function') {
+      throw new BridgeAuthError('SECURE_STORAGE_UNAVAILABLE', 'Secure pairing storage is unavailable.', 503);
+    }
+    if (!Number.isSafeInteger(maxChallenges) || maxChallenges < 1 || maxChallenges > 1024) {
+      throw new BridgeAuthError('INVALID_CHALLENGE_LIMIT', 'Challenge limit is invalid.');
+    }
+    if (!Number.isSafeInteger(challengeTtlMs) || challengeTtlMs < 1 || challengeTtlMs > 60_000) {
+      throw new BridgeAuthError('INVALID_CHALLENGE_TTL', 'Challenge lifetime is invalid.');
     }
     if (envelope !== null && !isValidEnvelope(envelope)) {
       throw new BridgeAuthError('INVALID_SECRET_ENVELOPE', 'The persisted pairing envelope is invalid.');
     }
+
     this.expectedOrigin = expectedOrigin;
-    this._envelope = envelope ? Object.freeze({ ...envelope }) : null;
+    this._protect = protect;
+    this._unprotect = unprotect;
+    this._maxChallenges = maxChallenges;
+    this._challengeTtlMs = challengeTtlMs;
     this._dependencies = dependencies(injected);
+    this._challenges = new Map();
+    this._secret = null;
+    this._envelope = envelope ? Object.freeze({ ...envelope }) : null;
+
+    if (envelope) {
+      try {
+        const secret = unprotect(Buffer.from(envelope.ciphertext, 'base64'));
+        assertPairingSecret(secret);
+        const digest = this._dependencies.createHash('sha256').update(secret, 'utf8').digest('base64url');
+        if (!safeEqualText(digest, envelope.digest, this._dependencies)) throw new Error('digest mismatch');
+        this._secret = secret;
+      } catch {
+        throw new BridgeAuthError('INVALID_SECRET_ENVELOPE', 'The persisted pairing envelope could not be decrypted.');
+      }
+    }
   }
 
   get envelope() {
@@ -117,24 +152,75 @@ class BridgeAuth {
 
   rotate() {
     const secret = generatePairingSecret(this._dependencies);
-    this._envelope = hashPairingSecret(secret, this._dependencies);
+    let protectedBytes;
+    try {
+      protectedBytes = this._protect(secret);
+    } catch {
+      throw new BridgeAuthError('SECURE_STORAGE_UNAVAILABLE', 'Secure pairing storage is unavailable.', 503);
+    }
+    if (!Buffer.isBuffer(protectedBytes) || protectedBytes.length === 0 || protectedBytes.length > 6144) {
+      throw new BridgeAuthError('SECURE_STORAGE_UNAVAILABLE', 'Secure pairing storage returned invalid ciphertext.', 503);
+    }
+    this._secret = secret;
+    this._challenges.clear();
+    this._envelope = Object.freeze({
+      version: 2,
+      algorithm: 'electron-safe-storage',
+      ciphertext: protectedBytes.toString('base64'),
+      digest: this._dependencies.createHash('sha256').update(secret, 'utf8').digest('base64url')
+    });
     return { secret, envelope: this.envelope };
   }
 
   revoke() {
+    this._secret = null;
     this._envelope = null;
+    this._challenges.clear();
   }
 
-  authenticate({ origin, secret } = {}) {
-    if (origin !== this.expectedOrigin || !this._envelope) return false;
-    return verifyPairingSecret(secret, this._envelope, this._dependencies);
+  _purgeExpired(now) {
+    for (const [nonce, challenge] of this._challenges) {
+      if (challenge.expiresAt <= now) this._challenges.delete(nonce);
+    }
   }
 
-  authenticateRequest(request) {
-    if (!request || typeof request !== 'object') return false;
-    const headers = request.headers || {};
-    const secret = headers['x-apt-pairing'];
-    return this.authenticate({ origin: headers.origin, secret });
+  issueChallenge(clientNonce) {
+    if (!this._secret) throw new BridgeAuthError('PAIRING_UNAVAILABLE', 'Bridge pairing is unavailable.', 503);
+    if (typeof clientNonce !== 'string' || !NONCE_PATTERN.test(clientNonce)) {
+      throw new BridgeAuthError('INVALID_NONCE', 'Client nonce is invalid.');
+    }
+    const now = this._dependencies.now();
+    this._purgeExpired(now);
+    if (this._challenges.size >= this._maxChallenges) {
+      throw new BridgeAuthError('CHALLENGE_CAPACITY', 'Too many bridge challenges are outstanding.', 429);
+    }
+    let serverNonce;
+    do {
+      serverNonce = this._dependencies.randomBytes(32).toString('base64url');
+    } while (this._challenges.has(serverNonce));
+    const expiresAt = now + this._challengeTtlMs;
+    this._challenges.set(serverNonce, { clientNonce, expiresAt });
+    return {
+      serverNonce,
+      serverProof: computeServerProof(this._secret, clientNonce, serverNonce, this._dependencies)
+    };
+  }
+
+  authenticateCookie(request = {}) {
+    const { clientNonce, serverNonce, deploymentUrl, cookieValue, proof } = request;
+    if (!this._secret || !NONCE_PATTERN.test(typeof clientNonce === 'string' ? clientNonce : '') ||
+        !NONCE_PATTERN.test(typeof serverNonce === 'string' ? serverNonce : '') ||
+        !PROOF_PATTERN.test(typeof proof === 'string' ? proof : '') ||
+        typeof deploymentUrl !== 'string' || deploymentUrl.length < 1 || deploymentUrl.length > 2048 ||
+        typeof cookieValue !== 'string' || cookieValue.length < 1 || cookieValue.length > 4096) {
+      return false;
+    }
+    const challenge = this._challenges.get(serverNonce);
+    if (!challenge) return false;
+    this._challenges.delete(serverNonce);
+    if (challenge.expiresAt <= this._dependencies.now() || challenge.clientNonce !== clientNonce) return false;
+    const expected = computeCookieProof(this._secret, request, this._dependencies);
+    return safeEqualText(proof, expected, this._dependencies);
   }
 }
 
@@ -142,22 +228,14 @@ function readJsonBody(stream, options = {}) {
   const maxBytes = options.maxBytes ?? DEFAULT_MAX_BODY_BYTES;
   const deadlineMs = options.deadlineMs ?? DEFAULT_BODY_DEADLINE_MS;
   const deps = dependencies(options);
-
-  if (!stream || typeof stream.on !== 'function') {
-    return Promise.reject(new BridgeAuthError('INVALID_BODY_STREAM', 'A readable request body is required.'));
-  }
-  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) {
-    return Promise.reject(new BridgeAuthError('INVALID_BODY_LIMIT', 'Body limit must be a positive integer.'));
-  }
-  if (!Number.isSafeInteger(deadlineMs) || deadlineMs < 1) {
-    return Promise.reject(new BridgeAuthError('INVALID_BODY_DEADLINE', 'Body deadline must be a positive integer.'));
-  }
+  if (!stream || typeof stream.on !== 'function') return Promise.reject(new BridgeAuthError('INVALID_BODY_STREAM', 'A readable request body is required.'));
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) return Promise.reject(new BridgeAuthError('INVALID_BODY_LIMIT', 'Body limit must be a positive integer.'));
+  if (!Number.isSafeInteger(deadlineMs) || deadlineMs < 1) return Promise.reject(new BridgeAuthError('INVALID_BODY_DEADLINE', 'Body deadline must be a positive integer.'));
 
   return new Promise((resolve, reject) => {
     const chunks = [];
     let total = 0;
     let settled = false;
-
     const cleanup = () => {
       deps.clearTimeout(timer);
       stream.removeListener('data', onData);
@@ -174,10 +252,7 @@ function readJsonBody(stream, options = {}) {
     const onData = (chunk) => {
       const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
       total += buffer.length;
-      if (total > maxBytes) {
-        fail(new BridgeAuthError('BODY_TOO_LARGE', 'Request body exceeds the configured limit.', 413));
-        return;
-      }
+      if (total > maxBytes) return fail(new BridgeAuthError('BODY_TOO_LARGE', 'Request body exceeds the configured limit.', 413));
       chunks.push(buffer);
     };
     const onError = () => fail(new BridgeAuthError('BODY_READ_ERROR', 'Could not read the request body.'));
@@ -186,23 +261,15 @@ function readJsonBody(stream, options = {}) {
       settled = true;
       cleanup();
       let parsed;
-      try {
-        parsed = JSON.parse(Buffer.concat(chunks).toString('utf8'));
-      } catch {
-        reject(new BridgeAuthError('MALFORMED_JSON', 'Request body must be valid JSON.'));
-        return;
-      }
+      try { parsed = JSON.parse(Buffer.concat(chunks).toString('utf8')); }
+      catch { reject(new BridgeAuthError('MALFORMED_JSON', 'Request body must be valid JSON.')); return; }
       if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
         reject(new BridgeAuthError('INVALID_JSON_BODY', 'Request body must be a JSON object.'));
         return;
       }
       resolve(parsed);
     };
-
-    const timer = deps.setTimeout(
-      () => fail(new BridgeAuthError('BODY_DEADLINE_EXCEEDED', 'Request body deadline exceeded.', 408)),
-      deadlineMs
-    );
+    const timer = deps.setTimeout(() => fail(new BridgeAuthError('BODY_DEADLINE_EXCEEDED', 'Request body deadline exceeded.', 408)), deadlineMs);
     stream.on('data', onData);
     stream.on('end', onEnd);
     stream.on('error', onError);
@@ -210,25 +277,15 @@ function readJsonBody(stream, options = {}) {
 }
 
 function createRequestLimiter({ maxConcurrent = 4 } = {}) {
-  if (!Number.isSafeInteger(maxConcurrent) || maxConcurrent < 1) {
-    throw new BridgeAuthError('INVALID_CONCURRENCY_LIMIT', 'Concurrency limit must be a positive integer.');
-  }
+  if (!Number.isSafeInteger(maxConcurrent) || maxConcurrent < 1) throw new BridgeAuthError('INVALID_CONCURRENCY_LIMIT', 'Concurrency limit must be a positive integer.');
   let active = 0;
   return {
     get active() { return active; },
     async run(work) {
-      if (typeof work !== 'function') {
-        throw new BridgeAuthError('INVALID_REQUEST_WORK', 'Request work must be a function.');
-      }
-      if (active >= maxConcurrent) {
-        throw new BridgeAuthError('TOO_MANY_REQUESTS', 'Too many bridge requests are active.', 429);
-      }
+      if (typeof work !== 'function') throw new BridgeAuthError('INVALID_REQUEST_WORK', 'Request work must be a function.');
+      if (active >= maxConcurrent) throw new BridgeAuthError('TOO_MANY_REQUESTS', 'Too many bridge requests are active.', 429);
       active += 1;
-      try {
-        return await work();
-      } finally {
-        active -= 1;
-      }
+      try { return await work(); } finally { active -= 1; }
     }
   };
 }
@@ -238,13 +295,21 @@ module.exports = {
   APT_EXTENSION_ORIGIN,
   BridgeAuth,
   BridgeAuthError,
+  COOKIE_PROOF_DOMAIN,
   DEFAULT_BODY_DEADLINE_MS,
+  DEFAULT_CHALLENGE_TTL_MS,
   DEFAULT_MAX_BODY_BYTES,
+  DEFAULT_MAX_CHALLENGES,
   EXTENSION_ORIGIN_PATTERN,
+  NONCE_PATTERN,
   SECRET_PATTERN,
+  SERVER_PROOF_DOMAIN,
+  canonicalCookieProof,
+  canonicalServerProof,
+  computeCookieProof,
+  computeServerProof,
   createRequestLimiter,
   generatePairingSecret,
-  hashPairingSecret,
-  readJsonBody,
-  verifyPairingSecret
+  isValidEnvelope,
+  readJsonBody
 };
diff --git a/src/electron-runtime.js b/src/electron-runtime.js
index 37af5cb..a65926c 100644
--- a/src/electron-runtime.js
+++ b/src/electron-runtime.js
@@ -26,13 +26,13 @@ function safeErrorMessage(error, fallback) {
     : fallback;
 }
 
-function loadPairingEnvelope(envelopePath) {
+function loadPairingEnvelope(envelopePath, { protect, unprotect } = {}) {
   if (!fs.existsSync(envelopePath)) return null;
   const bytes = fs.readFileSync(envelopePath);
   if (bytes.length === 0 || bytes.length > 4096) throw new Error('Invalid pairing envelope file');
   const parsed = JSON.parse(bytes.toString('utf8'));
   // BridgeAuth performs the authoritative envelope schema validation.
-  return new BridgeAuth({ envelope: parsed }).envelope;
+  return new BridgeAuth({ envelope: parsed, protect, unprotect }).envelope;
 }
 
 function atomicWritePairingEnvelope(envelopePath, envelope) {
@@ -51,30 +51,38 @@ function atomicWritePairingEnvelope(envelopePath, envelope) {
 }
 
 class PairingController {
-  constructor({ envelopePath, bridgeAuth } = {}) {
+  constructor({ envelopePath, bridgeAuth, protect, unprotect } = {}) {
     if (typeof envelopePath !== 'string' || envelopePath.length === 0) {
       throw new TypeError('PairingController requires an envelope path');
     }
     this.envelopePath = envelopePath;
+    this.unavailable = false;
     if (bridgeAuth) {
       this.bridgeAuth = bridgeAuth;
+    } else if (typeof protect !== 'function' || typeof unprotect !== 'function') {
+      this.bridgeAuth = null;
+      this.unavailable = true;
     } else {
       let envelope = null;
       try {
-        envelope = loadPairingEnvelope(envelopePath);
+        envelope = loadPairingEnvelope(envelopePath, { protect, unprotect });
       } catch {
         try { fs.unlinkSync(envelopePath); } catch {}
       }
-      this.bridgeAuth = new BridgeAuth({ envelope });
+      this.bridgeAuth = new BridgeAuth({ envelope, protect, unprotect });
     }
   }
 
   initialize() {
+    if (this.unavailable) return { paired: false, unavailable: true };
     if (this.bridgeAuth.envelope) return { paired: true };
     return this.rotate();
   }
 
   rotate() {
+    if (this.unavailable || !this.bridgeAuth) {
+      throw new BridgeAuthError('SECURE_STORAGE_UNAVAILABLE', 'Secure pairing storage is unavailable.', 503);
+    }
     const { secret, envelope } = this.bridgeAuth.rotate();
     try {
       atomicWritePairingEnvelope(this.envelopePath, envelope);
@@ -86,17 +94,18 @@ class PairingController {
   }
 
   revoke() {
-    this.bridgeAuth.revoke();
+    if (this.bridgeAuth) this.bridgeAuth.revoke();
     try {
       fs.unlinkSync(this.envelopePath);
     } catch (error) {
       if (error.code !== 'ENOENT') throw error;
     }
-    return { paired: false };
+    return this.unavailable ? { paired: false, unavailable: true } : { paired: false };
   }
 
   getStatus() {
-    return { paired: Boolean(this.bridgeAuth.envelope) };
+    if (this.unavailable) return { paired: false, unavailable: true };
+    return { paired: Boolean(this.bridgeAuth && this.bridgeAuth.envelope) };
   }
 }
 
@@ -118,7 +127,7 @@ function createBridgeHandler({
   maxBodyBytes,
   deadlineMs,
 } = {}) {
-  if (!bridgeAuth || typeof bridgeAuth.authenticateRequest !== 'function') {
+  if (!bridgeAuth || typeof bridgeAuth.issueChallenge !== 'function' || typeof bridgeAuth.authenticateCookie !== 'function') {
     throw new TypeError('Bridge handler requires bridge authentication');
   }
   if (!sessionStore || typeof sessionStore.establish !== 'function') {
@@ -135,7 +144,7 @@ function createBridgeHandler({
     response.setHeader('Access-Control-Allow-Origin', APT_EXTENSION_ORIGIN);
     response.setHeader('Vary', 'Origin');
     response.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
-    response.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-APT-Pairing');
+    response.setHeader('Access-Control-Allow-Headers', 'Content-Type');
     response.setHeader('Access-Control-Max-Age', '600');
 
     if (request.method === 'OPTIONS') {
@@ -143,29 +152,38 @@ function createBridgeHandler({
       response.end();
       return;
     }
-    if (request.method !== 'POST' || request.url !== '/cookie') {
+    if (request.method !== 'POST' || (request.url !== '/challenge' && request.url !== '/cookie')) {
       writeJson(response, 404, { success: false, message: 'Not found' });
       return;
     }
-    if (!bridgeAuth.authenticateRequest(request)) {
-      writeJson(response, 403, { success: false, message: 'Forbidden' });
-      return;
-    }
 
     try {
+      let payload;
       await limiter.run(async () => {
         const data = await readJsonBody(request, { maxBytes: maxBodyBytes, deadlineMs });
+        if (request.url === '/challenge') {
+          payload = { success: true, ...bridgeAuth.issueChallenge(data.clientNonce) };
+          return;
+        }
+        if (!bridgeAuth.authenticateCookie(data)) {
+          throw new BridgeAuthError('FORBIDDEN', 'Cookie proof was rejected.', 403);
+        }
         const state = sessionStore.establish(data.deploymentUrl, data.cookieValue);
         onConnectionStateChanged({ connected: state.connected, origin: state.origin });
+        payload = { success: true, message: 'Session received' };
       });
-      writeJson(response, 200, { success: true, message: 'Session received' });
+      writeJson(response, 200, payload);
     } catch (error) {
       const statusCode = error instanceof BridgeAuthError
         ? error.statusCode
         : error && error.code === 'INVALID_SESSION_COOKIE'
           ? 400
           : 400;
-      writeJson(response, statusCode, { success: false, message: statusCode === 429 ? 'Too many requests' : 'Invalid request' });
+      const message = statusCode === 429 ? 'Too many requests'
+        : statusCode === 403 ? 'Forbidden'
+          : statusCode === 503 ? 'Pairing unavailable'
+            : 'Invalid request';
+      writeJson(response, statusCode, { success: false, message });
     }
   };
 }
@@ -189,6 +207,22 @@ class AppRuntime {
     this.proxyByDevice = new Map();
   }
 
+  _reconcileProxies() {
+    const tracked = this.proxyManager && typeof this.proxyManager.listTrackedProxies === 'function'
+      ? this.proxyManager.listTrackedProxies()
+      : [];
+    this.proxyByDevice = new Map();
+    for (const proxy of tracked) {
+      try {
+        const deviceId = validateDeviceId(proxy.deviceId);
+        if (Number.isSafeInteger(proxy.processId) && proxy.processId > 0) {
+          this.proxyByDevice.set(deviceId, proxy.processId);
+        }
+      } catch {}
+    }
+    return tracked.filter((proxy) => this.proxyByDevice.get(proxy.deviceId) === proxy.processId);
+  }
+
   async getDevices() {
     try {
       const devices = await this.altaClient.getDevices();
@@ -222,6 +256,7 @@ class AppRuntime {
   async launchProxy(deviceId) {
     try {
       const validatedId = validateDeviceId(deviceId);
+      this._reconcileProxies();
       if (!this.allowedDeviceIds.has(validatedId)) {
         return { success: false, message: 'Select a device from the current Alta device list.' };
       }
@@ -242,6 +277,7 @@ class AppRuntime {
   }
 
   async stopProxy(key) {
+    this._reconcileProxies();
     let deviceId = null;
     let processId = null;
     if (typeof key === 'string') {
@@ -261,12 +297,25 @@ class AppRuntime {
   }
 
   disconnect() {
+    const tracked = this._reconcileProxies();
+    for (const proxy of tracked) {
+      try { this.proxyManager.stopProxy(proxy.processId); } catch {}
+    }
+    const remaining = this._reconcileProxies();
+    if (remaining.length > 0) {
+      return {
+        success: false,
+        message: 'Could not stop every active proxy. The Alta session remains connected.',
+        ...this.getConnectionState(),
+      };
+    }
     this.sessionStore.clear();
     this.allowedDeviceIds.clear();
-    return this.getConnectionState();
+    return { success: true, ...this.getConnectionState() };
   }
 
   getConnectionState() {
+    this._reconcileProxies();
     const state = this.sessionStore.describe();
     return {
       connected: state.connected,
diff --git a/src/update-policy.js b/src/update-policy.js
index b01a3a1..8f3fb6e 100644
--- a/src/update-policy.js
+++ b/src/update-policy.js
@@ -140,27 +140,44 @@ function parseRelease(body) {
   };
 }
 
-function defaultRequest({ url, timeoutMs, maxBodyBytes }) {
+function defaultRequest({
+  url,
+  timeoutMs,
+  maxBodyBytes,
+  httpsGet = https.get,
+  setTimer = setTimeout,
+  clearTimer = clearTimeout,
+}) {
   if (url !== LATEST_RELEASE_URL) {
     return Promise.reject(policyError('UNTRUSTED_REQUEST_URL', 'Update checks are restricted to GitPeji'));
   }
 
   return new Promise((resolve, reject) => {
     let settled = false;
+    let responseStream = null;
+    let deadlineTimer = null;
+    const clearDeadline = () => {
+      if (deadlineTimer !== null) {
+        clearTimer(deadlineTimer);
+        deadlineTimer = null;
+      }
+    };
     const finishReject = (error) => {
       if (!settled) {
         settled = true;
+        clearDeadline();
         reject(error);
       }
     };
 
-    const request = https.get(url, {
+    const request = httpsGet(url, {
       headers: {
         accept: 'application/json',
         'user-agent': 'Alta-Proxy-Tool-update-check',
       },
       agent: false,
     }, (response) => {
+      responseStream = response;
       const chunks = [];
       let receivedBytes = 0;
       const contentLength = Number(response.headers['content-length']);
@@ -183,6 +200,7 @@ function defaultRequest({ url, timeoutMs, maxBodyBytes }) {
       response.on('end', () => {
         if (settled) return;
         settled = true;
+        clearDeadline();
         resolve({
           statusCode: response.statusCode,
           headers: response.headers,
@@ -193,9 +211,12 @@ function defaultRequest({ url, timeoutMs, maxBodyBytes }) {
       response.on('error', finishReject);
     });
 
-    request.setTimeout(timeoutMs, () => {
-      request.destroy(policyError('REQUEST_TIMEOUT', 'Release check timed out'));
-    });
+    deadlineTimer = setTimer(() => {
+      const timeoutError = policyError('REQUEST_TIMEOUT', 'Release check timed out');
+      if (responseStream && typeof responseStream.destroy === 'function') responseStream.destroy();
+      request.destroy(timeoutError);
+      finishReject(timeoutError);
+    }, timeoutMs);
     request.on('error', (error) => {
       if (error instanceof UpdatePolicyError) {
         finishReject(error);
diff --git a/test/bridge-auth.test.js b/test/bridge-auth.test.js
index 6c535b3..24b0e1c 100644
--- a/test/bridge-auth.test.js
+++ b/test/bridge-auth.test.js
@@ -7,108 +7,175 @@ const { PassThrough, Readable } = require('node:stream');
 const {
   BridgeAuth,
   BridgeAuthError,
+  computeCookieProof,
+  computeServerProof,
   generatePairingSecret,
-  hashPairingSecret,
-  verifyPairingSecret,
   readJsonBody,
   createRequestLimiter
 } = require('../src/bridge-auth');
 
 const EXTENSION_ORIGIN = 'chrome-extension://onbkfpbggekakjddomjjnboippimlmch';
+const CLIENT_NONCE = Buffer.alloc(32, 1).toString('base64url');
+const protect = (plaintext) => Buffer.from(`protected:${plaintext}`, 'utf8');
+const unprotect = (ciphertext) => {
+  const value = Buffer.from(ciphertext).toString('utf8');
+  if (!value.startsWith('protected:')) throw new Error('bad ciphertext');
+  return value.slice('protected:'.length);
+};
 
-test('pairing secrets are random, URL-safe, and stored as a hash envelope', () => {
+function createAuth(options = {}) {
+  return new BridgeAuth({ expectedOrigin: EXTENSION_ORIGIN, protect, unprotect, ...options });
+}
+
+test('pairing secrets are random and persisted only in a versioned protected envelope', () => {
   const first = generatePairingSecret();
   const second = generatePairingSecret();
   assert.match(first, /^[A-Za-z0-9_-]{43}$/);
   assert.notEqual(first, second);
 
-  const envelope = hashPairingSecret(first);
-  assert.equal(envelope.version, 1);
-  assert.equal(envelope.algorithm, 'scrypt');
-  assert.equal(Object.values(envelope).includes(first), false);
-  assert.equal(verifyPairingSecret(first, envelope), true);
-  assert.equal(verifyPairingSecret(second, envelope), false);
-  assert.equal(verifyPairingSecret('', envelope), false);
-  assert.equal(verifyPairingSecret(null, envelope), false);
+  const auth = createAuth();
+  const { secret, envelope } = auth.rotate();
+  assert.deepEqual(Object.keys(envelope).sort(), ['algorithm', 'ciphertext', 'digest', 'version']);
+  assert.equal(envelope.version, 2);
+  assert.equal(envelope.algorithm, 'electron-safe-storage');
+  assert.equal(JSON.stringify(envelope).includes(secret), false);
+  assert.equal(Buffer.from(envelope.ciphertext, 'base64').toString('utf8').includes(secret), true,
+    'test protector is intentionally transparent after decoding; disk JSON itself is never plaintext');
 });
 
-test('auth rejects missing/wrong secrets and unknown or malformed origins', () => {
-  const auth = new BridgeAuth({ expectedOrigin: EXTENSION_ORIGIN });
-  const { secret } = auth.rotate();
+test('protected envelope restores server authentication without request-time scrypt', () => {
+  let protectCalls = 0;
+  let unprotectCalls = 0;
+  const first = new BridgeAuth({
+    protect(value) { protectCalls += 1; return protect(value); },
+    unprotect(value) { unprotectCalls += 1; return unprotect(value); }
+  });
+  const { secret, envelope } = first.rotate();
+  const restored = new BridgeAuth({
+    envelope: JSON.parse(JSON.stringify(envelope)),
+    protect,
+    unprotect(value) { unprotectCalls += 1; return unprotect(value); }
+  });
+  const challenge = restored.issueChallenge(CLIENT_NONCE);
 
-  assert.equal(auth.authenticate({ origin: EXTENSION_ORIGIN, secret }), true);
-  assert.equal(auth.authenticate({ origin: EXTENSION_ORIGIN }), false);
-  assert.equal(auth.authenticate({ origin: EXTENSION_ORIGIN, secret: 'wrong' }), false);
-  assert.equal(auth.authenticate({ origin: 'chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', secret }), false);
-  assert.equal(auth.authenticate({ origin: `${EXTENSION_ORIGIN}/`, secret }), false);
-  assert.equal(auth.authenticate({ origin: `${EXTENSION_ORIGIN}\r\nX-Evil: yes`, secret }), false);
-  assert.equal(auth.authenticate({ origin: EXTENSION_ORIGIN, secret: `${secret}\r\n` }), false);
+  assert.equal(protectCalls, 1);
+  assert.equal(unprotectCalls, 1);
+  assert.equal(challenge.serverProof, computeServerProof(secret, CLIENT_NONCE, challenge.serverNonce));
+  assert.equal(Object.hasOwn(challenge, 'secret'), false);
 });
 
-test('rotation invalidates the previous secret and revoke invalidates the current secret', () => {
-  const auth = new BridgeAuth({ expectedOrigin: EXTENSION_ORIGIN });
-  const first = auth.rotate().secret;
-  const second = auth.rotate().secret;
+test('challenge proof and cookie proof are domain-separated, constant-time authenticated, and one-time', () => {
+  const auth = createAuth();
+  const secret = auth.rotate().secret;
+  const challenge = auth.issueChallenge(CLIENT_NONCE);
+  const cookieRequest = {
+    clientNonce: CLIENT_NONCE,
+    serverNonce: challenge.serverNonce,
+    deploymentUrl: 'https://customer.avasecurity.com',
+    cookieValue: 'synthetic-cookie'
+  };
+  cookieRequest.proof = computeCookieProof(secret, cookieRequest);
 
-  assert.equal(auth.authenticate({ origin: EXTENSION_ORIGIN, secret: first }), false);
-  assert.equal(auth.authenticate({ origin: EXTENSION_ORIGIN, secret: second }), true);
+  assert.notEqual(challenge.serverProof, cookieRequest.proof);
+  assert.equal(auth.authenticateCookie(cookieRequest), true);
+  assert.equal(auth.authenticateCookie(cookieRequest), false, 'challenge replay must fail');
+});
+
+test('challenge cache is bounded, expires entries, and rejects malformed nonces', () => {
+  let now = 100;
+  const auth = createAuth({ maxChallenges: 1, challengeTtlMs: 50, now: () => now });
+  auth.rotate();
+  auth.issueChallenge(CLIENT_NONCE);
+  assert.throws(() => auth.issueChallenge(Buffer.alloc(32, 2).toString('base64url')),
+    (error) => error.code === 'CHALLENGE_CAPACITY');
+  now = 151;
+  const replacement = auth.issueChallenge(Buffer.alloc(32, 2).toString('base64url'));
+  assert.match(replacement.serverNonce, /^[A-Za-z0-9_-]{43}$/);
+  assert.throws(() => auth.issueChallenge('short'), (error) => error.code === 'INVALID_NONCE');
+});
+
+test('expired and forged cookie proofs fail and consume the one-time challenge', () => {
+  let now = 100;
+  const auth = createAuth({ challengeTtlMs: 50, now: () => now });
+  const secret = auth.rotate().secret;
+  const expired = auth.issueChallenge(CLIENT_NONCE);
+  now = 151;
+  assert.equal(auth.authenticateCookie({
+    clientNonce: CLIENT_NONCE,
+    serverNonce: expired.serverNonce,
+    deploymentUrl: 'https://customer.avasecurity.com',
+    cookieValue: 'cookie',
+    proof: computeCookieProof(secret, {
+      clientNonce: CLIENT_NONCE,
+      serverNonce: expired.serverNonce,
+      deploymentUrl: 'https://customer.avasecurity.com',
+      cookieValue: 'cookie'
+    })
+  }), false);
+
+  now = 200;
+  const forged = auth.issueChallenge(CLIENT_NONCE);
+  const request = {
+    clientNonce: CLIENT_NONCE,
+    serverNonce: forged.serverNonce,
+    deploymentUrl: 'https://customer.avasecurity.com',
+    cookieValue: 'cookie',
+    proof: 'A'.repeat(43)
+  };
+  assert.equal(auth.authenticateCookie(request), false);
+  request.proof = computeCookieProof(secret, request);
+  assert.equal(auth.authenticateCookie(request), false, 'forged attempt consumes challenge');
+});
+
+test('rotation clears outstanding challenges and revoke disables challenge issuance', () => {
+  const auth = createAuth();
+  auth.rotate();
+  const prior = auth.issueChallenge(CLIENT_NONCE);
+  auth.rotate();
+  assert.equal(auth.authenticateCookie({
+    clientNonce: CLIENT_NONCE,
+    serverNonce: prior.serverNonce,
+    deploymentUrl: 'https://customer.avasecurity.com',
+    cookieValue: 'cookie',
+    proof: 'A'.repeat(43)
+  }), false);
   auth.revoke();
-  assert.equal(auth.authenticate({ origin: EXTENSION_ORIGIN, secret: second }), false);
+  assert.throws(() => auth.issueChallenge(CLIENT_NONCE), (error) => error.code === 'PAIRING_UNAVAILABLE');
   assert.equal(auth.envelope, null);
 });
 
-test('an envelope can be safely persisted and loaded by a future desktop wiring', () => {
-  const first = new BridgeAuth({ expectedOrigin: EXTENSION_ORIGIN });
-  const { secret, envelope } = first.rotate();
-  const persisted = JSON.parse(JSON.stringify(envelope));
-  const restored = new BridgeAuth({ expectedOrigin: EXTENSION_ORIGIN, envelope: persisted });
-
-  assert.equal(restored.authenticate({ origin: EXTENSION_ORIGIN, secret }), true);
-  assert.throws(
-    () => new BridgeAuth({ expectedOrigin: 'https://example.test' }),
-    (error) => error instanceof BridgeAuthError && error.code === 'INVALID_EXTENSION_ORIGIN'
-  );
-  assert.throws(
-    () => new BridgeAuth({ expectedOrigin: 'chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' }),
-    (error) => error instanceof BridgeAuthError && error.code === 'INVALID_EXTENSION_ORIGIN'
-  );
+test('invalid origin and protected-envelope dependencies fail closed', () => {
+  assert.throws(() => new BridgeAuth({ expectedOrigin: 'https://example.test', protect, unprotect }),
+    (error) => error instanceof BridgeAuthError && error.code === 'INVALID_EXTENSION_ORIGIN');
+  assert.throws(() => new BridgeAuth({ expectedOrigin: 'chrome-extension://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', protect, unprotect }),
+    (error) => error instanceof BridgeAuthError && error.code === 'INVALID_EXTENSION_ORIGIN');
+  assert.throws(() => new BridgeAuth(), (error) => error.code === 'SECURE_STORAGE_UNAVAILABLE');
+  assert.throws(() => new BridgeAuth({ protect, unprotect, envelope: { version: 1, algorithm: 'scrypt' } }),
+    (error) => error.code === 'INVALID_SECRET_ENVELOPE');
 });
 
 test('readJsonBody accepts a bounded JSON object and rejects malformed or oversized input', async () => {
-  assert.deepEqual(
-    await readJsonBody(Readable.from(['{"ok":true}']), { maxBytes: 64 }),
-    { ok: true }
-  );
-
-  await assert.rejects(
-    readJsonBody(Readable.from(['{"nope"']), { maxBytes: 64 }),
-    (error) => error.code === 'MALFORMED_JSON'
-  );
-  await assert.rejects(
-    readJsonBody(Readable.from(['{"value":"', 'x'.repeat(100), '"}']), { maxBytes: 32 }),
-    (error) => error.code === 'BODY_TOO_LARGE'
-  );
-  await assert.rejects(
-    readJsonBody(Readable.from(['[]']), { maxBytes: 64 }),
-    (error) => error.code === 'INVALID_JSON_BODY'
-  );
+  assert.deepEqual(await readJsonBody(Readable.from(['{"ok":true}']), { maxBytes: 64 }), { ok: true });
+  await assert.rejects(readJsonBody(Readable.from(['{"nope"']), { maxBytes: 64 }), (error) => error.code === 'MALFORMED_JSON');
+  await assert.rejects(readJsonBody(Readable.from(['{"value":"', 'x'.repeat(100), '"}']), { maxBytes: 32 }),
+    (error) => error.code === 'BODY_TOO_LARGE');
+  await assert.rejects(readJsonBody(Readable.from(['[]']), { maxBytes: 64 }), (error) => error.code === 'INVALID_JSON_BODY');
 });
 
-test('readJsonBody aborts a slow body at its deadline', async () => {
+test('readJsonBody aborts a slow body at its absolute deadline', async () => {
   const stream = new PassThrough();
   const pending = readJsonBody(stream, { maxBytes: 64, deadlineMs: 15 });
   stream.write('{');
   await assert.rejects(pending, (error) => error.code === 'BODY_DEADLINE_EXCEEDED');
 });
 
-test('request limiter rejects excess concurrent bodies before work begins', async () => {
+test('request limiter rejects excess concurrent work before it begins', async () => {
   const limiter = createRequestLimiter({ maxConcurrent: 1 });
   let release;
   const active = limiter.run(() => new Promise((resolve) => { release = resolve; }));
-  await assert.rejects(
-    limiter.run(async () => 'never'),
-    (error) => error.code === 'TOO_MANY_REQUESTS'
-  );
+  let entered = false;
+  await assert.rejects(limiter.run(async () => { entered = true; }), (error) => error.code === 'TOO_MANY_REQUESTS');
+  assert.equal(entered, false);
   release('done');
   assert.equal(await active, 'done');
   assert.equal(limiter.active, 0);
diff --git a/test/extension-contract.test.js b/test/extension-contract.test.js
index 871a2df..6c47b53 100644
--- a/test/extension-contract.test.js
+++ b/test/extension-contract.test.js
@@ -37,7 +37,7 @@ function makeElement() {
   };
 }
 
-function makePopupHarness({ paired = true, confirmCopy = false, clipboardReject = null } = {}) {
+function makePopupHarness({ paired = true, confirmCopy = false, clipboardReject = null, validServerProof = true } = {}) {
   const elements = Object.fromEntries(
     ['tabInfo', 'pairingInfo', 'sendBtn', 'copyBtn', 'statusMsg', 'copyWarning', 'confirmCopy', 'openOptionsBtn']
       .map((id) => [id, makeElement()])
@@ -66,8 +66,18 @@ function makePopupHarness({ paired = true, confirmCopy = false, clipboardReject
     documentApi,
     navigatorApi,
     confirmCopy: () => confirmCopy,
+    cryptoApi: crypto.webcrypto,
     fetchImpl: async (...args) => {
       fetchCalls.push(args);
+      if (args[0].endsWith('/challenge')) {
+        const { clientNonce } = JSON.parse(args[1].body);
+        const serverNonce = 'B'.repeat(43);
+        const canonical = JSON.stringify(['apt-server-challenge-v1', clientNonce, serverNonce]);
+        const serverProof = validServerProof
+          ? crypto.createHmac('sha256', 'A'.repeat(43)).update(canonical).digest('base64url')
+          : 'C'.repeat(43);
+        return { ok: true, json: async () => ({ success: true, serverNonce, serverProof }) };
+      }
       return { ok: true, json: async () => ({ success: true }) };
     }
   });
@@ -122,18 +132,37 @@ test('deployment detection rejects non-HTTPS, bare, and lookalike Alta hosts', (
   assert.equal(isSupportedDeploymentUrl('https://customer.avasecurity.com.evil.test/path'), false);
 });
 
-test('Send to APT uses the paired secret header and exact endpoint', async () => {
+test('Send to APT authenticates the listener before reading or sending the cookie', async () => {
   const harness = makePopupHarness({ paired: true });
   await harness.controller.init();
   await harness.controller.sendToApt();
-  assert.equal(harness.fetchCalls.length, 1);
-  const [url, request] = harness.fetchCalls[0];
+  assert.equal(harness.fetchCalls.length, 2);
+  const [challengeUrl, challengeRequest] = harness.fetchCalls[0];
+  assert.equal(challengeUrl, 'http://127.0.0.1:18247/challenge');
+  assert.equal(JSON.stringify(challengeRequest).includes('sensitive-va-token'), false);
+  assert.equal(JSON.stringify(challengeRequest).includes('A'.repeat(43)), false);
+  const [url, request] = harness.fetchCalls[1];
   assert.equal(url, 'http://127.0.0.1:18247/cookie');
-  assert.equal(request.headers['X-APT-Pairing'], 'A'.repeat(43));
-  assert.deepEqual(JSON.parse(request.body), {
-    deploymentUrl: 'https://customer.avasecurity.com',
-    cookieValue: 'sensitive-va-token'
-  });
+  assert.equal(Object.keys(request.headers).some((name) => /pairing/i.test(name)), false);
+  const body = JSON.parse(request.body);
+  assert.equal(body.deploymentUrl, 'https://customer.avasecurity.com');
+  assert.equal(body.cookieValue, 'sensitive-va-token');
+  assert.match(body.clientNonce, /^[A-Za-z0-9_-]{43}$/);
+  assert.equal(body.serverNonce, 'B'.repeat(43));
+  assert.match(body.proof, /^[A-Za-z0-9_-]{43}$/);
+  assert.equal(request.body.includes('A'.repeat(43)), false);
+});
+
+test('a port-squatting fake server with an invalid proof receives no cookie or pairing secret', async () => {
+  const harness = makePopupHarness({ paired: true, validServerProof: false });
+  await harness.controller.init();
+  await harness.controller.sendToApt();
+  assert.equal(harness.fetchCalls.length, 1);
+  assert.equal(harness.fetchCalls[0][0], 'http://127.0.0.1:18247/challenge');
+  assert.equal(harness.cookieReads, 0);
+  const network = JSON.stringify(harness.fetchCalls);
+  assert.equal(network.includes('sensitive-va-token'), false);
+  assert.equal(network.includes('A'.repeat(43)), false);
 });
 
 test('copy cancellation occurs before cookie access and never writes the token', async () => {
diff --git a/test/runtime-contract.test.js b/test/runtime-contract.test.js
index 9a98262..80ad2db 100644
--- a/test/runtime-contract.test.js
+++ b/test/runtime-contract.test.js
@@ -13,7 +13,12 @@ const {
   createBridgeHandler,
   loadPairingEnvelope,
 } = require('../src/electron-runtime');
-const { APT_EXTENSION_ORIGIN, BridgeAuth } = require('../src/bridge-auth');
+const {
+  APT_EXTENSION_ORIGIN,
+  BridgeAuth,
+  computeCookieProof,
+  createRequestLimiter,
+} = require('../src/bridge-auth');
 const { createSessionStore } = require('../src/session-store');
 
 const ROOT = path.join(__dirname, '..');
@@ -33,12 +38,11 @@ function responseHarness() {
   };
 }
 
-function requestHarness({ method = 'POST', origin = APT_EXTENSION_ORIGIN, secret, body = '{}' } = {}) {
+function requestHarness({ method = 'POST', origin = APT_EXTENSION_ORIGIN, url = '/cookie', body = '{}' } = {}) {
   const request = new PassThrough();
   request.method = method;
-  request.url = '/cookie';
+  request.url = url;
   request.headers = { origin };
-  if (secret !== undefined) request.headers['x-apt-pairing'] = secret;
   process.nextTick(() => request.end(body));
   return request;
 }
@@ -47,10 +51,19 @@ test('runtime keeps Alta credentials in main-owned modules and exposes only non-
   const sessionStore = createSessionStore();
   sessionStore.establish('https://customer.avasecurity.com', 'top-secret-cookie');
   const calls = [];
+  const tracked = [];
   const proxyManager = {
-    launchProxy(request) { calls.push(request); return { success: true, processId: 91, deviceId: request.deviceId, status: 'running' }; },
-    stopProxy(processId) { calls.push({ processId }); return { success: true, processId, status: 'stop-requested' }; },
-    listTrackedProxies() { return []; },
+    launchProxy(request) {
+      calls.push(request);
+      tracked.push({ processId: 91, deviceId: request.deviceId, status: 'running', startedAt: 1 });
+      return { success: true, processId: 91, deviceId: request.deviceId, status: 'running' };
+    },
+    stopProxy(processId) {
+      calls.push({ processId });
+      tracked.splice(0, tracked.length);
+      return { success: true, processId, status: 'stop-requested' };
+    },
+    listTrackedProxies() { return tracked.slice(); },
   };
   const runtime = new AppRuntime({
     sessionStore,
@@ -86,8 +99,10 @@ test('runtime keeps Alta credentials in main-owned modules and exposes only non-
   assert.equal((await runtime.stopProxy(999)).success, false);
 });
 
-test('bridge rejects unknown preflight and unauthenticated requests before reading their body', async () => {
-  const auth = new BridgeAuth();
+test('bridge authenticates itself before accepting a one-time HMAC cookie request', async () => {
+  const protect = (value) => Buffer.from(`protected:${value}`);
+  const unprotect = (value) => Buffer.from(value).toString().slice('protected:'.length);
+  const auth = new BridgeAuth({ protect, unprotect });
   const secret = auth.rotate().secret;
   const sessionStore = createSessionStore();
   let stateNotifications = 0;
@@ -103,44 +118,72 @@ test('bridge rejects unknown preflight and unauthenticated requests before readi
   assert.equal(unknownResponse.statusCode, 403);
   assert.equal(unknownResponse.headers['access-control-allow-origin'], undefined);
 
-  const unauthenticated = requestHarness({ body: '{'.repeat(1000) });
-  let dataRead = false;
-  unauthenticated.on('data', () => { dataRead = true; });
-  const unauthenticatedResponse = responseHarness();
-  await handler(unauthenticated, unauthenticatedResponse);
-  assert.equal(unauthenticatedResponse.statusCode, 403);
-  assert.equal(dataRead, false);
-
-  const allowedPreflight = requestHarness({ method: 'OPTIONS', secret });
+  const allowedPreflight = requestHarness({ method: 'OPTIONS' });
   const allowedResponse = responseHarness();
   await handler(allowedPreflight, allowedResponse);
   assert.equal(allowedResponse.statusCode, 204);
   assert.equal(allowedResponse.headers['access-control-allow-origin'], APT_EXTENSION_ORIGIN);
-  assert.match(allowedResponse.headers['access-control-allow-headers'], /X-APT-Pairing/);
+  assert.doesNotMatch(allowedResponse.headers['access-control-allow-headers'], /X-APT-Pairing/i);
 
-  const accepted = requestHarness({
-    secret,
-    body: JSON.stringify({ deploymentUrl: 'https://customer.avasecurity.com', cookieValue: 'valid-cookie' }),
-  });
+  const clientNonce = Buffer.alloc(32, 3).toString('base64url');
+  const challengeResponse = responseHarness();
+  await handler(requestHarness({ url: '/challenge', body: JSON.stringify({ clientNonce }) }), challengeResponse);
+  assert.equal(challengeResponse.statusCode, 200);
+  const challenge = JSON.parse(challengeResponse.body);
+  assert.equal(JSON.stringify(challenge).includes(secret), false);
+
+  const cookieBody = {
+    clientNonce,
+    serverNonce: challenge.serverNonce,
+    deploymentUrl: 'https://customer.avasecurity.com',
+    cookieValue: 'valid-cookie',
+  };
+  cookieBody.proof = computeCookieProof(secret, cookieBody);
   const acceptedResponse = responseHarness();
-  await handler(accepted, acceptedResponse);
+  await handler(requestHarness({ body: JSON.stringify(cookieBody) }), acceptedResponse);
   assert.equal(acceptedResponse.statusCode, 200);
   assert.deepEqual(sessionStore.describe(), { connected: true, origin: 'https://customer.avasecurity.com' });
   assert.equal(stateNotifications, 1);
   assert.equal(acceptedResponse.body.includes('valid-cookie'), false);
+
+  const replayResponse = responseHarness();
+  await handler(requestHarness({ body: JSON.stringify(cookieBody) }), replayResponse);
+  assert.equal(replayResponse.statusCode, 403);
 });
 
-test('pairing envelope persists with restrictive permissions and secrets are returned once', () => {
+test('bridge limiter encloses body reads and HMAC authentication under forged floods', async () => {
+  const auth = new BridgeAuth({ protect: (value) => Buffer.from(value), unprotect: (value) => Buffer.from(value).toString() });
+  auth.rotate();
+  const limiter = createRequestLimiter({ maxConcurrent: 1 });
+  const handler = createBridgeHandler({ bridgeAuth: auth, sessionStore: createSessionStore(), limiter, deadlineMs: 50 });
+  const held = new PassThrough();
+  held.method = 'POST';
+  held.url = '/challenge';
+  held.headers = { origin: APT_EXTENSION_ORIGIN };
+  const first = handler(held, responseHarness());
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(limiter.active, 1);
+  const rejected = responseHarness();
+  await handler(requestHarness({ url: '/challenge', body: JSON.stringify({ clientNonce: 'A'.repeat(43) }) }), rejected);
+  assert.equal(rejected.statusCode, 429);
+  held.end('{}');
+  await first;
+});
+
+test('pairing envelope persists encrypted with restrictive permissions and secrets are returned once', () => {
   const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-pairing-'));
   const envelopePath = path.join(directory, 'bridge-pairing.json');
-  const controller = new PairingController({ envelopePath });
+  const protect = (value) => Buffer.from(`dpapi:${value}`);
+  const unprotect = (value) => Buffer.from(value).toString().slice('dpapi:'.length);
+  const controller = new PairingController({ envelopePath, protect, unprotect });
 
   const first = controller.initialize();
   assert.equal(first.paired, true);
   assert.match(first.secret, /^[A-Za-z0-9_-]{43}$/);
   assert.deepEqual(controller.getStatus(), { paired: true });
-  const persisted = loadPairingEnvelope(envelopePath);
+  const persisted = loadPairingEnvelope(envelopePath, { protect, unprotect });
   assert.equal(Object.values(persisted).includes(first.secret), false);
+  assert.equal(fs.readFileSync(envelopePath, 'utf8').includes(first.secret), false);
   if (process.platform !== 'win32') assert.equal(fs.statSync(envelopePath).mode & 0o777, 0o600);
 
   const rotated = controller.rotate();
@@ -152,6 +195,84 @@ test('pairing envelope persists with restrictive permissions and secrets are ret
   assert.equal(fs.existsSync(envelopePath), false);
 });
 
+test('pairing fails closed and reports unavailable without secure storage', () => {
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-pairing-unavailable-'));
+  const controller = new PairingController({ envelopePath: path.join(directory, 'bridge-pairing.json') });
+  assert.deepEqual(controller.initialize(), { paired: false, unavailable: true });
+  assert.deepEqual(controller.getStatus(), { paired: false, unavailable: true });
+  assert.throws(() => controller.rotate(), (error) => error.code === 'SECURE_STORAGE_UNAVAILABLE');
+});
+
+test('runtime reconciles exited children and permits relaunch for the same device', async () => {
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'synthetic-cookie');
+  const deviceId = '550e8400-e29b-41d4-a716-446655440000';
+  const tracked = [];
+  let nextPid = 4101;
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: { getDevices: async () => [{ guid: deviceId }] },
+    proxyManager: {
+      launchProxy() {
+        const entry = { processId: nextPid++, deviceId, status: 'running', startedAt: 1 };
+        tracked.push(entry);
+        return { success: true, ...entry };
+      },
+      stopProxy() { throw new Error('unused'); },
+      listTrackedProxies() { return tracked.slice(); },
+    },
+  });
+  await runtime.getDevices();
+  assert.equal((await runtime.launchProxy(deviceId)).processId, 4101);
+  tracked.length = 0;
+  assert.deepEqual(runtime.getConnectionState().activeProxies, []);
+  assert.equal((await runtime.launchProxy(deviceId)).processId, 4102);
+});
+
+test('disconnect stops every owned proxy before clearing the Alta session', async () => {
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'synthetic-cookie');
+  const tracked = [
+    { processId: 4101, deviceId: '550e8400-e29b-41d4-a716-446655440000', status: 'running', startedAt: 1 },
+    { processId: 4102, deviceId: '550e8400-e29b-41d4-a716-446655440001', status: 'running', startedAt: 1 },
+  ];
+  const stopped = [];
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: {},
+    proxyManager: {
+      listTrackedProxies() { return tracked.slice(); },
+      stopProxy(processId) {
+        stopped.push(processId);
+        tracked.splice(tracked.findIndex((entry) => entry.processId === processId), 1);
+        return { success: true, processId, status: 'stop-requested' };
+      },
+    },
+  });
+  const state = runtime.disconnect();
+  assert.deepEqual(stopped, [4101, 4102]);
+  assert.equal(state.connected, false);
+  assert.deepEqual(state.activeProxies, []);
+});
+
+test('disconnect reports failure truthfully and retains session when an owned proxy cannot stop', () => {
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'synthetic-cookie');
+  const tracked = [{ processId: 4101, deviceId: '550e8400-e29b-41d4-a716-446655440000', status: 'running', startedAt: 1 }];
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: {},
+    proxyManager: {
+      listTrackedProxies() { return tracked.slice(); },
+      stopProxy() { return { success: false, processId: 4101, status: 'permission-denied' }; },
+    },
+  });
+  const state = runtime.disconnect();
+  assert.equal(state.success, false);
+  assert.equal(state.connected, true);
+  assert.deepEqual(state.activeProxies.map((entry) => entry.processId), [4101]);
+});
+
 test('update runtime is check-only and opens only the fixed GitPeji releases page', async () => {
   const opened = [];
   const runtime = new AppRuntime({
diff --git a/test/update-policy.test.js b/test/update-policy.test.js
index 626ce3f..956f61c 100644
--- a/test/update-policy.test.js
+++ b/test/update-policy.test.js
@@ -2,6 +2,7 @@
 
 const assert = require('node:assert/strict');
 const test = require('node:test');
+const { EventEmitter } = require('node:events');
 
 const {
   LATEST_RELEASE_URL,
@@ -9,6 +10,7 @@ const {
   MAX_BODY_BYTES,
   checkForUpdate,
   compareSemver,
+  defaultRequest,
 } = require('../src/update-policy');
 
 function response(body, overrides = {}) {
@@ -188,3 +190,35 @@ test('unexpected HTTP and content types fail closed', async () => {
     'INVALID_CONTENT_TYPE',
   );
 });
+
+test('default transport enforces an absolute deadline despite trickled response bytes', async () => {
+  const request = new EventEmitter();
+  const responseStream = new EventEmitter();
+  request.destroyedWith = null;
+  responseStream.destroyed = false;
+  request.destroy = (error) => { request.destroyedWith = error; request.emit('error', error); };
+  request.setTimeout = () => { throw new Error('inactivity timeout must not be used'); };
+  responseStream.destroy = () => { responseStream.destroyed = true; };
+  responseStream.headers = { 'content-type': 'application/json' };
+  responseStream.statusCode = 200;
+  let deadline;
+  let cleared = false;
+  const pending = defaultRequest({
+    url: LATEST_RELEASE_URL,
+    timeoutMs: 5000,
+    maxBodyBytes: MAX_BODY_BYTES,
+    httpsGet: (_url, _options, onResponse) => {
+      onResponse(responseStream);
+      return request;
+    },
+    setTimer: (callback, milliseconds) => { assert.equal(milliseconds, 5000); deadline = callback; return 7; },
+    clearTimer: (timer) => { assert.equal(timer, 7); cleared = true; },
+  });
+  responseStream.emit('data', Buffer.from('{'));
+  responseStream.emit('data', Buffer.from(' '));
+  deadline();
+  await rejectsWithCode(pending, 'REQUEST_TIMEOUT');
+  assert.equal(responseStream.destroyed, true);
+  assert.equal(request.destroyedWith.code, 'REQUEST_TIMEOUT');
+  assert.equal(cleared, true);
+});

From 08498653eb6297ce425eee9640bc3abd2b5f4fd2 Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Wed, 19 Aug 2026 21:45:20 +0000
Subject: [PATCH 08/22] chore: modernize APT runtime and CI

---
 .gitea/workflows/ci.yml     |   36 +
 README.md                   |    7 +-
 package-lock.json           | 3444 ++++++++---------------------------
 package.json                |   36 +-
 scripts/verify-kit.js       |  224 +++
 test/build-contract.test.js |   97 +
 6 files changed, 1192 insertions(+), 2652 deletions(-)
 create mode 100644 .gitea/workflows/ci.yml
 create mode 100644 scripts/verify-kit.js
 create mode 100644 test/build-contract.test.js

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..25146e0
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,36 @@
+name: APT build checks
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  build-checks:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+
+      - name: Install locked dependencies
+        run: npm ci
+
+      - name: Run source policy and tests
+        run: npm run check
+
+      - name: Audit production dependencies
+        run: npm run audit:prod
+
+      - name: Build unpacked Windows application
+        run: npm run build-test
+
+      - name: Verify unpacked build and extension policy
+        run: node scripts/verify-kit.js --build dist/win-unpacked
diff --git a/README.md b/README.md
index 6fdd720..3e06161 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ APT is a Windows Electron desktop app that imports an existing Alta Video sessio
 ## Requirements
 
 - Windows (current supported runtime scope)
-- Node.js and npm for development
+- Node.js 22.12 or newer and npm for development
 - Chrome with the bundled extension loaded unpacked
 - `aware-cam-proxy.exe` beside the development app or packaged portable executable
 - An active Alta Video login in Chrome
@@ -39,6 +39,7 @@ Use **Generate / Rotate** if a pairing may have been exposed, then update the ex
 ```bash
 npm test          # Node test suite, including synthetic runtime contracts
 npm run check     # Syntax checks plus tests
+npm run audit:prod
 npm run build-test
 ```
 
@@ -62,4 +63,6 @@ Core files:
 npm run build
 ```
 
-The output remains Windows-only because the external camera helper is Windows-specific. Copy `aware-cam-proxy.exe` beside the portable APT executable before use. Dependencies are intentionally unchanged in this hardening release.
+The output remains Windows-only because the external camera helper is Windows-specific. Copy `aware-cam-proxy.exe` beside the portable APT executable before use.
+
+CI produces an unpacked Windows build only for verification. It does not publish, release, push, deploy, or sign artifacts. Windows code signing and verification with the approved certificate remain mandatory manual release gates; a successful build must not be represented as signed.
diff --git a/package-lock.json b/package-lock.json
index 3850785..d199b5c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,39 +1,29 @@
 {
   "name": "alta-api-client",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "alta-api-client",
-      "version": "1.0.0",
+      "version": "1.1.0",
       "license": "MIT",
       "dependencies": {
-        "axios": "^1.6.0",
-        "crypto-js": "^4.2.0"
+        "axios": "1.19.0"
       },
       "devDependencies": {
-        "electron": "^28.0.0",
-        "electron-builder": "^26.4.0",
-        "electron-packager": "^17.1.2"
+        "electron": "43.4.1",
+        "electron-builder": "26.15.3"
       }
     },
-    "node_modules/@develar/schema-utils": {
-      "version": "2.6.5",
-      "resolved": "https://registry.npmjs.org/@develar/schema-utils/-/schema-utils-2.6.5.tgz",
-      "integrity": "sha512-0cp4PsWQ/9avqTVMCtZ+GirikIA36ikvjtHweU4/j8yLtgObI0+JUPhYFScgwlteveGB1rt3Cm8UhN04XayDig==",
+    "node_modules/@electron-internal/extract-zip": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/@electron-internal/extract-zip/-/extract-zip-1.0.5.tgz",
+      "integrity": "sha512-+bqFCP98pLI0Tt0XQo1TmlXtwjWchISndDOxCkEcIuUgXWpBnLyRI+2DU+mesvnMMX6L1XDqYNA0lXNDHd/yiA==",
       "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ajv": "^6.12.0",
-        "ajv-keywords": "^3.4.1"
-      },
+      "license": "BSD-2-Clause",
       "engines": {
-        "node": ">= 8.9.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/webpack"
+        "node": ">=22.12.0"
       }
     },
     "node_modules/@electron/asar": {
@@ -55,9 +45,9 @@
       }
     },
     "node_modules/@electron/asar/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -99,9 +89,9 @@
       }
     },
     "node_modules/@electron/fuses/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -121,28 +111,6 @@
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/@electron/get": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@electron/get/-/get-2.0.3.tgz",
-      "integrity": "sha512-Qkzpg2s9GnVV2I2BjRksUi43U5e6+zaQMcjoJy0C+C5oxaKl+fmckGDQFtRpZpZV0NQekuZZ+tGz7EA9TVnQtQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.1.1",
-        "env-paths": "^2.2.0",
-        "fs-extra": "^8.1.0",
-        "got": "^11.8.5",
-        "progress": "^2.0.3",
-        "semver": "^6.2.0",
-        "sumchecker": "^3.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "optionalDependencies": {
-        "global-agent": "^3.0.0"
-      }
-    },
     "node_modules/@electron/notarize": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/@electron/notarize/-/notarize-2.5.0.tgz",
@@ -175,9 +143,9 @@
       }
     },
     "node_modules/@electron/notarize/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -271,26 +239,18 @@
       }
     },
     "node_modules/@electron/rebuild": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@electron/rebuild/-/rebuild-4.0.1.tgz",
-      "integrity": "sha512-iMGXb6Ib7H/Q3v+BKZJoETgF9g6KMNZVbsO4b7Dmpgb5qTFqyFTzqW9F3TOSHdybv2vKYKzSS9OiZL+dcJb+1Q==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/@electron/rebuild/-/rebuild-4.2.0.tgz",
+      "integrity": "sha512-RKL/O+jGoXJMxrx/5771y1n0xTKmFuOYGO3gMmwypBM6rsH0kou0mswwdXA2JrhIkE4xyC7v9vGk0n6NPzgOxQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@malept/cross-spawn-promise": "^2.0.0",
-        "chalk": "^4.0.0",
         "debug": "^4.1.1",
-        "detect-libc": "^2.0.1",
-        "got": "^11.7.0",
-        "graceful-fs": "^4.2.11",
         "node-abi": "^4.2.0",
         "node-api-version": "^0.2.1",
-        "node-gyp": "^11.2.0",
-        "ora": "^5.1.0",
-        "read-binary-file-arch": "^1.0.6",
-        "semver": "^7.3.5",
-        "tar": "^6.0.5",
-        "yargs": "^17.0.1"
+        "node-gyp": "^12.2.0",
+        "read-binary-file-arch": "^1.0.6"
       },
       "bin": {
         "electron-rebuild": "lib/cli.js"
@@ -299,19 +259,6 @@
         "node": ">=22.12.0"
       }
     },
-    "node_modules/@electron/rebuild/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/@electron/universal": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/@electron/universal/-/universal-2.0.3.tgz",
@@ -332,9 +279,9 @@
       }
     },
     "node_modules/@electron/universal/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -342,9 +289,9 @@
       }
     },
     "node_modules/@electron/universal/node_modules/fs-extra": {
-      "version": "11.3.3",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.3.tgz",
-      "integrity": "sha512-VWSRii4t0AFm6ixFFmLLx1t7wS1gh+ckoa84aOeapGum0h+EZd1EhEumSB+ZdDLnEPuucsVB9oB7cxJHap6Afg==",
+      "version": "11.4.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.4.0.tgz",
+      "integrity": "sha512-EQsFzMUJkCKGr1ePqlYADkIUmHW1s3ZXr5Yqy6wbGrfUCphpl2maM/kyOIRA2HpP3AaFQTZXD4ldjek+nccddA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -357,9 +304,9 @@
       }
     },
     "node_modules/@electron/universal/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -370,13 +317,13 @@
       }
     },
     "node_modules/@electron/universal/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^2.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -402,6 +349,7 @@
       "dev": true,
       "license": "BSD-2-Clause",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "cross-dirname": "^0.1.0",
         "debug": "^4.3.4",
@@ -417,12 +365,13 @@
       }
     },
     "node_modules/@electron/windows-sign/node_modules/fs-extra": {
-      "version": "11.3.3",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.3.tgz",
-      "integrity": "sha512-VWSRii4t0AFm6ixFFmLLx1t7wS1gh+ckoa84aOeapGum0h+EZd1EhEumSB+ZdDLnEPuucsVB9oB7cxJHap6Afg==",
+      "version": "11.4.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.4.0.tgz",
+      "integrity": "sha512-EQsFzMUJkCKGr1ePqlYADkIUmHW1s3ZXr5Yqy6wbGrfUCphpl2maM/kyOIRA2HpP3AaFQTZXD4ldjek+nccddA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "graceful-fs": "^4.2.0",
         "jsonfile": "^6.0.1",
@@ -433,12 +382,13 @@
       }
     },
     "node_modules/@electron/windows-sign/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "universalify": "^2.0.0"
       },
@@ -453,136 +403,11 @@
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "engines": {
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/@isaacs/balanced-match": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@isaacs/balanced-match/-/balanced-match-4.0.1.tgz",
-      "integrity": "sha512-yzMTt9lEb8Gv7zRioUilSglI0c0smZ9k5D65677DLWLtWJaXIS3CqcGyUFByYKlnUj6TkjLVs54fBl6+TiGQDQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
-    "node_modules/@isaacs/brace-expansion": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/@isaacs/brace-expansion/-/brace-expansion-5.0.0.tgz",
-      "integrity": "sha512-ZT55BDLV0yv0RBm2czMiZ+SqCGO7AvmOM3G/w2xhVPH+te0aKgFjmBvGlL1dH+ql2tgGO3MVrbb3jCKyvpgnxA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@isaacs/balanced-match": "^4.0.1"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      }
-    },
-    "node_modules/@isaacs/cliui": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
-      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "string-width": "^5.1.2",
-        "string-width-cjs": "npm:string-width@^4.2.0",
-        "strip-ansi": "^7.0.1",
-        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
-        "wrap-ansi": "^8.1.0",
-        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/ansi-regex": {
-      "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/ansi-styles": {
-      "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/emoji-regex": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@isaacs/cliui/node_modules/string-width": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "eastasianwidth": "^0.2.0",
-        "emoji-regex": "^9.2.2",
-        "strip-ansi": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/strip-ansi": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
-      "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
-      }
-    },
-    "node_modules/@isaacs/cliui/node_modules/wrap-ansi": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
-      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^6.1.0",
-        "string-width": "^5.0.1",
-        "strip-ansi": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
     "node_modules/@isaacs/fs-minipass": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
@@ -652,9 +477,9 @@
       }
     },
     "node_modules/@malept/flatpak-bundler/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -674,65 +499,69 @@
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/@npmcli/agent": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/agent/-/agent-3.0.0.tgz",
-      "integrity": "sha512-S79NdEgDQd/NGCay6TCoVzXSj74skRZIKJcpJjC5lOq34SZzyI6MqtiiWoiVWoVrTcGjNeC4ipbh1VIHlpfF5Q==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "agent-base": "^7.1.0",
-        "http-proxy-agent": "^7.0.0",
-        "https-proxy-agent": "^7.0.1",
-        "lru-cache": "^10.0.1",
-        "socks-proxy-agent": "^8.0.3"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
-    "node_modules/@npmcli/agent/node_modules/lru-cache": {
-      "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/@npmcli/fs": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-4.0.0.tgz",
-      "integrity": "sha512-/xGlezI6xfGO9NwuJlnwz/K14qD1kCSAGtacBHnGzeAIuJGazcp45KP5NuyARXoKb7cwulAGWVsbeSxdG/cb0Q==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "semver": "^7.3.5"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
-    "node_modules/@npmcli/fs/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/@pkgjs/parseargs": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
-      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
+    "node_modules/@noble/hashes": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.3.0.tgz",
+      "integrity": "sha512-oN+QwyX7VSHotibwubG3kpzbwKrfnyR6OOO+3Nk/53ADL7FmgHHz4TgrbaYKvvOw09u6QTx0oiH1cNCIOuN0CQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
-        "node": ">=14"
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@peculiar/asn1-schema": {
+      "version": "2.9.3",
+      "resolved": "https://registry.npmjs.org/@peculiar/asn1-schema/-/asn1-schema-2.9.3.tgz",
+      "integrity": "sha512-SOux4+jikCnOwoJvpBp/grOqzFmJPnNSwe3sAg1Bn93YdmCiDtvolZifJIhiRq0UWMTnLRPj9/ZCMAc2W9VsMQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/utils": "^2.0.2",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/json-schema": {
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/@peculiar/json-schema/-/json-schema-1.1.12.tgz",
+      "integrity": "sha512-coUfuoMeIB7B8/NMekxaDzLhaYmp0HZNPEjYRm9goRou8UZIC3z21s0sL9AWoCw4EG876QyO3kYrc61WNF9B/w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/@peculiar/utils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@peculiar/utils/-/utils-2.0.3.tgz",
+      "integrity": "sha512-+oL3HPFRIZ1St2K50lWCXiioIgSoxzz7R1J3uF6neO2yl1sgmpgY6XXJH4BdpoDkMWznQTeYF6oWNDZLCdQ4eQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/@peculiar/webcrypto": {
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/@peculiar/webcrypto/-/webcrypto-1.7.1.tgz",
+      "integrity": "sha512-ODOov0sGMJMf3jPonOkgGqPknTsu+DdQ7kD++gz8aI+aFMOMHFbWAA2taqXXVTdP+OTOQR/znGvSpmkeI0WTYQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@peculiar/asn1-schema": "^2.7.0",
+        "@peculiar/json-schema": "^1.1.12",
+        "@peculiar/utils": "^2.0.2",
+        "tslib": "^2.8.1",
+        "webcrypto-core": "^1.9.2"
+      },
+      "engines": {
+        "node": ">=14.18.0"
       }
     },
     "node_modules/@sindresorhus/is": {
@@ -775,9 +604,9 @@
       }
     },
     "node_modules/@types/debug": {
-      "version": "4.1.12",
-      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.12.tgz",
-      "integrity": "sha512-vIChWdVG3LG1SMxEvI/AK+FWJthlrqlTu7fbrlywTkkaONwk/UAGaULXRlf8vkzFBLVm0zkMdCquhL5aOjhXPQ==",
+      "version": "4.1.13",
+      "resolved": "https://registry.npmjs.org/@types/debug/-/debug-4.1.13.tgz",
+      "integrity": "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -819,25 +648,13 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "18.19.130",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.130.tgz",
-      "integrity": "sha512-GRaXQx6jGfL8sKfaIDD6OupbIHBr9jv7Jnaml9tB7l4v068PAOXqfcujMMo5PhbIs6ggR1XODELqahT2R8v0fg==",
+      "version": "24.13.3",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",
+      "integrity": "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~5.26.4"
-      }
-    },
-    "node_modules/@types/plist": {
-      "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/@types/plist/-/plist-3.0.5.tgz",
-      "integrity": "sha512-E6OCaRmAe4WDmWNsL/9RMqdkkzDCY1etutkflWk4c+AcjDU07Pcz1fQwTX0TQz+Pxqn9i4L1TU3UFpjnrcDgxA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@types/node": "*",
-        "xmlbuilder": ">=11.0.1"
+        "undici-types": "~7.18.0"
       }
     },
     "node_modules/@types/responselike": {
@@ -850,50 +667,24 @@
         "@types/node": "*"
       }
     },
-    "node_modules/@types/verror": {
-      "version": "1.10.11",
-      "resolved": "https://registry.npmjs.org/@types/verror/-/verror-1.10.11.tgz",
-      "integrity": "sha512-RlDm9K7+o5stv0Co8i8ZRGxDbrTxhJtgjqjFyVh/tXQyl/rYtTKlnTvZ88oSTeYREWurwx20Js4kTuKCsFkUtg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/@types/yauzl": {
-      "version": "2.10.3",
-      "resolved": "https://registry.npmjs.org/@types/yauzl/-/yauzl-2.10.3.tgz",
-      "integrity": "sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@types/node": "*"
-      }
-    },
     "node_modules/@xmldom/xmldom": {
-      "version": "0.8.11",
-      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.11.tgz",
-      "integrity": "sha512-cQzWCtO6C8TQiYl1ruKNn2U6Ao4o4WBBcbL61yJl84x+j5sOWWFU9X7DpND8XZG3daDppSsigMdfAIl2upQBRw==",
+      "version": "0.8.14",
+      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.14.tgz",
+      "integrity": "sha512-T4EDRUBVZYRldYApjEJiU0e1stYWaRAX7CuSnKzrpwdZKo53zGV8/pqfzV6FfwNl9YThD2OumQYvqtvjvgG7aQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
       }
     },
-    "node_modules/7zip-bin": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/7zip-bin/-/7zip-bin-5.2.0.tgz",
-      "integrity": "sha512-ukTPVhqG4jNzMro2qA9HSCSSVJN3aN7tlb+hfqYCt3ER0yWroeA2VR38MNrOHLQ/cVj+DaIMad0kFCtWWowh/A==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/abbrev": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-3.0.1.tgz",
-      "integrity": "sha512-AO2ac6pjRB3SJmGJo+v5/aK6Omggp6fsLrs6wN9bd35ulu4cCwaAU9+7ZhXjeqHVkaHThLuzH0nZr0YpCDhygg==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-4.0.0.tgz",
+      "integrity": "sha512-a1wflyaL0tHtJSmLSOVybYhy22vRih4eduhhrkcjgrWGnRfrZtovJ2FRjxuTtkkj47O/baf0R86QU5OuYpz8fA==",
       "dev": true,
       "license": "ISC",
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
     "node_modules/agent-base": {
@@ -907,33 +698,22 @@
       }
     },
     "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "fast-deep-equal": "^3.1.1",
-        "fast-json-stable-stringify": "^2.0.0",
-        "json-schema-traverse": "^0.4.1",
-        "uri-js": "^4.2.2"
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
       },
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/epoberezkin"
       }
     },
-    "node_modules/ajv-keywords": {
-      "version": "3.5.2",
-      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-3.5.2.tgz",
-      "integrity": "sha512-5p6WTN0DdTGVQk6VjcEju19IgaHudalcfabD7yhDGeA6bcQnmL+CpveLJq/3hvfwd1aof6L386Ougkx6RfyMIQ==",
-      "dev": true,
-      "license": "MIT",
-      "peerDependencies": {
-        "ajv": "^6.9.1"
-      }
-    },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
@@ -960,39 +740,36 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
-    "node_modules/app-builder-bin": {
-      "version": "5.0.0-alpha.12",
-      "resolved": "https://registry.npmjs.org/app-builder-bin/-/app-builder-bin-5.0.0-alpha.12.tgz",
-      "integrity": "sha512-j87o0j6LqPL3QRr8yid6c+Tt5gC7xNfYo6uQIQkorAC6MpeayVMZrEDzKmJJ/Hlv7EnOQpaRm53k6ktDYZyB6w==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/app-builder-lib": {
-      "version": "26.4.0",
-      "resolved": "https://registry.npmjs.org/app-builder-lib/-/app-builder-lib-26.4.0.tgz",
-      "integrity": "sha512-Uas6hNe99KzP3xPWxh5LGlH8kWIVjZixzmMJHNB9+6hPyDpjc7NQMkVgi16rQDdpCFy22ZU5sp8ow7tvjeMgYQ==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/app-builder-lib/-/app-builder-lib-26.15.3.tgz",
+      "integrity": "sha512-2VnyWkqsP5v5XbBhL3tD5Syx8iNPBYsoU7kY4S2fz7wg8Rj/nztWKCUzGKaFRTv0Xwf3/H058CR1Kvtd/3lRow==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@develar/schema-utils": "~2.6.5",
         "@electron/asar": "3.4.1",
         "@electron/fuses": "^1.8.0",
+        "@electron/get": "^3.0.0",
         "@electron/notarize": "2.5.0",
         "@electron/osx-sign": "1.3.3",
-        "@electron/rebuild": "4.0.1",
+        "@electron/rebuild": "^4.0.4",
         "@electron/universal": "2.0.3",
         "@malept/flatpak-bundler": "^0.4.0",
+        "@noble/hashes": "^2.2.0",
+        "@peculiar/webcrypto": "^1.7.1",
         "@types/fs-extra": "9.0.13",
+        "ajv": "^8.18.0",
+        "asn1js": "^3.0.10",
         "async-exit-hook": "^2.0.1",
-        "builder-util": "26.3.4",
-        "builder-util-runtime": "9.5.1",
+        "builder-util": "26.15.3",
+        "builder-util-runtime": "9.7.0",
         "chromium-pickle-js": "^0.2.0",
         "ci-info": "4.3.1",
         "debug": "^4.3.4",
         "dotenv": "^16.4.5",
         "dotenv-expand": "^11.0.6",
         "ejs": "^3.1.8",
-        "electron-publish": "26.3.4",
+        "electron-publish": "26.15.3",
         "fs-extra": "^10.1.0",
         "hosted-git-info": "^4.1.0",
         "isbinaryfile": "^5.0.0",
@@ -1000,21 +777,87 @@
         "js-yaml": "^4.1.0",
         "json5": "^2.2.3",
         "lazy-val": "^1.0.5",
-        "minimatch": "^10.0.3",
+        "minimatch": "^10.2.5",
+        "pkijs": "^3.4.0",
         "plist": "3.1.0",
+        "proper-lockfile": "^4.1.2",
         "resedit": "^1.7.0",
         "semver": "~7.7.3",
-        "tar": "^6.1.12",
+        "tar": "^7.5.7",
         "temp-file": "^3.4.0",
         "tiny-async-pool": "1.3.0",
+        "unzipper": "^0.12.3",
         "which": "^5.0.0"
       },
       "engines": {
         "node": ">=14.0.0"
       },
       "peerDependencies": {
-        "dmg-builder": "26.4.0",
-        "electron-builder-squirrel-windows": "26.4.0"
+        "dmg-builder": "26.15.3",
+        "electron-builder-squirrel-windows": "26.15.3"
+      }
+    },
+    "node_modules/app-builder-lib/node_modules/@electron/get": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@electron/get/-/get-3.1.0.tgz",
+      "integrity": "sha512-F+nKc0xW+kVbBRhFzaMgPy3KwmuNTYX1fx6+FxxoSnNgwYX6LD7AKBTWkU0MQ6IBoe7dz069CNkR673sPAgkCQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.1.1",
+        "env-paths": "^2.2.0",
+        "fs-extra": "^8.1.0",
+        "got": "^11.8.5",
+        "progress": "^2.0.3",
+        "semver": "^6.2.0",
+        "sumchecker": "^3.0.1"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "optionalDependencies": {
+        "global-agent": "^3.0.0"
+      }
+    },
+    "node_modules/app-builder-lib/node_modules/@electron/get/node_modules/fs-extra": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-8.1.0.tgz",
+      "integrity": "sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^4.0.0",
+        "universalify": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=6 <7 || >=8"
+      }
+    },
+    "node_modules/app-builder-lib/node_modules/@electron/get/node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/app-builder-lib/node_modules/ci-info": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.3.1.tgz",
+      "integrity": "sha512-Wdy2Igu8OcBpI2pZePZ5oWjPC38tmDVx5WKUXKwlLYkA0ozo85sLsLvkBbBn/sZaSCMFOGZJ14fvW9t5/d7kdA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/sibiraj-s"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
       }
     },
     "node_modules/app-builder-lib/node_modules/fs-extra": {
@@ -1032,10 +875,10 @@
         "node": ">=12"
       }
     },
-    "node_modules/app-builder-lib/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+    "node_modules/app-builder-lib/node_modules/fs-extra/node_modules/jsonfile": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1045,20 +888,7 @@
         "graceful-fs": "^4.1.6"
       }
     },
-    "node_modules/app-builder-lib/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/app-builder-lib/node_modules/universalify": {
+    "node_modules/app-builder-lib/node_modules/fs-extra/node_modules/universalify": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
       "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
@@ -1068,6 +898,19 @@
         "node": ">= 10.0.0"
       }
     },
+    "node_modules/app-builder-lib/node_modules/semver": {
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/argparse": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
@@ -1075,26 +918,19 @@
       "dev": true,
       "license": "Python-2.0"
     },
-    "node_modules/assert-plus": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/assert-plus/-/assert-plus-1.0.0.tgz",
-      "integrity": "sha512-NfJ4UzBCcQGLDlQq7nHxH+tv3kyZ0hHQqF5BO6J7tNJeP5do1llPr8dZ8zHonfhAu0PHAdMkSo+8o0wxg9lZWw==",
+    "node_modules/asn1js": {
+      "version": "3.0.10",
+      "resolved": "https://registry.npmjs.org/asn1js/-/asn1js-3.0.10.tgz",
+      "integrity": "sha512-S2s3aOytiKdFRdulw2qPE51MzjzVOisppcVv7jVFR+Kw0kxwvFrDcYA0h7Ndqbmj0HkMIXYWaoj7fli8kgx1eg==",
       "dev": true,
-      "license": "MIT",
-      "optional": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "pvtsutils": "^1.3.6",
+        "pvutils": "^1.1.5",
+        "tslib": "^2.8.1"
+      },
       "engines": {
-        "node": ">=0.8"
-      }
-    },
-    "node_modules/astral-regex": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/astral-regex/-/astral-regex-2.0.0.tgz",
-      "integrity": "sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">=8"
+        "node": ">=12.0.0"
       }
     },
     "node_modules/async": {
@@ -1130,25 +966,23 @@
         "node": ">= 4.0.0"
       }
     },
-    "node_modules/author-regex": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/author-regex/-/author-regex-1.0.0.tgz",
-      "integrity": "sha512-KbWgR8wOYRAPekEmMXrYYdc7BRyhn2Ftk7KWfMUnQ43hFdojWEFRxhhRUm3/OFEdPa1r0KAvTTg9YQK57xTe0g==",
+    "node_modules/aws4": {
+      "version": "1.13.2",
+      "resolved": "https://registry.npmjs.org/aws4/-/aws4-1.13.2.tgz",
+      "integrity": "sha512-lHe62zvbTB5eEABUVi/AwVh0ZKY9rMMDhmm+eeyuuUQbQ3+J+fONVQOZyj+DdrvD4BY33uYniyRJ4UJIaSKAfw==",
       "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8"
-      }
+      "license": "MIT"
     },
     "node_modules/axios": {
-      "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.2.tgz",
-      "integrity": "sha512-VPk9ebNqPcy5lRGuSlKx752IlDatOjT9paPlm8A7yOuW2Fbvp4X3JznJtT4f0GzGLLiWE9W8onz51SqLYwzGaA==",
+      "version": "1.19.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.19.0.tgz",
+      "integrity": "sha512-ht/iuYZXEjFxLH/Hkezgd7m6JKlHHXEUSneaDz8uZe1Gj5QZtCnpyDsckvAiEnT89OEbCLmnte4R4sn7P0EKFw==",
       "license": "MIT",
       "dependencies": {
-        "follow-redirects": "^1.15.6",
-        "form-data": "^4.0.4",
-        "proxy-from-env": "^1.1.0"
+        "follow-redirects": "^1.16.0",
+        "form-data": "^4.0.6",
+        "https-proxy-agent": "^5.0.1",
+        "proxy-from-env": "^2.1.0"
       }
     },
     "node_modules/balanced-match": {
@@ -1179,18 +1013,6 @@
       ],
       "license": "MIT"
     },
-    "node_modules/bl": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
-      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "buffer": "^5.5.0",
-        "inherits": "^2.0.4",
-        "readable-stream": "^3.4.0"
-      }
-    },
     "node_modules/bluebird": {
       "version": "3.7.2",
       "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
@@ -1208,9 +1030,9 @@
       "optional": true
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1218,54 +1040,6 @@
         "concat-map": "0.0.1"
       }
     },
-    "node_modules/buffer": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
-      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "base64-js": "^1.3.1",
-        "ieee754": "^1.1.13"
-      }
-    },
-    "node_modules/buffer-crc32": {
-      "version": "0.2.13",
-      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
-      "integrity": "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/buffer-equal": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/buffer-equal/-/buffer-equal-1.0.1.tgz",
-      "integrity": "sha512-QoV3ptgEaQpvVwbXdSO39iqPQTCxSF7A5U99AxbHYqUdCizL/lH2Z0A2y6nbZucxMEOtNyZfG2s6gsVugGpKkg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/buffer-from": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
@@ -1274,16 +1048,14 @@
       "license": "MIT"
     },
     "node_modules/builder-util": {
-      "version": "26.3.4",
-      "resolved": "https://registry.npmjs.org/builder-util/-/builder-util-26.3.4.tgz",
-      "integrity": "sha512-aRn88mYMktHxzdqDMF6Ayj0rKoX+ZogJ75Ck7RrIqbY/ad0HBvnS2xA4uHfzrGr5D2aLL3vU6OBEH4p0KMV2XQ==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/builder-util/-/builder-util-26.15.3.tgz",
+      "integrity": "sha512-q2hn7Mbo2nFNkVekPiHFx6Nfo3hURmES3tfBn+k5Pqxl2RkmP3QGqZUhH/q9Pch/4G05NRhPjDlVj1O8q4Txvw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/debug": "^4.1.6",
-        "7zip-bin": "~5.2.0",
-        "app-builder-bin": "5.0.0-alpha.12",
-        "builder-util-runtime": "9.5.1",
+        "builder-util-runtime": "9.7.0",
         "chalk": "^4.1.2",
         "cross-spawn": "^7.0.6",
         "debug": "^4.3.4",
@@ -1296,12 +1068,15 @@
         "stat-mode": "^1.0.0",
         "temp-file": "^3.4.0",
         "tiny-async-pool": "1.3.0"
+      },
+      "engines": {
+        "node": ">=14.0.0"
       }
     },
     "node_modules/builder-util-runtime": {
-      "version": "9.5.1",
-      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.5.1.tgz",
-      "integrity": "sha512-qt41tMfgHTllhResqM5DcnHyDIWNgzHvuY2jDcYP9iaGpkWxTUzV6GQjDeLnlR1/DtdlcsWQbA7sByMpmJFTLQ==",
+      "version": "9.7.0",
+      "resolved": "https://registry.npmjs.org/builder-util-runtime/-/builder-util-runtime-9.7.0.tgz",
+      "integrity": "sha512-g/kR520giAFYkSXTzcmF3kqQq7wi8F6N6SzeDgZrqTBN+VHdmgWOyTdD1yD7AATDId/yXLvuP34CxW46/BwCdw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1327,10 +1102,24 @@
         "node": ">=12"
       }
     },
+    "node_modules/builder-util/node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "^7.1.2",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
     "node_modules/builder-util/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1350,119 +1139,14 @@
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/cacache": {
-      "version": "19.0.1",
-      "resolved": "https://registry.npmjs.org/cacache/-/cacache-19.0.1.tgz",
-      "integrity": "sha512-hdsUxulXCi5STId78vRVYEtDAjq99ICAUktLTeTYsLoTE6Z8dS0c8pWNCxwdrk9YfJeobDZc2Y186hD/5ZQgFQ==",
+    "node_modules/bytestreamjs": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/bytestreamjs/-/bytestreamjs-2.0.1.tgz",
+      "integrity": "sha512-U1Z/ob71V/bXfVABvNr/Kumf5VyeQRBEm6Txb0PQ6S7V5GpBM3w4Cbqz/xPDicR5tN0uvDifng8C+5qECeGwyQ==",
       "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "@npmcli/fs": "^4.0.0",
-        "fs-minipass": "^3.0.0",
-        "glob": "^10.2.2",
-        "lru-cache": "^10.0.1",
-        "minipass": "^7.0.3",
-        "minipass-collect": "^2.0.1",
-        "minipass-flush": "^1.0.5",
-        "minipass-pipeline": "^1.2.4",
-        "p-map": "^7.0.2",
-        "ssri": "^12.0.0",
-        "tar": "^7.4.3",
-        "unique-filename": "^4.0.0"
-      },
+      "license": "BSD-3-Clause",
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
-    "node_modules/cacache/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
-    "node_modules/cacache/node_modules/chownr": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
-      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/cacache/node_modules/glob": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
-      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "foreground-child": "^3.1.0",
-        "jackspeak": "^3.1.2",
-        "minimatch": "^9.0.4",
-        "minipass": "^7.1.2",
-        "package-json-from-dist": "^1.0.0",
-        "path-scurry": "^1.11.1"
-      },
-      "bin": {
-        "glob": "dist/esm/bin.mjs"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/cacache/node_modules/lru-cache": {
-      "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/cacache/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/cacache/node_modules/tar": {
-      "version": "7.5.2",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.2.tgz",
-      "integrity": "sha512-7NyxrTE4Anh8km8iEy7o0QYPs+0JKBTj5ZaqHg6B39erLg0qYXN3BijtShwbsNSvQ+LN75+KV+C4QR/f6Gwnpg==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "@isaacs/fs-minipass": "^4.0.0",
-        "chownr": "^3.0.0",
-        "minipass": "^7.1.2",
-        "minizlib": "^3.1.0",
-        "yallist": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/cacache/node_modules/yallist": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
-      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=18"
+        "node": ">=6.0.0"
       }
     },
     "node_modules/cacheable-lookup": {
@@ -1525,13 +1209,13 @@
       }
     },
     "node_modules/chownr": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz",
-      "integrity": "sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
+      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "engines": {
-        "node": ">=10"
+        "node": ">=18"
       }
     },
     "node_modules/chromium-pickle-js": {
@@ -1542,9 +1226,9 @@
       "license": "MIT"
     },
     "node_modules/ci-info": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.3.1.tgz",
-      "integrity": "sha512-Wdy2Igu8OcBpI2pZePZ5oWjPC38tmDVx5WKUXKwlLYkA0ozo85sLsLvkBbBn/sZaSCMFOGZJ14fvW9t5/d7kdA==",
+      "version": "4.4.0",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.4.0.tgz",
+      "integrity": "sha512-77PSwercCZU2Fc4sX94eF8k8Pxte6JAwL4/ICZLFjJLqegs7kCuAsqqj/70NQF6TvDpgFjkubQB2FW2ZZddvQg==",
       "dev": true,
       "funding": [
         {
@@ -1557,50 +1241,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/cli-cursor": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-3.1.0.tgz",
-      "integrity": "sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "restore-cursor": "^3.1.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/cli-spinners": {
-      "version": "2.9.2",
-      "resolved": "https://registry.npmjs.org/cli-spinners/-/cli-spinners-2.9.2.tgz",
-      "integrity": "sha512-ywqV+5MmyL4E7ybXgKys4DugZbX0FC6LnwrhjuykIjnK9k8OQacQ7axGKnjDXWNhns0xot3bZI5h55H8yo9cJg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/cli-truncate": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/cli-truncate/-/cli-truncate-2.1.0.tgz",
-      "integrity": "sha512-n8fOixwDD6b/ObinzTrp1ZKFzbgvKZvuz/TvejnLn1aQfC6r52XEx85FmuC+3HI+JM7coBRXUvNqEU2PHVrHpg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "slice-ansi": "^3.0.0",
-        "string-width": "^4.2.0"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/cliui": {
       "version": "8.0.1",
       "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
@@ -1616,16 +1256,6 @@
         "node": ">=12"
       }
     },
-    "node_modules/clone": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/clone/-/clone-1.0.4.tgz",
-      "integrity": "sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8"
-      }
-    },
     "node_modules/clone-response": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/clone-response/-/clone-response-1.0.3.tgz",
@@ -1699,23 +1329,11 @@
       "license": "MIT"
     },
     "node_modules/core-util-is": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz",
-      "integrity": "sha512-3lqz5YjWTYnW6dlDa5TLaTCcShfar1e40rmcJVwCBJC6mWlFuj0eCHIElmG1g5kyuJ/GD+8Wn4FFCcz4gJPfaQ==",
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
+      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
       "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/crc": {
-      "version": "3.8.0",
-      "resolved": "https://registry.npmjs.org/crc/-/crc-3.8.0.tgz",
-      "integrity": "sha512-iX3mfgcTMIq3ZKLIsVFAbv7+Mc10kxabAGQb8HvjA1o3T1PIYprbakQ65d3I+2HGHt6nSKkM9PYjgoJO2KcFBQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "buffer": "^5.1.0"
-      }
+      "license": "MIT"
     },
     "node_modules/cross-dirname": {
       "version": "0.1.0",
@@ -1723,7 +1341,8 @@
       "integrity": "sha512-+R08/oI0nl3vfPcqftZRpytksBXDzOUveBq/NBVx0sUp1axwzPQrKinNx5yd5sxPu8j1wIy8AfnVQ+5eFdha6Q==",
       "dev": true,
       "license": "MIT",
-      "optional": true
+      "optional": true,
+      "peer": true
     },
     "node_modules/cross-spawn": {
       "version": "7.0.6",
@@ -1740,77 +1359,6 @@
         "node": ">= 8"
       }
     },
-    "node_modules/cross-spawn-windows-exe": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/cross-spawn-windows-exe/-/cross-spawn-windows-exe-1.2.0.tgz",
-      "integrity": "sha512-mkLtJJcYbDCxEG7Js6eUnUNndWjyUZwJ3H7bErmmtOYU/Zb99DyUkpamuIZE0b3bhmJyZ7D90uS6f+CGxRRjOw==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/malept"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/subscription/pkg/npm-cross-spawn-windows-exe?utm_medium=referral&utm_source=npm_fund"
-        }
-      ],
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@malept/cross-spawn-promise": "^1.1.0",
-        "is-wsl": "^2.2.0",
-        "which": "^2.0.2"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/cross-spawn-windows-exe/node_modules/@malept/cross-spawn-promise": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@malept/cross-spawn-promise/-/cross-spawn-promise-1.1.1.tgz",
-      "integrity": "sha512-RTBGWL5FWQcg9orDOCcp4LvItNzUPcyEU9bwaeJX0rJ1IQxzucC48Y0/sQLp/g6t99IQgAlGIaesJS+gTn7tVQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/malept"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/subscription/pkg/npm-.malept-cross-spawn-promise?utm_medium=referral&utm_source=npm_fund"
-        }
-      ],
-      "license": "Apache-2.0",
-      "dependencies": {
-        "cross-spawn": "^7.0.1"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/cross-spawn-windows-exe/node_modules/isexe": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/cross-spawn-windows-exe/node_modules/which": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "node-which": "bin/node-which"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
     "node_modules/cross-spawn/node_modules/isexe": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
@@ -1834,17 +1382,10 @@
         "node": ">= 8"
       }
     },
-    "node_modules/crypto-js": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/crypto-js/-/crypto-js-4.2.0.tgz",
-      "integrity": "sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==",
-      "license": "MIT"
-    },
     "node_modules/debug": {
       "version": "4.4.3",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
       "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.3"
@@ -1887,19 +1428,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/defaults": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/defaults/-/defaults-1.0.4.tgz",
-      "integrity": "sha512-eFuaLoy/Rxalv2kr+lqMlUnrDWV+3j4pljOIJgLIhI058IQfWJ7vXhyEIHu+HtC738klGALYxOKDO0bQP3tg8A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "clone": "^1.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/defer-to-connect": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/defer-to-connect/-/defer-to-connect-2.0.1.tgz",
@@ -1957,16 +1485,6 @@
         "node": ">=0.4.0"
       }
     },
-    "node_modules/detect-libc": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
-      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/detect-node": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/detect-node/-/detect-node-2.1.0.tgz",
@@ -1987,9 +1505,9 @@
       }
     },
     "node_modules/dir-compare/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -2000,21 +1518,16 @@
       }
     },
     "node_modules/dmg-builder": {
-      "version": "26.4.0",
-      "resolved": "https://registry.npmjs.org/dmg-builder/-/dmg-builder-26.4.0.tgz",
-      "integrity": "sha512-ce4Ogns4VMeisIuCSK0C62umG0lFy012jd8LMZ6w/veHUeX4fqfDrGe+HTWALAEwK6JwKP+dhPvizhArSOsFbg==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/dmg-builder/-/dmg-builder-26.15.3.tgz",
+      "integrity": "sha512-O3zJUFUYHJKgzPqioHxfxzBzlSC1eXCSr79gMSBKBP5AgjjpmrydMsMLotEg9fAJF36vdUncb+4ndRNxoPdlSQ==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "app-builder-lib": "26.4.0",
-        "builder-util": "26.3.4",
+        "app-builder-lib": "26.15.3",
+        "builder-util": "26.15.3",
         "fs-extra": "^10.1.0",
-        "iconv-lite": "^0.6.2",
         "js-yaml": "^4.1.0"
-      },
-      "optionalDependencies": {
-        "dmg-license": "^1.0.11"
       }
     },
     "node_modules/dmg-builder/node_modules/fs-extra": {
@@ -2033,9 +1546,9 @@
       }
     },
     "node_modules/dmg-builder/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2055,33 +1568,6 @@
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/dmg-license": {
-      "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/dmg-license/-/dmg-license-1.0.11.tgz",
-      "integrity": "sha512-ZdzmqwKmECOWJpqefloC5OJy1+WZBBse5+MR88z9g9Zn4VY+WYUkAyojmhzJckH5YbbZGcYIuGAkY5/Ys5OM2Q==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "dependencies": {
-        "@types/plist": "^3.0.1",
-        "@types/verror": "^1.10.3",
-        "ajv": "^6.10.0",
-        "crc": "^3.8.0",
-        "iconv-corefoundation": "^1.1.7",
-        "plist": "^3.0.4",
-        "smart-buffer": "^4.0.2",
-        "verror": "^1.10.0"
-      },
-      "bin": {
-        "dmg-license": "bin/dmg-license.js"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/dotenv": {
       "version": "16.6.1",
       "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
@@ -2125,12 +1611,15 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/eastasianwidth": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
-      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
+    "node_modules/duplexer2": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/duplexer2/-/duplexer2-0.1.4.tgz",
+      "integrity": "sha512-asLFVfWWtJ90ZyOUHMqk7/S2w2guQKxUI2itj3d92ADHhxUSbCMGi1f1cBcJ7xM1To+pE/Khbwo1yuNbMEPKeA==",
       "dev": true,
-      "license": "MIT"
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "readable-stream": "^2.0.2"
+      }
     },
     "node_modules/ejs": {
       "version": "3.1.10",
@@ -2149,37 +1638,37 @@
       }
     },
     "node_modules/electron": {
-      "version": "28.3.3",
-      "resolved": "https://registry.npmjs.org/electron/-/electron-28.3.3.tgz",
-      "integrity": "sha512-ObKMLSPNhomtCOBAxFS8P2DW/4umkh72ouZUlUKzXGtYuPzgr1SYhskhFWgzAsPtUzhL2CzyV2sfbHcEW4CXqw==",
+      "version": "43.4.1",
+      "resolved": "https://registry.npmjs.org/electron/-/electron-43.4.1.tgz",
+      "integrity": "sha512-5b+EuiwkgG5iRcsEL34rimgRpkYp15SsfZOa0pC5kXs0Tb82TH4n95rpQzTZa7yRCbA7tm0WoEbuBL6NaAhAcA==",
       "dev": true,
-      "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
-        "@electron/get": "^2.0.0",
-        "@types/node": "^18.11.18",
-        "extract-zip": "^2.0.1"
+        "@electron-internal/extract-zip": "^1.0.1",
+        "@electron/get": "^5.0.0",
+        "@types/node": "^24.9.0"
       },
       "bin": {
-        "electron": "cli.js"
+        "electron": "cli.js",
+        "install-electron": "install.js"
       },
       "engines": {
-        "node": ">= 12.20.55"
+        "node": ">= 22.12.0"
       }
     },
     "node_modules/electron-builder": {
-      "version": "26.4.0",
-      "resolved": "https://registry.npmjs.org/electron-builder/-/electron-builder-26.4.0.tgz",
-      "integrity": "sha512-FCUqvdq2AULL+Db2SUGgjOYTbrgkPxZtCjqIZGnjH9p29pTWyesQqBIfvQBKa6ewqde87aWl49n/WyI/NyUBog==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/electron-builder/-/electron-builder-26.15.3.tgz",
+      "integrity": "sha512-a1KM5heqS3gQCZzizXEI8RjJy3QVogULPdeSknt76uLDpBIW/HDGsMg/XgP0riP6PI9COsRvFITKKGDqA8fJxA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "app-builder-lib": "26.4.0",
-        "builder-util": "26.3.4",
-        "builder-util-runtime": "9.5.1",
+        "app-builder-lib": "26.15.3",
+        "builder-util": "26.15.3",
+        "builder-util-runtime": "9.7.0",
         "chalk": "^4.1.2",
         "ci-info": "^4.2.0",
-        "dmg-builder": "26.4.0",
+        "dmg-builder": "26.15.3",
         "fs-extra": "^10.1.0",
         "lazy-val": "^1.0.5",
         "simple-update-notifier": "2.0.0",
@@ -2194,15 +1683,15 @@
       }
     },
     "node_modules/electron-builder-squirrel-windows": {
-      "version": "26.4.0",
-      "resolved": "https://registry.npmjs.org/electron-builder-squirrel-windows/-/electron-builder-squirrel-windows-26.4.0.tgz",
-      "integrity": "sha512-7dvalY38xBzWNaoOJ4sqy2aGIEpl2S1gLPkkB0MHu1Hu5xKQ82il1mKSFlXs6fLpXUso/NmyjdHGlSHDRoG8/w==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/electron-builder-squirrel-windows/-/electron-builder-squirrel-windows-26.15.3.tgz",
+      "integrity": "sha512-Jc19XPV9y9+2bAdZPkXuVNGNIEFBq9poHC61l8Kv6FdK7DRG3+Ic0rerC0DXOaeHNz8yW0fg/JnF8GQROOF5MA==",
       "dev": true,
       "license": "MIT",
       "peer": true,
       "dependencies": {
-        "app-builder-lib": "26.4.0",
-        "builder-util": "26.3.4",
+        "app-builder-lib": "26.15.3",
+        "builder-util": "26.15.3",
         "electron-winstaller": "5.4.0"
       }
     },
@@ -2244,219 +1733,19 @@
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/electron-packager": {
-      "version": "17.1.2",
-      "resolved": "https://registry.npmjs.org/electron-packager/-/electron-packager-17.1.2.tgz",
-      "integrity": "sha512-XofXdikjYI7MVBcnXeoOvRR+yFFFHOLs3J7PF5KYQweigtgLshcH4W660PsvHr4lYZ03JBpLyEcUB8DzHZ+BNw==",
-      "deprecated": "Please use @electron/packager moving forward. There is no API change, just a package name change",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "@electron/asar": "^3.2.1",
-        "@electron/get": "^2.0.0",
-        "@electron/notarize": "^1.2.3",
-        "@electron/osx-sign": "^1.0.5",
-        "@electron/universal": "^1.3.2",
-        "cross-spawn-windows-exe": "^1.2.0",
-        "debug": "^4.0.1",
-        "extract-zip": "^2.0.0",
-        "filenamify": "^4.1.0",
-        "fs-extra": "^11.1.0",
-        "galactus": "^1.0.0",
-        "get-package-info": "^1.0.0",
-        "junk": "^3.1.0",
-        "parse-author": "^2.0.0",
-        "plist": "^3.0.0",
-        "rcedit": "^3.0.1",
-        "resolve": "^1.1.6",
-        "semver": "^7.1.3",
-        "yargs-parser": "^21.1.1"
-      },
-      "bin": {
-        "electron-packager": "bin/electron-packager.js"
-      },
-      "engines": {
-        "node": ">= 14.17.5"
-      },
-      "funding": {
-        "url": "https://github.com/electron/electron-packager?sponsor=1"
-      }
-    },
-    "node_modules/electron-packager/node_modules/@electron/notarize": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/@electron/notarize/-/notarize-1.2.4.tgz",
-      "integrity": "sha512-W5GQhJEosFNafewnS28d3bpQ37/s91CDWqxVchHfmv2dQSTWpOzNlUVQwYzC1ay5bChRV/A9BTL68yj0Pa+TSg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.1.1",
-        "fs-extra": "^9.0.1"
-      },
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
-    "node_modules/electron-packager/node_modules/@electron/notarize/node_modules/fs-extra": {
-      "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
-      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "at-least-node": "^1.0.0",
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/electron-packager/node_modules/@electron/universal": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/@electron/universal/-/universal-1.5.1.tgz",
-      "integrity": "sha512-kbgXxyEauPJiQQUNG2VgUeyfQNFk6hBF11ISN2PNI6agUgPl55pv4eQmaqHzTAzchBvqZ2tQuRVaPStGf0mxGw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@electron/asar": "^3.2.1",
-        "@malept/cross-spawn-promise": "^1.1.0",
-        "debug": "^4.3.1",
-        "dir-compare": "^3.0.0",
-        "fs-extra": "^9.0.1",
-        "minimatch": "^3.0.4",
-        "plist": "^3.0.4"
-      },
-      "engines": {
-        "node": ">=8.6"
-      }
-    },
-    "node_modules/electron-packager/node_modules/@electron/universal/node_modules/fs-extra": {
-      "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
-      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "at-least-node": "^1.0.0",
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/electron-packager/node_modules/@malept/cross-spawn-promise": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@malept/cross-spawn-promise/-/cross-spawn-promise-1.1.1.tgz",
-      "integrity": "sha512-RTBGWL5FWQcg9orDOCcp4LvItNzUPcyEU9bwaeJX0rJ1IQxzucC48Y0/sQLp/g6t99IQgAlGIaesJS+gTn7tVQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/malept"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/subscription/pkg/npm-.malept-cross-spawn-promise?utm_medium=referral&utm_source=npm_fund"
-        }
-      ],
-      "license": "Apache-2.0",
-      "dependencies": {
-        "cross-spawn": "^7.0.1"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/electron-packager/node_modules/dir-compare": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/dir-compare/-/dir-compare-3.3.0.tgz",
-      "integrity": "sha512-J7/et3WlGUCxjdnD3HAAzQ6nsnc0WL6DD7WcwJb7c39iH1+AWfg+9OqzJNaI6PkBwBvm1mhZNL9iY/nRiZXlPg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "buffer-equal": "^1.0.0",
-        "minimatch": "^3.0.4"
-      }
-    },
-    "node_modules/electron-packager/node_modules/fs-extra": {
-      "version": "11.3.3",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.3.tgz",
-      "integrity": "sha512-VWSRii4t0AFm6ixFFmLLx1t7wS1gh+ckoa84aOeapGum0h+EZd1EhEumSB+ZdDLnEPuucsVB9oB7cxJHap6Afg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=14.14"
-      }
-    },
-    "node_modules/electron-packager/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "universalify": "^2.0.0"
-      },
-      "optionalDependencies": {
-        "graceful-fs": "^4.1.6"
-      }
-    },
-    "node_modules/electron-packager/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/electron-packager/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/electron-packager/node_modules/universalify": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
-      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
     "node_modules/electron-publish": {
-      "version": "26.3.4",
-      "resolved": "https://registry.npmjs.org/electron-publish/-/electron-publish-26.3.4.tgz",
-      "integrity": "sha512-5/ouDPb73SkKuay2EXisPG60LTFTMNHWo2WLrK5GDphnWK9UC+yzYrzVeydj078Yk4WUXi0+TaaZsNd6Zt5k/A==",
+      "version": "26.15.3",
+      "resolved": "https://registry.npmjs.org/electron-publish/-/electron-publish-26.15.3.tgz",
+      "integrity": "sha512-g/2bn8YTavY4cuS5F+jOS7zmZbXXBV8KZ8yHKfJjFPoKtzBqrpCdNPxBd3tqdBwP7BVd0lGzf7Bk2s0KesWZ4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/fs-extra": "^9.0.11",
-        "builder-util": "26.3.4",
-        "builder-util-runtime": "9.5.1",
+        "aws4": "^1.13.2",
+        "builder-util": "26.15.3",
+        "builder-util-runtime": "9.7.0",
         "chalk": "^4.1.2",
-        "form-data": "^4.0.0",
+        "form-data": "^4.0.5",
         "fs-extra": "^10.1.0",
         "lazy-val": "^1.0.5",
         "mime": "^2.5.2"
@@ -2478,9 +1767,9 @@
       }
     },
     "node_modules/electron-publish/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2507,6 +1796,7 @@
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@electron/asar": "^3.2.1",
         "debug": "^4.1.1",
@@ -2527,6 +1817,7 @@
       "integrity": "sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "graceful-fs": "^4.1.2",
         "jsonfile": "^4.0.0",
@@ -2536,6 +1827,64 @@
         "node": ">=6 <7 || >=8"
       }
     },
+    "node_modules/electron/node_modules/@electron/get": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@electron/get/-/get-5.1.0.tgz",
+      "integrity": "sha512-3kSBtG8ObcTVfXanm5vVJ6UnBLEVmVsRk1M+vGqCuMBV+XLCbJYuWQful+yIy0GQDsSlK0kHEriEHn7SPk4EnA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.1.1",
+        "env-paths": "^3.0.0",
+        "graceful-fs": "^4.2.11",
+        "progress": "^2.0.3",
+        "semver": "^7.6.3",
+        "sumchecker": "^3.0.1"
+      },
+      "engines": {
+        "node": ">=22.12.0"
+      },
+      "optionalDependencies": {
+        "undici": "^7.24.4"
+      }
+    },
+    "node_modules/electron/node_modules/env-paths": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-3.0.0.tgz",
+      "integrity": "sha512-dtJUTepzMW3Lm/NPxRf3wP4642UWhjL2sQxc+ym2YMj1m/H2zDNQOlezafzkHwn6sMstjHTwG6iQQsctDW/b1A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/electron/node_modules/semver": {
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/electron/node_modules/undici": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
+      "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=20.18.1"
+      }
+    },
     "node_modules/emoji-regex": {
       "version": "8.0.0",
       "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
@@ -2543,17 +1892,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/encoding": {
-      "version": "0.1.13",
-      "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz",
-      "integrity": "sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "iconv-lite": "^0.6.2"
-      }
-    },
     "node_modules/end-of-stream": {
       "version": "1.4.5",
       "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
@@ -2581,16 +1919,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/error-ex": {
-      "version": "1.3.4",
-      "resolved": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.4.tgz",
-      "integrity": "sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "is-arrayish": "^0.2.1"
-      }
-    },
     "node_modules/es-define-property": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
@@ -2610,9 +1938,9 @@
       }
     },
     "node_modules/es-object-atoms": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
-      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0"
@@ -2675,38 +2003,6 @@
       "dev": true,
       "license": "Apache-2.0"
     },
-    "node_modules/extract-zip": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/extract-zip/-/extract-zip-2.0.1.tgz",
-      "integrity": "sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "debug": "^4.1.1",
-        "get-stream": "^5.1.0",
-        "yauzl": "^2.10.0"
-      },
-      "bin": {
-        "extract-zip": "cli.js"
-      },
-      "engines": {
-        "node": ">= 10.17.0"
-      },
-      "optionalDependencies": {
-        "@types/yauzl": "^2.9.1"
-      }
-    },
-    "node_modules/extsprintf": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/extsprintf/-/extsprintf-1.4.1.tgz",
-      "integrity": "sha512-Wrk35e8ydCKDj/ArClo1VrPVmN8zph5V4AtHwIuHhvMXsKf73UT3BOD+azBIW+3wOJ4FhEH7zyaJCFvChjYvMA==",
-      "dev": true,
-      "engines": [
-        "node >=0.6.0"
-      ],
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
       "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
@@ -2714,22 +2010,22 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/fast-json-stable-stringify": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
-      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
+    "node_modules/fast-uri": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
+      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
       "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/fd-slicer": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/fd-slicer/-/fd-slicer-1.1.0.tgz",
-      "integrity": "sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "pend": "~1.2.0"
-      }
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
     },
     "node_modules/fdir": {
       "version": "6.5.0",
@@ -2750,9 +2046,9 @@
       }
     },
     "node_modules/filelist": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.4.tgz",
-      "integrity": "sha512-w1cEuf3S+DrLCQL7ET6kz+gmlJdbq9J7yXCSjK/OZCPA+qEN1WyF4ZAf0YYJa4/shHJra2t/d/r8SV4Ji+x+8Q==",
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.6.tgz",
+      "integrity": "sha512-5giy2PkLYY1cP39p17Ech+2xlpTRL9HLspOfEgm0L6CwBXBTgsK5ou0JtzYuepxkaQ/tvhCFIJ5uXo0OrM2DxA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -2760,9 +2056,9 @@
       }
     },
     "node_modules/filelist/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2770,9 +2066,9 @@
       }
     },
     "node_modules/filelist/node_modules/minimatch": {
-      "version": "5.1.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
-      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
+      "version": "5.1.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
+      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -2782,103 +2078,10 @@
         "node": ">=10"
       }
     },
-    "node_modules/filename-reserved-regex": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/filename-reserved-regex/-/filename-reserved-regex-2.0.0.tgz",
-      "integrity": "sha512-lc1bnsSr4L4Bdif8Xb/qrtokGbq5zlsms/CYH8PP+WtCkGNF65DPiQY8vG3SakEdRn8Dlnm+gW/qWKKjS5sZzQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/filenamify": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/filenamify/-/filenamify-4.3.0.tgz",
-      "integrity": "sha512-hcFKyUG57yWGAzu1CMt/dPzYZuv+jAJUT85bL8mrXvNe6hWj6yEHEc4EdcgiA6Z3oi1/9wXJdZPXF2dZNgwgOg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "filename-reserved-regex": "^2.0.0",
-        "strip-outer": "^1.0.1",
-        "trim-repeated": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/find-up": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-2.1.0.tgz",
-      "integrity": "sha512-NWzkk0jSJtTt08+FBFMvXoeZnOJD+jTtsRmBYbAIzJdX6l7dLgR7CTubCM5/eDdPUBvLCeVasP1brfVR/9/EZQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "locate-path": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/flora-colossus": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/flora-colossus/-/flora-colossus-2.0.0.tgz",
-      "integrity": "sha512-dz4HxH6pOvbUzZpZ/yXhafjbR2I8cenK5xL0KtBFb7U2ADsR+OwXifnxZjij/pZWF775uSCMzWVd+jDik2H2IA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.3.4",
-        "fs-extra": "^10.1.0"
-      },
-      "engines": {
-        "node": ">= 12"
-      }
-    },
-    "node_modules/flora-colossus/node_modules/fs-extra": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
-      "integrity": "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/flora-colossus/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "universalify": "^2.0.0"
-      },
-      "optionalDependencies": {
-        "graceful-fs": "^4.1.6"
-      }
-    },
-    "node_modules/flora-colossus/node_modules/universalify": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
-      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
     "node_modules/follow-redirects": {
-      "version": "1.15.11",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.11.tgz",
-      "integrity": "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==",
+      "version": "1.16.0",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
+      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
       "funding": [
         {
           "type": "individual",
@@ -2895,80 +2098,22 @@
         }
       }
     },
-    "node_modules/foreground-child": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
-      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "cross-spawn": "^7.0.6",
-        "signal-exit": "^4.0.1"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/foreground-child/node_modules/signal-exit": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
-      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
-      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/form-data": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz",
-      "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==",
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
         "combined-stream": "^1.0.8",
         "es-set-tostringtag": "^2.1.0",
-        "hasown": "^2.0.2",
-        "mime-types": "^2.1.12"
+        "hasown": "^2.0.4",
+        "mime-types": "^2.1.35"
       },
       "engines": {
         "node": ">= 6"
       }
     },
-    "node_modules/fs-extra": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-8.1.0.tgz",
-      "integrity": "sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^4.0.0",
-        "universalify": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=6 <7 || >=8"
-      }
-    },
-    "node_modules/fs-minipass": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-3.0.3.tgz",
-      "integrity": "sha512-XUBA9XClHbnJWSfBzjkm6RvPsyg3sryZt06BEQoXcF7EK/xpGaQYJgQKDJSUH5SGZ76Y7pFx1QBnXz09rU5Fbw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^7.0.3"
-      },
-      "engines": {
-        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-      }
-    },
     "node_modules/fs.realpath": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
@@ -2985,59 +2130,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/galactus": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/galactus/-/galactus-1.0.0.tgz",
-      "integrity": "sha512-R1fam6D4CyKQGNlvJne4dkNF+PvUUl7TAJInvTGa9fti9qAv95quQz29GXapA4d8Ec266mJJxFVh82M4GIIGDQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "debug": "^4.3.4",
-        "flora-colossus": "^2.0.0",
-        "fs-extra": "^10.1.0"
-      },
-      "engines": {
-        "node": ">= 12"
-      }
-    },
-    "node_modules/galactus/node_modules/fs-extra": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
-      "integrity": "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/galactus/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "universalify": "^2.0.0"
-      },
-      "optionalDependencies": {
-        "graceful-fs": "^4.1.6"
-      }
-    },
-    "node_modules/galactus/node_modules/universalify": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
-      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
     "node_modules/get-caller-file": {
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
@@ -3072,39 +2164,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/get-package-info": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/get-package-info/-/get-package-info-1.0.0.tgz",
-      "integrity": "sha512-SCbprXGAPdIhKAXiG+Mk6yeoFH61JlYunqdFQFHDtLjJlDjFf6x07dsS8acO+xWt52jpdVo49AlVDnUVK1sDNw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "bluebird": "^3.1.1",
-        "debug": "^2.2.0",
-        "lodash.get": "^4.0.0",
-        "read-pkg-up": "^2.0.0"
-      },
-      "engines": {
-        "node": ">= 4.0"
-      }
-    },
-    "node_modules/get-package-info/node_modules/debug": {
-      "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ms": "2.0.0"
-      }
-    },
-    "node_modules/get-package-info/node_modules/ms": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/get-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
@@ -3157,9 +2216,9 @@
       }
     },
     "node_modules/glob/node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -3317,9 +2376,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
@@ -3377,79 +2436,28 @@
       }
     },
     "node_modules/https-proxy-agent": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
-      "dev": true,
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
       "license": "MIT",
       "dependencies": {
-        "agent-base": "^7.1.2",
+        "agent-base": "6",
         "debug": "4"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 6"
       }
     },
-    "node_modules/iconv-corefoundation": {
-      "version": "1.1.7",
-      "resolved": "https://registry.npmjs.org/iconv-corefoundation/-/iconv-corefoundation-1.1.7.tgz",
-      "integrity": "sha512-T10qvkw0zz4wnm560lOEg0PovVqUXuOFhhHAkixw8/sycy7TJt7v/RrkEKEQnAw2viPSJu6iAkErxnzR0g8PpQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "dependencies": {
-        "cli-truncate": "^2.1.0",
-        "node-addon-api": "^1.6.3"
-      },
-      "engines": {
-        "node": "^8.11.2 || >=10"
-      }
-    },
-    "node_modules/iconv-lite": {
-      "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
-      "dev": true,
+    "node_modules/https-proxy-agent/node_modules/agent-base": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
       "license": "MIT",
       "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
+        "debug": "4"
       },
       "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/ieee754": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
-      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/imurmurhash": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
-      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8.19"
+        "node": ">= 6.0.0"
       }
     },
     "node_modules/inflight": {
@@ -3471,55 +2479,6 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/ip-address": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
-      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 12"
-      }
-    },
-    "node_modules/is-arrayish": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz",
-      "integrity": "sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/is-core-module": {
-      "version": "2.16.1",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.1.tgz",
-      "integrity": "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "hasown": "^2.0.2"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/is-docker": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
-      "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
-      "dev": true,
-      "license": "MIT",
-      "bin": {
-        "is-docker": "cli.js"
-      },
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
@@ -3530,41 +2489,12 @@
         "node": ">=8"
       }
     },
-    "node_modules/is-interactive": {
+    "node_modules/isarray": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-interactive/-/is-interactive-1.0.0.tgz",
-      "integrity": "sha512-2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==",
+      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
+      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
       "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/is-unicode-supported": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-0.1.0.tgz",
-      "integrity": "sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/is-wsl": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
-      "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "is-docker": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
+      "license": "MIT"
     },
     "node_modules/isbinaryfile": {
       "version": "5.0.7",
@@ -3580,29 +2510,13 @@
       }
     },
     "node_modules/isexe": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.1.tgz",
-      "integrity": "sha512-LpB/54B+/2J5hqQ7imZHfdU31OlgQqx7ZicVlkm9kzg9/w8GKLEcFfJl/t7DCEDueOyBAD6zCCwTO6Fzs0NoEQ==",
-      "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/jackspeak": {
-      "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
-      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
+      "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
       "dev": true,
       "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "@isaacs/cliui": "^8.0.2"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      },
-      "optionalDependencies": {
-        "@pkgjs/parseargs": "^0.11.0"
+      "engines": {
+        "node": ">=18"
       }
     },
     "node_modules/jake": {
@@ -3624,9 +2538,9 @@
       }
     },
     "node_modules/jiti": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz",
-      "integrity": "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==",
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
+      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -3634,10 +2548,20 @@
       }
     },
     "node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
       "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"
@@ -3654,9 +2578,9 @@
       "license": "MIT"
     },
     "node_modules/json-schema-traverse": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
       "dev": true,
       "license": "MIT"
     },
@@ -3691,16 +2615,6 @@
         "graceful-fs": "^4.1.6"
       }
     },
-    "node_modules/junk": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/junk/-/junk-3.1.0.tgz",
-      "integrity": "sha512-pBxcB3LFc8QVgdggvZWyeys+hnrNWg4OcZIU/1X59k5jQdLBlCsYGRQaz234SqoRLTCgMH00fY0xRJH+F9METQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/keyv": {
       "version": "4.5.4",
       "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
@@ -3718,68 +2632,13 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/load-json-file": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/load-json-file/-/load-json-file-2.0.0.tgz",
-      "integrity": "sha512-3p6ZOGNbiX4CdvEd1VcE6yi78UrGNpjHO33noGwHCnT/o2fyllJDepsm8+mFFv/DvtwFHht5HIHSyOy5a+ChVQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.1.2",
-        "parse-json": "^2.2.0",
-        "pify": "^2.0.0",
-        "strip-bom": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/locate-path": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-2.0.0.tgz",
-      "integrity": "sha512-NCI2kiDkyR7VeEKm27Kda/iQHyKJe1Bu0FlTbYp3CqJu+9IFe9bLyAjMxf5ZDDbEg+iMPzB5zYyUTSm8wVTKmA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "p-locate": "^2.0.0",
-        "path-exists": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/lodash.get": {
-      "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/lodash.get/-/lodash.get-4.4.2.tgz",
-      "integrity": "sha512-z+Uw/vLuy6gQe8cfaFWD7p0wVv8fJl3mbzXh33RS+0oW2wvUqiRXiQ69gLWSLpgB5/6sU+r6BlQR0MBILadqTQ==",
-      "deprecated": "This package is deprecated. Use the optional chaining (?.) operator instead.",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/log-symbols": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/log-symbols/-/log-symbols-4.1.0.tgz",
-      "integrity": "sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "chalk": "^4.1.0",
-        "is-unicode-supported": "^0.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/lowercase-keys": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/lowercase-keys/-/lowercase-keys-2.0.0.tgz",
@@ -3803,29 +2662,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/make-fetch-happen": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-14.0.3.tgz",
-      "integrity": "sha512-QMjGbFTP0blj97EeidG5hk/QhKQ3T4ICckQGLgz38QF7Vgbk6e6FTARN8KhKxyBbWn8R0HU+bnw8aSoFPD4qtQ==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "@npmcli/agent": "^3.0.0",
-        "cacache": "^19.0.1",
-        "http-cache-semantics": "^4.1.1",
-        "minipass": "^7.0.2",
-        "minipass-fetch": "^4.0.0",
-        "minipass-flush": "^1.0.5",
-        "minipass-pipeline": "^1.2.4",
-        "negotiator": "^1.0.0",
-        "proc-log": "^5.0.0",
-        "promise-retry": "^2.0.1",
-        "ssri": "^12.0.0"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
     "node_modules/matcher": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/matcher/-/matcher-3.0.0.tgz",
@@ -3883,16 +2719,6 @@
         "node": ">= 0.6"
       }
     },
-    "node_modules/mimic-fn": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
-      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/mimic-response": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-1.0.1.tgz",
@@ -3904,21 +2730,44 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "10.1.1",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.1.1.tgz",
-      "integrity": "sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==",
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "@isaacs/brace-expansion": "^5.0.0"
+        "brace-expansion": "^5.0.8"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/minimatch/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/minimatch/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
     "node_modules/minimist": {
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
@@ -3930,124 +2779,15 @@
       }
     },
     "node_modules/minipass": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=16 || 14 >=14.17"
       }
     },
-    "node_modules/minipass-collect": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-2.0.1.tgz",
-      "integrity": "sha512-D7V8PO9oaz7PWGLbCACuI1qEOsq7UKfLotx/C0Aet43fCUB/wfQ7DYeq2oR/svFJGYDHPr38SHATeaj/ZoKHKw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^7.0.3"
-      },
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
-    "node_modules/minipass-fetch": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-4.0.1.tgz",
-      "integrity": "sha512-j7U11C5HXigVuutxebFadoYBbd7VSdZWggSe64NVdvWNBqGAiXPL2QVCehjmw7lY1oF9gOllYbORh+hiNgfPgQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "minipass": "^7.0.3",
-        "minipass-sized": "^1.0.3",
-        "minizlib": "^3.0.1"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      },
-      "optionalDependencies": {
-        "encoding": "^0.1.13"
-      }
-    },
-    "node_modules/minipass-flush": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.5.tgz",
-      "integrity": "sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/minipass-flush/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/minipass-pipeline": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/minipass-pipeline/-/minipass-pipeline-1.2.4.tgz",
-      "integrity": "sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/minipass-pipeline/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/minipass-sized": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/minipass-sized/-/minipass-sized-1.0.3.tgz",
-      "integrity": "sha512-MbkQQ2CTiBMlA2Dm/5cY+9SWFEN8pzzOXi6rlM5Xxq0Yqbda5ZQy9sU75a673FE9ZK0Zsbr6Y5iP6u9nktfg2g==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/minipass-sized/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/minizlib": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
@@ -4062,39 +2802,29 @@
       }
     },
     "node_modules/mkdirp": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
-      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
+      "version": "0.5.6",
+      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
+      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "minimist": "^1.2.6"
+      },
       "bin": {
         "mkdirp": "bin/cmd.js"
-      },
-      "engines": {
-        "node": ">=10"
       }
     },
     "node_modules/ms": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
       "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "dev": true,
       "license": "MIT"
     },
-    "node_modules/negotiator": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
-      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/node-abi": {
-      "version": "4.24.0",
-      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-4.24.0.tgz",
-      "integrity": "sha512-u2EC1CeNe25uVtX3EZbdQ275c74zdZmmpzrHEQh2aIYqoVjlglfUpOX9YY85x1nlBydEKDVaSmMNhR7N82Qj8A==",
+      "version": "4.33.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-4.33.0.tgz",
+      "integrity": "sha512-vLBWCKb+7LWsX+TbfzWOkw0W81m377tyx3hOweBTjO43CXZnRGS1/JPWs20fr0PgZyDXk6ROYrylsEycK8raDA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4105,9 +2835,9 @@
       }
     },
     "node_modules/node-abi/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -4117,14 +2847,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/node-addon-api": {
-      "version": "1.7.2",
-      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-1.7.2.tgz",
-      "integrity": "sha512-ibPK3iA+vaY1eEjESkQkM0BbCqFOaZMiXRTtdB0u7b4djtY6JnsjvPdUHVMg6xQt3B8fpTTWHI9A+ADjM9frzg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/node-api-version": {
       "version": "0.2.1",
       "resolved": "https://registry.npmjs.org/node-api-version/-/node-api-version-0.2.1.tgz",
@@ -4136,9 +2858,9 @@
       }
     },
     "node_modules/node-api-version/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -4149,44 +2871,44 @@
       }
     },
     "node_modules/node-gyp": {
-      "version": "11.5.0",
-      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-11.5.0.tgz",
-      "integrity": "sha512-ra7Kvlhxn5V9Slyus0ygMa2h+UqExPqUIkfk7Pc8QTLT956JLSy51uWFwHtIYy0vI8cB4BDhc/S03+880My/LQ==",
+      "version": "12.4.0",
+      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-12.4.0.tgz",
+      "integrity": "sha512-OMcPNvqTCFUnNaBlmdgq+lfNqY7gTiSmNRDjY3uAXRyudeKZEZxu3CLtjMQrx4zZxCX2b/mpNqTtwuCJgXhHkw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "env-paths": "^2.2.0",
         "exponential-backoff": "^3.1.1",
         "graceful-fs": "^4.2.6",
-        "make-fetch-happen": "^14.0.3",
-        "nopt": "^8.0.0",
-        "proc-log": "^5.0.0",
+        "nopt": "^9.0.0",
+        "proc-log": "^6.0.0",
         "semver": "^7.3.5",
-        "tar": "^7.4.3",
+        "tar": "^7.5.4",
         "tinyglobby": "^0.2.12",
-        "which": "^5.0.0"
+        "undici": "^6.25.0",
+        "which": "^6.0.0"
       },
       "bin": {
         "node-gyp": "bin/node-gyp.js"
       },
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
-    "node_modules/node-gyp/node_modules/chownr": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
-      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
+    "node_modules/node-gyp/node_modules/isexe": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-4.0.0.tgz",
+      "integrity": "sha512-FFUtZMpoZ8RqHS3XeXEmHWLA4thH+ZxCv2lOiPIn1Xc7CxrqhWzNSDzD+/chS/zbYezmiwWLdQC09JdQKmthOw==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
-        "node": ">=18"
+        "node": ">=20"
       }
     },
     "node_modules/node-gyp/node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -4196,77 +2918,43 @@
         "node": ">=10"
       }
     },
-    "node_modules/node-gyp/node_modules/tar": {
-      "version": "7.5.2",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.2.tgz",
-      "integrity": "sha512-7NyxrTE4Anh8km8iEy7o0QYPs+0JKBTj5ZaqHg6B39erLg0qYXN3BijtShwbsNSvQ+LN75+KV+C4QR/f6Gwnpg==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "@isaacs/fs-minipass": "^4.0.0",
-        "chownr": "^3.0.0",
-        "minipass": "^7.1.2",
-        "minizlib": "^3.1.0",
-        "yallist": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/node-gyp/node_modules/yallist": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
-      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/nopt": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/nopt/-/nopt-8.1.0.tgz",
-      "integrity": "sha512-ieGu42u/Qsa4TFktmaKEwM6MQH0pOWnaB3htzh0JRtx84+Mebc0cbZYN5bC+6WTZ4+77xrL9Pn5m7CV6VIkV7A==",
+    "node_modules/node-gyp/node_modules/which": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/which/-/which-6.0.1.tgz",
+      "integrity": "sha512-oGLe46MIrCRqX7ytPUf66EAYvdeMIZYn3WaocqqKZAxrBpkqHfL/qvTyJ/bTk5+AqHCjXmrv3CEWgy368zhRUg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "abbrev": "^3.0.0"
+        "isexe": "^4.0.0"
+      },
+      "bin": {
+        "node-which": "bin/which.js"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/node-int64": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
+      "integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/nopt": {
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/nopt/-/nopt-9.0.0.tgz",
+      "integrity": "sha512-Zhq3a+yFKrYwSBluL4H9XP3m3y5uvQkB/09CwDruCiRmR/UJYnn9W4R48ry0uGC70aeTPKLynBtscP9efFFcPw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "abbrev": "^4.0.0"
       },
       "bin": {
         "nopt": "bin/nopt.js"
       },
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
-    "node_modules/normalize-package-data": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-2.5.0.tgz",
-      "integrity": "sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "hosted-git-info": "^2.1.4",
-        "resolve": "^1.10.0",
-        "semver": "2 || 3 || 4 || 5",
-        "validate-npm-package-license": "^3.0.1"
-      }
-    },
-    "node_modules/normalize-package-data/node_modules/hosted-git-info": {
-      "version": "2.8.9",
-      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.9.tgz",
-      "integrity": "sha512-mxIDAb9Lsm6DoOJ7xH+5+X4y1LU/4Hi50L9C5sIswK3JzULS4bwk1FvjdBgvYR4bzT4tuUQiC15FE2f5HbLvYw==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/normalize-package-data/node_modules/semver": {
-      "version": "5.7.2",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
-      "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
     "node_modules/normalize-url": {
@@ -4303,46 +2991,6 @@
         "wrappy": "1"
       }
     },
-    "node_modules/onetime": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
-      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "mimic-fn": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/ora": {
-      "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/ora/-/ora-5.4.1.tgz",
-      "integrity": "sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "bl": "^4.1.0",
-        "chalk": "^4.1.0",
-        "cli-cursor": "^3.1.0",
-        "cli-spinners": "^2.5.0",
-        "is-interactive": "^1.0.0",
-        "is-unicode-supported": "^0.1.0",
-        "log-symbols": "^4.1.0",
-        "strip-ansi": "^6.0.0",
-        "wcwidth": "^1.0.1"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/p-cancelable": {
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/p-cancelable/-/p-cancelable-2.1.1.tgz",
@@ -4369,98 +3017,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/p-locate": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-2.0.0.tgz",
-      "integrity": "sha512-nQja7m7gSKuewoVRen45CtVfODR3crN3goVQ0DDZ9N3yHxgpkuBhZqsaiotSQRrADUrne346peY7kT3TSACykg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "p-limit": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/p-locate/node_modules/p-limit": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-1.3.0.tgz",
-      "integrity": "sha512-vvcXsLAJ9Dr5rQOPk7toZQZJApBl2K4J6dANSsEuh6QI41JYcsS/qhTGa9ErIUUgK3WNQoJYvylxvjqmiqEA9Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "p-try": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/p-map": {
-      "version": "7.0.4",
-      "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.0.4.tgz",
-      "integrity": "sha512-tkAQEw8ysMzmkhgw8k+1U/iPhWNhykKnSk4Rd5zLoPJCuJaGRPo6YposrZgaxHKzDHdDWWZvE/Sk7hsL2X/CpQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/p-try": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/p-try/-/p-try-1.0.0.tgz",
-      "integrity": "sha512-U1etNYuMJoIz3ZXSrrySFjsXQTWOx2/jdi86L+2pRvph/qMKL6sbcCYdH23fqsbm8TH2Gn0OybpT4eSFlCVHww==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/package-json-from-dist": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
-      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
-      "dev": true,
-      "license": "BlueOak-1.0.0"
-    },
-    "node_modules/parse-author": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/parse-author/-/parse-author-2.0.0.tgz",
-      "integrity": "sha512-yx5DfvkN8JsHL2xk2Os9oTia467qnvRgey4ahSm2X8epehBLx/gWLcy5KI+Y36ful5DzGbCS6RazqZGgy1gHNw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "author-regex": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/parse-json": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-2.2.0.tgz",
-      "integrity": "sha512-QR/GGaKCkhwk1ePQNYDRKYZ3mwU9ypsKhB0XyFnLQdomyEqk3e8wpW3V5Jp88zbxK4n5ST1nqo+g9juTpownhQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "error-ex": "^1.2.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/path-exists": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-3.0.0.tgz",
-      "integrity": "sha512-bpC7GYwiDYQ4wYLe+FA8lhRjhQCMcQGuSgGGqDkg/QerRWw9CmGRT0iSOVRSZJ29NMLZgIzqaljJ63oaL4NIJQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/path-is-absolute": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
@@ -4481,50 +3037,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/path-parse": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
-      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/path-scurry": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
-      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "lru-cache": "^10.2.0",
-        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
-      },
-      "engines": {
-        "node": ">=16 || 14 >=14.18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/path-scurry/node_modules/lru-cache": {
-      "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/path-type": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/path-type/-/path-type-2.0.0.tgz",
-      "integrity": "sha512-dUnb5dXUf+kzhC/W/F4e5/SkluXIFf5VUHolW1Eg1irn1hGWjPGdsRcvYJ1nD6lhk8Ir7VM0bHJKsYTx8Jx9OQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "pify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/pe-library": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/pe-library/-/pe-library-0.4.1.tgz",
@@ -4540,13 +3052,6 @@
         "url": "https://github.com/sponsors/jet2jet"
       }
     },
-    "node_modules/pend": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/pend/-/pend-1.2.0.tgz",
-      "integrity": "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/picocolors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
@@ -4555,12 +3060,11 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -4568,14 +3072,35 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
-    "node_modules/pify": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/pify/-/pify-2.3.0.tgz",
-      "integrity": "sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==",
+    "node_modules/pkijs": {
+      "version": "3.4.0",
+      "resolved": "https://registry.npmjs.org/pkijs/-/pkijs-3.4.0.tgz",
+      "integrity": "sha512-emEcLuomt2j03vxD54giVB4SxTjnsqkU692xZOZXHDVoYyypEm+b3jpiTcc+Cf+myooc+/Ly0z01jqeNHVgJGw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@noble/hashes": "1.4.0",
+        "asn1js": "^3.0.6",
+        "bytestreamjs": "^2.0.1",
+        "pvtsutils": "^1.3.6",
+        "pvutils": "^1.1.3",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
+    "node_modules/pkijs/node_modules/@noble/hashes": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.4.0.tgz",
+      "integrity": "sha512-V1JJ1WTRUqHHrOSh597hURcMqVKVGL/ea3kv0gSnEdsEZ0/+VyPghM1lMNGc00z7CIQorSvbKpuJkxvuHbvdbg==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=0.10.0"
+        "node": ">= 16"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
       }
     },
     "node_modules/plist": {
@@ -4600,6 +3125,7 @@
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "dependencies": {
         "commander": "^9.4.0"
       },
@@ -4617,20 +3143,28 @@
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "peer": true,
       "engines": {
         "node": "^12.20.0 || >=14"
       }
     },
     "node_modules/proc-log": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-5.0.0.tgz",
-      "integrity": "sha512-Azwzvl90HaF0aCz1JrDdXQykFakSSNPaPoiZ9fm5qJIMHioDZEi7OAdRwSm6rSoPtY3Qutnm3L7ogmg3dc+wbQ==",
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-6.1.0.tgz",
+      "integrity": "sha512-iG+GYldRf2BQ0UDUAd6JQ/RwzaQy6mXmsk/IzlYyal4A4SNFw54MeH4/tLkF4I5WoWG9SQwuqWzS99jaFQHBuQ==",
       "dev": true,
       "license": "ISC",
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
+    "node_modules/process-nextick-args": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
+      "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/progress": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/progress/-/progress-2.0.3.tgz",
@@ -4655,11 +3189,26 @@
         "node": ">=10"
       }
     },
+    "node_modules/proper-lockfile": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/proper-lockfile/-/proper-lockfile-4.1.2.tgz",
+      "integrity": "sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.4",
+        "retry": "^0.12.0",
+        "signal-exit": "^3.0.2"
+      }
+    },
     "node_modules/proxy-from-env": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
-      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
-      "license": "MIT"
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
+      "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
     },
     "node_modules/pump": {
       "version": "3.0.3",
@@ -4672,14 +3221,24 @@
         "once": "^1.3.1"
       }
     },
-    "node_modules/punycode": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+    "node_modules/pvtsutils": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/pvtsutils/-/pvtsutils-1.3.6.tgz",
+      "integrity": "sha512-PLgQXQ6H2FWCaeRak8vvk1GW462lMxB5s3Jm673N82zI4vqtVUPuZdffdZbPDFRoU8kAhItWFtPCWiPpp4/EDg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.8.1"
+      }
+    },
+    "node_modules/pvutils": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/pvutils/-/pvutils-1.2.0.tgz",
+      "integrity": "sha512-BbubeCEyTuQjVMakvJQ/Sxbc93F2pwmbsxONT/ZRrwU7Ua38d8unYTwXpTVLAKJ4BDuH9IGztCjQcd/N/39Dvg==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=6"
+        "node": ">=16.0.0"
       }
     },
     "node_modules/quick-lru": {
@@ -4695,19 +3254,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/rcedit": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/rcedit/-/rcedit-3.1.0.tgz",
-      "integrity": "sha512-WRlRdY1qZbu1L11DklT07KuHfRk42l0NFFJdaExELEu4fEQ982bP5Z6OWGPj/wLLIuKRQDCxZJGAwoFsxhZhNA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "cross-spawn-windows-exe": "^1.1.0"
-      },
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
     "node_modules/read-binary-file-arch": {
       "version": "1.0.6",
       "resolved": "https://registry.npmjs.org/read-binary-file-arch/-/read-binary-file-arch-1.0.6.tgz",
@@ -4721,48 +3267,20 @@
         "read-binary-file-arch": "cli.js"
       }
     },
-    "node_modules/read-pkg": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-2.0.0.tgz",
-      "integrity": "sha512-eFIBOPW7FGjzBuk3hdXEuNSiTZS/xEMlH49HxMyzb0hyPfu4EhVjT2DH32K1hSSmVq4sebAWnZuuY5auISUTGA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "load-json-file": "^2.0.0",
-        "normalize-package-data": "^2.3.2",
-        "path-type": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/read-pkg-up": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/read-pkg-up/-/read-pkg-up-2.0.0.tgz",
-      "integrity": "sha512-1orxQfbWGUiTn9XsPlChs6rLie/AV9jwZTGmu2NZw/CUDJQchXJFYE0Fq5j7+n558T1JhDWLdhyd1Zj+wLY//w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "find-up": "^2.0.0",
-        "read-pkg": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/readable-stream": {
-      "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
+      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "inherits": "^2.0.3",
-        "string_decoder": "^1.1.1",
-        "util-deprecate": "^1.0.1"
-      },
-      "engines": {
-        "node": ">= 6"
+        "core-util-is": "~1.0.0",
+        "inherits": "~2.0.3",
+        "isarray": "~1.0.0",
+        "process-nextick-args": "~2.0.0",
+        "safe-buffer": "~5.1.1",
+        "string_decoder": "~1.1.1",
+        "util-deprecate": "~1.0.1"
       }
     },
     "node_modules/require-directory": {
@@ -4775,6 +3293,16 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/resedit": {
       "version": "1.7.2",
       "resolved": "https://registry.npmjs.org/resedit/-/resedit-1.7.2.tgz",
@@ -4793,27 +3321,6 @@
         "url": "https://github.com/sponsors/jet2jet"
       }
     },
-    "node_modules/resolve": {
-      "version": "1.22.11",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.11.tgz",
-      "integrity": "sha512-RfqAvLnMl313r7c9oclB1HhUEAezcpLjz95wFH4LVuhk9JF/r22qmVP9AMmOU4vMX7Q8pN8jwNg/CSpdFnMjTQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "is-core-module": "^2.16.1",
-        "path-parse": "^1.0.7",
-        "supports-preserve-symlinks-flag": "^1.0.0"
-      },
-      "bin": {
-        "resolve": "bin/resolve"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/resolve-alpn": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/resolve-alpn/-/resolve-alpn-1.2.1.tgz",
@@ -4834,20 +3341,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/restore-cursor": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-3.1.0.tgz",
-      "integrity": "sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "onetime": "^5.1.0",
-        "signal-exit": "^3.0.2"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/retry": {
       "version": "0.12.0",
       "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
@@ -4865,6 +3358,7 @@
       "deprecated": "Rimraf versions prior to v4 are no longer supported",
       "dev": true,
       "license": "ISC",
+      "peer": true,
       "dependencies": {
         "glob": "^7.1.3"
       },
@@ -4892,37 +3386,16 @@
       }
     },
     "node_modules/safe-buffer": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/safer-buffer": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/sanitize-filename": {
-      "version": "1.6.3",
-      "resolved": "https://registry.npmjs.org/sanitize-filename/-/sanitize-filename-1.6.3.tgz",
-      "integrity": "sha512-y/52Mcy7aw3gRm7IrcGDFx/bCk4AhRh2eI9luHOQM86nZsqwiRkkq2GekHXBBD+SmPidc8i2PqtYZl+pWJ8Oeg==",
+      "version": "1.6.4",
+      "resolved": "https://registry.npmjs.org/sanitize-filename/-/sanitize-filename-1.6.4.tgz",
+      "integrity": "sha512-9ZyI08PsvdQl2r/bBIGubpVdR3RR9sY6RDiWFPreA21C/EFlQhmgo20UZlNjZMMZNubusLhAQozkA0Od5J21Eg==",
       "dev": true,
       "license": "WTFPL OR ISC",
       "dependencies": {
@@ -4930,25 +3403,15 @@
       }
     },
     "node_modules/sax": {
-      "version": "1.4.4",
-      "resolved": "https://registry.npmjs.org/sax/-/sax-1.4.4.tgz",
-      "integrity": "sha512-1n3r/tGXO6b6VXMdFT54SHzT9ytu9yr7TaELowdYpMqY/Ao7EnlQGmAQ1+RatX7Tkkdm6hONI2owqNx2aZj5Sw==",
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/sax/-/sax-1.6.1.tgz",
+      "integrity": "sha512-42tBVwLWnaQvW5zc4HbZrTuWccECCZfBi92FDuwtqxasH+JbPB3/FOKb1m222K42R4WxuxzzMsTswfzgtSu64Q==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=11.0.0"
       }
     },
-    "node_modules/semver": {
-      "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      }
-    },
     "node_modules/semver-compare": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/semver-compare/-/semver-compare-1.0.0.tgz",
@@ -5030,63 +3493,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/slice-ansi": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-3.0.0.tgz",
-      "integrity": "sha512-pSyv7bSTC7ig9Dcgbw9AuRNUb5k5V6oDudjZoMBSr13qpLBG7tB+zgCkARjq7xIUgdz5P1Qe8u+rSGdouOOIyQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "astral-regex": "^2.0.0",
-        "is-fullwidth-code-point": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/smart-buffer": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
-      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 6.0.0",
-        "npm": ">= 3.0.0"
-      }
-    },
-    "node_modules/socks": {
-      "version": "2.8.7",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.7.tgz",
-      "integrity": "sha512-HLpt+uLy/pxB+bum/9DzAgiKS8CX1EvbWxI4zlmgGCExImLdiad2iCwXT5Z4c9c3Eq8rP2318mPW2c+QbtjK8A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ip-address": "^10.0.1",
-        "smart-buffer": "^4.2.0"
-      },
-      "engines": {
-        "node": ">= 10.0.0",
-        "npm": ">= 3.0.0"
-      }
-    },
-    "node_modules/socks-proxy-agent": {
-      "version": "8.0.5",
-      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz",
-      "integrity": "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^7.1.2",
-        "debug": "^4.3.4",
-        "socks": "^2.8.3"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
     "node_modules/source-map": {
       "version": "0.6.1",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
@@ -5108,42 +3514,6 @@
         "source-map": "^0.6.0"
       }
     },
-    "node_modules/spdx-correct": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
-      "integrity": "sha512-kN9dJbvnySHULIluDHy32WHRUu3Og7B9sbY7tsFLctQkIqnMh3hErYgdMjTYuqmcXX+lK5T1lnUt3G7zNswmZA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "spdx-expression-parse": "^3.0.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
-    "node_modules/spdx-exceptions": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
-      "integrity": "sha512-PiU42r+xO4UbUS1buo3LPJkjlO7430Xn5SVAhdpzzsPHsjbYVflnnFdATgabnLude+Cqu25p6N+g2lw/PFsa4w==",
-      "dev": true,
-      "license": "CC-BY-3.0"
-    },
-    "node_modules/spdx-expression-parse": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
-      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "spdx-exceptions": "^2.1.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
-    "node_modules/spdx-license-ids": {
-      "version": "3.0.22",
-      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.22.tgz",
-      "integrity": "sha512-4PRT4nh1EImPbt2jASOKHX7PB7I+e4IWNLvkKFDxNhJlfjbYlleYQh285Z/3mPTHSAK/AvdMmw5BNNuYH8ShgQ==",
-      "dev": true,
-      "license": "CC0-1.0"
-    },
     "node_modules/sprintf-js": {
       "version": "1.1.3",
       "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.1.3.tgz",
@@ -5152,19 +3522,6 @@
       "license": "BSD-3-Clause",
       "optional": true
     },
-    "node_modules/ssri": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/ssri/-/ssri-12.0.0.tgz",
-      "integrity": "sha512-S7iGNosepx9RadX82oimUkvr0Ct7IjJbEbs4mJcTxst8um95J3sDYU1RBEOvdu6oL1Wek2ODI5i4MAw+dZ6cAQ==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^7.0.3"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
     "node_modules/stat-mode": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/stat-mode/-/stat-mode-1.0.0.tgz",
@@ -5176,13 +3533,13 @@
       }
     },
     "node_modules/string_decoder": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
-      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "safe-buffer": "~5.2.0"
+        "safe-buffer": "~5.1.0"
       }
     },
     "node_modules/string-width": {
@@ -5200,22 +3557,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/string-width-cjs": {
-      "name": "string-width",
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/strip-ansi": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
@@ -5229,53 +3570,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/strip-ansi-cjs": {
-      "name": "strip-ansi",
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-bom": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
-      "integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/strip-outer": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/strip-outer/-/strip-outer-1.0.1.tgz",
-      "integrity": "sha512-k55yxKHwaXnpYGsOzg4Vl8+tDrWylxDEpknGjhTiZB8dFRU5rTo9CAzeycivxV3s+zlTKwrs6WxMxR95n26kwg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "escape-string-regexp": "^1.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/strip-outer/node_modules/escape-string-regexp": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
-      "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8.0"
-      }
-    },
     "node_modules/sumchecker": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/sumchecker/-/sumchecker-3.0.1.tgz",
@@ -5302,98 +3596,31 @@
         "node": ">=8"
       }
     },
-    "node_modules/supports-preserve-symlinks-flag": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
-      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
     "node_modules/tar": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-6.2.1.tgz",
-      "integrity": "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==",
+      "version": "7.5.22",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
+      "integrity": "sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "chownr": "^2.0.0",
-        "fs-minipass": "^2.0.0",
-        "minipass": "^5.0.0",
-        "minizlib": "^2.1.1",
-        "mkdirp": "^1.0.3",
-        "yallist": "^4.0.0"
+        "@isaacs/fs-minipass": "^4.0.0",
+        "chownr": "^3.0.0",
+        "minipass": "^7.1.2",
+        "minizlib": "^3.1.0",
+        "yallist": "^5.0.0"
       },
       "engines": {
-        "node": ">=10"
+        "node": ">=18"
       }
     },
-    "node_modules/tar/node_modules/fs-minipass": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz",
-      "integrity": "sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/tar/node_modules/fs-minipass/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/tar/node_modules/minipass": {
+    "node_modules/tar/node_modules/yallist": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-5.0.0.tgz",
-      "integrity": "sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
+      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/tar/node_modules/minizlib": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz",
-      "integrity": "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "minipass": "^3.0.0",
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
-    "node_modules/tar/node_modules/minizlib/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
+        "node": ">=18"
       }
     },
     "node_modules/temp": {
@@ -5402,6 +3629,7 @@
       "integrity": "sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "mkdirp": "^0.5.1",
         "rimraf": "~2.6.2"
@@ -5437,9 +3665,9 @@
       }
     },
     "node_modules/temp-file/node_modules/jsonfile": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.0.tgz",
-      "integrity": "sha512-FGuPw30AdOIUTRMC2OMRtQV+jkVj2cfPqSeWXv1NEAJ1qZ5zb1X6z1mFhbfOB/iy3ssJCD+3KuZ8r8C3uVFlAg==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5459,19 +3687,6 @@
         "node": ">= 10.0.0"
       }
     },
-    "node_modules/temp/node_modules/mkdirp": {
-      "version": "0.5.6",
-      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
-      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "minimist": "^1.2.6"
-      },
-      "bin": {
-        "mkdirp": "bin/cmd.js"
-      }
-    },
     "node_modules/tiny-async-pool": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/tiny-async-pool/-/tiny-async-pool-1.3.0.tgz",
@@ -5493,14 +3708,14 @@
       }
     },
     "node_modules/tinyglobby": {
-      "version": "0.2.15",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
-      "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "fdir": "^6.5.0",
-        "picomatch": "^4.0.3"
+        "picomatch": "^4.0.4"
       },
       "engines": {
         "node": ">=12.0.0"
@@ -5510,9 +3725,9 @@
       }
     },
     "node_modules/tmp": {
-      "version": "0.2.5",
-      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.5.tgz",
-      "integrity": "sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==",
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.2.7.tgz",
+      "integrity": "sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5529,29 +3744,6 @@
         "tmp": "^0.2.0"
       }
     },
-    "node_modules/trim-repeated": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/trim-repeated/-/trim-repeated-1.0.0.tgz",
-      "integrity": "sha512-pkonvlKk8/ZuR0D5tLW8ljt5I8kmxp2XKymhepUeOdCEfKpZaktSArkLHZt76OB1ZvO9bssUsDty4SWhLvZpLg==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "escape-string-regexp": "^1.0.2"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/trim-repeated/node_modules/escape-string-regexp": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
-      "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.8.0"
-      }
-    },
     "node_modules/truncate-utf8-bytes": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/truncate-utf8-bytes/-/truncate-utf8-bytes-1.0.2.tgz",
@@ -5562,6 +3754,13 @@
         "utf8-byte-length": "^1.0.1"
       }
     },
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "dev": true,
+      "license": "0BSD"
+    },
     "node_modules/type-fest": {
       "version": "0.13.1",
       "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.13.1.tgz",
@@ -5576,39 +3775,23 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/undici": {
+      "version": "6.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
+      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
+      }
+    },
     "node_modules/undici-types": {
-      "version": "5.26.5",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
-      "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==",
+      "version": "7.18.2",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
+      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/unique-filename": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-4.0.0.tgz",
-      "integrity": "sha512-XSnEewXmQ+veP7xX2dS5Q4yZAvO40cBN2MWkJ7D/6sW4Dg6wYBNwM1Vrnz1FhH5AdeLIlUXRI9e28z1YZi71NQ==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "unique-slug": "^5.0.0"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
-    "node_modules/unique-slug": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/unique-slug/-/unique-slug-5.0.0.tgz",
-      "integrity": "sha512-9OdaqO5kwqR+1kVgHAhsp5vPNU0hnxRa26rBFNfNgM7M6pNtgzeBn3s/xbyCQL3dcjzOatcef6UUHpB/6MaETg==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "imurmurhash": "^0.1.4"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
     "node_modules/universalify": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.1.2.tgz",
@@ -5619,14 +3802,56 @@
         "node": ">= 4.0.0"
       }
     },
-    "node_modules/uri-js": {
-      "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
-      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
+    "node_modules/unzipper": {
+      "version": "0.12.5",
+      "resolved": "https://registry.npmjs.org/unzipper/-/unzipper-0.12.5.tgz",
+      "integrity": "sha512-tXYOi9R57Uj/2Z25SOs5RRSzq886MBQj2gY8dPL+xl/kv6s6SvByoKfAtvfVeEuhntWDgjd2o9p2lb4TVPAz0A==",
       "dev": true,
-      "license": "BSD-2-Clause",
+      "license": "MIT",
       "dependencies": {
-        "punycode": "^2.1.0"
+        "bluebird": "~3.7.2",
+        "duplexer2": "~0.1.4",
+        "fs-extra": "11.3.1",
+        "graceful-fs": "^4.2.2",
+        "node-int64": "^0.4.0"
+      }
+    },
+    "node_modules/unzipper/node_modules/fs-extra": {
+      "version": "11.3.1",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.1.tgz",
+      "integrity": "sha512-eXvGGwZ5CL17ZSwHWd3bbgk7UUpF6IFHtP57NYYakPvHOs8GDgDe5KJI36jIJzDkJ6eJjuzRA8eBQb6SkKue0g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.14"
+      }
+    },
+    "node_modules/unzipper/node_modules/jsonfile": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "universalify": "^2.0.0"
+      },
+      "optionalDependencies": {
+        "graceful-fs": "^4.1.6"
+      }
+    },
+    "node_modules/unzipper/node_modules/universalify": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
+      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 10.0.0"
       }
     },
     "node_modules/utf8-byte-length": {
@@ -5643,41 +3868,18 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/validate-npm-package-license": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz",
-      "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "spdx-correct": "^3.0.0",
-        "spdx-expression-parse": "^3.0.0"
-      }
-    },
-    "node_modules/verror": {
-      "version": "1.10.1",
-      "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.1.tgz",
-      "integrity": "sha512-veufcmxri4e3XSrT0xwfUR7kguIkaxBeosDg00yDWhk49wdwkSUrvvsm7nc75e1PUyvIeZj6nS8VQRYz2/S4Xg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "assert-plus": "^1.0.0",
-        "core-util-is": "1.0.2",
-        "extsprintf": "^1.2.0"
-      },
-      "engines": {
-        "node": ">=0.6.0"
-      }
-    },
-    "node_modules/wcwidth": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/wcwidth/-/wcwidth-1.0.1.tgz",
-      "integrity": "sha512-XHPEwS0q6TaxcvG85+8EYkbiCux2XtWG2mkc47Ng2A77BQu9+DqIOJldST4HgPkuea7dvKSj5VgX3P1d4rW8Tg==",
+    "node_modules/webcrypto-core": {
+      "version": "1.9.2",
+      "resolved": "https://registry.npmjs.org/webcrypto-core/-/webcrypto-core-1.9.2.tgz",
+      "integrity": "sha512-gsXecm82UQNlTBURJGuqOWy1Ww08S3kZUcr3aOJS02Pk0xLtkfeUAVC0u0xhgdonFme80edSJUIJyuvL/7250Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "defaults": "^1.0.3"
+        "@peculiar/asn1-schema": "^2.7.0",
+        "@peculiar/json-schema": "^1.1.12",
+        "@peculiar/utils": "^2.0.2",
+        "asn1js": "^3.0.10",
+        "tslib": "^2.8.1"
       }
     },
     "node_modules/which": {
@@ -5714,25 +3916,6 @@
         "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
       }
     },
-    "node_modules/wrap-ansi-cjs": {
-      "name": "wrap-ansi",
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
-      }
-    },
     "node_modules/wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
@@ -5768,9 +3951,9 @@
       "license": "ISC"
     },
     "node_modules/yargs": {
-      "version": "17.7.2",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz",
-      "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==",
+      "version": "17.7.3",
+      "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.3.tgz",
+      "integrity": "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5796,17 +3979,6 @@
         "node": ">=12"
       }
     },
-    "node_modules/yauzl": {
-      "version": "2.10.0",
-      "resolved": "https://registry.npmjs.org/yauzl/-/yauzl-2.10.0.tgz",
-      "integrity": "sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "buffer-crc32": "~0.2.3",
-        "fd-slicer": "~1.1.0"
-      }
-    },
     "node_modules/yocto-queue": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
diff --git a/package.json b/package.json
index 712ee0c..db926ae 100644
--- a/package.json
+++ b/package.json
@@ -1,15 +1,16 @@
 {
   "name": "alta-api-client",
-  "version": "1.0.0",
-  "description": "Electron app for connecting to Alta API",
+  "version": "1.1.0",
+  "description": "Secure Windows Electron client for the Alta Camera Proxy",
   "main": "main.js",
   "scripts": {
     "start": "electron .",
     "dev": "electron . --dev",
     "test": "node --test test/*.test.js",
-    "check": "node --check main.js && node --check preload.js && node --check renderer.js && node --check src/electron-runtime.js && node --check chrome-extension/popup.js && npm test",
+    "check": "node scripts/verify-kit.js && npm test",
+    "audit:prod": "npm audit --omit=dev --audit-level=low",
     "build": "electron-builder --win --publish=never",
-    "build-test": "electron-builder --win --dir",
+    "build-test": "electron-builder --win --dir --publish=never",
     "build-kit": "powershell -ExecutionPolicy Bypass -File build-kit.ps1",
     "prebuild": "echo Checking build requirements..."
   },
@@ -19,15 +20,24 @@
     "directories": {
       "output": "dist"
     },
+    "files": [
+      "main.js",
+      "preload.js",
+      "renderer.js",
+      "index.html",
+      "styles.css",
+      "src/**/*",
+      "chrome-extension/**/*",
+      "assets/**/*",
+      "package.json"
+    ],
     "win": {
       "target": "portable",
-      "icon": "assets/icon.png",
-      "signAndEditExecutable": false
+      "icon": "assets/icon.png"
     },
     "portable": {
       "artifactName": "AltaCameraProxy-${version}-portable.exe"
-    },
-    "forceCodeSigning": false
+    }
   },
   "keywords": [
     "electron",
@@ -35,15 +45,13 @@
     "api",
     "avigilon"
   ],
-  "author": "Your Name",
+  "author": "Peji",
   "license": "MIT",
   "devDependencies": {
-    "electron": "^28.0.0",
-    "electron-builder": "^26.4.0",
-    "electron-packager": "^17.1.2"
+    "electron": "43.4.1",
+    "electron-builder": "26.15.3"
   },
   "dependencies": {
-    "axios": "^1.6.0",
-    "crypto-js": "^4.2.0"
+    "axios": "1.19.0"
   }
 }
diff --git a/scripts/verify-kit.js b/scripts/verify-kit.js
new file mode 100644
index 0000000..b7168b4
--- /dev/null
+++ b/scripts/verify-kit.js
@@ -0,0 +1,224 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const zlib = require('node:zlib');
+const { spawnSync } = require('node:child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const REQUIRED_EXTENSION_FILES = Object.freeze([
+  'manifest.json', 'popup.html', 'popup.js', 'popup.css',
+  'options.html', 'options.js', 'options.css',
+]);
+const TEXT_EXTENSIONS = new Set(['.css', '.html', '.js', '.json', '.md', '.ps1', '.yml', '.yaml']);
+const FORBIDDEN_PATTERNS = Object.freeze([
+  ['legacy bridge token', /apt-local-bridge-token/i],
+  ['legacy pairing header', /X-APT-Token/i],
+  ['legacy cookie proxy', /cookie-proxy-/i],
+  ['GitHub release API', /api\.github\.com/i],
+  ['executable updater', /download-and-install-update/i],
+  ['broad process termination', /taskkill/i],
+]);
+
+function fail(message) {
+  throw new Error(message);
+}
+
+function normalizeRelative(name) {
+  if (typeof name !== 'string' || name.length === 0 || name.includes('\0')) fail(`Unsafe empty or NUL path: ${name}`);
+  const unix = name.replaceAll('\\', '/');
+  if (unix.startsWith('/') || /^[A-Za-z]:\//.test(unix)) fail(`Unsafe absolute path: ${name}`);
+  const normalized = path.posix.normalize(unix);
+  if (normalized === '..' || normalized.startsWith('../')) fail(`Unsafe parent path: ${name}`);
+  return normalized.replace(/^\.\//, '');
+}
+
+function assertTextPolicy(name, content) {
+  for (const [label, pattern] of FORBIDDEN_PATTERNS) {
+    if (pattern.test(content)) fail(`Forbidden ${label} string in ${name}`);
+  }
+}
+
+function listDirectory(root, { ignoreTopLevel = [] } = {}) {
+  const absoluteRoot = path.resolve(root);
+  if (!fs.statSync(absoluteRoot).isDirectory()) fail(`Expected a directory: ${root}`);
+  const files = new Map();
+  const ignored = new Set(ignoreTopLevel);
+  const walk = (directory) => {
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const absolute = path.join(directory, entry.name);
+      const relative = normalizeRelative(path.relative(absoluteRoot, absolute));
+      if (!relative.includes('/') && ignored.has(relative)) continue;
+      if (entry.isSymbolicLink()) fail(`Unsafe symbolic link: ${relative}`);
+      if (entry.isDirectory()) walk(absolute);
+      else if (entry.isFile()) files.set(relative, () => fs.readFileSync(absolute));
+      else fail(`Unsupported filesystem entry: ${relative}`);
+    }
+  };
+  walk(absoluteRoot);
+  return files;
+}
+
+function findEndOfCentralDirectory(buffer) {
+  const minimum = Math.max(0, buffer.length - 65_557);
+  for (let offset = buffer.length - 22; offset >= minimum; offset -= 1) {
+    if (buffer.readUInt32LE(offset) === 0x06054b50) return offset;
+  }
+  fail('Invalid ZIP: end-of-central-directory record not found');
+}
+
+function listZip(zipPath) {
+  const zip = fs.readFileSync(zipPath);
+  const end = findEndOfCentralDirectory(zip);
+  const entryCount = zip.readUInt16LE(end + 10);
+  let offset = zip.readUInt32LE(end + 16);
+  const files = new Map();
+
+  for (let index = 0; index < entryCount; index += 1) {
+    if (zip.readUInt32LE(offset) !== 0x02014b50) fail('Invalid ZIP central-directory entry');
+    const flags = zip.readUInt16LE(offset + 8);
+    const method = zip.readUInt16LE(offset + 10);
+    const compressedSize = zip.readUInt32LE(offset + 20);
+    const uncompressedSize = zip.readUInt32LE(offset + 24);
+    const nameLength = zip.readUInt16LE(offset + 28);
+    const extraLength = zip.readUInt16LE(offset + 30);
+    const commentLength = zip.readUInt16LE(offset + 32);
+    const externalAttributes = zip.readUInt32LE(offset + 38);
+    const localOffset = zip.readUInt32LE(offset + 42);
+    const name = normalizeRelative(zip.subarray(offset + 46, offset + 46 + nameLength).toString('utf8'));
+    offset += 46 + nameLength + extraLength + commentLength;
+    if (name.endsWith('/')) continue;
+    const unixMode = externalAttributes >>> 16;
+    if ((unixMode & 0o170000) === 0o120000) fail(`Unsafe ZIP symbolic link: ${name}`);
+    if ((flags & 1) !== 0) fail(`Encrypted ZIP entries are unsupported: ${name}`);
+    if (files.has(name)) fail(`Duplicate ZIP entry: ${name}`);
+
+    files.set(name, () => {
+      if (zip.readUInt32LE(localOffset) !== 0x04034b50) fail(`Invalid ZIP local entry: ${name}`);
+      const localNameLength = zip.readUInt16LE(localOffset + 26);
+      const localExtraLength = zip.readUInt16LE(localOffset + 28);
+      const start = localOffset + 30 + localNameLength + localExtraLength;
+      const compressed = zip.subarray(start, start + compressedSize);
+      const content = method === 0 ? compressed : method === 8 ? zlib.inflateRawSync(compressed) : fail(`Unsupported ZIP method ${method}: ${name}`);
+      if (content.length !== uncompressedSize) fail(`Invalid ZIP size for ${name}`);
+      return content;
+    });
+  }
+  return files;
+}
+
+function listAsar(asarPath) {
+  const asar = require('@electron/asar');
+  const files = new Map();
+  for (const archiveName of asar.listPackage(asarPath)) {
+    if (!archiveName.startsWith('/')) fail(`Unsafe ASAR path: ${archiveName}`);
+    const name = normalizeRelative(archiveName.slice(1));
+    let stat;
+    try {
+      stat = asar.statFile(asarPath, name);
+    } catch (error) {
+      fail(`Invalid ASAR entry ${name}: ${error.message}`);
+    }
+    if (!Number.isSafeInteger(stat.size)) continue;
+    if (!name.startsWith('node_modules/')) files.set(name, () => asar.extractFile(asarPath, name));
+  }
+  return files;
+}
+
+function findFile(files, suffix) {
+  const matches = [...files.keys()].filter((name) => name === suffix || name.endsWith(`/${suffix}`));
+  if (matches.length !== 1) fail(`Expected exactly one ${suffix}, found ${matches.length}`);
+  return matches[0];
+}
+
+function verifyExtension(files, expectedVersion) {
+  const manifestName = findFile(files, 'chrome-extension/manifest.json');
+  const extensionRoot = manifestName.slice(0, -'manifest.json'.length);
+  for (const required of REQUIRED_EXTENSION_FILES) {
+    if (!files.has(`${extensionRoot}${required}`)) fail(`Missing expected extension file: ${required}`);
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(files.get(manifestName)().toString('utf8'));
+  } catch (error) {
+    fail(`Invalid extension manifest: ${error.message}`);
+  }
+  if (manifest.version !== expectedVersion) {
+    fail(`Extension version ${manifest.version} does not match application version ${expectedVersion}`);
+  }
+}
+
+function verifyTextFiles(files) {
+  for (const [name, load] of files) {
+    if (TEXT_EXTENSIONS.has(path.extname(name).toLowerCase())) assertTextPolicy(name, load().toString('utf8'));
+  }
+}
+
+function verifySyntax(files) {
+  const javascript = [...files.keys()].filter((name) => name.endsWith('.js'));
+  javascript.push('scripts/verify-kit.js');
+  for (const name of javascript) {
+    const result = spawnSync(process.execPath, ['--check', path.join(ROOT, name)], { encoding: 'utf8' });
+    if (result.status !== 0) fail(`JavaScript syntax check failed for ${name}: ${result.stderr.trim()}`);
+  }
+}
+
+function verifySource() {
+  const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
+  const lock = JSON.parse(fs.readFileSync(path.join(ROOT, 'package-lock.json'), 'utf8'));
+  const files = listDirectory(ROOT, { ignoreTopLevel: ['.git', 'dist', 'node_modules'] });
+  verifyExtension(files, pkg.version);
+  for (const [label, version] of [['lockfile', lock.version], ['lockfile root package', lock.packages?.['']?.version]]) {
+    if (version !== pkg.version) fail(`${label} version ${version} does not match application version ${pkg.version}`);
+  }
+  const productionRoots = ['main.js', 'preload.js', 'renderer.js', 'index.html', 'src/', 'chrome-extension/'];
+  const productionFiles = new Map([...files].filter(([name]) =>
+    productionRoots.some((root) => name === root || name.startsWith(root))
+  ));
+  verifyTextFiles(productionFiles);
+  verifySyntax(productionFiles);
+  return pkg.version;
+}
+
+function verifySupplied(target, expectedVersion, mode) {
+  const absolute = path.resolve(target);
+  if (!fs.existsSync(absolute)) fail(`Supplied ${mode} does not exist: ${target}`);
+  const isDirectory = fs.statSync(absolute).isDirectory();
+  const files = isDirectory ? listDirectory(absolute) : listZip(absolute);
+  const hostNames = [...files.keys()];
+  if (mode === 'build' && !hostNames.includes('chrome-extension/manifest.json')) {
+    const asarName = hostNames.find((name) => /(?:^|\/)resources\/app\.asar$/i.test(name));
+    if (!asarName || !isDirectory) fail('Missing packaged app.asar in supplied build');
+    for (const [name, load] of listAsar(path.join(absolute, asarName))) files.set(name, load);
+  }
+  verifyExtension(files, expectedVersion);
+  verifyTextFiles(files);
+  if (!hostNames.some((name) => /(?:^|\/)Alta(?:CameraProxy| Camera Proxy)(?:-[^/]*)?\.exe$/i.test(name))) {
+    fail(`Missing expected APT executable in supplied ${mode}`);
+  }
+  if (mode === 'kit' && !hostNames.some((name) => /(?:^|\/)aware-cam-proxy\.exe$/i.test(name))) {
+    fail('Missing expected aware-cam-proxy.exe in supplied kit');
+  }
+}
+
+function main(argv) {
+  const version = verifySource();
+  if (argv.length > 0) {
+    const buildMode = argv[0] === '--build';
+    const target = buildMode ? argv[1] : argv[0];
+    if (!target || argv.length !== (buildMode ? 2 : 1)) fail('Usage: node scripts/verify-kit.js [--build <directory>|<kit-directory-or-zip>]');
+    verifySupplied(target, version, buildMode ? 'build' : 'kit');
+  }
+  process.stdout.write(`APT source${argv.length ? ' and supplied artifact' : ''} verified at version ${version}.\n`);
+}
+
+if (require.main === module) {
+  try {
+    main(process.argv.slice(2));
+  } catch (error) {
+    process.stderr.write(`Verification failed: ${error.message}\n`);
+    process.exitCode = 1;
+  }
+}
+
+module.exports = { normalizeRelative, verifySource, verifySupplied };
diff --git a/test/build-contract.test.js b/test/build-contract.test.js
new file mode 100644
index 0000000..f26198a
--- /dev/null
+++ b/test/build-contract.test.js
@@ -0,0 +1,97 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const ROOT = path.join(__dirname, '..');
+const read = (name) => fs.readFileSync(path.join(ROOT, name), 'utf8');
+const readJson = (name) => JSON.parse(read(name));
+
+function writeKit(root, { version = '1.1.0', legacy = false } = {}) {
+  const extension = path.join(root, 'chrome-extension');
+  fs.mkdirSync(extension, { recursive: true });
+  fs.writeFileSync(path.join(root, 'AltaCameraProxy.exe'), 'synthetic executable');
+  fs.writeFileSync(path.join(root, 'aware-cam-proxy.exe'), 'synthetic helper');
+  for (const name of ['popup.html', 'popup.js', 'popup.css', 'options.html', 'options.js', 'options.css']) {
+    fs.writeFileSync(path.join(extension, name), legacy && name === 'popup.js' ? 'apt-local-bridge-token' : `'use strict';`);
+  }
+  fs.writeFileSync(path.join(extension, 'manifest.json'), JSON.stringify({
+    manifest_version: 3,
+    name: 'Alta Proxy Tool Bridge',
+    version,
+  }));
+}
+
+test('application and extension versions and supported dependencies stay coordinated', () => {
+  const pkg = readJson('package.json');
+  const lock = readJson('package-lock.json');
+  const manifest = readJson('chrome-extension/manifest.json');
+
+  assert.equal(pkg.version, '1.1.0');
+  assert.equal(manifest.version, pkg.version);
+  assert.equal(lock.version, pkg.version);
+  assert.equal(lock.packages[''].version, pkg.version);
+  assert.deepEqual(pkg.dependencies, { axios: '1.19.0' });
+  assert.deepEqual(pkg.devDependencies, {
+    electron: '43.4.1',
+    'electron-builder': '26.15.3',
+  });
+  for (const removed of ['crypto-js', 'electron-packager']) {
+    assert.equal(pkg.dependencies?.[removed], undefined);
+    assert.equal(pkg.devDependencies?.[removed], undefined);
+  }
+});
+
+test('build remains Windows portable without misleading signing overrides', () => {
+  const pkg = readJson('package.json');
+  assert.equal(pkg.build.win.target, 'portable');
+  assert.equal(pkg.build.portable.artifactName, 'AltaCameraProxy-${version}-portable.exe');
+  assert.equal(Object.hasOwn(pkg.build.win, 'signAndEditExecutable'), false);
+  assert.equal(Object.hasOwn(pkg.build, 'forceCodeSigning'), false);
+  assert.equal(pkg.scripts['audit:prod'], 'npm audit --omit=dev --audit-level=low');
+  assert.match(pkg.scripts.check, /verify-kit/);
+});
+
+test('GitPeji CI is build-only and runs all hardening gates on Node 22', () => {
+  const workflow = read('.gitea/workflows/ci.yml');
+  assert.match(workflow, /actions\/checkout@v4/);
+  assert.match(workflow, /actions\/setup-node@v4/);
+  assert.match(workflow, /node-version:\s*['"]?22['"]?/);
+  for (const command of ['npm ci', 'npm run check', 'npm run audit:prod', 'npm run build-test']) {
+    assert.ok(workflow.includes(command), `missing CI command: ${command}`);
+  }
+  assert.match(workflow, /verify-kit\.js\s+--build\s+dist\/win-unpacked/);
+  assert.doesNotMatch(workflow, /npm\s+(?:publish|run\s+(?:release|deploy))|actions\/(?:upload-release|deploy)|git\s+push/i);
+  assert.doesNotMatch(workflow, /secrets\./);
+});
+
+test('kit verifier accepts a complete synthetic kit and rejects version drift and legacy strings', () => {
+  const valid = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-kit-valid-'));
+  writeKit(valid);
+  const accepted = spawnSync(process.execPath, ['scripts/verify-kit.js', valid], { cwd: ROOT, encoding: 'utf8' });
+  assert.equal(accepted.status, 0, accepted.stderr || accepted.stdout);
+
+  const drifted = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-kit-drift-'));
+  writeKit(drifted, { version: '1.0.0' });
+  const rejectedDrift = spawnSync(process.execPath, ['scripts/verify-kit.js', drifted], { cwd: ROOT, encoding: 'utf8' });
+  assert.notEqual(rejectedDrift.status, 0);
+  assert.match(rejectedDrift.stderr, /version/i);
+
+  const legacy = fs.mkdtempSync(path.join(os.tmpdir(), 'apt-kit-legacy-'));
+  writeKit(legacy, { legacy: true });
+  const rejectedLegacy = spawnSync(process.execPath, ['scripts/verify-kit.js', legacy], { cwd: ROOT, encoding: 'utf8' });
+  assert.notEqual(rejectedLegacy.status, 0);
+  assert.match(rejectedLegacy.stderr, /forbidden/i);
+});
+
+test('kit verifier rejects unsafe relative archive paths', () => {
+  const { normalizeRelative } = require('../scripts/verify-kit');
+  for (const unsafe of ['../escape', 'folder/../../escape', '/absolute', 'C:\\absolute']) {
+    assert.throws(() => normalizeRelative(unsafe), /unsafe/i);
+  }
+  assert.equal(normalizeRelative('chrome-extension\\manifest.json'), 'chrome-extension/manifest.json');
+});

From 582fc46914ba0eadc3810a950d85cc1ab9afd2aa Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Wed, 19 Aug 2026 22:10:01 +0000
Subject: [PATCH 09/22] fix: enforce fresh Alta error boundaries

---
 src/alta-client.js       |  6 +----
 test/alta-client.test.js | 51 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+), 5 deletions(-)

diff --git a/src/alta-client.js b/src/alta-client.js
index 6ea04ce..f2a53a1 100644
--- a/src/alta-client.js
+++ b/src/alta-client.js
@@ -98,15 +98,11 @@ function enforceResponseSize(data, headers, maxBytes) {
 }
 
 function safeTransportError(operation, error, cookie) {
-  if (error && typeof error === 'object' && typeof error.code === 'string' && error.code.startsWith('ALTA_')) {
-    return error;
-  }
   const formatted = formatAltaError(operation, error, { secrets: [cookie, `va=${cookie}`] });
-  const safe = altaError(formatted.code, formatted.message, {
+  return altaError(formatted.code, formatted.message, {
     status: formatted.status,
     timeout: formatted.timeout,
   });
-  return safe;
 }
 
 class AltaClient {
diff --git a/test/alta-client.test.js b/test/alta-client.test.js
index dfc5f1f..b33c295 100644
--- a/test/alta-client.test.js
+++ b/test/alta-client.test.js
@@ -167,6 +167,57 @@ test('rejects malformed response envelopes, JSON, status and endpoint data shape
   await assert.rejects(authClient.getAuthInfo(), { code: 'INVALID_ALTA_RESPONSE_DATA' });
 });
 
+test('returns a fresh allowlisted error when transport throws an ALTA error with secret-bearing fields', async () => {
+  const source = Object.assign(new Error(`Alta request failed for va=${SENTINEL}`), {
+    code: 'ALTA_TRANSPORT_FAILURE',
+    status: 503,
+    timeout: true,
+    config: { headers: { Cookie: `va=${SENTINEL}` }, data: SENTINEL },
+    request: { headers: { Cookie: `va=${SENTINEL}` }, body: SENTINEL },
+    response: { status: 502, headers: { 'set-cookie': `va=${SENTINEL}` }, data: SENTINEL },
+    body: SENTINEL,
+  });
+  const client = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async () => { throw source; },
+  });
+
+  const caught = await client.getDevices().catch((error) => error);
+  assert.notEqual(caught, source);
+  assert.equal(caught.code, 'ALTA_TRANSPORT_FAILURE');
+  assert.equal(caught.message, 'Alta request failed for va=[REDACTED]');
+  assert.equal(caught.status, 502);
+  assert.equal(caught.timeout, true);
+  assert.deepEqual(Object.keys(caught).sort(), ['code', 'status', 'timeout']);
+  for (const field of ['config', 'request', 'response', 'headers', 'data', 'body']) {
+    assert.equal(field in caught, false, field);
+  }
+  assert.doesNotMatch(JSON.stringify(caught), new RegExp(SENTINEL));
+});
+
+test('safely formats a transport error whose code getter throws a secret', async () => {
+  const source = new Error('Transport failed safely');
+  Object.defineProperty(source, 'code', {
+    enumerable: true,
+    get() { throw new Error(SENTINEL); },
+  });
+  source.config = { headers: { Cookie: `va=${SENTINEL}` } };
+  const client = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async () => { throw source; },
+  });
+
+  const caught = await client.getDevices().catch((error) => error);
+  assert.notEqual(caught, source);
+  assert.equal(caught.code, 'ALTA_ERROR');
+  assert.equal(caught.message, 'Transport failed safely');
+  assert.equal(caught.status, null);
+  assert.equal(caught.timeout, false);
+  assert.deepEqual(Object.keys(caught).sort(), ['code', 'status', 'timeout']);
+  assert.equal('config' in caught, false);
+  assert.doesNotMatch(JSON.stringify(caught), new RegExp(SENTINEL));
+});
+
 test('revalidates the stored origin before each request', async () => {
   const store = { requireSession: () => Object.freeze({ origin: 'https://evil.example', cookie: SENTINEL }) };
   let called = false;

From 808698dc46c39c821da3d355631660275f7ed2bd Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Wed, 19 Aug 2026 22:26:47 +0000
Subject: [PATCH 10/22] fix: keep Alta bearer out of proxy command lines

---
 .github/workflows/deploy-pages.yml            | 37 --------------
 README.md                                     |  5 +-
 .../2026-08-19-apt-security-foundation.md     |  8 +--
 docs/security/2026-08-security-baseline.md    |  4 +-
 index.html                                    |  6 +++
 main.js                                       |  2 +-
 package.json                                  |  1 +
 preload.js                                    |  2 +-
 renderer-controller.js                        | 41 +++++++++++++++
 renderer.js                                   | 32 ++++++++----
 src/electron-runtime.js                       |  9 ++--
 src/proxy-launch.js                           | 31 ++++++------
 test/proxy-launch.test.js                     | 39 +++++++--------
 test/renderer-controller.test.js              | 41 +++++++++++++++
 test/runtime-contract.test.js                 | 50 +++++++++++++++++--
 15 files changed, 207 insertions(+), 101 deletions(-)
 delete mode 100644 .github/workflows/deploy-pages.yml
 create mode 100644 renderer-controller.js
 create mode 100644 test/renderer-controller.test.js

diff --git a/.github/workflows/deploy-pages.yml b/.github/workflows/deploy-pages.yml
deleted file mode 100644
index 4892639..0000000
--- a/.github/workflows/deploy-pages.yml
+++ /dev/null
@@ -1,37 +0,0 @@
-name: Deploy GitHub Pages
-
-on:
-  push:
-    branches: [master]
-    paths:
-      - 'docs/**'
-      - '.github/workflows/deploy-pages.yml'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
-concurrency:
-  group: pages
-  cancel-in-progress: false
-
-jobs:
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Configure Pages
-        uses: actions/configure-pages@v5
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
-        with:
-          path: docs
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@v4
diff --git a/README.md b/README.md
index 3e06161..974b6c2 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ APT is a Windows Electron desktop app that imports an existing Alta Video sessio
 - The renderer receives only connection origin/state, device/site/auth responses, and owned proxy metadata. It never receives or supplies the Alta session value.
 - The bridge listens only on `127.0.0.1:18247`, accepts only the committed extension origin, requires the `X-APT-Pairing` secret, limits concurrent/body/deadline work, and validates an exact canonical Alta HTTPS origin.
 - The pairing envelope is a scrypt hash stored atomically under Electron `userData` with restrictive permissions. The plaintext secret is shown once on first run or rotation. Revoke invalidates it.
-- Proxy launch is a direct `spawn` of the fixed helper with `shell: false`; stop actions can target only children owned by this app.
+- Proxy launch is a direct, detached `spawn` of the fixed helper with `shell: false`. Its exact arguments are deployment host, non-secret Alta username/email, and selected device UUID; no session bearer, password, or 2FA value reaches the command line. Stop actions can target only children owned by this app.
 - Updates are **check-only**. APT checks the exact GitPeji release API and can open only `https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases` in the system browser. It never downloads, replaces, or executes an update.
 
 ## Requirements
@@ -30,7 +30,8 @@ npm start
 2. Start APT. Under **Bridge Pairing**, copy the one-time secret.
 3. Open the extension pairing settings, paste the secret, and save it.
 4. Visit your Alta deployment in Chrome and use **Send to APT**.
-5. Select a local camera and choose **Start Proxy**.
+5. Select a local camera, enter your Alta username/email, and choose **Start Proxy**.
+6. Complete the password and 2FA prompts in the helper's visible Windows console. APT does not collect or pass those secrets.
 
 Use **Generate / Rotate** if a pairing may have been exposed, then update the extension. Use **Revoke** to immediately disable bridge authentication.
 
diff --git a/docs/plans/2026-08-19-apt-security-foundation.md b/docs/plans/2026-08-19-apt-security-foundation.md
index d2484a3..dba08e9 100644
--- a/docs/plans/2026-08-19-apt-security-foundation.md
+++ b/docs/plans/2026-08-19-apt-security-foundation.md
@@ -36,7 +36,7 @@ Feature discovery begins only after Phase A passes independent security review a
 
 ## Non-negotiable guardrails
 
-- GitPeji is the only source of truth. Do not fetch from, push to, publish on, or update from GitHub.
+- GitPeji is the only source of truth. Do not fetch from, push to, publish on, or update from alternate source hosts.
 - Use a fresh worktree from GitPeji `master` at `a80074ac57b7a4517837b5d95754f5e6433df3ac` or newer.
 - Preserve current Tool Hub downloads and production visibility until Zac approves replacement.
 - Do not use real Alta cookies in automated tests; use conspicuous synthetic sentinels.
@@ -73,7 +73,7 @@ git worktree add -b hardening/security-foundation /home/peji/worktrees/apt-secur
 git -C /home/peji/worktrees/apt-security-foundation status --short --branch
 ```
 
-**Expected:** clean branch based on exact GitPeji `origin/master`; no GitHub remote used.
+**Expected:** clean branch based on exact GitPeji `origin/master`; no alternate-host remote used.
 
 **Commit:** `docs: record APT security hardening baseline`
 
@@ -387,7 +387,7 @@ npm run check
 **Files:**
 - Create: `.gitea/workflows/ci.yml`
 - Create: `.gitea/workflows/release.yml`
-- Remove or retire: `.github/workflows/deploy-pages.yml`
+- Remove or retire the legacy alternate-host Pages workflow.
 - Modify: `docs/index.html`
 - Create: `scripts/verify-kit.js`
 
@@ -395,7 +395,7 @@ npm run check
 
 1. CI gate: `npm ci`, syntax, tests, audit policy, Windows unpacked build, kit verification, secret scan.
 2. Release gate: tag/version match, clean source, approved helper checksum, exact artifact hashes, SBOM, checksums, retained logs.
-3. Point docs/downloads to GitPeji or the approved Tool Hub route, never GitHub.
+3. Point docs/downloads to GitPeji or the approved Tool Hub route, never an alternate source host.
 4. Publish no artifact automatically until the first manual release rehearsal passes.
 5. Rehearse on a non-production candidate tag and verify fresh download/extraction.
 
diff --git a/docs/security/2026-08-security-baseline.md b/docs/security/2026-08-security-baseline.md
index d85bfd4..df20ddb 100644
--- a/docs/security/2026-08-security-baseline.md
+++ b/docs/security/2026-08-security-baseline.md
@@ -7,11 +7,11 @@
 - Implementation plan: `docs/plans/2026-08-19-apt-security-foundation.md`
 - Starting package version: `1.0.0`
 - Starting audit: 25 findings (1 critical, 22 high, 2 moderate); production-only audit 3 findings (2 high, 1 moderate)
-- Starting release state: GitPeji/GitHub split-brain, no application CI, unsafe unsigned updater, no automated tests
+- Starting release state: split release hosting, no application CI, unsafe unsigned updater, no automated tests
 
 ## Guardrails
 
-- GitPeji only; GitHub remote removed.
+- GitPeji only; alternate-host remote removed.
 - Production Tool Hub and existing downloads remain unchanged.
 - Synthetic sentinel credentials only in tests.
 - Work remains on the isolated hardening branch until review gates pass.
diff --git a/index.html b/index.html
index 9ff6456..f97b005 100644
--- a/index.html
+++ b/index.html
@@ -74,6 +74,11 @@
                             <label for="selectedDeviceId">Device UUID:</label>
                             <input type="text" id="selectedDeviceId" placeholder="Select a device from the list" readonly>
                         </div>
+                        <div class="input-row">
+                            <label for="altaUsername">Alta username / email:</label>
+                            <input type="text" id="altaUsername" maxlength="254" placeholder="name@example.com" autocomplete="username" spellcheck="false">
+                        </div>
+                        <p class="section-help">The proxy helper opens a Windows console and prompts for your password and 2FA. APT never sends those secrets on its command line.</p>
                         <div class="proxy-buttons">
                             <button type="button" id="startProxyBtn" class="btn-primary" disabled>Start Proxy</button>
                             <button type="button" id="stopProxyBtn" class="btn-outline" disabled>Stop Proxy</button>
@@ -97,6 +102,7 @@
         </div>
     </div>
 
+    <script src="renderer-controller.js"></script>
     <script src="renderer.js"></script>
 </body>
 </html>
diff --git a/main.js b/main.js
index f2dfea9..8a08077 100644
--- a/main.js
+++ b/main.js
@@ -77,7 +77,7 @@ function registerIpcHandlers() {
   registerIpc('get-devices', () => runtime.getDevices());
   registerIpc('get-device-sites', () => runtime.getDeviceSites());
   registerIpc('get-auth-info', () => runtime.getAuthInfo());
-  registerIpc('launch-proxy', (deviceId) => runtime.launchProxy(deviceId));
+  registerIpc('launch-proxy', (deviceId, username) => runtime.launchProxy(deviceId, username));
   registerIpc('stop-proxy', async (key) => {
     const result = await runtime.stopProxy(key);
     sendConnectionState();
diff --git a/package.json b/package.json
index db926ae..fec0d8e 100644
--- a/package.json
+++ b/package.json
@@ -24,6 +24,7 @@
       "main.js",
       "preload.js",
       "renderer.js",
+      "renderer-controller.js",
       "index.html",
       "styles.css",
       "src/**/*",
diff --git a/preload.js b/preload.js
index 56855af..93f85ba 100644
--- a/preload.js
+++ b/preload.js
@@ -13,7 +13,7 @@ contextBridge.exposeInMainWorld('electronAPI', Object.freeze({
   getDevices: () => ipcRenderer.invoke('get-devices'),
   getDeviceSites: () => ipcRenderer.invoke('get-device-sites'),
   getAuthInfo: () => ipcRenderer.invoke('get-auth-info'),
-  launchProxy: (deviceId) => ipcRenderer.invoke('launch-proxy', deviceId),
+  launchProxy: (deviceId, username) => ipcRenderer.invoke('launch-proxy', deviceId, username),
   stopProxy: (key) => ipcRenderer.invoke('stop-proxy', key),
   disconnect: () => ipcRenderer.invoke('disconnect'),
   getConnectionState: () => ipcRenderer.invoke('get-connection-state'),
diff --git a/renderer-controller.js b/renderer-controller.js
new file mode 100644
index 0000000..84fded4
--- /dev/null
+++ b/renderer-controller.js
@@ -0,0 +1,41 @@
+'use strict';
+
+(function exposeRendererController(globalScope) {
+  function createRendererController({
+    disconnect,
+    renderConnectionState,
+    clearDisconnectedState,
+    showConnectionStatus,
+  } = {}) {
+    if (
+      typeof disconnect !== 'function' ||
+      typeof renderConnectionState !== 'function' ||
+      typeof clearDisconnectedState !== 'function' ||
+      typeof showConnectionStatus !== 'function'
+    ) {
+      throw new TypeError('Renderer controller dependencies are invalid.');
+    }
+
+    return Object.freeze({
+      async disconnect() {
+        const result = await disconnect();
+        if (!result || result.success !== true) {
+          const message = result && typeof result.message === 'string'
+            ? result.message
+            : 'Failed to disconnect from Alta. The current connection remains active.';
+          showConnectionStatus(message, 'error');
+          return result;
+        }
+
+        renderConnectionState(result);
+        clearDisconnectedState();
+        showConnectionStatus('Disconnected from Alta.', 'info');
+        return result;
+      },
+    });
+  }
+
+  const api = Object.freeze({ createRendererController });
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  if (globalScope) globalScope.AptRendererController = api;
+}(typeof window !== 'undefined' ? window : undefined));
diff --git a/renderer.js b/renderer.js
index 8b45106..a0ed42e 100644
--- a/renderer.js
+++ b/renderer.js
@@ -7,6 +7,7 @@ const statusIndicator = document.getElementById('statusIndicator');
 const deviceSearch = document.getElementById('deviceSearch');
 const disconnectBtn = document.getElementById('disconnectBtn');
 const selectedDeviceId = document.getElementById('selectedDeviceId');
+const altaUsername = document.getElementById('altaUsername');
 const startProxyBtn = document.getElementById('startProxyBtn');
 const stopProxyBtn = document.getElementById('stopProxyBtn');
 const checkUpdateBtn = document.getElementById('checkUpdateBtn');
@@ -54,7 +55,8 @@ function renderConnectionState(state) {
 function updateProxyButtons() {
   const id = selectedDevice && (selectedDevice.guid || selectedDevice.id);
   const active = id ? activeDeviceIds().has(id.toLowerCase()) : false;
-  startProxyBtn.disabled = !connection.connected || !id || active;
+  const hasUsername = altaUsername.value.trim().length > 0;
+  startProxyBtn.disabled = !connection.connected || !id || !hasUsername || active;
   stopProxyBtn.disabled = !id || !active;
 }
 
@@ -204,14 +206,21 @@ async function loadDevices() {
   }
 }
 
+const rendererController = window.AptRendererController.createRendererController({
+  disconnect: () => window.electronAPI.disconnect(),
+  renderConnectionState,
+  clearDisconnectedState: () => {
+    allDevices = [];
+    allSites = {};
+    collapsedSites.clear();
+    altaUsername.value = '';
+    clearDeviceList();
+  },
+  showConnectionStatus: (message, type) => showStatus(connectionStatus, message, type),
+});
+
 async function handleDisconnect() {
-  const state = await window.electronAPI.disconnect();
-  renderConnectionState(state);
-  allDevices = [];
-  allSites = {};
-  collapsedSites.clear();
-  clearDeviceList();
-  showStatus(connectionStatus, 'Disconnected from Alta.', 'info');
+  await rendererController.disconnect();
 }
 
 async function handleStartProxy() {
@@ -219,7 +228,7 @@ async function handleStartProxy() {
   if (!id) return;
   startProxyBtn.disabled = true;
   showStatus(connectionStatus, `Starting proxy for ${selectedDevice.name || 'selected device'}...`, 'info');
-  const result = await window.electronAPI.launchProxy(id);
+  const result = await window.electronAPI.launchProxy(id, altaUsername.value);
   if (result.success) {
     connection = await window.electronAPI.getConnectionState();
     renderConnectionState(connection);
@@ -284,8 +293,10 @@ async function initialize() {
   renderPairingStatus(await window.electronAPI.getPairingStatus());
   if (connection.connected) await loadDevices();
   window.electronAPI.onConnectionStateChanged(async (state) => {
+    const wasConnected = connection.connected;
+    const previousOrigin = connection.origin;
     renderConnectionState(state);
-    if (state.connected) {
+    if (state.connected && (!wasConnected || state.origin !== previousOrigin)) {
       allDevices = [];
       allSites = {};
       clearDeviceList();
@@ -300,6 +311,7 @@ disconnectBtn.addEventListener('click', handleDisconnect);
 startProxyBtn.addEventListener('click', handleStartProxy);
 stopProxyBtn.addEventListener('click', handleStopProxy);
 deviceSearch.addEventListener('input', filterDevices);
+altaUsername.addEventListener('input', updateProxyButtons);
 checkUpdateBtn.addEventListener('click', () => checkForUpdates(true));
 openReleasesBtn.addEventListener('click', () => window.electronAPI.openFixedReleasesPage());
 dismissUpdateBtn.addEventListener('click', () => { updateNotice.style.display = 'none'; });
diff --git a/src/electron-runtime.js b/src/electron-runtime.js
index a65926c..cfdf200 100644
--- a/src/electron-runtime.js
+++ b/src/electron-runtime.js
@@ -10,7 +10,7 @@ const {
   readJsonBody,
 } = require('./bridge-auth');
 const { RELEASES_PAGE_URL } = require('./update-policy');
-const { validateDeviceId } = require('./proxy-launch');
+const { validateDeviceId, validateUsername } = require('./proxy-launch');
 
 const PAIRING_ENVELOPE_FILENAME = 'bridge-pairing.json';
 
@@ -19,7 +19,7 @@ function safeErrorMessage(error, fallback) {
     'NO_ALTA_SESSION', 'INVALID_ALTA_ARGUMENTS', 'ALTA_TIMEOUT', 'ALTA_HTTP_ERROR',
     'INVALID_ALTA_RESPONSE', 'INVALID_ALTA_RESPONSE_DATA', 'ALTA_RESPONSE_TOO_LARGE',
     'UNSAFE_ALTA_REDIRECT', 'TOO_MANY_ALTA_REDIRECTS', 'HELPER_NOT_FOUND',
-    'UNSUPPORTED_PLATFORM', 'INVALID_DEVICE_ID', 'SPAWN_FAILED',
+    'UNSUPPORTED_PLATFORM', 'INVALID_DEVICE_ID', 'INVALID_USERNAME', 'SPAWN_FAILED',
   ]);
   return error && allowed.has(error.code) && typeof error.message === 'string'
     ? error.message
@@ -253,9 +253,10 @@ class AppRuntime {
     }
   }
 
-  async launchProxy(deviceId) {
+  async launchProxy(deviceId, username) {
     try {
       const validatedId = validateDeviceId(deviceId);
+      const validatedUsername = validateUsername(username);
       this._reconcileProxies();
       if (!this.allowedDeviceIds.has(validatedId)) {
         return { success: false, message: 'Select a device from the current Alta device list.' };
@@ -266,7 +267,7 @@ class AppRuntime {
       const session = this.sessionStore.requireSession();
       const result = this.proxyManager.launchProxy({
         deploymentHost: new URL(session.origin).hostname,
-        cookie: session.cookie,
+        username: validatedUsername,
         deviceId: validatedId,
       });
       this.proxyByDevice.set(validatedId, result.processId);
diff --git a/src/proxy-launch.js b/src/proxy-launch.js
index aef53c2..2954d1b 100644
--- a/src/proxy-launch.js
+++ b/src/proxy-launch.js
@@ -5,7 +5,7 @@ const nodePath = require('node:path');
 const { spawn: nodeSpawn } = require('node:child_process');
 
 const HELPER_FILENAME = 'aware-cam-proxy.exe';
-const MAX_COOKIE_LENGTH = 4096;
+const MAX_USERNAME_LENGTH = 254;
 const MAX_HOST_LENGTH = 253;
 const DEVICE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -41,20 +41,19 @@ function validateDeviceId(value) {
   return value.toLowerCase();
 }
 
-function validateCookie(value) {
-  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_COOKIE_LENGTH) {
-    throw new ProxyLaunchError('Cookie is invalid.', 'INVALID_COOKIE');
+function validateUsername(value) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_USERNAME_LENGTH || value.trim().length === 0) {
+    throw new ProxyLaunchError('Alta username is invalid.', 'INVALID_USERNAME');
   }
-  if (/[\u0000-\u001f\u007f]/.test(value)) {
-    throw new ProxyLaunchError('Cookie must not contain control characters.', 'INVALID_COOKIE');
+  if (/[\u0000-\u001f\u007f-\u009f]/.test(value)) {
+    throw new ProxyLaunchError('Alta username must not contain control characters.', 'INVALID_USERNAME');
   }
   return value;
 }
 
-function redactMessage(error, secret) {
+function safeProcessError(error) {
   const source = error && typeof error.message === 'string' ? error.message : 'Unknown process error';
-  const withoutSecret = secret ? source.split(secret).join('[REDACTED]') : source;
-  return withoutSecret.replace(/[\u0000-\u001f\u007f]/g, ' ').slice(0, 512);
+  return source.replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ').slice(0, 512);
 }
 
 function safeMetadata(entry, status = entry.status) {
@@ -98,7 +97,7 @@ function createProxyManager({
 
     const deploymentHost = validateDeploymentHost(request.deploymentHost);
     const deviceId = validateDeviceId(request.deviceId);
-    const cookie = validateCookie(request.cookie);
+    const username = validateUsername(request.username);
 
     if (!fs.existsSync(helperPath)) {
       throw new ProxyLaunchError('Proxy helper was not found in the approved application directory.', 'HELPER_NOT_FOUND');
@@ -108,17 +107,17 @@ function createProxyManager({
     try {
       child = spawn(
         helperPath,
-        ['-a', deploymentHost, '-d', deviceId, '-k', cookie],
+        ['-a', deploymentHost, '-u', username, '-d', deviceId],
         {
           shell: false,
-          detached: false,
+          detached: true,
           stdio: 'ignore',
           windowsHide: false
         }
       );
     } catch (error) {
       throw new ProxyLaunchError(
-        `Failed to launch proxy helper: ${redactMessage(error, cookie)}`,
+        `Failed to launch proxy helper: ${safeProcessError(error)}`,
         'SPAWN_FAILED'
       );
     }
@@ -202,10 +201,10 @@ function createProxyManager({
 
 module.exports = {
   HELPER_FILENAME,
-  MAX_COOKIE_LENGTH,
+  MAX_USERNAME_LENGTH,
   ProxyLaunchError,
   createProxyManager,
-  validateCookie,
   validateDeploymentHost,
-  validateDeviceId
+  validateDeviceId,
+  validateUsername
 };
diff --git a/test/proxy-launch.test.js b/test/proxy-launch.test.js
index 373e7ff..b95307e 100644
--- a/test/proxy-launch.test.js
+++ b/test/proxy-launch.test.js
@@ -11,7 +11,7 @@ const APPROVED_DIRECTORY = 'C:\\Program Files\\Alta Proxy Tool';
 const APPROVED_HELPER = 'C:\\Program Files\\Alta Proxy Tool\\aware-cam-proxy.exe';
 const VALID_HOST = 'tenant.avasecurity.com';
 const VALID_DEVICE_ID = '123e4567-e89b-42d3-a456-426614174000';
-const SYNTHETIC_COOKIE = 'va=HERMES_SENTINEL_SECRET';
+const VALID_USERNAME = 'proxy.operator+apt@example.com';
 
 function loadModule() {
   return require(MODULE_PATH);
@@ -56,7 +56,7 @@ function validRequest(overrides = {}) {
   return {
     deploymentHost: VALID_HOST,
     deviceId: VALID_DEVICE_ID,
-    cookie: SYNTHETIC_COOKIE,
+    username: VALID_USERNAME,
     ...overrides
   };
 }
@@ -72,10 +72,10 @@ test('launches the approved helper directly with exact argv and shell disabled',
 
   assert.deepEqual(calls, [[
     APPROVED_HELPER,
-    ['-a', VALID_HOST, '-d', VALID_DEVICE_ID, '-k', SYNTHETIC_COOKIE],
+    ['-a', VALID_HOST, '-u', VALID_USERNAME, '-d', VALID_DEVICE_ID],
     {
       shell: false,
-      detached: false,
+      detached: true,
       stdio: 'ignore',
       windowsHide: false
     }
@@ -89,13 +89,13 @@ test('launches the approved helper directly with exact argv and shell disabled',
   });
 });
 
-test('passes cookie metacharacters literally in argv without invoking a shell', () => {
-  const cookie = 'va=abc&whoami|calc.exe;<>()^%!"`$';
+test('passes username punctuation literally in argv without invoking a shell', () => {
+  const username = 'proxy+apt&literal|name@example.com';
   const { manager, calls } = createHarness();
 
-  manager.launchProxy(validRequest({ cookie }));
+  manager.launchProxy(validRequest({ username }));
 
-  assert.equal(calls[0][1][5], cookie);
+  assert.equal(calls[0][1][3], username);
   assert.equal(calls[0][2].shell, false);
 });
 
@@ -104,8 +104,8 @@ test('rejects the CRLF calc.exe reproducer in every structured input', () => {
   const attacks = [
     { deploymentHost: `${VALID_HOST}\r\ncalc.exe` },
     { deviceId: `${VALID_DEVICE_ID}\r\ncalc.exe` },
-    { cookie: `${SYNTHETIC_COOKIE}\r\ncalc.exe` },
-    { cookie: `${SYNTHETIC_COOKIE}\0calc.exe` }
+    { username: `${VALID_USERNAME}\r\ncalc.exe` },
+    { username: `${VALID_USERNAME}\0calc.exe` }
   ];
 
   for (const attack of attacks) {
@@ -178,10 +178,10 @@ test('normalizes a valid Alta hostname to lowercase', () => {
   assert.equal(calls[0][1][1], 'tenant.avigilon.com');
 });
 
-test('rejects empty, oversized, and control-character cookies', () => {
-  for (const cookie of ['', 'x'.repeat(4097), 'va=abc\nxyz', 'va=abc\rxyz', 'va=abc\0xyz']) {
+test('rejects empty, oversized, non-string, and control-character usernames', () => {
+  for (const username of ['', 'x'.repeat(255), 42, 'user\nname', 'user\rname', 'user\0name', 'user\u007fname']) {
     const { manager } = createHarness();
-    assert.throws(() => manager.launchProxy(validRequest({ cookie })), /cookie/i);
+    assert.throws(() => manager.launchProxy(validRequest({ username })), /username/i);
   }
 });
 
@@ -205,27 +205,25 @@ test('requires an absolute approved application directory and Windows platform',
   );
 });
 
-test('redacts the cookie if spawn throws an error containing it', () => {
+test('reports a bounded spawn failure without credential redaction machinery', () => {
   const { createProxyManager } = loadModule();
   const manager = createProxyManager({
     appDirectory: APPROVED_DIRECTORY,
     fs: { existsSync: () => true },
     platform: 'win32',
-    spawn: () => { throw new Error(`spawn failed for ${SYNTHETIC_COOKIE}`); }
+    spawn: () => { throw new Error('spawn failed'); }
   });
 
   assert.throws(
     () => manager.launchProxy(validRequest()),
     (error) => {
       assert.match(error.message, /spawn failed/);
-      assert.match(error.message, /\[REDACTED\]/);
-      assert.doesNotMatch(error.message, /HERMES_SENTINEL_SECRET/);
       return true;
     }
   );
 });
 
-test('tracks only safe process metadata and never exposes or persists cookies', () => {
+test('tracks only safe process metadata and never exposes usernames', () => {
   const { manager } = createHarness();
   manager.launchProxy(validRequest());
 
@@ -236,7 +234,7 @@ test('tracks only safe process metadata and never exposes or persists cookies',
     startedAt: 1_777_777_777_777,
     status: 'running'
   }]);
-  assert.doesNotMatch(JSON.stringify(tracked), /HERMES_SENTINEL_SECRET/);
+  assert.doesNotMatch(JSON.stringify(tracked), /proxy\.operator/);
 });
 
 test('stopping one tracked process leaves the other tracked process alive', () => {
@@ -309,8 +307,9 @@ test('exit events remove only the matching owned child', () => {
   assert.deepEqual(manager.listTrackedProxies().map((item) => item.processId), [4101]);
 });
 
-test('source contains no shell launchers, broad process killers, or persistence APIs', () => {
+test('source contains no bearer argv, shell launchers, broad process killers, or persistence APIs', () => {
   const source = fs.readFileSync(path.join(__dirname, '..', 'src', 'proxy-launch.js'), 'utf8');
+  assert.doesNotMatch(source, /cookie|bearer|token|-k/i);
   assert.doesNotMatch(source, /\b(?:cmd(?:\.exe)?|powershell|taskkill|pkill|wmic)\b/i);
   assert.doesNotMatch(source, /\.(?:bat|command)\b/i);
   assert.doesNotMatch(source, /(?:writeFile|appendFile|mkdtemp|tmpdir)/);
diff --git a/test/renderer-controller.test.js b/test/renderer-controller.test.js
new file mode 100644
index 0000000..841097e
--- /dev/null
+++ b/test/renderer-controller.test.js
@@ -0,0 +1,41 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { createRendererController } = require('../renderer-controller');
+
+function harness(result) {
+  const calls = [];
+  const controller = createRendererController({
+    disconnect: async () => result,
+    renderConnectionState: (state) => calls.push(['render', state]),
+    clearDisconnectedState: () => calls.push(['clear']),
+    showConnectionStatus: (message, type) => calls.push(['status', message, type]),
+  });
+  return { controller, calls };
+}
+
+test('failed disconnect retains visible connection, device, and proxy state', async () => {
+  const result = {
+    success: false,
+    connected: true,
+    activeProxies: [{ deviceId: '550e8400-e29b-41d4-a716-446655440000', processId: 4101 }],
+    message: 'Could not stop every active proxy. The Alta session remains connected.',
+  };
+  const { controller, calls } = harness(result);
+
+  assert.equal(await controller.disconnect(), result);
+  assert.deepEqual(calls, [['status', result.message, 'error']]);
+});
+
+test('successful disconnect renders disconnected state and clears device state', async () => {
+  const result = { success: true, connected: false, origin: null, activeProxies: [] };
+  const { controller, calls } = harness(result);
+
+  assert.equal(await controller.disconnect(), result);
+  assert.deepEqual(calls, [
+    ['render', result],
+    ['clear'],
+    ['status', 'Disconnected from Alta.', 'info'],
+  ]);
+});
diff --git a/test/runtime-contract.test.js b/test/runtime-contract.test.js
index 80ad2db..5d4d074 100644
--- a/test/runtime-contract.test.js
+++ b/test/runtime-contract.test.js
@@ -79,11 +79,14 @@ test('runtime keeps Alta credentials in main-owned modules and exposes only non-
   });
 
   assert.deepEqual(await runtime.getDevices(), { success: true, devices: [{ guid: '550e8400-e29b-41d4-a716-446655440000' }] });
-  const launched = await runtime.launchProxy('550e8400-e29b-41d4-a716-446655440000');
+  const launched = await runtime.launchProxy(
+    '550e8400-e29b-41d4-a716-446655440000',
+    'proxy.operator@example.com'
+  );
   assert.equal(launched.success, true);
   assert.deepEqual(calls[0], {
     deploymentHost: 'customer.avasecurity.com',
-    cookie: 'top-secret-cookie',
+    username: 'proxy.operator@example.com',
     deviceId: '550e8400-e29b-41d4-a716-446655440000',
   });
   assert.deepEqual(runtime.getConnectionState(), {
@@ -99,6 +102,29 @@ test('runtime keeps Alta credentials in main-owned modules and exposes only non-
   assert.equal((await runtime.stopProxy(999)).success, false);
 });
 
+test('runtime rejects invalid usernames before calling the proxy manager', async () => {
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'top-secret-cookie');
+  const deviceId = '550e8400-e29b-41d4-a716-446655440000';
+  let launches = 0;
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: { getDevices: async () => [{ guid: deviceId }] },
+    proxyManager: {
+      launchProxy() { launches += 1; },
+      listTrackedProxies() { return []; },
+    },
+  });
+  await runtime.getDevices();
+
+  for (const username of ['', 'x'.repeat(255), 'operator@example.com\r\n-k secret', null]) {
+    const result = await runtime.launchProxy(deviceId, username);
+    assert.equal(result.success, false);
+    assert.match(result.message, /username/i);
+  }
+  assert.equal(launches, 0);
+});
+
 test('bridge authenticates itself before accepting a one-time HMAC cookie request', async () => {
   const protect = (value) => Buffer.from(`protected:${value}`);
   const unprotect = (value) => Buffer.from(value).toString().slice('protected:'.length);
@@ -223,10 +249,10 @@ test('runtime reconciles exited children and permits relaunch for the same devic
     },
   });
   await runtime.getDevices();
-  assert.equal((await runtime.launchProxy(deviceId)).processId, 4101);
+  assert.equal((await runtime.launchProxy(deviceId, 'operator@example.com')).processId, 4101);
   tracked.length = 0;
   assert.deepEqual(runtime.getConnectionState().activeProxies, []);
-  assert.equal((await runtime.launchProxy(deviceId)).processId, 4102);
+  assert.equal((await runtime.launchProxy(deviceId, 'operator@example.com')).processId, 4102);
 });
 
 test('disconnect stops every owned proxy before clearing the Alta session', async () => {
@@ -304,8 +330,12 @@ test('preload and renderer expose only narrow, credential-free contracts', () =>
   ];
   for (const method of expectedMethods) assert.match(preload, new RegExp(`\\b${method}\\b`));
   assert.doesNotMatch(preload, /downloadAndInstall|download-and-install|onUpdateDownloadProgress|onExtensionCookie/);
+  assert.match(preload, /launchProxy:\s*\(deviceId, username\)/);
+  assert.doesNotMatch(preload, /launchProxy:\s*\([^)]*(?:cookie|origin)/i);
   assert.doesNotMatch(renderer, /cookieValue|sessionData\.cookies|cookies\s*:/);
+  assert.match(renderer, /state\.connected\s*&&\s*\(!wasConnected\s*\|\|\s*state\.origin\s*!==\s*previousOrigin\)/);
   assert.doesNotMatch(html, /id="cookieKey"|updateProgress|Install Update/);
+  assert.match(html, /id="altaUsername"/);
   assert.match(renderer, /openFixedReleasesPage/);
   assert.match(html, /Bridge Pairing/);
 });
@@ -327,3 +357,15 @@ test('source policy removes legacy credential IPC, shell launch, broad kill, and
   assert.match(read('main.js'), /18247/);
   assert.match(read('main.js'), /shell\.openExternal/);
 });
+
+test('production source and documentation are GitPeji-only with no active GitHub workflow', () => {
+  assert.equal(fs.existsSync(path.join(ROOT, '.github', 'workflows', 'deploy-pages.yml')), false);
+  const sourceAndDocs = [
+    'main.js', 'preload.js', 'renderer.js', 'renderer-controller.js', 'index.html',
+    'src/electron-runtime.js', 'src/proxy-launch.js', 'README.md', 'CLAUDE.md',
+    'docs/security/2026-08-security-baseline.md',
+    'docs/plans/2026-08-19-apt-security-foundation.md',
+  ].map(read).join('\n');
+  assert.doesNotMatch(sourceAndDocs, /github/i);
+  assert.match(sourceAndDocs, /GitPeji/);
+});

From 8dad96c27d4c34b6f038b0c0285045112275cb90 Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Wed, 19 Aug 2026 22:39:40 +0000
Subject: [PATCH 11/22] fix: support GitPeji tags and interactive helper auth

---
 src/proxy-launch.js                       |  2 +-
 src/update-policy.js                      | 14 ++++++---
 test/fixtures/gitpeji-latest-release.json | 15 ++++++++++
 test/proxy-launch.test.js                 |  6 ++--
 test/update-policy.test.js                | 35 ++++++++++++++++++++++-
 5 files changed, 64 insertions(+), 8 deletions(-)
 create mode 100644 test/fixtures/gitpeji-latest-release.json

diff --git a/src/proxy-launch.js b/src/proxy-launch.js
index 2954d1b..5ddfa8f 100644
--- a/src/proxy-launch.js
+++ b/src/proxy-launch.js
@@ -111,7 +111,7 @@ function createProxyManager({
         {
           shell: false,
           detached: true,
-          stdio: 'ignore',
+          stdio: 'inherit',
           windowsHide: false
         }
       );
diff --git a/src/update-policy.js b/src/update-policy.js
index 8f3fb6e..4302d0f 100644
--- a/src/update-policy.js
+++ b/src/update-policy.js
@@ -8,7 +8,7 @@ const REQUEST_TIMEOUT_MS = 5000;
 const MAX_BODY_BYTES = 64 * 1024;
 const MAX_RELEASE_NAME_LENGTH = 200;
 
-// SemVer 2.0.0 without loose forms such as a leading "v" or omitted fields.
+// Strict SemVer 2.0.0 without loose forms such as omitted fields.
 const SEMVER_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
 
 class UpdatePolicyError extends Error {
@@ -41,6 +41,12 @@ function parseSemver(version, errorCode = 'INVALID_VERSION') {
   };
 }
 
+function normalizeReleaseTag(tag) {
+  const version = tag.startsWith('v') ? tag.slice(1) : tag;
+  parseSemver(version, 'INVALID_RELEASE_VERSION');
+  return version;
+}
+
 function compareIdentifier(left, right) {
   const leftNumeric = /^\d+$/.test(left);
   const rightNumeric = /^\d+$/.test(right);
@@ -290,14 +296,14 @@ async function checkForUpdate({
   }
 
   const release = parseRelease(body);
-  parseSemver(release.latestVersion, 'INVALID_RELEASE_VERSION');
+  const latestVersion = normalizeReleaseTag(release.latestVersion);
 
   const metadata = {
-    status: compareSemver(release.latestVersion, currentVersion) > 0
+    status: compareSemver(latestVersion, currentVersion) > 0
       ? 'update-available'
       : 'up-to-date',
     ...baseMetadata,
-    latestVersion: release.latestVersion,
+    latestVersion,
     releaseName: release.releaseName,
   };
   if (release.publishedAt !== undefined) {
diff --git a/test/fixtures/gitpeji-latest-release.json b/test/fixtures/gitpeji-latest-release.json
new file mode 100644
index 0000000..c2251d8
--- /dev/null
+++ b/test/fixtures/gitpeji-latest-release.json
@@ -0,0 +1,15 @@
+{
+  "id": 17,
+  "tag_name": "v1.0.0",
+  "target_commitish": "main",
+  "name": "Alta Proxy Tool v1.0.0",
+  "body": "Initial GitPeji release",
+  "draft": false,
+  "prerelease": false,
+  "created_at": "2026-08-19T12:30:00Z",
+  "published_at": "2026-08-19T12:34:56Z",
+  "html_url": "https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases/tag/v1.0.0",
+  "tarball_url": "https://git.pejicorp.com/peji/Alta-Proxy-Tool/archive/v1.0.0.tar.gz",
+  "zipball_url": "https://git.pejicorp.com/peji/Alta-Proxy-Tool/archive/v1.0.0.zip",
+  "assets": []
+}
diff --git a/test/proxy-launch.test.js b/test/proxy-launch.test.js
index b95307e..5a33273 100644
--- a/test/proxy-launch.test.js
+++ b/test/proxy-launch.test.js
@@ -65,7 +65,7 @@ test('exports the proxy manager module', () => {
   assert.doesNotThrow(() => loadModule());
 });
 
-test('launches the approved helper directly with exact argv and shell disabled', () => {
+test('launches the approved helper directly in a visible interactive console', () => {
   const { manager, calls } = createHarness();
 
   const result = manager.launchProxy(validRequest());
@@ -76,7 +76,7 @@ test('launches the approved helper directly with exact argv and shell disabled',
     {
       shell: false,
       detached: true,
-      stdio: 'ignore',
+      stdio: 'inherit',
       windowsHide: false
     }
   ]]);
@@ -97,6 +97,8 @@ test('passes username punctuation literally in argv without invoking a shell', (
 
   assert.equal(calls[0][1][3], username);
   assert.equal(calls[0][2].shell, false);
+  assert.equal(calls[0][2].stdio, 'inherit');
+  assert.notEqual(calls[0][2].stdio, 'ignore');
 });
 
 test('rejects the CRLF calc.exe reproducer in every structured input', () => {
diff --git a/test/update-policy.test.js b/test/update-policy.test.js
index 956f61c..9a24a4c 100644
--- a/test/update-policy.test.js
+++ b/test/update-policy.test.js
@@ -3,6 +3,8 @@
 const assert = require('node:assert/strict');
 const test = require('node:test');
 const { EventEmitter } = require('node:events');
+const fs = require('node:fs');
+const path = require('node:path');
 
 const {
   LATEST_RELEASE_URL,
@@ -30,6 +32,24 @@ async function rejectsWithCode(promise, code) {
   });
 }
 
+test('accepts a live-shape GitPeji v-tag and normalizes it to bare semver', async () => {
+  const fixture = fs.readFileSync(
+    path.join(__dirname, 'fixtures', 'gitpeji-latest-release.json'),
+    'utf8',
+  );
+
+  const result = await checkForUpdate({
+    currentVersion: '0.9.0',
+    request: async () => response(fixture),
+    platform: 'win32',
+    arch: 'x64',
+  });
+
+  assert.equal(result.status, 'update-available');
+  assert.equal(result.latestVersion, '1.0.0');
+  assert.equal(result.releaseName, 'Alta Proxy Tool v1.0.0');
+});
+
 test('valid update returns only sanitized, check-only metadata', async () => {
   let requestOptions;
   const request = async (options) => {
@@ -148,7 +168,20 @@ test('redirects and response host drift are rejected', async () => {
 });
 
 test('invalid or non-strict semver fails closed', async () => {
-  const invalidVersions = ['v1.2.3', '1.2', '01.2.3', '1.2.3.4', 'latest'];
+  const invalidVersions = [
+    'V1.2.3',
+    'vv1.2.3',
+    ' v1.2.3',
+    'v1.2.3 ',
+    'v1.2',
+    'v01.2.3',
+    'v1.2.3.4',
+    'vlatest',
+    '1.2',
+    '01.2.3',
+    '1.2.3.4',
+    'latest',
+  ];
 
   for (const tag_name of invalidVersions) {
     await rejectsWithCode(

From c66d0ce49e8048d362c7f430857f6ae844b53af0 Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Wed, 19 Aug 2026 22:48:09 +0000
Subject: [PATCH 12/22] ci: target available GitPeji runner

---
 .gitea/workflows/ci.yml     | 2 +-
 test/build-contract.test.js | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 25146e0..0cb0aa6 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   build-checks:
-    runs-on: ubuntu-latest
+    runs-on: alta-tool-hub-ci
     permissions:
       contents: read
     steps:
diff --git a/test/build-contract.test.js b/test/build-contract.test.js
index f26198a..6d20ba2 100644
--- a/test/build-contract.test.js
+++ b/test/build-contract.test.js
@@ -56,8 +56,10 @@ test('build remains Windows portable without misleading signing overrides', () =
   assert.match(pkg.scripts.check, /verify-kit/);
 });
 
-test('GitPeji CI is build-only and runs all hardening gates on Node 22', () => {
+test('GitPeji CI targets the live runner and is build-only on Node 22', () => {
   const workflow = read('.gitea/workflows/ci.yml');
+  assert.match(workflow, /^\s*runs-on:\s*alta-tool-hub-ci\s*$/m);
+  assert.doesNotMatch(workflow, /^\s*runs-on:\s*ubuntu-latest\s*$/m);
   assert.match(workflow, /actions\/checkout@v4/);
   assert.match(workflow, /actions\/setup-node@v4/);
   assert.match(workflow, /node-version:\s*['"]?22['"]?/);

From f65273c7a9760e581f4fde9a45cf7af1a6549ce2 Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Wed, 19 Aug 2026 22:58:04 +0000
Subject: [PATCH 13/22] ci: isolate APT GitPeji runner

---
 .gitea/workflows/ci.yml     | 2 +-
 test/build-contract.test.js | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 0cb0aa6..f86f288 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -7,7 +7,7 @@ on:
 
 jobs:
   build-checks:
-    runs-on: alta-tool-hub-ci
+    runs-on: apt-ci
     permissions:
       contents: read
     steps:
diff --git a/test/build-contract.test.js b/test/build-contract.test.js
index 6d20ba2..f40c6e1 100644
--- a/test/build-contract.test.js
+++ b/test/build-contract.test.js
@@ -58,7 +58,7 @@ test('build remains Windows portable without misleading signing overrides', () =
 
 test('GitPeji CI targets the live runner and is build-only on Node 22', () => {
   const workflow = read('.gitea/workflows/ci.yml');
-  assert.match(workflow, /^\s*runs-on:\s*alta-tool-hub-ci\s*$/m);
+  assert.match(workflow, /runs-on:\s*apt-ci/);
   assert.doesNotMatch(workflow, /^\s*runs-on:\s*ubuntu-latest\s*$/m);
   assert.match(workflow, /actions\/checkout@v4/);
   assert.match(workflow, /actions\/setup-node@v4/);

From 4a10e6051e5766f27be5c69c31f12d2201d1ff1d Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Wed, 19 Aug 2026 23:12:56 +0000
Subject: [PATCH 14/22] fix: confirm proxy exit before disconnect

---
 main.js                       |  81 +++++++++++++++++++++----
 src/electron-runtime.js       |  14 +++--
 src/proxy-launch.js           | 109 +++++++++++++++++++++++++++-------
 test/proxy-launch.test.js     |  92 ++++++++++++++++++++++++----
 test/runtime-contract.test.js |  64 +++++++++++++++++++-
 5 files changed, 308 insertions(+), 52 deletions(-)

diff --git a/main.js b/main.js
index 8a08077..65b3b9c 100644
--- a/main.js
+++ b/main.js
@@ -1,6 +1,6 @@
 'use strict';
 
-const { app, BrowserWindow, ipcMain, safeStorage, shell } = require('electron');
+const { app, BrowserWindow, dialog, ipcMain, safeStorage, shell } = require('electron');
 const http = require('node:http');
 const path = require('node:path');
 const { pathToFileURL } = require('node:url');
@@ -23,6 +23,8 @@ let bridgeServer = null;
 let runtime = null;
 let pairingController = null;
 let firstRunPairingSecret = null;
+let quitCleanupInProgress = false;
+let allowConfirmedQuit = false;
 
 function getAppDirectory() {
   return app.isPackaged
@@ -83,8 +85,8 @@ function registerIpcHandlers() {
     sendConnectionState();
     return result;
   });
-  registerIpc('disconnect', () => {
-    const state = runtime.disconnect();
+  registerIpc('disconnect', async () => {
+    const state = await runtime.disconnect();
     sendConnectionState();
     return state;
   });
@@ -157,17 +159,72 @@ app.whenReady().then(() => {
   startBridgeServer();
 });
 
+function closeBridgeServer() {
+  if (!bridgeServer) return Promise.resolve();
+  const server = bridgeServer;
+  return new Promise((resolve, reject) => {
+    const finish = (error) => {
+      if (!error || error.code === 'ERR_SERVER_NOT_RUNNING') {
+        if (bridgeServer === server) bridgeServer = null;
+        resolve();
+        return;
+      }
+      reject(error);
+    };
+    try { server.close(finish); } catch (error) { finish(error); }
+  });
+}
+
+async function notifyQuitBlocked(state) {
+  sendConnectionState();
+  const activeCount = state && Array.isArray(state.activeProxies) ? state.activeProxies.length : 0;
+  const activeProxiesRemain = activeCount > 0;
+  const processDetail = activeProxiesRemain
+    ? `${activeCount} app-owned proxy process${activeCount === 1 ? '' : 'es'} remain active.`
+    : 'No app-owned proxy process remains active.';
+  const sessionDetail = state && state.connected
+    ? ' The Alta session is still connected; resolve the process error and try quitting again.'
+    : ' Resolve the shutdown error and try quitting again.';
+  await dialog.showMessageBox({
+    type: 'error',
+    title: activeProxiesRemain ? 'Alta Camera Proxy is still running' : 'Alta Camera Proxy could not close',
+    message: activeProxiesRemain
+      ? 'The app could not confirm that every proxy process exited.'
+      : 'The app could not complete shutdown safely.',
+    detail: `${processDetail}${sessionDetail}`,
+    buttons: ['OK'],
+    noLink: true,
+  });
+}
+
 app.on('before-quit', (event) => {
-  if (runtime) {
-    const state = runtime.disconnect();
-    if (state.activeProxies.length > 0) {
-      event.preventDefault();
-      sendConnectionState();
-      return;
+  if (allowConfirmedQuit) return;
+  event.preventDefault();
+  if (quitCleanupInProgress) return;
+  quitCleanupInProgress = true;
+
+  (async () => {
+    try {
+      const state = runtime
+        ? await runtime.disconnect()
+        : { success: true, connected: false, activeProxies: [] };
+      if (!state.success || state.activeProxies.length > 0) {
+        await notifyQuitBlocked(state);
+        return;
+      }
+      await closeBridgeServer();
+      if (runtime) runtime.sessionStore.dispose();
+      allowConfirmedQuit = true;
+      app.quit();
+    } catch {
+      const state = runtime
+        ? runtime.getConnectionState()
+        : { connected: false, activeProxies: [] };
+      await notifyQuitBlocked(state);
+    } finally {
+      quitCleanupInProgress = false;
     }
-    runtime.sessionStore.dispose();
-  }
-  if (bridgeServer) bridgeServer.close();
+  })();
 });
 
 app.on('window-all-closed', () => {
diff --git a/src/electron-runtime.js b/src/electron-runtime.js
index cfdf200..77efd1e 100644
--- a/src/electron-runtime.js
+++ b/src/electron-runtime.js
@@ -292,21 +292,23 @@ class AppRuntime {
     }
     if (!processId || !deviceId) return { success: false, message: 'Proxy process is not owned by this app.' };
 
-    const result = this.proxyManager.stopProxy(processId);
+    const result = await this.proxyManager.stopProxy(processId);
     if (result.success) this.proxyByDevice.delete(deviceId);
     return { ...result, deviceId };
   }
 
-  disconnect() {
+  async disconnect() {
     const tracked = this._reconcileProxies();
-    for (const proxy of tracked) {
-      try { this.proxyManager.stopProxy(proxy.processId); } catch {}
-    }
+    await Promise.all(tracked.map(async (proxy) => {
+      try {
+        await this.proxyManager.stopProxy(proxy.processId);
+      } catch {}
+    }));
     const remaining = this._reconcileProxies();
     if (remaining.length > 0) {
       return {
         success: false,
-        message: 'Could not stop every active proxy. The Alta session remains connected.',
+        message: 'Could not confirm every active proxy exited. The Alta session remains connected.',
         ...this.getConnectionState(),
       };
     }
diff --git a/src/proxy-launch.js b/src/proxy-launch.js
index 5ddfa8f..58dffb2 100644
--- a/src/proxy-launch.js
+++ b/src/proxy-launch.js
@@ -10,6 +10,7 @@ const MAX_HOST_LENGTH = 253;
 const DEVICE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const ALTA_SUFFIXES = ['.avasecurity.com', '.avigilon.com'];
+const DEFAULT_STOP_TIMEOUT_MS = 5_000;
 
 class ProxyLaunchError extends Error {
   constructor(message, code) {
@@ -70,7 +71,10 @@ function createProxyManager({
   fs = nodeFs,
   spawn = nodeSpawn,
   platform = process.platform,
-  now = Date.now
+  now = Date.now,
+  stopTimeoutMs = DEFAULT_STOP_TIMEOUT_MS,
+  setTimeout = global.setTimeout,
+  clearTimeout = global.clearTimeout
 } = {}) {
   if (platform !== 'win32') {
     throw new ProxyLaunchError('Proxy helper is supported only on the Windows platform.', 'UNSUPPORTED_PLATFORM');
@@ -78,7 +82,9 @@ function createProxyManager({
   if (typeof appDirectory !== 'string' || !nodePath.win32.isAbsolute(appDirectory)) {
     throw new ProxyLaunchError('Approved application directory must be an absolute path.', 'INVALID_APP_DIRECTORY');
   }
-  if (typeof fs.existsSync !== 'function' || typeof spawn !== 'function' || typeof now !== 'function') {
+  if (typeof fs.existsSync !== 'function' || typeof spawn !== 'function' || typeof now !== 'function' ||
+      !Number.isSafeInteger(stopTimeoutMs) || stopTimeoutMs <= 0 ||
+      typeof setTimeout !== 'function' || typeof clearTimeout !== 'function') {
     throw new TypeError('Invalid proxy manager dependency.');
   }
 
@@ -90,6 +96,32 @@ function createProxyManager({
     if (current && current.child === child) trackedChildren.delete(processId);
   }
 
+  function hasConfirmedExit(child) {
+    return (child.exitCode !== null && child.exitCode !== undefined) ||
+      (child.signalCode !== null && child.signalCode !== undefined);
+  }
+
+  function finishStopAttempt(entry, result) {
+    const attempt = entry.stopAttempt;
+    if (!attempt) return;
+    entry.stopAttempt = null;
+    entry.stopPromise = null;
+    clearTimeout(attempt.timer);
+    attempt.resolve(result);
+  }
+
+  function confirmExit(entry) {
+    const current = trackedChildren.get(entry.processId);
+    if (!current || current.child !== entry.child) return;
+    trackedChildren.delete(entry.processId);
+    finishStopAttempt(entry, {
+      success: true,
+      processId: entry.processId,
+      deviceId: entry.deviceId,
+      status: 'stopped'
+    });
+  }
+
   function launchProxy(request) {
     if (!request || typeof request !== 'object' || Array.isArray(request)) {
       throw new ProxyLaunchError('Proxy launch request is invalid.', 'INVALID_REQUEST');
@@ -139,19 +171,24 @@ function createProxyManager({
       processId: child.pid,
       deviceId,
       startedAt: now(),
-      status: 'running'
+      status: 'running',
+      stopAttempt: null,
+      stopPromise: null
     };
     trackedChildren.set(entry.processId, entry);
 
     if (typeof child.once === 'function') {
-      child.once('exit', () => removeIfOwned(entry.processId, child));
-      child.once('error', () => removeIfOwned(entry.processId, child));
+      child.once('exit', () => confirmExit(entry));
+      child.once('close', () => confirmExit(entry));
+      child.once('error', () => {
+        if (hasConfirmedExit(child)) confirmExit(entry);
+      });
     }
 
     return { success: true, ...safeMetadata(entry) };
   }
 
-  function stopProxy(processId) {
+  async function stopProxy(processId) {
     if (!Number.isSafeInteger(processId) || processId <= 0) {
       throw new ProxyLaunchError('Process identifier is invalid.', 'INVALID_PROCESS_ID');
     }
@@ -159,28 +196,56 @@ function createProxyManager({
     const entry = trackedChildren.get(processId);
     if (!entry) return { success: false, processId, status: 'not-tracked' };
 
-    try {
-      const requested = entry.child.kill('SIGTERM');
-      if (!requested) {
-        removeIfOwned(processId, entry.child);
-        return {
-          success: true,
-          processId,
-          deviceId: entry.deviceId,
-          status: 'already-exited'
-        };
-      }
-
+    if (hasConfirmedExit(entry.child)) {
       removeIfOwned(processId, entry.child);
       return {
         success: true,
         processId,
         deviceId: entry.deviceId,
-        status: 'stop-requested'
+        status: 'already-exited'
       };
+    }
+    if (entry.stopPromise) return entry.stopPromise;
+
+    entry.status = 'stopping';
+    entry.stopPromise = new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        finishStopAttempt(entry, {
+          success: false,
+          processId,
+          deviceId: entry.deviceId,
+          status: 'stop-timeout',
+          message: 'Timed out waiting for the tracked proxy process to exit.'
+        });
+      }, stopTimeoutMs);
+      entry.stopAttempt = { resolve, timer };
+    });
+    const stopPromise = entry.stopPromise;
+
+    try {
+      const requested = entry.child.kill('SIGTERM');
+      if (!requested) {
+        if (hasConfirmedExit(entry.child)) {
+          removeIfOwned(processId, entry.child);
+          finishStopAttempt(entry, {
+            success: true,
+            processId,
+            deviceId: entry.deviceId,
+            status: 'already-exited'
+          });
+        } else {
+          finishStopAttempt(entry, {
+            success: false,
+            processId,
+            deviceId: entry.deviceId,
+            status: 'stop-failed',
+            message: 'Unable to confirm that the tracked proxy process exited.'
+          });
+        }
+      }
     } catch (error) {
       const permissionDenied = error && (error.code === 'EPERM' || error.code === 'EACCES');
-      return {
+      finishStopAttempt(entry, {
         success: false,
         processId,
         deviceId: entry.deviceId,
@@ -188,8 +253,9 @@ function createProxyManager({
         message: permissionDenied
           ? 'Unable to stop the tracked proxy process: permission denied.'
           : 'Unable to stop the tracked proxy process.'
-      };
+      });
     }
+    return stopPromise;
   }
 
   function listTrackedProxies() {
@@ -200,6 +266,7 @@ function createProxyManager({
 }
 
 module.exports = {
+  DEFAULT_STOP_TIMEOUT_MS,
   HELPER_FILENAME,
   MAX_USERNAME_LENGTH,
   ProxyLaunchError,
diff --git a/test/proxy-launch.test.js b/test/proxy-launch.test.js
index 5a33273..10c4e64 100644
--- a/test/proxy-launch.test.js
+++ b/test/proxy-launch.test.js
@@ -24,6 +24,8 @@ class FakeChild extends EventEmitter {
     this.killResult = killResult;
     this.killCalls = [];
     this.killError = null;
+    this.exitCode = null;
+    this.signalCode = null;
   }
 
   kill(signal) {
@@ -33,7 +35,13 @@ class FakeChild extends EventEmitter {
   }
 }
 
-function createHarness({ helperExists = true, children = [new FakeChild(4101)] } = {}) {
+function createHarness({
+  helperExists = true,
+  children = [new FakeChild(4101)],
+  stopTimeoutMs = 5_000,
+  setTimeout = global.setTimeout,
+  clearTimeout = global.clearTimeout,
+} = {}) {
   const calls = [];
   let childIndex = 0;
   const spawn = (...args) => {
@@ -47,7 +55,10 @@ function createHarness({ helperExists = true, children = [new FakeChild(4101)] }
     fs: fsStub,
     spawn,
     platform: 'win32',
-    now: () => 1_777_777_777_777
+    now: () => 1_777_777_777_777,
+    stopTimeoutMs,
+    setTimeout,
+    clearTimeout,
   });
   return { manager, calls, children };
 }
@@ -239,32 +250,38 @@ test('tracks only safe process metadata and never exposes usernames', () => {
   assert.doesNotMatch(JSON.stringify(tracked), /proxy\.operator/);
 });
 
-test('stopping one tracked process leaves the other tracked process alive', () => {
+test('stopping one tracked process waits for confirmed exit and leaves the other alive', async () => {
   const first = new FakeChild(4101);
   const second = new FakeChild(4102);
   const { manager } = createHarness({ children: [first, second] });
   manager.launchProxy(validRequest());
   manager.launchProxy(validRequest({ deviceId: '123e4567-e89b-42d3-a456-426614174001' }));
 
-  const result = manager.stopProxy(4101);
+  const stopping = manager.stopProxy(4101);
+  assert.deepEqual(manager.listTrackedProxies().map((item) => [item.processId, item.status]), [
+    [4101, 'stopping'],
+    [4102, 'running'],
+  ]);
+  first.emit('exit', 0, 'SIGTERM');
+  const result = await stopping;
 
   assert.deepEqual(result, {
     success: true,
     processId: 4101,
     deviceId: VALID_DEVICE_ID,
-    status: 'stop-requested'
+    status: 'stopped'
   });
   assert.deepEqual(first.killCalls, ['SIGTERM']);
   assert.deepEqual(second.killCalls, []);
   assert.deepEqual(manager.listTrackedProxies().map((item) => item.processId), [4102]);
 });
 
-test('never stops an untracked PID', () => {
+test('never stops an untracked PID', async () => {
   const child = new FakeChild(4101);
   const { manager } = createHarness({ children: [child] });
   manager.launchProxy(validRequest());
 
-  assert.deepEqual(manager.stopProxy(9999), {
+  assert.deepEqual(await manager.stopProxy(9999), {
     success: false,
     processId: 9999,
     status: 'not-tracked'
@@ -272,21 +289,22 @@ test('never stops an untracked PID', () => {
   assert.deepEqual(child.killCalls, []);
 });
 
-test('reports already-exited and permission-denied states honestly', () => {
+test('reports already-exited and permission-denied states honestly', async () => {
   const exited = new FakeChild(4101, false);
+  exited.exitCode = 0;
   const denied = new FakeChild(4102);
   denied.killError = Object.assign(new Error('operation not permitted'), { code: 'EPERM' });
   const { manager } = createHarness({ children: [exited, denied] });
   manager.launchProxy(validRequest());
   manager.launchProxy(validRequest({ deviceId: '123e4567-e89b-42d3-a456-426614174001' }));
 
-  assert.deepEqual(manager.stopProxy(4101), {
+  assert.deepEqual(await manager.stopProxy(4101), {
     success: true,
     processId: 4101,
     deviceId: VALID_DEVICE_ID,
     status: 'already-exited'
   });
-  assert.deepEqual(manager.stopProxy(4102), {
+  assert.deepEqual(await manager.stopProxy(4102), {
     success: false,
     processId: 4102,
     deviceId: '123e4567-e89b-42d3-a456-426614174001',
@@ -296,6 +314,60 @@ test('reports already-exited and permission-denied states honestly', () => {
   assert.deepEqual(manager.listTrackedProxies().map((item) => item.processId), [4102]);
 });
 
+test('kill true is only a request and times out while the child remains tracked as stopping', async () => {
+  let timeoutCallback;
+  const child = new FakeChild(4101, true);
+  const { manager } = createHarness({
+    children: [child],
+    stopTimeoutMs: 25,
+    setTimeout(callback, delay) {
+      assert.equal(delay, 25);
+      timeoutCallback = callback;
+      return 123;
+    },
+    clearTimeout() {},
+  });
+  manager.launchProxy(validRequest());
+
+  const stopping = manager.stopProxy(4101);
+  assert.deepEqual(manager.listTrackedProxies().map(({ processId, status }) => ({ processId, status })), [
+    { processId: 4101, status: 'stopping' },
+  ]);
+  timeoutCallback();
+
+  assert.deepEqual(await stopping, {
+    success: false,
+    processId: 4101,
+    deviceId: VALID_DEVICE_ID,
+    status: 'stop-timeout',
+    message: 'Timed out waiting for the tracked proxy process to exit.',
+  });
+  assert.equal(manager.listTrackedProxies()[0].status, 'stopping');
+});
+
+test('kill false does not claim success without confirmed exit', async () => {
+  const child = new FakeChild(4101, false);
+  const { manager } = createHarness({ children: [child] });
+  manager.launchProxy(validRequest());
+
+  assert.deepEqual(await manager.stopProxy(4101), {
+    success: false,
+    processId: 4101,
+    deviceId: VALID_DEVICE_ID,
+    status: 'stop-failed',
+    message: 'Unable to confirm that the tracked proxy process exited.',
+  });
+  assert.equal(manager.listTrackedProxies()[0].status, 'stopping');
+});
+
+test('generic child errors retain tracking unless process exit is confirmed', () => {
+  const child = new FakeChild(4101);
+  const { manager } = createHarness({ children: [child] });
+  manager.launchProxy(validRequest());
+  child.emit('error', new Error('transient process error'));
+  assert.deepEqual(manager.listTrackedProxies().map((entry) => entry.processId), [4101]);
+});
+
 test('exit events remove only the matching owned child', () => {
   const original = new FakeChild(4101);
   const replacement = new FakeChild(4101);
diff --git a/test/runtime-contract.test.js b/test/runtime-contract.test.js
index 5d4d074..596befc 100644
--- a/test/runtime-contract.test.js
+++ b/test/runtime-contract.test.js
@@ -275,13 +275,13 @@ test('disconnect stops every owned proxy before clearing the Alta session', asyn
       },
     },
   });
-  const state = runtime.disconnect();
+  const state = await runtime.disconnect();
   assert.deepEqual(stopped, [4101, 4102]);
   assert.equal(state.connected, false);
   assert.deepEqual(state.activeProxies, []);
 });
 
-test('disconnect reports failure truthfully and retains session when an owned proxy cannot stop', () => {
+test('disconnect reports failure truthfully and retains session when an owned proxy cannot stop', async () => {
   const sessionStore = createSessionStore();
   sessionStore.establish('https://customer.avasecurity.com', 'synthetic-cookie');
   const tracked = [{ processId: 4101, deviceId: '550e8400-e29b-41d4-a716-446655440000', status: 'running', startedAt: 1 }];
@@ -293,12 +293,52 @@ test('disconnect reports failure truthfully and retains session when an owned pr
       stopProxy() { return { success: false, processId: 4101, status: 'permission-denied' }; },
     },
   });
-  const state = runtime.disconnect();
+  const state = await runtime.disconnect();
   assert.equal(state.success, false);
   assert.equal(state.connected, true);
   assert.deepEqual(state.activeProxies.map((entry) => entry.processId), [4101]);
 });
 
+test('kill request without exit keeps proxy tracked and session connected until confirmed exit', async () => {
+  const { EventEmitter } = require('node:events');
+  const { createProxyManager } = require('../src/proxy-launch');
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'synthetic-cookie');
+  const deviceId = '550e8400-e29b-41d4-a716-446655440000';
+  const child = new EventEmitter();
+  child.pid = 4101;
+  child.exitCode = null;
+  child.signalCode = null;
+  child.kill = () => true;
+  let timeoutCallback;
+  const proxyManager = createProxyManager({
+    appDirectory: 'C:\\Program Files\\Alta Proxy Tool',
+    fs: { existsSync: () => true },
+    spawn: () => child,
+    platform: 'win32',
+    stopTimeoutMs: 10,
+    setTimeout(callback) { timeoutCallback = callback; return 1; },
+    clearTimeout() {},
+  });
+  proxyManager.launchProxy({ deploymentHost: 'customer.avasecurity.com', username: 'operator@example.com', deviceId });
+  const runtime = new AppRuntime({ sessionStore, altaClient: {}, proxyManager });
+
+  const firstDisconnect = runtime.disconnect();
+  assert.equal(proxyManager.listTrackedProxies()[0].status, 'stopping');
+  timeoutCallback();
+  const failed = await firstDisconnect;
+  assert.equal(failed.success, false);
+  assert.equal(failed.connected, true);
+  assert.deepEqual(failed.activeProxies, [{ deviceId, processId: 4101 }]);
+
+  child.exitCode = 0;
+  child.emit('exit', 0, null);
+  const disconnected = await runtime.disconnect();
+  assert.equal(disconnected.success, true);
+  assert.equal(disconnected.connected, false);
+  assert.deepEqual(disconnected.activeProxies, []);
+});
+
 test('update runtime is check-only and opens only the fixed GitPeji releases page', async () => {
   const opened = [];
   const runtime = new AppRuntime({
@@ -340,6 +380,24 @@ test('preload and renderer expose only narrow, credential-free contracts', () =>
   assert.match(html, /Bridge Pairing/);
 });
 
+test('Electron quit waits for confirmed cleanup and reports a safe failure instead of disposing', () => {
+  const main = read('main.js');
+  const beforeQuit = main.slice(main.indexOf("app.on('before-quit'"), main.indexOf("app.on('window-all-closed'"));
+  const preventIndex = beforeQuit.indexOf('event.preventDefault()');
+  const disconnectIndex = beforeQuit.indexOf('await runtime.disconnect()');
+  const activeCheckIndex = beforeQuit.indexOf('state.activeProxies.length > 0');
+  const disposeIndex = beforeQuit.indexOf('runtime.sessionStore.dispose()');
+  const confirmedQuitIndex = beforeQuit.indexOf('allowConfirmedQuit = true');
+  const quitIndex = beforeQuit.indexOf('app.quit()');
+
+  assert.ok(preventIndex >= 0 && preventIndex < disconnectIndex);
+  assert.ok(disconnectIndex < activeCheckIndex && activeCheckIndex < disposeIndex);
+  assert.ok(disposeIndex < confirmedQuitIndex && confirmedQuitIndex < quitIndex);
+  assert.match(main, /dialog\.showMessageBox/);
+  assert.match(main, /could not confirm that every proxy process exited/i);
+  assert.doesNotMatch(beforeQuit, /taskkill|pkill|wmic/i);
+});
+
 test('source policy removes legacy credential IPC, shell launch, broad kill, and executable updater', () => {
   const production = ['main.js', 'preload.js', 'renderer.js', 'index.html', 'src/electron-runtime.js']
     .map(read).join('\n');

From 6a8a4cf95a8ef5f11a571045026f29605d11848c Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Thu, 20 Aug 2026 01:05:46 +0000
Subject: [PATCH 15/22] feat: add bounded large-deployment discovery

---
 main.js                        |   2 +
 preload.js                     |   2 +
 src/alta-client.js             |  51 +++++++++----
 src/device-projection.js       | 127 +++++++++++++++++++++++++++++++++
 src/electron-runtime.js        |  82 ++++++++++++++++++---
 test/alta-client.test.js       |  57 ++++++++++++++-
 test/device-projection.test.js |  83 +++++++++++++++++++++
 test/runtime-contract.test.js  |  69 +++++++++++++++++-
 8 files changed, 449 insertions(+), 24 deletions(-)
 create mode 100644 src/device-projection.js
 create mode 100644 test/device-projection.test.js

diff --git a/main.js b/main.js
index 65b3b9c..29b18c6 100644
--- a/main.js
+++ b/main.js
@@ -78,6 +78,8 @@ function registerIpc(channel, handler) {
 function registerIpcHandlers() {
   registerIpc('get-devices', () => runtime.getDevices());
   registerIpc('get-device-sites', () => runtime.getDeviceSites());
+  registerIpc('get-device-groups', () => runtime.getDeviceGroups());
+  registerIpc('get-device-hierarchy', () => runtime.getDeviceHierarchy());
   registerIpc('get-auth-info', () => runtime.getAuthInfo());
   registerIpc('launch-proxy', (deviceId, username) => runtime.launchProxy(deviceId, username));
   registerIpc('stop-proxy', async (key) => {
diff --git a/preload.js b/preload.js
index 93f85ba..bd60372 100644
--- a/preload.js
+++ b/preload.js
@@ -12,6 +12,8 @@ function onConnectionStateChanged(callback) {
 contextBridge.exposeInMainWorld('electronAPI', Object.freeze({
   getDevices: () => ipcRenderer.invoke('get-devices'),
   getDeviceSites: () => ipcRenderer.invoke('get-device-sites'),
+  getDeviceGroups: () => ipcRenderer.invoke('get-device-groups'),
+  getDeviceHierarchy: () => ipcRenderer.invoke('get-device-hierarchy'),
   getAuthInfo: () => ipcRenderer.invoke('get-auth-info'),
   launchProxy: (deviceId, username) => ipcRenderer.invoke('launch-proxy', deviceId, username),
   stopProxy: (key) => ipcRenderer.invoke('stop-proxy', key),
diff --git a/src/alta-client.js b/src/alta-client.js
index f2a53a1..ff16611 100644
--- a/src/alta-client.js
+++ b/src/alta-client.js
@@ -3,13 +3,24 @@
 const { canonicalizeAltaOrigin, assertSameAltaOrigin } = require('./url-policy');
 const { formatAltaError } = require('./error-redaction');
 
-const DEFAULT_TIMEOUT_MS = 10_000;
-const DEFAULT_MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEVICE_MAX_RESPONSE_BYTES = 32 * 1024 * 1024;
+const HIERARCHY_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+const AUTH_MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+const DEFAULT_MAX_RESPONSE_BYTES = DEVICE_MAX_RESPONSE_BYTES;
+const MAX_ARRAY_OBJECTS = 10_000;
 const DEFAULT_MAX_REDIRECTS = 3;
 const ENDPOINTS = Object.freeze({
-  getDevices: Object.freeze({ path: '/api/v1/devices', shape: 'array' }),
-  getDeviceSites: Object.freeze({ path: '/api/v1/deviceSites', shape: 'array' }),
-  getAuthInfo: Object.freeze({ path: '/api/v1/auth', shape: 'object' }),
+  getDevices: Object.freeze({
+    path: '/api/v1/devices', shape: 'array', maxResponseBytes: DEVICE_MAX_RESPONSE_BYTES, maxObjects: MAX_ARRAY_OBJECTS,
+  }),
+  getDeviceSites: Object.freeze({
+    path: '/api/v1/deviceSites', shape: 'array', maxResponseBytes: HIERARCHY_MAX_RESPONSE_BYTES, maxObjects: MAX_ARRAY_OBJECTS,
+  }),
+  getDeviceGroups: Object.freeze({
+    path: '/api/v1/deviceGroups', shape: 'array', maxResponseBytes: HIERARCHY_MAX_RESPONSE_BYTES, maxObjects: MAX_ARRAY_OBJECTS,
+  }),
+  getAuthInfo: Object.freeze({ path: '/api/v1/auth', shape: 'object', maxResponseBytes: AUTH_MAX_RESPONSE_BYTES }),
 });
 const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 
@@ -118,7 +129,7 @@ class AltaClient {
     }
     if (typeof transport !== 'function') throw new TypeError('AltaClient transport must be a function');
     if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > DEFAULT_TIMEOUT_MS) {
-      throw new RangeError('AltaClient timeout must be between 1 and 10000ms');
+      throw new RangeError('AltaClient timeout must be between 1 and 30000ms');
     }
     if (!Number.isInteger(maxResponseBytes) || maxResponseBytes < 1 || maxResponseBytes > DEFAULT_MAX_RESPONSE_BYTES) {
       throw new RangeError('Invalid Alta response size limit');
@@ -141,6 +152,10 @@ class AltaClient {
     return this.#invoke('getDeviceSites', args);
   }
 
+  getDeviceGroups(...args) {
+    return this.#invoke('getDeviceGroups', args);
+  }
+
   getAuthInfo(...args) {
     return this.#invoke('getAuthInfo', args);
   }
@@ -150,6 +165,7 @@ class AltaClient {
       throw altaError('INVALID_ALTA_ARGUMENTS', 'Alta API methods do not accept renderer parameters');
     }
     const endpoint = ENDPOINTS[operation];
+    const maxResponseBytes = Math.min(this.maxResponseBytes, endpoint.maxResponseBytes);
     const session = this.sessionStore.requireSession();
     const origin = canonicalizeAltaOrigin(session.origin);
     const cookie = session.cookie;
@@ -157,10 +173,15 @@ class AltaClient {
     const controller = new AbortController();
 
     try {
-      const data = await this.#request(operation, `${origin}${endpoint.path}`, origin, cookie, deadline, controller, 0);
+      const data = await this.#request(
+        operation, `${origin}${endpoint.path}`, origin, cookie, deadline, controller, 0, maxResponseBytes,
+      );
       if (endpoint.shape === 'array' && !Array.isArray(data)) {
         throw altaError('INVALID_ALTA_RESPONSE_DATA', 'Alta response did not contain an array');
       }
+      if (endpoint.shape === 'array' && data.length > endpoint.maxObjects) {
+        throw altaError('ALTA_RESPONSE_TOO_MANY_OBJECTS', 'Alta response exceeded the object limit');
+      }
       if (endpoint.shape === 'object' && (!data || typeof data !== 'object' || Array.isArray(data))) {
         throw altaError('INVALID_ALTA_RESPONSE_DATA', 'Alta response did not contain an object');
       }
@@ -172,7 +193,7 @@ class AltaClient {
     }
   }
 
-  async #request(operation, url, origin, cookie, deadline, controller, redirectCount) {
+  async #request(operation, url, origin, cookie, deadline, controller, redirectCount, maxResponseBytes) {
     assertSameAltaOrigin(url, origin);
     const remaining = deadline - Date.now();
     if (remaining <= 0) throw altaError('ALTA_TIMEOUT', 'Alta request timed out', { timeout: true });
@@ -196,7 +217,7 @@ class AltaClient {
           signal: controller.signal,
           proxy: false,
           maxRedirects: 0,
-          maxResponseBytes: this.maxResponseBytes,
+          maxResponseBytes,
         }))),
         timeoutPromise,
       ]);
@@ -209,7 +230,7 @@ class AltaClient {
     }
     const headers = normalizeHeaders(response.headers);
     // Bound every response, including redirects and errors, before acting on it.
-    enforceResponseSize(response.data, headers, this.maxResponseBytes);
+    enforceResponseSize(response.data, headers, maxResponseBytes);
 
     if (REDIRECT_STATUSES.has(response.status)) {
       if (typeof headers.location !== 'string' || headers.location.length === 0) {
@@ -225,14 +246,16 @@ class AltaClient {
       } catch {
         throw altaError('UNSAFE_ALTA_REDIRECT', 'Alta redirect changed the validated origin');
       }
-      return this.#request(operation, target.href, origin, cookie, deadline, controller, redirectCount + 1);
+      return this.#request(
+        operation, target.href, origin, cookie, deadline, controller, redirectCount + 1, maxResponseBytes,
+      );
     }
 
     if (response.status < 200 || response.status > 299) {
       throw altaError('ALTA_HTTP_ERROR', 'Alta request returned an error status', { status: response.status });
     }
 
-    return parseData(response.data, this.maxResponseBytes);
+    return parseData(response.data, maxResponseBytes);
   }
 }
 
@@ -242,10 +265,14 @@ function createAltaClient(options) {
 
 module.exports = {
   AltaClient,
+  AUTH_MAX_RESPONSE_BYTES,
   DEFAULT_MAX_REDIRECTS,
   DEFAULT_MAX_RESPONSE_BYTES,
   DEFAULT_TIMEOUT_MS,
+  DEVICE_MAX_RESPONSE_BYTES,
   ENDPOINTS,
+  HIERARCHY_MAX_RESPONSE_BYTES,
+  MAX_ARRAY_OBJECTS,
   axiosTransport,
   createAltaClient,
 };
diff --git a/src/device-projection.js b/src/device-projection.js
new file mode 100644
index 0000000..fdebb16
--- /dev/null
+++ b/src/device-projection.js
@@ -0,0 +1,127 @@
+'use strict';
+
+const { validateDeviceId } = require('./proxy-launch');
+
+const MAX_PROJECTED_PAYLOAD_BYTES = 8 * 1024 * 1024;
+
+function projectionError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function nullableString(value) {
+  return typeof value === 'string' ? value : null;
+}
+
+function nullableId(value) {
+  return typeof value === 'string' && value.length > 0 ? value : null;
+}
+
+function nullableBoolean(value) {
+  return typeof value === 'boolean' ? value : null;
+}
+
+function projectDevice(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  let id;
+  try {
+    id = validateDeviceId(raw.guid);
+  } catch {
+    return null;
+  }
+  return {
+    id,
+    name: nullableString(raw.name),
+    type: nullableString(raw.type),
+    model: nullableString(raw.model),
+    address: nullableString(raw.address),
+    siteId: nullableId(raw.server_group_id),
+    deviceGroupId: nullableId(raw.device_group_id),
+    displayStatus: nullableString(raw.live && raw.live.display_status),
+    localStorage: nullableBoolean(raw.capabilities && raw.capabilities.localStorage),
+  };
+}
+
+function projectSite(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  const id = nullableId(raw.id);
+  if (!id) return null;
+  return {
+    id,
+    name: nullableString(raw.name),
+    pendingDeletionStart: nullableString(raw.pending_deletion_start),
+  };
+}
+
+function projectGroup(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  const id = nullableId(raw.id);
+  if (!id) return null;
+  return {
+    id,
+    name: nullableString(raw.name),
+    parentId: nullableId(raw.parent_id),
+    pendingDeletionStart: nullableString(raw.pending_deletion_start),
+  };
+}
+
+function projectArray(values, projector) {
+  const projected = [];
+  let invalid = 0;
+  for (const value of Array.isArray(values) ? values : []) {
+    const item = projector(value);
+    if (item) projected.push(item);
+    else invalid += 1;
+  }
+  return { projected, invalid };
+}
+
+function safeMetadataError(value) {
+  return typeof value === 'string' && value.length > 0 ? value.slice(0, 512) : null;
+}
+
+function projectDeviceHierarchy({ devices = [], sites = [], groups = [], metadataErrors = {} } = {}) {
+  if (!Array.isArray(devices) || !Array.isArray(sites) || !Array.isArray(groups)) {
+    throw new TypeError('Hierarchy projection requires arrays');
+  }
+  const deviceProjection = projectArray(devices, projectDevice);
+  const siteProjection = projectArray(sites, projectSite);
+  const groupProjection = projectArray(groups, projectGroup);
+  const payload = {
+    devices: deviceProjection.projected,
+    sites: siteProjection.projected,
+    groups: groupProjection.projected,
+    diagnostics: {
+      devices: {
+        received: devices.length,
+        eligible: deviceProjection.projected.length,
+        invalid: deviceProjection.invalid,
+      },
+      sites: {
+        received: sites.length,
+        projected: siteProjection.projected.length,
+        invalid: siteProjection.invalid,
+        error: safeMetadataError(metadataErrors.sites),
+      },
+      groups: {
+        received: groups.length,
+        projected: groupProjection.projected.length,
+        invalid: groupProjection.invalid,
+        error: safeMetadataError(metadataErrors.groups),
+      },
+    },
+  };
+  if (Buffer.byteLength(JSON.stringify(payload)) > MAX_PROJECTED_PAYLOAD_BYTES) {
+    throw projectionError('PROJECTED_PAYLOAD_TOO_LARGE', 'Projected Alta hierarchy exceeded the IPC size limit');
+  }
+  return payload;
+}
+
+module.exports = {
+  MAX_PROJECTED_PAYLOAD_BYTES,
+  projectDevice,
+  projectDeviceHierarchy,
+  projectGroup,
+  projectSite,
+};
diff --git a/src/electron-runtime.js b/src/electron-runtime.js
index 77efd1e..9c0324a 100644
--- a/src/electron-runtime.js
+++ b/src/electron-runtime.js
@@ -10,14 +10,18 @@ const {
   readJsonBody,
 } = require('./bridge-auth');
 const { RELEASES_PAGE_URL } = require('./update-policy');
+const { projectDeviceHierarchy, projectGroup, projectSite } = require('./device-projection');
 const { validateDeviceId, validateUsername } = require('./proxy-launch');
 
+const DEFAULT_DISCOVERY_TIMEOUT_MS = 60_000;
+
 const PAIRING_ENVELOPE_FILENAME = 'bridge-pairing.json';
 
 function safeErrorMessage(error, fallback) {
   const allowed = new Set([
     'NO_ALTA_SESSION', 'INVALID_ALTA_ARGUMENTS', 'ALTA_TIMEOUT', 'ALTA_HTTP_ERROR',
     'INVALID_ALTA_RESPONSE', 'INVALID_ALTA_RESPONSE_DATA', 'ALTA_RESPONSE_TOO_LARGE',
+    'ALTA_RESPONSE_TOO_MANY_OBJECTS', 'PROJECTED_PAYLOAD_TOO_LARGE',
     'UNSAFE_ALTA_REDIRECT', 'TOO_MANY_ALTA_REDIRECTS', 'HELPER_NOT_FOUND',
     'UNSUPPORTED_PLATFORM', 'INVALID_DEVICE_ID', 'INVALID_USERNAME', 'SPAWN_FAILED',
   ]);
@@ -196,13 +200,19 @@ class AppRuntime {
     checkForUpdate,
     currentVersion,
     openExternal,
+    discoveryTimeoutMs = DEFAULT_DISCOVERY_TIMEOUT_MS,
   } = {}) {
+    if (!Number.isInteger(discoveryTimeoutMs) || discoveryTimeoutMs < 1 ||
+        discoveryTimeoutMs > DEFAULT_DISCOVERY_TIMEOUT_MS) {
+      throw new RangeError('AppRuntime discovery timeout must be between 1 and 60000ms');
+    }
     this.sessionStore = sessionStore;
     this.altaClient = altaClient;
     this.proxyManager = proxyManager;
     this.checkForUpdatePolicy = checkForUpdate;
     this.currentVersion = currentVersion;
     this.openExternal = openExternal;
+    this.discoveryTimeoutMs = discoveryTimeoutMs;
     this.allowedDeviceIds = new Set();
     this.proxyByDevice = new Map();
   }
@@ -223,15 +233,17 @@ class AppRuntime {
     return tracked.filter((proxy) => this.proxyByDevice.get(proxy.deviceId) === proxy.processId);
   }
 
+  _setAllowedDevices(devices) {
+    this.allowedDeviceIds = new Set(devices.map((device) => device.id));
+  }
+
   async getDevices() {
     try {
-      const devices = await this.altaClient.getDevices();
-      this.allowedDeviceIds = new Set();
-      for (const device of devices) {
-        const candidate = device && (device.guid || device.id);
-        try { this.allowedDeviceIds.add(validateDeviceId(candidate)); } catch {}
-      }
-      return { success: true, devices };
+      const hierarchy = projectDeviceHierarchy({
+        devices: await this.altaClient.getDevices(), sites: [], groups: [],
+      });
+      this._setAllowedDevices(hierarchy.devices);
+      return { success: true, devices: hierarchy.devices };
     } catch (error) {
       return { success: false, devices: [], message: safeErrorMessage(error, 'Failed to get devices') };
     }
@@ -239,12 +251,66 @@ class AppRuntime {
 
   async getDeviceSites() {
     try {
-      return { success: true, sites: await this.altaClient.getDeviceSites() };
+      const sites = (await this.altaClient.getDeviceSites()).map(projectSite).filter(Boolean);
+      return { success: true, sites };
     } catch (error) {
       return { success: false, sites: [], message: safeErrorMessage(error, 'Failed to get device sites') };
     }
   }
 
+  async getDeviceGroups() {
+    try {
+      const groups = (await this.altaClient.getDeviceGroups()).map(projectGroup).filter(Boolean);
+      return { success: true, groups };
+    } catch (error) {
+      return { success: false, groups: [], message: safeErrorMessage(error, 'Failed to get device groups') };
+    }
+  }
+
+  async getDeviceHierarchy() {
+    let timer;
+    try {
+      const discovery = Promise.allSettled([
+        this.altaClient.getDevices(),
+        this.altaClient.getDeviceSites(),
+        this.altaClient.getDeviceGroups(),
+      ]);
+      const deadline = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          const error = new Error('Alta device discovery timed out');
+          error.code = 'DISCOVERY_TIMEOUT';
+          reject(error);
+        }, this.discoveryTimeoutMs);
+      });
+      const [deviceResult, siteResult, groupResult] = await Promise.race([discovery, deadline]);
+      if (deviceResult.status === 'rejected') throw deviceResult.reason;
+
+      const metadataErrors = {};
+      if (siteResult.status === 'rejected') {
+        metadataErrors.sites = 'Device sites unavailable';
+      }
+      if (groupResult.status === 'rejected') {
+        metadataErrors.groups = 'Device groups unavailable';
+      }
+      const hierarchy = projectDeviceHierarchy({
+        devices: deviceResult.value,
+        sites: siteResult.status === 'fulfilled' ? siteResult.value : [],
+        groups: groupResult.status === 'fulfilled' ? groupResult.value : [],
+        metadataErrors,
+      });
+      this._setAllowedDevices(hierarchy.devices);
+      return { success: true, hierarchy };
+    } catch (error) {
+      this.allowedDeviceIds.clear();
+      const message = error && error.code === 'DISCOVERY_TIMEOUT'
+        ? 'Alta device discovery timed out'
+        : safeErrorMessage(error, 'Failed to discover Alta devices');
+      return { success: false, hierarchy: { devices: [], sites: [], groups: [] }, message };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+
   async getAuthInfo() {
     try {
       return { success: true, authInfo: await this.altaClient.getAuthInfo() };
diff --git a/test/alta-client.test.js b/test/alta-client.test.js
index b33c295..e276600 100644
--- a/test/alta-client.test.js
+++ b/test/alta-client.test.js
@@ -3,7 +3,12 @@
 const test = require('node:test');
 const assert = require('node:assert/strict');
 const { SessionStore } = require('../src/session-store');
-const { AltaClient } = require('../src/alta-client');
+const {
+  AltaClient,
+  DEVICE_MAX_RESPONSE_BYTES,
+  HIERARCHY_MAX_RESPONSE_BYTES,
+  MAX_ARRAY_OBJECTS,
+} = require('../src/alta-client');
 
 const ORIGIN = 'https://tenant.avasecurity.com';
 const SENTINEL = 'HERMES_SENTINEL_SECRET';
@@ -24,17 +29,20 @@ test('uses only stored authority, fixed endpoint paths and hardened transport op
     calls.push(options);
     if (options.url.endsWith('/devices')) return response([]);
     if (options.url.endsWith('/deviceSites')) return response([{ id: 'site-1' }]);
+    if (options.url.endsWith('/deviceGroups')) return response([{ id: 'group-1' }]);
     return response({ user: 'engineer' });
   };
   const client = new AltaClient({ sessionStore: readyStore(), transport });
 
   assert.deepEqual(await client.getDevices(), []);
   assert.deepEqual(await client.getDeviceSites(), [{ id: 'site-1' }]);
+  assert.deepEqual(await client.getDeviceGroups(), [{ id: 'group-1' }]);
   assert.deepEqual(await client.getAuthInfo(), { user: 'engineer' });
 
   assert.deepEqual(calls.map((call) => call.url), [
     `${ORIGIN}/api/v1/devices`,
     `${ORIGIN}/api/v1/deviceSites`,
+    `${ORIGIN}/api/v1/deviceGroups`,
     `${ORIGIN}/api/v1/auth`,
   ]);
   for (const call of calls) {
@@ -42,11 +50,56 @@ test('uses only stored authority, fixed endpoint paths and hardened transport op
     assert.equal(call.proxy, false);
     assert.equal(call.maxRedirects, 0);
     assert.match(call.headers.Cookie, /^va=HERMES_SENTINEL_SECRET$/);
-    assert.ok(call.timeout > 0 && call.timeout <= 10_000);
+    assert.ok(call.timeout > 0 && call.timeout <= 30_000);
     assert.ok(call.maxResponseBytes > 0);
   }
 });
 
+test('uses endpoint-specific 32 MiB/4 MiB limits and a 30 second request deadline', async () => {
+  const calls = [];
+  const client = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async (options) => { calls.push(options); return response([]); },
+  });
+
+  await client.getDevices();
+  await client.getDeviceSites();
+  await client.getDeviceGroups();
+
+  assert.deepEqual(calls.map(({ maxResponseBytes }) => maxResponseBytes), [
+    DEVICE_MAX_RESPONSE_BYTES,
+    HIERARCHY_MAX_RESPONSE_BYTES,
+    HIERARCHY_MAX_RESPONSE_BYTES,
+  ]);
+  assert.ok(calls.every(({ timeout }) => timeout > 0 && timeout <= 30_000));
+});
+
+test('accepts device bodies above 2 MiB and rejects bodies above 32 MiB before parsing', async () => {
+  const acceptedBody = JSON.stringify([{
+    guid: '550e8400-e29b-41d4-a716-446655440000',
+    padding: 'x'.repeat((2 * 1024 * 1024) + 1),
+  }]);
+  const accepted = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async () => response(Buffer.from(acceptedBody)),
+  });
+  assert.equal((await accepted.getDevices()).length, 1);
+
+  const rejected = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async () => response(Buffer.alloc(DEVICE_MAX_RESPONSE_BYTES + 1, 0x20)),
+  });
+  await assert.rejects(rejected.getDevices(), { code: 'ALTA_RESPONSE_TOO_LARGE' });
+});
+
+test('rejects plain array responses containing more than 10,000 objects', async () => {
+  const client = new AltaClient({
+    sessionStore: readyStore(),
+    transport: async () => response(Array.from({ length: MAX_ARRAY_OBJECTS + 1 }, () => ({}))),
+  });
+  await assert.rejects(client.getDevices(), { code: 'ALTA_RESPONSE_TOO_MANY_OBJECTS' });
+});
+
 test('rejects renderer-supplied URL/cookie parameters before transport', async () => {
   let calls = 0;
   const client = new AltaClient({
diff --git a/test/device-projection.test.js b/test/device-projection.test.js
new file mode 100644
index 0000000..78722a9
--- /dev/null
+++ b/test/device-projection.test.js
@@ -0,0 +1,83 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const {
+  MAX_PROJECTED_PAYLOAD_BYTES,
+  projectDeviceHierarchy,
+} = require('../src/device-projection');
+
+function uuid(index) {
+  return `00000000-0000-4000-8000-${index.toString(16).padStart(12, '0')}`;
+}
+
+function rawDevice(index, overrides = {}) {
+  return {
+    guid: uuid(index),
+    name: `Camera ${index}`,
+    type: 'camera',
+    model: 'Synthetic',
+    address: `10.0.${Math.floor(index / 255)}.${index % 255}`,
+    server_group_id: 'site-1',
+    device_group_id: 'group-1',
+    capabilities: { localStorage: index % 2 === 0, secretCapability: 'drop-me' },
+    live: { display_status: 'online', private: 'drop-me' },
+    cookie: 'must-not-cross-ipc',
+    ...overrides,
+  };
+}
+
+test('projects only allowlisted fields and honestly diagnoses ineligible devices', () => {
+  const payload = projectDeviceHierarchy({
+    devices: [rawDevice(1), rawDevice(2, { guid: 'not-a-uuid' })],
+    sites: [{ id: 'site-1', name: 'HQ', pending_deletion_start: null, secret: 'drop-me' }],
+    groups: [{ id: 'group-1', name: 'Lobby', parent_id: null, pending_deletion_start: null, secret: 'drop-me' }],
+  });
+
+  assert.deepEqual(payload.devices, [{
+    id: uuid(1), name: 'Camera 1', type: 'camera', model: 'Synthetic', address: '10.0.0.1',
+    siteId: 'site-1', deviceGroupId: 'group-1', displayStatus: 'online', localStorage: false,
+  }]);
+  assert.deepEqual(payload.sites, [{ id: 'site-1', name: 'HQ', pendingDeletionStart: null }]);
+  assert.deepEqual(payload.groups, [{ id: 'group-1', name: 'Lobby', parentId: null, pendingDeletionStart: null }]);
+  assert.deepEqual(payload.diagnostics.devices, { received: 2, eligible: 1, invalid: 1 });
+  assert.doesNotMatch(JSON.stringify(payload), /drop-me|cookie|secretCapability|private/);
+});
+
+test('projects synthetic 1,500 and 10,000 camera deployments below the 8 MiB IPC cap', () => {
+  for (const count of [1_500, 10_000]) {
+    const payload = projectDeviceHierarchy({
+      devices: Array.from({ length: count }, (_, index) => rawDevice(index)),
+      sites: [],
+      groups: [],
+    });
+    assert.equal(payload.devices.length, count);
+    assert.equal(payload.diagnostics.devices.received, count);
+    assert.ok(Buffer.byteLength(JSON.stringify(payload)) <= MAX_PROJECTED_PAYLOAD_BYTES);
+  }
+});
+
+test('malformed hierarchy metadata does not hide valid cameras', () => {
+  const payload = projectDeviceHierarchy({
+    devices: [rawDevice(7)],
+    sites: [null, { id: {}, name: 'bad' }],
+    groups: ['bad'],
+    metadataErrors: { sites: 'Unavailable', groups: 'Unavailable' },
+  });
+  assert.equal(payload.devices.length, 1);
+  assert.deepEqual(payload.sites, []);
+  assert.deepEqual(payload.groups, []);
+  assert.equal(payload.diagnostics.sites.invalid, 2);
+  assert.equal(payload.diagnostics.groups.invalid, 1);
+  assert.equal(payload.diagnostics.sites.error, 'Unavailable');
+});
+
+test('rejects a projected hierarchy payload above 8 MiB', () => {
+  const devices = Array.from({ length: 10_000 }, (_, index) => rawDevice(index, {
+    name: `Camera ${index} ${'x'.repeat(900)}`,
+  }));
+  assert.throws(
+    () => projectDeviceHierarchy({ devices, sites: [], groups: [] }),
+    { code: 'PROJECTED_PAYLOAD_TOO_LARGE' },
+  );
+});
diff --git a/test/runtime-contract.test.js b/test/runtime-contract.test.js
index 596befc..f2f3036 100644
--- a/test/runtime-contract.test.js
+++ b/test/runtime-contract.test.js
@@ -78,7 +78,20 @@ test('runtime keeps Alta credentials in main-owned modules and exposes only non-
     openExternal: async () => {},
   });
 
-  assert.deepEqual(await runtime.getDevices(), { success: true, devices: [{ guid: '550e8400-e29b-41d4-a716-446655440000' }] });
+  assert.deepEqual(await runtime.getDevices(), {
+    success: true,
+    devices: [{
+      id: '550e8400-e29b-41d4-a716-446655440000',
+      name: null,
+      type: null,
+      model: null,
+      address: null,
+      siteId: null,
+      deviceGroupId: null,
+      displayStatus: null,
+      localStorage: null,
+    }],
+  });
   const launched = await runtime.launchProxy(
     '550e8400-e29b-41d4-a716-446655440000',
     'proxy.operator@example.com'
@@ -102,6 +115,57 @@ test('runtime keeps Alta credentials in main-owned modules and exposes only non-
   assert.equal((await runtime.stopProxy(999)).success, false);
 });
 
+test('runtime discovers and projects hierarchy while metadata failures preserve cameras', async () => {
+  const deviceId = '550e8400-e29b-41d4-a716-446655440000';
+  const runtime = new AppRuntime({
+    sessionStore: createSessionStore(),
+    altaClient: {
+      getDevices: async () => [{
+        guid: deviceId,
+        name: 'Camera',
+        server_group_id: 'site-1',
+        secret: 'drop-me',
+      }],
+      getDeviceSites: async () => { throw Object.assign(new Error('tenant secret'), { code: 'ALTA_HTTP_ERROR' }); },
+      getDeviceGroups: async () => [{ id: 'group-1', name: 'Lobby', parent_id: null }],
+    },
+    proxyManager: { listTrackedProxies: () => [] },
+  });
+
+  const result = await runtime.getDeviceHierarchy();
+  assert.equal(result.success, true);
+  assert.deepEqual(result.hierarchy.devices.map(({ id }) => id), [deviceId]);
+  assert.deepEqual(result.hierarchy.sites, []);
+  assert.deepEqual(result.hierarchy.groups, [{
+    id: 'group-1', name: 'Lobby', parentId: null, pendingDeletionStart: null,
+  }]);
+  assert.equal(result.hierarchy.diagnostics.sites.error, 'Device sites unavailable');
+  assert.doesNotMatch(JSON.stringify(result), /drop-me|tenant secret/);
+});
+
+test('runtime enforces a bounded whole-discovery deadline', async () => {
+  const runtime = new AppRuntime({
+    sessionStore: createSessionStore(),
+    altaClient: {
+      getDevices: async () => new Promise(() => {}),
+      getDeviceSites: async () => [],
+      getDeviceGroups: async () => [],
+    },
+    proxyManager: { listTrackedProxies: () => [] },
+    discoveryTimeoutMs: 25,
+  });
+  const result = await runtime.getDeviceHierarchy();
+  assert.deepEqual(result, {
+    success: false,
+    hierarchy: { devices: [], sites: [], groups: [] },
+    message: 'Alta device discovery timed out',
+  });
+});
+
+test('runtime rejects discovery deadlines above 60 seconds', () => {
+  assert.throws(() => new AppRuntime({ discoveryTimeoutMs: 60_001 }), /discovery timeout/i);
+});
+
 test('runtime rejects invalid usernames before calling the proxy manager', async () => {
   const sessionStore = createSessionStore();
   sessionStore.establish('https://customer.avasecurity.com', 'top-secret-cookie');
@@ -364,7 +428,8 @@ test('preload and renderer expose only narrow, credential-free contracts', () =>
   const renderer = read('renderer.js');
   const html = read('index.html');
   const expectedMethods = [
-    'getDevices', 'getDeviceSites', 'getAuthInfo', 'launchProxy', 'stopProxy', 'disconnect',
+    'getDevices', 'getDeviceSites', 'getDeviceGroups', 'getDeviceHierarchy', 'getAuthInfo',
+    'launchProxy', 'stopProxy', 'disconnect',
     'getConnectionState', 'checkForUpdates', 'openFixedReleasesPage', 'rotatePairing',
     'revokePairing', 'getPairingStatus', 'onConnectionStateChanged',
   ];

From c65a813e5f256d62ecc600caaf91a6b6273af43b Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Thu, 20 Aug 2026 01:03:48 +0000
Subject: [PATCH 16/22] feat: add scalable device hierarchy model

---
 device-tree.js                  | 304 ++++++++++++++++++++++++++++++++
 sidebar-controller.js           | 202 +++++++++++++++++++++
 test/device-tree.test.js        | 147 +++++++++++++++
 test/sidebar-controller.test.js | 114 ++++++++++++
 4 files changed, 767 insertions(+)
 create mode 100644 device-tree.js
 create mode 100644 sidebar-controller.js
 create mode 100644 test/device-tree.test.js
 create mode 100644 test/sidebar-controller.test.js

diff --git a/device-tree.js b/device-tree.js
new file mode 100644
index 0000000..aa3f26e
--- /dev/null
+++ b/device-tree.js
@@ -0,0 +1,304 @@
+'use strict';
+
+(function exposeDeviceTree(globalScope) {
+  const SPECIAL = Object.freeze({
+    ORPHAN_SITE: '__orphaned__',
+    UNGROUPED: '__ungrouped__',
+    UNKNOWN_GROUP_PREFIX: '__unknown_group__:',
+    UNKNOWN_SITE_PREFIX: '__unknown_site__:',
+  });
+
+  function text(value) {
+    return value === null || value === undefined ? '' : String(value).trim();
+  }
+
+  function normalized(value) {
+    return text(value).normalize('NFKD').toLocaleLowerCase();
+  }
+
+  function compareNodes(left, right) {
+    const nameOrder = left.normalizedName === right.normalizedName
+      ? 0
+      : (left.normalizedName < right.normalizedName ? -1 : 1);
+    const idOrder = left.canonicalId === right.canonicalId
+      ? 0
+      : (left.canonicalId < right.canonicalId ? -1 : 1);
+    return nameOrder || idOrder || left.ordinal - right.ordinal;
+  }
+
+  function createIdentity(kind, item, ordinal, occurrences, diagnostics) {
+    const rawId = text(item && item.id);
+    const canonicalId = rawId || `__invalid_${kind}_${ordinal}`;
+    const count = (occurrences.get(canonicalId) || 0) + 1;
+    occurrences.set(canonicalId, count);
+    if (!rawId) diagnostics.push({ code: 'malformed-id', kind, ordinal, id: rawId });
+    if (count > 1) diagnostics.push({ code: 'duplicate-id', kind, ordinal, id: canonicalId });
+    return {
+      rawId,
+      canonicalId,
+      uniqueId: count === 1 ? canonicalId : `${canonicalId}~${count}`,
+    };
+  }
+
+  function makeSite(id, name, ordinal, extra) {
+    return Object.assign({
+      kind: 'site', id, canonicalId: id, name, normalizedName: normalized(name), ordinal,
+      key: `site:${id}`, pendingDeletion: false, groups: [], synthetic: false,
+    }, extra);
+  }
+
+  function makeGroup(site, id, name, ordinal, extra) {
+    return Object.assign({
+      kind: 'group', id, canonicalId: id, name, normalizedName: normalized(name), ordinal,
+      key: `group:${site.id}:${id}`, parentKey: site.key, site, cameras: [],
+      pendingDeletion: false, synthetic: false,
+    }, extra);
+  }
+
+  function buildDeviceTree(payload = {}) {
+    const diagnostics = [];
+    const sourceSites = Array.isArray(payload.sites) ? payload.sites : [];
+    const sourceGroups = Array.isArray(payload.groups) ? payload.groups : [];
+    const sourceDevices = Array.isArray(payload.devices) ? payload.devices : [];
+    const rowByKey = new Map();
+    const cameraByKey = new Map();
+    const sites = [];
+    const siteByRawId = new Map();
+    const groupByRawId = new Map();
+    const groupOccurrences = new Map();
+    const siteOccurrences = new Map();
+    const cameraOccurrences = new Map();
+    let syntheticOrdinal = sourceSites.length + sourceGroups.length + sourceDevices.length;
+
+    sourceSites.forEach((item, ordinal) => {
+      const safe = item && typeof item === 'object' ? item : {};
+      const identity = createIdentity('site', safe, ordinal, siteOccurrences, diagnostics);
+      const site = makeSite(identity.uniqueId, text(safe.name) || identity.canonicalId, ordinal, {
+        canonicalId: identity.canonicalId,
+        pendingDeletion: safe.pendingDeletion === true,
+        source: safe,
+      });
+      sites.push(site);
+      rowByKey.set(site.key, site);
+      if (identity.rawId && !siteByRawId.has(identity.rawId)) siteByRawId.set(identity.rawId, site);
+    });
+
+    function ensureUnknownSite(rawSiteId) {
+      const labelId = text(rawSiteId);
+      const id = labelId ? `${SPECIAL.UNKNOWN_SITE_PREFIX}${labelId}` : SPECIAL.ORPHAN_SITE;
+      let site = rowByKey.get(`site:${id}`);
+      if (!site) {
+        const name = labelId ? `Unknown site: ${labelId}` : 'Orphaned cameras';
+        site = makeSite(id, name, syntheticOrdinal++, { synthetic: true, hierarchyStatus: labelId ? 'unknown-site' : 'orphan' });
+        sites.push(site);
+        rowByKey.set(site.key, site);
+      }
+      return site;
+    }
+
+    sourceGroups.forEach((item, ordinal) => {
+      const safe = item && typeof item === 'object' ? item : {};
+      const identity = createIdentity('group', safe, ordinal, groupOccurrences, diagnostics);
+      const parentId = text(safe.parentId);
+      const site = siteByRawId.get(parentId) || ensureUnknownSite(parentId);
+      if (!siteByRawId.has(parentId)) diagnostics.push({ code: parentId ? 'unknown-parent-site' : 'malformed-parent-site', key: `group:${site.id}:${identity.uniqueId}`, id: parentId });
+      const group = makeGroup(site, identity.uniqueId, text(safe.name) || identity.canonicalId, ordinal, {
+        canonicalId: identity.canonicalId,
+        rawParentId: parentId,
+        pendingDeletion: safe.pendingDeletion === true,
+        source: safe,
+      });
+      site.groups.push(group);
+      rowByKey.set(group.key, group);
+      if (identity.rawId && !groupByRawId.has(identity.rawId)) groupByRawId.set(identity.rawId, group);
+    });
+
+    function ensureGroup(site, id, name, status, template) {
+      const key = `group:${site.id}:${id}`;
+      let group = rowByKey.get(key);
+      if (!group) {
+        group = makeGroup(site, id, name, syntheticOrdinal++, {
+          synthetic: true,
+          hierarchyStatus: status,
+          canonicalId: template ? template.canonicalId : id,
+          pendingDeletion: template ? template.pendingDeletion : false,
+          source: template ? template.source : undefined,
+        });
+        site.groups.push(group);
+        rowByKey.set(group.key, group);
+      }
+      return group;
+    }
+
+    sourceDevices.forEach((item, ordinal) => {
+      const safe = item && typeof item === 'object' ? item : {};
+      const identity = createIdentity('camera', safe, ordinal, cameraOccurrences, diagnostics);
+      const directSiteId = text(safe.siteId);
+      const requestedGroupId = text(safe.deviceGroupId);
+      const knownGroup = requestedGroupId ? groupByRawId.get(requestedGroupId) : undefined;
+      let site;
+      let hierarchyStatus = text(safe.hierarchyStatus) || 'assigned';
+
+      if (directSiteId) {
+        site = siteByRawId.get(directSiteId) || ensureUnknownSite(directSiteId);
+        if (!siteByRawId.has(directSiteId)) hierarchyStatus = 'unknown-site';
+      } else if (knownGroup) {
+        site = knownGroup.site;
+        hierarchyStatus = 'inferred-site';
+      } else {
+        site = ensureUnknownSite('');
+        hierarchyStatus = requestedGroupId ? 'unknown-group' : 'orphan';
+      }
+
+      let group;
+      if (!requestedGroupId) {
+        group = ensureGroup(site, SPECIAL.UNGROUPED, 'Ungrouped', 'ungrouped');
+      } else if (!knownGroup) {
+        group = ensureGroup(site, `${SPECIAL.UNKNOWN_GROUP_PREFIX}${requestedGroupId}`, `Unknown group: ${requestedGroupId}`, 'unknown-group');
+        if (hierarchyStatus !== 'unknown-site') hierarchyStatus = 'unknown-group';
+        diagnostics.push({ code: 'unknown-group', key: `camera:${identity.uniqueId}`, id: requestedGroupId });
+      } else if (knownGroup.site !== site) {
+        group = ensureGroup(site, knownGroup.id, knownGroup.name, 'conflict', knownGroup);
+        hierarchyStatus = 'conflict';
+        diagnostics.push({ code: 'site-group-conflict', key: `camera:${identity.uniqueId}`, siteId: directSiteId, groupId: requestedGroupId, groupSiteId: knownGroup.site.canonicalId });
+      } else {
+        group = knownGroup;
+      }
+
+      const name = text(safe.name) || identity.canonicalId;
+      const camera = {
+        kind: 'camera', id: identity.uniqueId, canonicalId: identity.canonicalId,
+        key: `camera:${identity.uniqueId}`, name, normalizedName: normalized(name), ordinal,
+        parentKey: group.key, site, group, hierarchyStatus, source: safe,
+      };
+      camera.searchCorpus = normalized([
+        name, identity.canonicalId, safe.model, safe.type, safe.address, site.name, group.name,
+      ].map(text).join(' '));
+      group.cameras.push(camera);
+      cameraByKey.set(camera.key, camera);
+      rowByKey.set(camera.key, camera);
+    });
+
+    sites.forEach((site) => {
+      site.groups.sort(compareNodes);
+      site.groups.forEach((group) => group.cameras.sort(compareNodes));
+    });
+    sites.sort(compareNodes);
+
+    return Object.freeze({ sites, rowByKey, cameraByKey, diagnostics, cameraCount: cameraByKey.size });
+  }
+
+  function rowDescriptor(node, level, expanded, selectedKey, position, size) {
+    const aria = {
+      level,
+      expanded: node.kind === 'camera' ? undefined : expanded,
+      selected: node.key === selectedKey,
+      posinset: position,
+      setsize: size,
+    };
+    return {
+      key: node.key, parentKey: node.parentKey || null, kind: node.kind, id: node.id,
+      name: node.name, pendingDeletion: node.pendingDeletion === true,
+      hierarchyStatus: node.hierarchyStatus, aria,
+      ariaLevel: aria.level, ariaExpanded: aria.expanded, ariaSelected: aria.selected,
+      ariaPosInSet: aria.posinset, ariaSetSize: aria.setsize,
+    };
+  }
+
+  function flattenVisibleRows(model, options = {}) {
+    const expandedKeys = options.expandedKeys instanceof Set ? options.expandedKeys : new Set();
+    const selectedKey = typeof options.selectedKey === 'string' ? options.selectedKey : null;
+    const matches = options.matchCameraKeys instanceof Set ? options.matchCameraKeys : null;
+    const rows = [];
+    const includedGroups = (site) => site.groups.filter((group) => !matches || group.cameras.some((camera) => matches.has(camera.key)));
+    const includedSites = model.sites.filter((site) => !matches || includedGroups(site).length > 0);
+
+    includedSites.forEach((site, siteIndex) => {
+      const siteExpanded = expandedKeys.has(site.key);
+      rows.push(rowDescriptor(site, 1, siteExpanded, selectedKey, siteIndex + 1, includedSites.length));
+      if (!siteExpanded) return;
+      const groups = includedGroups(site);
+      groups.forEach((group, groupIndex) => {
+        const groupExpanded = expandedKeys.has(group.key);
+        rows.push(rowDescriptor(group, 2, groupExpanded, selectedKey, groupIndex + 1, groups.length));
+        if (!groupExpanded) return;
+        const cameras = matches ? group.cameras.filter((camera) => matches.has(camera.key)) : group.cameras;
+        cameras.forEach((camera, cameraIndex) => {
+          rows.push(rowDescriptor(camera, 3, undefined, selectedKey, cameraIndex + 1, cameras.length));
+        });
+      });
+    });
+    Object.defineProperty(rows, 'hiddenSelected', {
+      value: Boolean(selectedKey && model.rowByKey.has(selectedKey) && !rows.some((row) => row.key === selectedKey)),
+      enumerable: true,
+    });
+    return rows;
+  }
+
+  function calculateVirtualWindow(rows, options = {}) {
+    const rowHeight = Number.isFinite(options.rowHeight) && options.rowHeight > 0 ? options.rowHeight : 28;
+    const viewportHeight = Number.isFinite(options.viewportHeight) && options.viewportHeight >= 0 ? options.viewportHeight : 0;
+    const scrollTop = Math.max(0, Number.isFinite(options.scrollTop) ? options.scrollTop : 0);
+    const overscan = Math.max(0, Number.isInteger(options.overscan) ? options.overscan : 16);
+    const visibleStart = Math.floor(scrollTop / rowHeight);
+    const visibleEnd = Math.ceil((scrollTop + viewportHeight) / rowHeight);
+    const startIndex = Math.max(0, Math.min(rows.length, visibleStart - overscan));
+    const endIndex = Math.max(startIndex, Math.min(rows.length, visibleEnd + overscan));
+    return {
+      rows: rows.slice(startIndex, endIndex), startIndex, endIndex,
+      offsetTop: startIndex * rowHeight, totalHeight: rows.length * rowHeight,
+    };
+  }
+
+  function createSearchRunner(options = {}) {
+    const scheduler = typeof options.scheduler === 'function'
+      ? options.scheduler
+      : (work) => setTimeout(work, 0);
+    const chunkSize = Number.isInteger(options.chunkSize) && options.chunkSize > 0 ? options.chunkSize : 250;
+    let generation = 0;
+
+    function search(model, query, searchOptions = {}) {
+      const myGeneration = ++generation;
+      const terms = normalized(query).split(/\s+/).filter(Boolean);
+      const cameras = [...model.cameraByKey.values()];
+      const cameraKeys = new Set();
+      const expandedKeys = new Set(searchOptions.expandedKeys instanceof Set ? searchOptions.expandedKeys : []);
+      let index = 0;
+
+      return new Promise((resolve) => {
+        function finish(cancelled) {
+          resolve(Object.freeze({ generation: myGeneration, cancelled, count: cameraKeys.size, cameraKeys, expandedKeys }));
+        }
+        function work() {
+          if (myGeneration !== generation) return finish(true);
+          const end = Math.min(cameras.length, index + chunkSize);
+          for (; index < end; index += 1) {
+            const camera = cameras[index];
+            if (terms.every((term) => camera.searchCorpus.includes(term))) {
+              cameraKeys.add(camera.key);
+              expandedKeys.add(camera.site.key);
+              expandedKeys.add(camera.group.key);
+            }
+          }
+          if (index < cameras.length) scheduler(work);
+          else finish(false);
+        }
+        scheduler(work);
+      });
+    }
+
+    return Object.freeze({ search, cancel() { generation += 1; }, get generation() { return generation; } });
+  }
+
+  const api = Object.freeze({
+    SPECIAL,
+    buildDeviceTree,
+    buildDeviceTreeModel: buildDeviceTree,
+    flattenVisibleRows,
+    flattenRows: flattenVisibleRows,
+    createSearchRunner,
+    calculateVirtualWindow,
+  });
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  if (globalScope) globalScope.AptDeviceTree = api;
+}(typeof window !== 'undefined' ? window : undefined));
diff --git a/sidebar-controller.js b/sidebar-controller.js
new file mode 100644
index 0000000..fb1ec83
--- /dev/null
+++ b/sidebar-controller.js
@@ -0,0 +1,202 @@
+'use strict';
+
+(function defineSidebarController(root, factory) {
+  const treeApi = typeof module !== 'undefined' && module.exports
+    ? require('./device-tree')
+    : root && root.AptDeviceTree;
+  const api = factory(treeApi);
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  if (root) root.AptSidebarController = api;
+}(typeof window !== 'undefined' ? window : undefined, function sidebarFactory(treeApi) {
+  function validKey(key) {
+    return typeof key === 'string' && /^(site|group|camera):[^\s]+$/.test(key);
+  }
+
+  function copySet(value) {
+    return value instanceof Set ? new Set(value) : new Set();
+  }
+
+  function createInitialState(initial = {}) {
+    return {
+      expandedKeys: copySet(initial.expandedKeys),
+      activeKey: validKey(initial.activeKey) ? initial.activeKey : null,
+      selectedKey: validKey(initial.selectedKey) ? initial.selectedKey : null,
+      searchQuery: typeof initial.searchQuery === 'string' ? initial.searchQuery : '',
+      searchCameraKeys: initial.searchCameraKeys instanceof Set ? new Set(initial.searchCameraKeys) : null,
+      searchExpandedKeys: initial.searchExpandedKeys instanceof Set ? new Set(initial.searchExpandedKeys) : null,
+      searchGeneration: Number.isInteger(initial.searchGeneration) ? initial.searchGeneration : 0,
+      scrollTop: Number.isFinite(initial.scrollTop) ? Math.max(0, initial.scrollTop) : 0,
+      viewportHeight: Number.isFinite(initial.viewportHeight) ? Math.max(0, initial.viewportHeight) : 320,
+    };
+  }
+
+  function findRow(rows, key) {
+    if (!validKey(key) || !Array.isArray(rows)) return null;
+    return rows.find((row) => row && row.key === key) || null;
+  }
+
+  function changeExpansion(state, row, force) {
+    if (!row || row.kind === 'camera') return state;
+    const expandedKeys = copySet(state.expandedKeys);
+    const shouldExpand = force === undefined ? !expandedKeys.has(row.key) : force;
+    if (shouldExpand) expandedKeys.add(row.key);
+    else expandedKeys.delete(row.key);
+    return Object.assign({}, state, { expandedKeys, activeKey: row.key });
+  }
+
+  function activate(state, row) {
+    if (!row) return state;
+    if (row.kind === 'camera') return Object.assign({}, state, { activeKey: row.key, selectedKey: row.key });
+    return changeExpansion(state, row);
+  }
+
+  function moveActive(state, rows, targetIndex) {
+    if (!rows.length) return state;
+    const index = Math.max(0, Math.min(rows.length - 1, targetIndex));
+    return Object.assign({}, state, { activeKey: rows[index].key });
+  }
+
+  function reduceSidebar(state, action, rows = []) {
+    if (!state || !action || typeof action.type !== 'string') return state;
+    if (action.type === 'ACTIVATE' || action.type === 'CLICK') {
+      return activate(state, findRow(rows, action.rowKey));
+    }
+    if (action.type === 'SET_SELECTION') {
+      if (!validKey(action.rowKey) || !action.rowKey.startsWith('camera:') ||
+          (!action.allowHidden && !findRow(rows, action.rowKey))) return state;
+      return Object.assign({}, state, { selectedKey: action.rowKey, activeKey: action.rowKey });
+    }
+    if (action.type === 'SET_ACTIVE') {
+      const row = findRow(rows, action.rowKey);
+      return row ? Object.assign({}, state, { activeKey: row.key }) : state;
+    }
+    if (action.type === 'SET_VIEWPORT') {
+      const scrollTop = Number.isFinite(action.scrollTop) ? Math.max(0, action.scrollTop) : state.scrollTop;
+      const viewportHeight = Number.isFinite(action.viewportHeight) ? Math.max(0, action.viewportHeight) : state.viewportHeight;
+      if (scrollTop === state.scrollTop && viewportHeight === state.viewportHeight) return state;
+      return Object.assign({}, state, { scrollTop, viewportHeight });
+    }
+    if (action.type === 'SET_SEARCH_QUERY') {
+      const searchQuery = typeof action.query === 'string' ? action.query : '';
+      return Object.assign({}, state, {
+        searchQuery,
+        searchCameraKeys: searchQuery ? state.searchCameraKeys : null,
+        searchExpandedKeys: searchQuery ? state.searchExpandedKeys : null,
+      });
+    }
+    if (action.type === 'SET_SEARCH_RESULTS') {
+      if (!Number.isInteger(action.generation) || action.generation < state.searchGeneration) return state;
+      return Object.assign({}, state, {
+        searchQuery: typeof action.query === 'string' ? action.query : state.searchQuery,
+        searchCameraKeys: action.cameraKeys instanceof Set ? new Set(action.cameraKeys) : null,
+        searchExpandedKeys: action.expandedKeys instanceof Set ? new Set(action.expandedKeys) : null,
+        searchGeneration: action.generation,
+      });
+    }
+    if (action.type !== 'KEY' || typeof action.key !== 'string') return state;
+
+    if (action.key === 'Escape') {
+      if (!state.searchQuery && !state.searchCameraKeys) return state;
+      return Object.assign({}, state, { searchQuery: '', searchCameraKeys: null, searchExpandedKeys: null });
+    }
+    if (!rows.length) return state;
+    let index = rows.findIndex((row) => row.key === state.activeKey);
+    if (index < 0) index = 0;
+    const row = rows[index];
+    switch (action.key) {
+      case 'ArrowDown': return moveActive(state, rows, index + 1);
+      case 'ArrowUp': return moveActive(state, rows, index - 1);
+      case 'Home': return moveActive(state, rows, 0);
+      case 'End': return moveActive(state, rows, rows.length - 1);
+      case 'ArrowRight': {
+        if (row.kind === 'camera') return state;
+        if (!state.expandedKeys.has(row.key)) return changeExpansion(state, row, true);
+        const child = rows[index + 1];
+        return child && child.parentKey === row.key ? Object.assign({}, state, { activeKey: child.key }) : state;
+      }
+      case 'ArrowLeft':
+        if (row.kind !== 'camera' && state.expandedKeys.has(row.key)) return changeExpansion(state, row, false);
+        return row.parentKey && validKey(row.parentKey) ? Object.assign({}, state, { activeKey: row.parentKey }) : state;
+      case 'Enter':
+      case ' ':
+      case 'Spacebar': return activate(state, row);
+      default: return state;
+    }
+  }
+
+  function createSidebarController(options = {}) {
+    if (!treeApi || typeof treeApi.flattenVisibleRows !== 'function' || typeof treeApi.calculateVirtualWindow !== 'function') {
+      throw new Error('AptDeviceTree must be loaded before AptSidebarController.');
+    }
+    if (!options.model || !options.view || typeof options.view.commit !== 'function') {
+      throw new TypeError('Sidebar controller requires a model and view.commit adapter.');
+    }
+    const model = options.model;
+    const view = options.view;
+    const rowHeight = Number.isFinite(options.rowHeight) ? options.rowHeight : 28;
+    const overscan = Number.isInteger(options.overscan) ? options.overscan : 16;
+    const searchRunner = options.searchRunner || treeApi.createSearchRunner({ scheduler: options.scheduler, chunkSize: options.chunkSize });
+    let state = createInitialState(options.initialState);
+    let lastSnapshot;
+
+    function effectiveExpandedKeys() {
+      return state.searchQuery && state.searchExpandedKeys ? state.searchExpandedKeys : state.expandedKeys;
+    }
+
+    function commit() {
+      const rows = treeApi.flattenVisibleRows(model, {
+        expandedKeys: effectiveExpandedKeys(),
+        selectedKey: state.selectedKey,
+        matchCameraKeys: state.searchQuery ? state.searchCameraKeys : null,
+      });
+      const window = treeApi.calculateVirtualWindow(rows, {
+        scrollTop: state.scrollTop, viewportHeight: state.viewportHeight, rowHeight, overscan,
+      });
+      lastSnapshot = Object.freeze({ state, rows, window });
+      view.commit(lastSnapshot);
+      return lastSnapshot;
+    }
+
+    function dispatch(action) {
+      const visibleRows = lastSnapshot ? lastSnapshot.rows : [];
+      let safeAction = action;
+      if (action && action.type === 'SET_SELECTION') {
+        if (!model.cameraByKey.has(action.rowKey)) return lastSnapshot;
+        safeAction = Object.assign({}, action, { allowHidden: true });
+      }
+      const next = reduceSidebar(state, safeAction, visibleRows);
+      if (next === state) return lastSnapshot;
+      state = next;
+      return commit();
+    }
+
+    async function search(query) {
+      const normalizedQuery = typeof query === 'string' ? query : '';
+      if (!normalizedQuery.trim()) {
+        searchRunner.cancel();
+        return dispatch({ type: 'SET_SEARCH_QUERY', query: '' });
+      }
+      state = reduceSidebar(state, { type: 'SET_SEARCH_QUERY', query: normalizedQuery }, lastSnapshot ? lastSnapshot.rows : []);
+      const result = await searchRunner.search(model, normalizedQuery, { expandedKeys: state.expandedKeys });
+      if (result.cancelled) return result;
+      dispatch({
+        type: 'SET_SEARCH_RESULTS', query: normalizedQuery, generation: result.generation,
+        cameraKeys: result.cameraKeys, expandedKeys: result.expandedKeys,
+      });
+      return result;
+    }
+
+    commit();
+    return Object.freeze({
+      dispatch, search, getState: () => state, getSnapshot: () => lastSnapshot,
+      destroy() { searchRunner.cancel(); },
+    });
+  }
+
+  return Object.freeze({
+    createInitialState,
+    reduceSidebar,
+    sidebarReducer: reduceSidebar,
+    createSidebarController,
+  });
+}));
diff --git a/test/device-tree.test.js b/test/device-tree.test.js
new file mode 100644
index 0000000..81d14ed
--- /dev/null
+++ b/test/device-tree.test.js
@@ -0,0 +1,147 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const {
+  buildDeviceTree,
+  flattenVisibleRows,
+  createSearchRunner,
+  calculateVirtualWindow,
+} = require('../device-tree');
+
+function baseFixture() {
+  return {
+    sites: [
+      { id: 's2', name: 'Zulu' },
+      { id: 's1', name: 'Alpha', pendingDeletion: true },
+    ],
+    groups: [
+      { id: 'g2', name: 'Doors', parentId: 's2' },
+      { id: 'g1', name: 'Lobby', parentId: 's1', pendingDeletion: true },
+    ],
+    devices: [
+      { id: 'c4', name: 'No Group', siteId: 's1', type: 'camera' },
+      { id: 'c2', name: 'Inferred', deviceGroupId: 'g2', model: 'H5A' },
+      { id: 'c1', name: 'Front', siteId: 's1', deviceGroupId: 'g1', address: '10.0.0.1' },
+      { id: 'c3', name: 'Conflict', siteId: 's1', deviceGroupId: 'g2' },
+      { id: 'c5', name: 'Unknown Group', siteId: 's1', deviceGroupId: 'missing-g' },
+      { id: 'c6', name: 'Unknown Site', siteId: 'missing-s' },
+      { id: 'c7', name: 'Orphan' },
+    ],
+  };
+}
+
+test('builds deterministic hierarchy with explicit exceptional buckets and diagnostics', () => {
+  const model = buildDeviceTree(baseFixture());
+  assert.deepEqual(model.sites.map((site) => site.name), ['Alpha', 'Orphaned cameras', 'Unknown site: missing-s', 'Zulu']);
+  assert.equal(model.sites[0].pendingDeletion, true);
+  assert.deepEqual(model.sites[0].groups.map((group) => group.name), ['Doors', 'Lobby', 'Ungrouped', 'Unknown group: missing-g']);
+  assert.deepEqual(model.sites[3].groups[0].cameras.map((camera) => camera.name), ['Inferred']);
+
+  const conflict = model.cameraByKey.get('camera:c3');
+  assert.equal(conflict.site.id, 's1');
+  assert.equal(conflict.group.name, 'Doors');
+  assert.equal(conflict.hierarchyStatus, 'conflict');
+  assert.equal(model.cameraByKey.get('camera:c2').hierarchyStatus, 'inferred-site');
+  assert.ok(model.diagnostics.some((entry) => entry.code === 'site-group-conflict' && entry.key === 'camera:c3'));
+});
+
+test('duplicate and malformed IDs get stable unique keys and diagnostics', () => {
+  const fixture = {
+    sites: [{ id: 's', name: 'A' }, { id: 's', name: 'B' }, { name: 'Bad' }],
+    groups: [{ id: 'g', name: 'G', parentId: 's' }, { id: 'g', name: 'G2', parentId: 's' }],
+    devices: [
+      { id: 'c', name: 'Same', siteId: 's', deviceGroupId: 'g' },
+      { id: 'c', name: 'Same', siteId: 's', deviceGroupId: 'g' },
+      { name: 'Missing', siteId: 's' },
+    ],
+  };
+  const first = buildDeviceTree(fixture);
+  const second = buildDeviceTree(fixture);
+  assert.deepEqual([...first.rowByKey.keys()], [...second.rowByKey.keys()]);
+  assert.equal(new Set(first.rowByKey.keys()).size, first.rowByKey.size);
+  assert.ok(first.diagnostics.filter((entry) => entry.code === 'duplicate-id').length >= 3);
+  assert.ok(first.diagnostics.filter((entry) => entry.code === 'malformed-id').length >= 2);
+});
+
+test('sites start collapsed; expansion produces levels and complete ARIA metadata', () => {
+  const model = buildDeviceTree(baseFixture());
+  let rows = flattenVisibleRows(model, { expandedKeys: new Set(), selectedKey: 'camera:c1' });
+  assert.equal(rows.length, 4);
+  assert.ok(rows.every((row) => row.kind === 'site' && row.aria.level === 1 && row.aria.expanded === false));
+  assert.ok(rows.every((row) => row.aria.setsize === 4));
+  assert.equal(rows.hiddenSelected, true);
+
+  rows = flattenVisibleRows(model, { expandedKeys: new Set(['site:s1']) });
+  assert.deepEqual(rows.slice(0, 5).map((row) => row.kind), ['site', 'group', 'group', 'group', 'group']);
+  assert.ok(rows.slice(1, 5).every((row) => row.aria.level === 2 && row.aria.expanded === false));
+
+  rows = flattenVisibleRows(model, {
+    expandedKeys: new Set(['site:s1', 'group:s1:g1']),
+    selectedKey: 'camera:c1',
+  });
+  const camera = rows.find((row) => row.key === 'camera:c1');
+  assert.equal(camera.parentKey, 'group:s1:g1');
+  assert.deepEqual(camera.aria, { level: 3, expanded: undefined, selected: true, posinset: 1, setsize: 1 });
+  assert.equal(rows.hiddenSelected, false);
+});
+
+test('search covers camera fields and ancestors without mutating saved expansion', async () => {
+  const model = buildDeviceTree(baseFixture());
+  const scheduled = [];
+  const runner = createSearchRunner({ scheduler: (work) => scheduled.push(work), chunkSize: 2 });
+  const saved = new Set(['site:s2']);
+  const promise = runner.search(model, 'alpha lobby 10.0.0.1', { expandedKeys: saved });
+  while (scheduled.length) scheduled.shift()();
+  const result = await promise;
+  assert.equal(result.count, 1);
+  assert.deepEqual([...result.cameraKeys], ['camera:c1']);
+  assert.ok(result.expandedKeys.has('site:s1'));
+  assert.ok(result.expandedKeys.has('group:s1:g1'));
+  assert.deepEqual([...saved], ['site:s2']);
+
+  const ancestorPromise = runner.search(model, 'zulu', { expandedKeys: new Set() });
+  while (scheduled.length) scheduled.shift()();
+  const ancestor = await ancestorPromise;
+  assert.deepEqual([...ancestor.cameraKeys], ['camera:c2']);
+});
+
+test('new search cancels stale chunked generation', async () => {
+  const model = buildDeviceTree({
+    sites: [{ id: 's', name: 'Site' }],
+    groups: [],
+    devices: Array.from({ length: 700 }, (_, i) => ({ id: `c${i}`, name: `Camera ${i}`, siteId: 's' })),
+  });
+  const scheduled = [];
+  const runner = createSearchRunner({ scheduler: (work) => scheduled.push(work), chunkSize: 250 });
+  const stale = runner.search(model, 'camera', {});
+  scheduled.shift()();
+  const current = runner.search(model, 'camera 699', {});
+  while (scheduled.length) scheduled.shift()();
+  const [staleResult, currentResult] = await Promise.all([stale, current]);
+  assert.equal(staleResult.cancelled, true);
+  assert.equal(currentResult.cancelled, false);
+  assert.equal(currentResult.count, 1);
+});
+
+test('virtual window remains structurally bounded for 5,000 expanded shuffled cameras', () => {
+  const devices = Array.from({ length: 5000 }, (_, i) => ({ id: `id-${i}`, name: `Camera ${String(i).padStart(4, '0')}`, siteId: 's' }));
+  for (let i = devices.length - 1; i > 0; i -= 1) {
+    const j = (i * 48271) % (i + 1);
+    [devices[i], devices[j]] = [devices[j], devices[i]];
+  }
+  const model = buildDeviceTree({ sites: [{ id: 's', name: 'Large' }], groups: [], devices });
+  const rows = flattenVisibleRows(model, { expandedKeys: new Set(['site:s', 'group:s:__ungrouped__']) });
+  const window = calculateVirtualWindow(rows, { scrollTop: 50000, viewportHeight: 320, rowHeight: 28 });
+  assert.ok(window.rows.length >= 40 && window.rows.length <= 50, `mounted ${window.rows.length}`);
+  assert.equal(window.totalHeight, rows.length * 28);
+  assert.equal(window.offsetTop, window.startIndex * 28);
+});
+
+test('1,500-site/group fixture has deterministic stable ordering', () => {
+  const sites = Array.from({ length: 1500 }, (_, i) => ({ id: `s-${i}`, name: `Site ${i % 17}` }));
+  const groups = sites.map((site, i) => ({ id: `g-${i}`, name: `Group ${i % 11}`, parentId: site.id }));
+  const model = buildDeviceTree({ sites: sites.reverse(), groups: groups.reverse(), devices: [] });
+  const namesAndIds = model.sites.map((site) => `${site.normalizedName}|${site.id}`);
+  assert.deepEqual(namesAndIds, [...namesAndIds].sort((a, b) => a.localeCompare(b)));
+});
diff --git a/test/sidebar-controller.test.js b/test/sidebar-controller.test.js
new file mode 100644
index 0000000..1fcda70
--- /dev/null
+++ b/test/sidebar-controller.test.js
@@ -0,0 +1,114 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const { buildDeviceTree, flattenVisibleRows } = require('../device-tree');
+const { createInitialState, reduceSidebar, createSidebarController } = require('../sidebar-controller');
+
+function fixture() {
+  const model = buildDeviceTree({
+    sites: [{ id: 's', name: 'Site' }],
+    groups: [{ id: 'g', name: 'Group', parentId: 's' }],
+    devices: [
+      { id: 'a', name: 'Alpha', siteId: 's', deviceGroupId: 'g' },
+      { id: 'b', name: 'Beta', siteId: 's', deviceGroupId: 'g' },
+    ],
+  });
+  return model;
+}
+
+function visible(model, state) {
+  return flattenVisibleRows(model, state);
+}
+
+test('reducer expands, navigates, selects, collapses, and preserves hidden selection', () => {
+  const model = fixture();
+  let state = createInitialState();
+  let rows = visible(model, state);
+  state = reduceSidebar(state, { type: 'KEY', key: 'Home' }, rows);
+  assert.equal(state.activeKey, 'site:s');
+  state = reduceSidebar(state, { type: 'KEY', key: 'ArrowRight' }, rows);
+  assert.ok(state.expandedKeys.has('site:s'));
+
+  rows = visible(model, state);
+  state = reduceSidebar(state, { type: 'KEY', key: 'ArrowDown' }, rows);
+  assert.equal(state.activeKey, 'group:s:g');
+  state = reduceSidebar(state, { type: 'KEY', key: 'ArrowRight' }, rows);
+  rows = visible(model, state);
+  state = reduceSidebar(state, { type: 'KEY', key: 'ArrowDown' }, rows);
+  state = reduceSidebar(state, { type: 'KEY', key: 'Enter' }, rows);
+  assert.equal(state.selectedKey, 'camera:a');
+
+  state = reduceSidebar(state, { type: 'ACTIVATE', rowKey: 'site:s' }, rows);
+  assert.equal(state.selectedKey, 'camera:a');
+  assert.equal(visible(model, state).hiddenSelected, true);
+});
+
+test('keyboard Left/Right parent behavior, bounds, Space and Escape', () => {
+  const model = fixture();
+  let state = createInitialState({
+    expandedKeys: new Set(['site:s', 'group:s:g']),
+    activeKey: 'camera:a',
+    searchQuery: 'alpha',
+  });
+  let rows = visible(model, state);
+  state = reduceSidebar(state, { type: 'KEY', key: 'ArrowLeft' }, rows);
+  assert.equal(state.activeKey, 'group:s:g');
+  state = reduceSidebar(state, { type: 'KEY', key: 'ArrowLeft' }, rows);
+  assert.equal(state.expandedKeys.has('group:s:g'), false);
+  state = reduceSidebar(state, { type: 'KEY', key: 'End' }, visible(model, state));
+  assert.equal(state.activeKey, 'group:s:g');
+  state = reduceSidebar(state, { type: 'KEY', key: ' ' }, visible(model, state));
+  assert.equal(state.expandedKeys.has('group:s:g'), true);
+  state = reduceSidebar(state, { type: 'KEY', key: 'Escape' }, visible(model, state));
+  assert.equal(state.searchQuery, '');
+});
+
+test('malformed and unknown delegated row keys are no-ops', () => {
+  const state = createInitialState({ activeKey: 'site:s' });
+  const rows = visible(fixture(), state);
+  assert.equal(reduceSidebar(state, { type: 'ACTIVATE', rowKey: '__proto__' }, rows), state);
+  assert.equal(reduceSidebar(state, { type: 'CLICK', rowKey: 'camera:not-there' }, rows), state);
+});
+
+test('controller commits exactly once per dispatch through view adapter', () => {
+  const model = fixture();
+  const commits = [];
+  const view = { commit: (snapshot) => commits.push(snapshot) };
+  const controller = createSidebarController({ model, view, rowHeight: 28, overscan: 3 });
+  assert.equal(commits.length, 1);
+  controller.dispatch({ type: 'ACTIVATE', rowKey: 'site:s' });
+  assert.equal(commits.length, 2);
+  assert.equal(commits[1].state.expandedKeys.has('site:s'), true);
+  assert.ok(Array.isArray(commits[1].window.rows));
+});
+
+test('active and selected state survive virtualization and selection is indicated when hidden', () => {
+  const model = fixture();
+  const commits = [];
+  const controller = createSidebarController({ model, view: { commit: (value) => commits.push(value) } });
+  controller.dispatch({ type: 'SET_SELECTION', rowKey: 'camera:b' });
+  controller.dispatch({ type: 'SET_VIEWPORT', scrollTop: 9999, viewportHeight: 20 });
+  const snapshot = commits.at(-1);
+  assert.equal(snapshot.state.selectedKey, 'camera:b');
+  assert.equal(snapshot.rows.hiddenSelected, true);
+});
+
+test('controller search temporarily expands matches with one completion commit', async () => {
+  const model = fixture();
+  const commits = [];
+  const scheduled = [];
+  const controller = createSidebarController({
+    model,
+    view: { commit: (value) => commits.push(value) },
+    scheduler: (work) => scheduled.push(work),
+    chunkSize: 1,
+  });
+  const pending = controller.search('beta group');
+  while (scheduled.length) scheduled.shift()();
+  const result = await pending;
+  assert.equal(result.count, 1);
+  assert.equal(commits.length, 2);
+  assert.deepEqual(commits.at(-1).rows.map((row) => row.key), ['site:s', 'group:s:g', 'camera:b']);
+  assert.equal(controller.getState().expandedKeys.size, 0);
+});

From 8d256cd4ab4de1273afe396bec0a23692a431db8 Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Thu, 20 Aug 2026 01:15:01 +0000
Subject: [PATCH 17/22] feat: render scalable Alta site and group hierarchy

---
 README.md                       |   7 +-
 device-tree.js                  |   4 +-
 index.html                      |  17 +-
 package.json                    |   3 +
 renderer.js                     | 329 +++++++++++++++++---------------
 scripts/verify-kit.js           |   5 +-
 sidebar-controller.js           |  13 +-
 sidebar-view.js                 | 142 ++++++++++++++
 styles.css                      | 172 ++++++++++++++++-
 test/device-tree.test.js        |   5 +-
 test/renderer-hierarchy.test.js |  76 ++++++++
 test/sidebar-controller.test.js |   5 +
 12 files changed, 614 insertions(+), 164 deletions(-)
 create mode 100644 sidebar-view.js
 create mode 100644 test/renderer-hierarchy.test.js

diff --git a/README.md b/README.md
index 974b6c2..48a4dc6 100644
--- a/README.md
+++ b/README.md
@@ -35,6 +35,10 @@ npm start
 
 Use **Generate / Rotate** if a pairing may have been exposed, then update the extension. Use **Revoke** to immediately disable bridge authentication.
 
+## Camera hierarchy and large deployments
+
+The sidebar presents collapsed Alta sites, then device groups, then cameras, including explicit fallback nodes for ungrouped, orphaned, unknown, or conflicting metadata. Search opens only matching ancestors and supports full tree keyboard navigation. A fixed-height virtual window keeps the mounted DOM bounded even when thousands of cameras are visible; selection and active-proxy state survive expansion, search, and scrolling. If site or group metadata cannot be loaded, every valid camera remains selectable in the fallback hierarchy and APT shows a warning.
+
 ## Development and verification
 
 ```bash
@@ -54,7 +58,8 @@ Core files:
 - `src/proxy-launch.js` — fixed shell-free helper process management
 - `src/update-policy.js` — exact GitPeji check-only release policy
 - `preload.js` — narrow context bridge
-- `renderer.js`, `index.html`, `styles.css` — non-secret UI
+- `device-tree.js`, `sidebar-controller.js`, `sidebar-view.js` — pure hierarchy, interaction state, and bounded DOM adapter
+- `renderer.js`, `index.html`, `styles.css` — non-secret UI integration and Alta styling
 - `chrome-extension/` — stable-ID paired cookie sender
 - `test/` — pure and end-to-end contract tests
 
diff --git a/device-tree.js b/device-tree.js
index aa3f26e..05abce2 100644
--- a/device-tree.js
+++ b/device-tree.js
@@ -75,7 +75,7 @@
       const identity = createIdentity('site', safe, ordinal, siteOccurrences, diagnostics);
       const site = makeSite(identity.uniqueId, text(safe.name) || identity.canonicalId, ordinal, {
         canonicalId: identity.canonicalId,
-        pendingDeletion: safe.pendingDeletion === true,
+        pendingDeletion: safe.pendingDeletion === true || Boolean(text(safe.pendingDeletionStart)),
         source: safe,
       });
       sites.push(site);
@@ -105,7 +105,7 @@
       const group = makeGroup(site, identity.uniqueId, text(safe.name) || identity.canonicalId, ordinal, {
         canonicalId: identity.canonicalId,
         rawParentId: parentId,
-        pendingDeletion: safe.pendingDeletion === true,
+        pendingDeletion: safe.pendingDeletion === true || Boolean(text(safe.pendingDeletionStart)),
         source: safe,
       });
       site.groups.push(group);
diff --git a/index.html b/index.html
index f97b005..66d89d1 100644
--- a/index.html
+++ b/index.html
@@ -12,13 +12,19 @@
         <div class="main-layout">
             <aside class="devices-sidebar">
                 <div class="sidebar-header"><h2>Available Devices</h2></div>
-                <div id="deviceStatus" class="status-message"></div>
+                <div id="deviceStatus" class="status-message" role="status" aria-live="polite"></div>
                 <div class="device-search-container">
-                    <input type="text" id="deviceSearch" placeholder="Search devices..." class="device-search-input" autocomplete="off">
+                    <label class="visually-hidden" for="deviceSearch">Search cameras</label>
+                    <input type="search" id="deviceSearch" placeholder="Search cameras..." class="device-search-input" autocomplete="off" aria-controls="deviceList">
+                    <p id="deviceResults" class="tree-results" role="status" aria-live="polite">Connect to load cameras</p>
                 </div>
                 <div class="device-list-container">
-                    <div id="deviceList" class="device-list">
-                        <p class="placeholder-text">Connect through the paired Chrome extension to load devices</p>
+                    <div id="deviceList" class="device-list virtual-tree" role="tree" tabindex="0" aria-label="Alta camera hierarchy" aria-activedescendant="" aria-describedby="deviceResults">
+                        <div id="treeSpacer" class="virtual-tree-spacer">
+                            <div id="treeWindow" class="virtual-tree-window">
+                                <p class="placeholder-text">Connect through the paired Chrome extension to load devices</p>
+                            </div>
+                        </div>
                     </div>
                 </div>
             </aside>
@@ -103,6 +109,9 @@
     </div>
 
     <script src="renderer-controller.js"></script>
+    <script src="device-tree.js"></script>
+    <script src="sidebar-controller.js"></script>
+    <script src="sidebar-view.js"></script>
     <script src="renderer.js"></script>
 </body>
 </html>
diff --git a/package.json b/package.json
index fec0d8e..d222b54 100644
--- a/package.json
+++ b/package.json
@@ -25,6 +25,9 @@
       "preload.js",
       "renderer.js",
       "renderer-controller.js",
+      "device-tree.js",
+      "sidebar-controller.js",
+      "sidebar-view.js",
       "index.html",
       "styles.css",
       "src/**/*",
diff --git a/renderer.js b/renderer.js
index a0ed42e..70bd3f8 100644
--- a/renderer.js
+++ b/renderer.js
@@ -3,6 +3,9 @@
 const connectionStatus = document.getElementById('connectionStatus');
 const deviceStatus = document.getElementById('deviceStatus');
 const deviceList = document.getElementById('deviceList');
+const treeSpacer = document.getElementById('treeSpacer');
+const treeWindow = document.getElementById('treeWindow');
+const deviceResults = document.getElementById('deviceResults');
 const statusIndicator = document.getElementById('statusIndicator');
 const deviceSearch = document.getElementById('deviceSearch');
 const disconnectBtn = document.getElementById('disconnectBtn');
@@ -21,12 +24,14 @@ const pairingSecretRow = document.getElementById('pairingSecretRow');
 const rotatePairingBtn = document.getElementById('rotatePairingBtn');
 const revokePairingBtn = document.getElementById('revokePairingBtn');
 
+const ROW_HEIGHT = window.AptSidebarView.ROW_HEIGHT;
 let connection = { connected: false, origin: null, activeProxies: [] };
 let selectedDevice = null;
-let allDevices = [];
-let allSites = {};
-let collapsedSites = new Set();
-let loadingDevices = false;
+let hierarchyModel = null;
+let sidebarController = null;
+let loadGeneration = 0;
+let searchTimer = null;
+let scrollFrame = null;
 
 function showStatus(element, message, type) {
   element.textContent = message;
@@ -35,7 +40,20 @@ function showStatus(element, message, type) {
 }
 
 function activeDeviceIds() {
-  return new Set((connection.activeProxies || []).map((proxy) => proxy.deviceId));
+  return new Set((connection.activeProxies || []).map((proxy) => String(proxy.deviceId || '').toLowerCase()));
+}
+
+function deviceStatusFor(device) {
+  const value = String(device && (device.displayStatus ?? device.status ?? device.online) || '').toLowerCase();
+  return ['green', 'online', 'live', 'connected', 'true'].includes(value);
+}
+
+function updateProxyButtons() {
+  const id = selectedDevice && selectedDevice.id;
+  const active = id ? activeDeviceIds().has(id.toLowerCase()) : false;
+  const hasUsername = altaUsername.value.trim().length > 0;
+  startProxyBtn.disabled = !connection.connected || !id || !hasUsername || active;
+  stopProxyBtn.disabled = !id || !active;
 }
 
 function renderConnectionState(state) {
@@ -50,171 +68,141 @@ function renderConnectionState(state) {
   text.textContent = connection.connected ? 'Connected' : 'Disconnected';
   disconnectBtn.disabled = !connection.connected;
   updateProxyButtons();
+  if (sidebarController) sidebarController.refresh();
 }
 
-function updateProxyButtons() {
-  const id = selectedDevice && (selectedDevice.guid || selectedDevice.id);
-  const active = id ? activeDeviceIds().has(id.toLowerCase()) : false;
-  const hasUsername = altaUsername.value.trim().length > 0;
-  startProxyBtn.disabled = !connection.connected || !id || !hasUsername || active;
-  stopProxyBtn.disabled = !id || !active;
-}
-
-function clearDeviceList() {
-  deviceList.textContent = '';
+function showTreePlaceholder(message) {
+  treeSpacer.style.height = '0px';
+  treeWindow.style.transform = '';
   const placeholder = document.createElement('p');
   placeholder.className = 'placeholder-text';
-  placeholder.textContent = connection.connected ? 'Loading devices...' : 'Connect through the paired Chrome extension to load devices';
-  deviceList.appendChild(placeholder);
+  placeholder.textContent = message;
+  treeWindow.replaceChildren(placeholder);
+  deviceList.removeAttribute('aria-activedescendant');
+}
+
+function clearHierarchy() {
+  loadGeneration += 1;
+  if (searchTimer) clearTimeout(searchTimer);
+  searchTimer = null;
+  if (sidebarController) sidebarController.destroy();
+  sidebarController = null;
+  hierarchyModel = null;
   selectedDevice = null;
   selectedDeviceId.value = '';
+  deviceSearch.value = '';
+  deviceResults.textContent = connection.connected ? 'Loading cameras' : 'Connect to load cameras';
+  showTreePlaceholder(connection.connected
+    ? 'Loading devices...'
+    : 'Connect through the paired Chrome extension to load devices');
   updateProxyButtons();
 }
 
-function deviceStatusFor(device) {
-  const raw = device && device.live && device.live.display_status !== undefined
-    ? device.live.display_status
-    : device && device.status !== undefined
-      ? device.status
-      : device && device.online;
-  const value = String(raw ?? '').toLowerCase();
-  return ['green', 'online', 'live', 'connected', 'true'].includes(value);
-}
-
-function selectDevice(device, item) {
-  const previous = deviceList.querySelector('.device-item.selected');
-  if (previous) previous.classList.remove('selected');
-  item.classList.add('selected');
-  selectedDevice = device;
-  const id = device.guid || device.id || '';
-  selectedDeviceId.value = id;
-  showStatus(connectionStatus, `Selected device: ${device.name || 'Unnamed Device'}`, 'info');
+function syncSelection(snapshot) {
+  const selectedKey = snapshot && snapshot.state.selectedKey;
+  const camera = selectedKey && hierarchyModel ? hierarchyModel.cameraByKey.get(selectedKey) : null;
+  if (!camera) return;
+  if (selectedDevice && selectedDevice.id === camera.source.id) return;
+  selectedDevice = camera.source;
+  selectedDeviceId.value = selectedDevice.id;
+  showStatus(connectionStatus, `Selected device: ${selectedDevice.name || 'Unnamed Device'}`, 'info');
   updateProxyButtons();
 }
 
-function createDeviceItem(device) {
-  const item = document.createElement('div');
-  const id = device.guid || device.id || '';
-  item.className = 'device-item';
-  item.dataset.deviceId = id;
-  if (activeDeviceIds().has(String(id).toLowerCase())) item.classList.add('proxy-active');
-  const name = document.createElement('div');
-  name.className = 'device-name';
-  name.textContent = device.name || 'Unnamed Device';
-  const dot = document.createElement('div');
-  dot.className = `device-status-dot ${deviceStatusFor(device) ? 'online' : 'offline'}`;
-  item.append(name, dot);
-  item.addEventListener('click', () => selectDevice(device, item));
-  return item;
+function syncTreeScroll(snapshot) {
+  if (!snapshot) return;
+  const target = snapshot.state.scrollTop;
+  if (Math.abs(deviceList.scrollTop - target) >= ROW_HEIGHT) deviceList.scrollTop = target;
 }
 
-function groupDevicesBySite(devices) {
-  const groups = new Map();
-  for (const device of devices) {
-    const siteId = device.server_group_id;
-    const siteName = siteId && allSites[siteId];
-    const key = siteName ? siteId : '__ungrouped';
-    if (!groups.has(key)) groups.set(key, { name: siteName || 'Ungrouped', devices: [] });
-    groups.get(key).devices.push(device);
-  }
-  return [...groups.entries()].sort((left, right) => left[1].name.localeCompare(right[1].name));
+function describeHierarchyWarning(hierarchy, model) {
+  const diagnostics = hierarchy && hierarchy.diagnostics && typeof hierarchy.diagnostics === 'object'
+    ? hierarchy.diagnostics
+    : {};
+  const metadataErrors = hierarchy && hierarchy.metadataErrors && typeof hierarchy.metadataErrors === 'object'
+    ? hierarchy.metadataErrors
+    : {};
+  const unavailable = ['sites', 'groups'].filter((kind) => metadataErrors[kind] || (diagnostics[kind] && diagnostics[kind].error));
+  const issueCount = model.diagnostics.length;
+  if (!unavailable.length && issueCount === 0) return '';
+  const parts = [];
+  if (unavailable.length) parts.push(`${unavailable.join(' and ')} metadata unavailable`);
+  if (issueCount) parts.push(`${issueCount} hierarchy warning${issueCount === 1 ? '' : 's'}`);
+  return parts.join('; ');
 }
 
-function displayDevices(devices) {
-  deviceList.textContent = '';
-  if (!devices.length) {
-    const empty = document.createElement('p');
-    empty.className = 'no-devices';
-    empty.textContent = deviceSearch.value.trim() ? 'No devices match your search' : 'No local cameras found';
-    deviceList.appendChild(empty);
-    return;
-  }
-
-  const grouped = Object.keys(allSites).length > 0;
-  if (!grouped) {
-    for (const device of devices) deviceList.appendChild(createDeviceItem(device));
-    return;
-  }
-
-  for (const [siteId, group] of groupDevicesBySite(devices)) {
-    const header = document.createElement('div');
-    const collapsed = collapsedSites.has(siteId);
-    header.className = `site-group-header${collapsed ? ' collapsed' : ''}`;
-    const arrow = document.createElement('span');
-    arrow.className = 'site-group-arrow';
-    arrow.textContent = collapsed ? '\u25B6' : '\u25BC';
-    const name = document.createElement('span');
-    name.className = 'site-group-name';
-    name.textContent = group.name;
-    const count = document.createElement('span');
-    count.className = 'site-group-count';
-    count.textContent = String(group.devices.length);
-    header.append(arrow, name, count);
-    header.addEventListener('click', () => {
-      if (collapsedSites.has(siteId)) collapsedSites.delete(siteId);
-      else collapsedSites.add(siteId);
-      filterDevices();
-    });
-    deviceList.appendChild(header);
-    if (!collapsed) for (const device of group.devices) deviceList.appendChild(createDeviceItem(device));
-  }
-}
-
-function filterDevices() {
-  const query = deviceSearch.value.toLowerCase().trim();
-  if (!query) {
-    displayDevices(allDevices);
-    return;
-  }
-  displayDevices(allDevices.filter((device) => {
-    const values = [
-      device.name, device.guid, device.id, device.type, device.model, device.ipAddress,
-      device.server_group_id && allSites[device.server_group_id],
-    ];
-    return values.some((value) => String(value || '').toLowerCase().includes(query));
-  }));
+function installHierarchy(hierarchy) {
+  hierarchyModel = window.AptDeviceTree.buildDeviceTreeModel(hierarchy);
+  const view = window.AptSidebarView.createSidebarView({
+    document,
+    tree: deviceList,
+    spacer: treeSpacer,
+    windowElement: treeWindow,
+    model: hierarchyModel,
+    getActiveDeviceIds: activeDeviceIds,
+    isOnline: deviceStatusFor,
+    onCommit: (snapshot) => {
+      const count = snapshot.state.searchQuery && snapshot.state.searchCameraKeys
+        ? snapshot.state.searchCameraKeys.size
+        : hierarchyModel.cameraCount;
+      const hidden = snapshot.rows.hiddenSelected ? ' Selected camera is hidden by the current view.' : '';
+      deviceResults.textContent = snapshot.state.searchQuery
+        ? `${count} exact search result${count === 1 ? '' : 's'}.${hidden}`
+        : `${count} camera${count === 1 ? '' : 's'}.${hidden}`;
+    },
+  });
+  sidebarController = window.AptSidebarController.createSidebarController({
+    model: hierarchyModel,
+    view,
+    rowHeight: ROW_HEIGHT,
+    overscan: 16,
+    initialState: { viewportHeight: deviceList.clientHeight },
+  });
 }
 
 async function loadDevices() {
-  if (!connection.connected || loadingDevices) return;
-  loadingDevices = true;
-  showStatus(deviceStatus, 'Fetching devices...', 'info');
+  if (!connection.connected) return;
+  const generation = ++loadGeneration;
+  const origin = connection.origin;
+  showStatus(deviceStatus, 'Fetching camera hierarchy...', 'info');
   try {
-    const [devicesResult, sitesResult] = await Promise.all([
-      window.electronAPI.getDevices(),
-      window.electronAPI.getDeviceSites(),
-    ]);
-    allSites = {};
-    if (sitesResult.success && Array.isArray(sitesResult.sites)) {
-      for (const site of sitesResult.sites) if (site.id) allSites[site.id] = site.name || 'Unnamed Site';
-    }
-    if (!devicesResult.success) {
-      allDevices = [];
-      showStatus(deviceStatus, devicesResult.message || 'Failed to load devices', 'error');
-      clearDeviceList();
+    const result = await window.electronAPI.getDeviceHierarchy();
+    if (generation !== loadGeneration || !connection.connected || connection.origin !== origin) return;
+    if (!result.success) {
+      showStatus(deviceStatus, result.message || 'Failed to load cameras', 'error');
+      showTreePlaceholder('Could not load cameras');
       return;
     }
-    allDevices = devicesResult.devices.filter((device) =>
-      !device.capabilities || device.capabilities.localStorage === undefined || device.capabilities.localStorage === false
+    const hierarchy = result.hierarchy || { devices: [], sites: [], groups: [] };
+    installHierarchy(hierarchy);
+    const warning = describeHierarchyWarning(hierarchy, hierarchyModel);
+    const count = hierarchyModel.cameraCount;
+    showStatus(
+      deviceStatus,
+      warning ? `Found ${count} camera${count === 1 ? '' : 's'}; ${warning}. Cameras remain available in fallback hierarchy.` : `Found ${count} camera${count === 1 ? '' : 's'}`,
+      warning ? 'warning' : 'success',
     );
-    showStatus(deviceStatus, `Found ${allDevices.length} local camera${allDevices.length === 1 ? '' : 's'}`, 'success');
-    filterDevices();
   } catch {
-    showStatus(deviceStatus, 'Could not load devices.', 'error');
-  } finally {
-    loadingDevices = false;
+    if (generation !== loadGeneration) return;
+    showStatus(deviceStatus, 'Could not load cameras.', 'error');
+    showTreePlaceholder('Could not load cameras');
   }
 }
 
+function dispatchTree(action) {
+  if (!sidebarController) return null;
+  const snapshot = sidebarController.dispatch(action);
+  syncSelection(snapshot);
+  syncTreeScroll(snapshot);
+  return snapshot;
+}
+
 const rendererController = window.AptRendererController.createRendererController({
   disconnect: () => window.electronAPI.disconnect(),
   renderConnectionState,
   clearDisconnectedState: () => {
-    allDevices = [];
-    allSites = {};
-    collapsedSites.clear();
     altaUsername.value = '';
-    clearDeviceList();
+    clearHierarchy();
   },
   showConnectionStatus: (message, type) => showStatus(connectionStatus, message, type),
 });
@@ -224,15 +212,13 @@ async function handleDisconnect() {
 }
 
 async function handleStartProxy() {
-  const id = selectedDevice && (selectedDevice.guid || selectedDevice.id);
+  const id = selectedDevice && selectedDevice.id;
   if (!id) return;
   startProxyBtn.disabled = true;
   showStatus(connectionStatus, `Starting proxy for ${selectedDevice.name || 'selected device'}...`, 'info');
   const result = await window.electronAPI.launchProxy(id, altaUsername.value);
   if (result.success) {
-    connection = await window.electronAPI.getConnectionState();
-    renderConnectionState(connection);
-    filterDevices();
+    renderConnectionState(await window.electronAPI.getConnectionState());
     showStatus(connectionStatus, 'Camera proxy started.', 'success');
   } else {
     showStatus(connectionStatus, result.message || 'Failed to start camera proxy.', 'error');
@@ -241,13 +227,11 @@ async function handleStartProxy() {
 }
 
 async function handleStopProxy() {
-  const id = selectedDevice && (selectedDevice.guid || selectedDevice.id);
+  const id = selectedDevice && selectedDevice.id;
   if (!id) return;
   stopProxyBtn.disabled = true;
   const result = await window.electronAPI.stopProxy(id);
-  connection = await window.electronAPI.getConnectionState();
-  renderConnectionState(connection);
-  filterDevices();
+  renderConnectionState(await window.electronAPI.getConnectionState());
   showStatus(connectionStatus, result.success ? 'Camera proxy stopped.' : result.message || 'Failed to stop camera proxy.', result.success ? 'success' : 'error');
 }
 
@@ -288,6 +272,17 @@ function renderPairingStatus(result) {
   }
 }
 
+async function runSearch(query) {
+  if (!sidebarController) return;
+  const result = await sidebarController.search(query);
+  if (result && !result.cancelled) {
+    const count = result.count;
+    deviceResults.textContent = query.trim()
+      ? `${count} exact search result${count === 1 ? '' : 's'}.`
+      : `${hierarchyModel.cameraCount} camera${hierarchyModel.cameraCount === 1 ? '' : 's'}.`;
+  }
+}
+
 async function initialize() {
   renderConnectionState(await window.electronAPI.getConnectionState());
   renderPairingStatus(await window.electronAPI.getPairingStatus());
@@ -296,10 +291,12 @@ async function initialize() {
     const wasConnected = connection.connected;
     const previousOrigin = connection.origin;
     renderConnectionState(state);
+    if (!state.connected) {
+      clearHierarchy();
+      return;
+    }
     if (state.connected && (!wasConnected || state.origin !== previousOrigin)) {
-      allDevices = [];
-      allSites = {};
-      clearDeviceList();
+      clearHierarchy();
       showStatus(connectionStatus, `Connected to ${state.origin}`, 'success');
       await loadDevices();
     }
@@ -307,10 +304,42 @@ async function initialize() {
   setTimeout(() => checkForUpdates(false), 2000);
 }
 
+deviceList.addEventListener('click', (event) => {
+  const row = event.target.closest('.tree-row[data-row-key]');
+  if (!row || !deviceList.contains(row)) return;
+  dispatchTree({ type: 'CLICK', rowKey: row.dataset.rowKey });
+  deviceList.focus();
+});
+deviceList.addEventListener('keydown', (event) => {
+  if (!['ArrowUp', 'ArrowDown', 'ArrowLeft', 'ArrowRight', 'Home', 'End', 'Enter', ' ', 'Spacebar', 'Escape'].includes(event.key)) return;
+  event.preventDefault();
+  dispatchTree({ type: 'KEY', key: event.key });
+  if (event.key === 'Escape') {
+    deviceSearch.value = '';
+    runSearch('');
+  }
+});
+deviceList.addEventListener('scroll', () => {
+  if (scrollFrame || !sidebarController) return;
+  scrollFrame = requestAnimationFrame(() => {
+    scrollFrame = null;
+    sidebarController.dispatch({ type: 'SET_VIEWPORT', scrollTop: deviceList.scrollTop, viewportHeight: deviceList.clientHeight });
+  });
+});
+deviceSearch.addEventListener('input', () => {
+  if (searchTimer) clearTimeout(searchTimer);
+  searchTimer = setTimeout(() => runSearch(deviceSearch.value), 125);
+});
+deviceSearch.addEventListener('keydown', (event) => {
+  if (event.key !== 'Escape') return;
+  event.preventDefault();
+  if (searchTimer) clearTimeout(searchTimer);
+  deviceSearch.value = '';
+  runSearch('');
+});
 disconnectBtn.addEventListener('click', handleDisconnect);
 startProxyBtn.addEventListener('click', handleStartProxy);
 stopProxyBtn.addEventListener('click', handleStopProxy);
-deviceSearch.addEventListener('input', filterDevices);
 altaUsername.addEventListener('input', updateProxyButtons);
 checkUpdateBtn.addEventListener('click', () => checkForUpdates(true));
 openReleasesBtn.addEventListener('click', () => window.electronAPI.openFixedReleasesPage());
diff --git a/scripts/verify-kit.js b/scripts/verify-kit.js
index b7168b4..fc863ec 100644
--- a/scripts/verify-kit.js
+++ b/scripts/verify-kit.js
@@ -171,7 +171,10 @@ function verifySource() {
   for (const [label, version] of [['lockfile', lock.version], ['lockfile root package', lock.packages?.['']?.version]]) {
     if (version !== pkg.version) fail(`${label} version ${version} does not match application version ${pkg.version}`);
   }
-  const productionRoots = ['main.js', 'preload.js', 'renderer.js', 'index.html', 'src/', 'chrome-extension/'];
+  const productionRoots = [
+    'main.js', 'preload.js', 'renderer.js', 'renderer-controller.js', 'device-tree.js',
+    'sidebar-controller.js', 'sidebar-view.js', 'index.html', 'src/', 'chrome-extension/',
+  ];
   const productionFiles = new Map([...files].filter(([name]) =>
     productionRoots.some((root) => name === root || name.startsWith(root))
   ));
diff --git a/sidebar-controller.js b/sidebar-controller.js
index fb1ec83..6219a3b 100644
--- a/sidebar-controller.js
+++ b/sidebar-controller.js
@@ -133,7 +133,7 @@
     }
     const model = options.model;
     const view = options.view;
-    const rowHeight = Number.isFinite(options.rowHeight) ? options.rowHeight : 28;
+    const rowHeight = Number.isFinite(options.rowHeight) ? options.rowHeight : 30;
     const overscan = Number.isInteger(options.overscan) ? options.overscan : 16;
     const searchRunner = options.searchRunner || treeApi.createSearchRunner({ scheduler: options.scheduler, chunkSize: options.chunkSize });
     let state = createInitialState(options.initialState);
@@ -149,6 +149,15 @@
         selectedKey: state.selectedKey,
         matchCameraKeys: state.searchQuery ? state.searchCameraKeys : null,
       });
+      const activeIndex = rows.findIndex((row) => row.key === state.activeKey);
+      if (activeIndex >= 0 && state.viewportHeight > 0) {
+        const activeTop = activeIndex * rowHeight;
+        const activeBottom = activeTop + rowHeight;
+        let scrollTop = state.scrollTop;
+        if (activeTop < scrollTop) scrollTop = activeTop;
+        else if (activeBottom > scrollTop + state.viewportHeight) scrollTop = activeBottom - state.viewportHeight;
+        if (scrollTop !== state.scrollTop) state = Object.assign({}, state, { scrollTop });
+      }
       const window = treeApi.calculateVirtualWindow(rows, {
         scrollTop: state.scrollTop, viewportHeight: state.viewportHeight, rowHeight, overscan,
       });
@@ -188,7 +197,7 @@
 
     commit();
     return Object.freeze({
-      dispatch, search, getState: () => state, getSnapshot: () => lastSnapshot,
+      dispatch, search, refresh: commit, getState: () => state, getSnapshot: () => lastSnapshot,
       destroy() { searchRunner.cancel(); },
     });
   }
diff --git a/sidebar-view.js b/sidebar-view.js
new file mode 100644
index 0000000..e45b955
--- /dev/null
+++ b/sidebar-view.js
@@ -0,0 +1,142 @@
+'use strict';
+
+(function exposeSidebarView(root, factory) {
+  const api = factory();
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  if (root) root.AptSidebarView = api;
+}(typeof window !== 'undefined' ? window : undefined, function sidebarViewFactory() {
+  const ROW_HEIGHT = 30;
+
+  function stableDomId(key) {
+    return `apt-tree-row-${Array.from(String(key || '')).map((character) => character.codePointAt(0).toString(16)).join('-')}`;
+  }
+
+  function describeVirtualRows(snapshot, options = {}) {
+    const activeIds = options.activeDeviceIds instanceof Set ? options.activeDeviceIds : new Set();
+    const model = options.model;
+    const isOnline = typeof options.isOnline === 'function' ? options.isOnline : () => false;
+    const windowRows = snapshot && snapshot.window && Array.isArray(snapshot.window.rows)
+      ? snapshot.window.rows
+      : [];
+    return windowRows.map((row, windowIndex) => {
+      const node = model && model.rowByKey ? model.rowByKey.get(row.key) : null;
+      const device = node && node.kind === 'camera' ? node.source : null;
+      const deviceId = device ? device.id : row.id;
+      const classes = ['tree-row', `tree-${row.kind}`];
+      if (row.ariaSelected) classes.push('selected');
+      if (snapshot.state && snapshot.state.activeKey === row.key) classes.push('active');
+      if (row.pendingDeletion) classes.push('pending-deletion');
+      if (row.hierarchyStatus && !['assigned', 'inferred-site'].includes(row.hierarchyStatus)) classes.push('hierarchy-warning');
+      if (row.kind === 'camera') {
+        classes.push(isOnline(device || row) ? 'online' : 'offline');
+        if (activeIds.has(String(deviceId || '').toLowerCase())) classes.push('proxy-active');
+      }
+      return Object.freeze({
+        key: row.key,
+        kind: row.kind,
+        name: row.name,
+        device,
+        deviceId,
+        role: 'treeitem',
+        domId: stableDomId(row.key),
+        top: windowIndex * ROW_HEIGHT,
+        classes: classes.join(' '),
+        pendingDeletion: row.pendingDeletion === true,
+        hierarchyStatus: row.hierarchyStatus,
+        address: device && device.address ? device.address : '',
+        aria: {
+          level: row.ariaLevel,
+          expanded: row.ariaExpanded,
+          selected: row.ariaSelected,
+          posinset: row.ariaPosInSet,
+          setsize: row.ariaSetSize,
+        },
+      });
+    });
+  }
+
+  function setAria(element, name, value) {
+    if (value === undefined || value === null) element.removeAttribute(`aria-${name}`);
+    else element.setAttribute(`aria-${name}`, String(value));
+  }
+
+  function createSidebarView(options = {}) {
+    const documentRef = options.document;
+    const tree = options.tree;
+    const spacer = options.spacer;
+    const windowElement = options.windowElement;
+    if (!documentRef || !tree || !spacer || !windowElement) {
+      throw new TypeError('Sidebar view requires document, tree, spacer, and windowElement.');
+    }
+
+    function createRow(descriptor) {
+      const element = documentRef.createElement('div');
+      element.id = descriptor.domId;
+      element.className = descriptor.classes;
+      element.dataset.rowKey = descriptor.key;
+      element.setAttribute('role', descriptor.role);
+      element.style.top = `${descriptor.top}px`;
+      setAria(element, 'level', descriptor.aria.level);
+      setAria(element, 'expanded', descriptor.aria.expanded);
+      setAria(element, 'selected', descriptor.aria.selected);
+      setAria(element, 'posinset', descriptor.aria.posinset);
+      setAria(element, 'setsize', descriptor.aria.setsize);
+
+      const disclosure = documentRef.createElement('span');
+      disclosure.className = 'tree-disclosure';
+      disclosure.setAttribute('aria-hidden', 'true');
+      disclosure.textContent = descriptor.kind === 'camera' ? '' : (descriptor.aria.expanded ? '\u25bc' : '\u25b6');
+      const label = documentRef.createElement('span');
+      label.className = 'tree-label';
+      label.textContent = descriptor.name;
+      element.append(disclosure, label);
+
+      if (descriptor.address) {
+        const address = documentRef.createElement('span');
+        address.className = 'tree-address';
+        address.textContent = descriptor.address;
+        element.appendChild(address);
+      }
+      if (descriptor.pendingDeletion) {
+        const pending = documentRef.createElement('span');
+        pending.className = 'tree-badge pending';
+        pending.textContent = 'Pending deletion';
+        element.appendChild(pending);
+      }
+      if (descriptor.hierarchyStatus && !['assigned', 'inferred-site'].includes(descriptor.hierarchyStatus)) {
+        const warning = documentRef.createElement('span');
+        warning.className = 'tree-warning';
+        warning.title = `Hierarchy: ${descriptor.hierarchyStatus}`;
+        warning.setAttribute('aria-label', `Hierarchy warning: ${descriptor.hierarchyStatus}`);
+        warning.textContent = '!';
+        element.appendChild(warning);
+      }
+      return element;
+    }
+
+    function commit(snapshot) {
+      const descriptors = describeVirtualRows(snapshot, {
+        model: options.model,
+        activeDeviceIds: typeof options.getActiveDeviceIds === 'function' ? options.getActiveDeviceIds() : new Set(),
+        isOnline: options.isOnline,
+      });
+      spacer.style.height = `${snapshot.window.totalHeight}px`;
+      windowElement.style.transform = `translateY(${snapshot.window.offsetTop}px)`;
+      windowElement.style.height = `${descriptors.length * ROW_HEIGHT}px`;
+      const fragment = documentRef.createDocumentFragment();
+      for (const descriptor of descriptors) fragment.appendChild(createRow(descriptor));
+      windowElement.replaceChildren(fragment);
+
+      const active = descriptors.find((row) => snapshot.state.activeKey === row.key);
+      if (active) tree.setAttribute('aria-activedescendant', active.domId);
+      else tree.removeAttribute('aria-activedescendant');
+      tree.classList.toggle('has-hidden-selection', snapshot.rows.hiddenSelected === true);
+      if (typeof options.onCommit === 'function') options.onCommit(snapshot, descriptors);
+      return descriptors;
+    }
+
+    return Object.freeze({ commit });
+  }
+
+  return Object.freeze({ ROW_HEIGHT, stableDomId, describeVirtualRows, createSidebarView });
+}));
diff --git a/styles.css b/styles.css
index 83958c4..aff017a 100644
--- a/styles.css
+++ b/styles.css
@@ -51,7 +51,7 @@ body {
 
 /* Left Sidebar - Available Devices */
 .devices-sidebar {
-    width: 220px;
+    width: 300px;
     background: var(--card-bg);
     border-right: 1px solid var(--border);
     display: flex;
@@ -113,7 +113,175 @@ body {
 .device-list {
     flex: 1;
     overflow-y: auto;
-    padding: 8px;
+    padding: 0;
+}
+
+/* Accessible, bounded virtual hierarchy */
+.visually-hidden {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    padding: 0;
+    margin: -1px;
+    overflow: hidden;
+    clip: rect(0, 0, 0, 0);
+    white-space: nowrap;
+    border: 0;
+}
+
+.tree-results {
+    min-height: 16px;
+    margin-top: 6px;
+    color: var(--text-secondary);
+    font-size: 11px;
+}
+
+.virtual-tree {
+    position: relative;
+    outline: none;
+}
+
+.virtual-tree:focus-visible {
+    box-shadow: inset 0 0 0 2px var(--accent-primary);
+}
+
+.virtual-tree.has-hidden-selection::after {
+    content: 'Selected camera hidden';
+    position: sticky;
+    bottom: 4px;
+    left: 8px;
+    z-index: 3;
+    display: inline-block;
+    padding: 2px 6px;
+    border-radius: 3px;
+    background: var(--bg-primary);
+    color: var(--warning);
+    font-size: 10px;
+    pointer-events: none;
+}
+
+.virtual-tree-spacer {
+    position: relative;
+    min-height: 100%;
+}
+
+.virtual-tree-window {
+    position: absolute;
+    top: 0;
+    right: 0;
+    left: 0;
+    will-change: transform;
+}
+
+.tree-row {
+    position: absolute;
+    right: 0;
+    left: 0;
+    height: 30px;
+    display: flex;
+    align-items: center;
+    gap: 5px;
+    padding-right: 8px;
+    border-left: 2px solid transparent;
+    color: var(--text-primary);
+    cursor: default;
+    user-select: none;
+}
+
+.tree-row:hover,
+.tree-row.active {
+    background: var(--hover-bg);
+}
+
+.tree-row.active {
+    border-left-color: var(--accent-primary);
+    box-shadow: inset 0 0 0 1px rgba(14, 122, 254, 0.35);
+}
+
+.tree-row.selected {
+    background: rgba(14, 122, 254, 0.28);
+}
+
+.tree-site {
+    padding-left: 8px;
+    color: var(--accent-primary);
+    font-weight: 700;
+}
+
+.tree-group {
+    padding-left: 24px;
+    color: #b8cbea;
+    font-weight: 600;
+}
+
+.tree-camera {
+    padding-left: 42px;
+}
+
+.tree-camera::before {
+    content: '';
+    width: 7px;
+    height: 7px;
+    flex: 0 0 7px;
+    border-radius: 50%;
+    background: var(--error);
+}
+
+.tree-camera.online::before {
+    background: var(--success);
+}
+
+.tree-camera.proxy-active {
+    border-right: 3px solid var(--success);
+}
+
+.tree-disclosure {
+    width: 10px;
+    flex: 0 0 10px;
+    color: var(--text-secondary);
+    font-size: 9px;
+    text-align: center;
+}
+
+.tree-label {
+    min-width: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+.tree-address {
+    margin-left: auto;
+    overflow: hidden;
+    color: var(--text-secondary);
+    font-family: Consolas, monospace;
+    font-size: 10px;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+}
+
+.tree-badge {
+    flex: 0 0 auto;
+    padding: 1px 4px;
+    border-radius: 3px;
+    font-size: 9px;
+}
+
+.tree-badge.pending,
+.tree-row.pending-deletion {
+    color: var(--warning);
+}
+
+.tree-warning {
+    width: 14px;
+    height: 14px;
+    flex: 0 0 14px;
+    border: 1px solid var(--warning);
+    border-radius: 50%;
+    color: var(--warning);
+    font-size: 9px;
+    line-height: 12px;
+    text-align: center;
 }
 
 .device-item {
diff --git a/test/device-tree.test.js b/test/device-tree.test.js
index 81d14ed..f850d1f 100644
--- a/test/device-tree.test.js
+++ b/test/device-tree.test.js
@@ -13,11 +13,11 @@ function baseFixture() {
   return {
     sites: [
       { id: 's2', name: 'Zulu' },
-      { id: 's1', name: 'Alpha', pendingDeletion: true },
+      { id: 's1', name: 'Alpha', pendingDeletionStart: '2026-08-19T12:00:00Z' },
     ],
     groups: [
       { id: 'g2', name: 'Doors', parentId: 's2' },
-      { id: 'g1', name: 'Lobby', parentId: 's1', pendingDeletion: true },
+      { id: 'g1', name: 'Lobby', parentId: 's1', pendingDeletionStart: '2026-08-19T12:00:00Z' },
     ],
     devices: [
       { id: 'c4', name: 'No Group', siteId: 's1', type: 'camera' },
@@ -36,6 +36,7 @@ test('builds deterministic hierarchy with explicit exceptional buckets and diagn
   assert.deepEqual(model.sites.map((site) => site.name), ['Alpha', 'Orphaned cameras', 'Unknown site: missing-s', 'Zulu']);
   assert.equal(model.sites[0].pendingDeletion, true);
   assert.deepEqual(model.sites[0].groups.map((group) => group.name), ['Doors', 'Lobby', 'Ungrouped', 'Unknown group: missing-g']);
+  assert.equal(model.sites[0].groups.find((group) => group.id === 'g1').pendingDeletion, true);
   assert.deepEqual(model.sites[3].groups[0].cameras.map((camera) => camera.name), ['Inferred']);
 
   const conflict = model.cameraByKey.get('camera:c3');
diff --git a/test/renderer-hierarchy.test.js b/test/renderer-hierarchy.test.js
new file mode 100644
index 0000000..0eebc29
--- /dev/null
+++ b/test/renderer-hierarchy.test.js
@@ -0,0 +1,76 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const { describeVirtualRows } = require('../sidebar-view');
+
+const ROOT = path.resolve(__dirname, '..');
+const read = (name) => fs.readFileSync(path.join(ROOT, name), 'utf8');
+
+function syntheticSnapshot(count) {
+  const rows = Array.from({ length: count }, (_, index) => ({
+    key: `camera:00000000-0000-4000-8000-${String(index).padStart(12, '0')}`,
+    id: `00000000-0000-4000-8000-${String(index).padStart(12, '0')}`,
+    kind: 'camera', name: `Camera ${index}`, ariaLevel: 3, ariaSelected: index === 4,
+    ariaPosInSet: index + 1, ariaSetSize: count,
+  }));
+  const startIndex = Math.max(0, Math.floor(count / 2) - 20);
+  return {
+    state: { activeKey: rows[startIndex].key, selectedKey: rows[4].key },
+    rows: Object.assign(rows, { hiddenSelected: true }),
+    window: { rows: rows.slice(startIndex, startIndex + 60), startIndex, offsetTop: startIndex * 30, totalHeight: count * 30 },
+  };
+}
+
+test('renderer loads hierarchy foundations in order and exposes an accessible virtual tree', () => {
+  const html = read('index.html');
+  const treeIndex = html.indexOf('device-tree.js');
+  const controllerIndex = html.indexOf('sidebar-controller.js');
+  const viewIndex = html.indexOf('sidebar-view.js');
+  const rendererIndex = html.indexOf('renderer.js');
+  assert.ok(treeIndex >= 0 && treeIndex < controllerIndex && controllerIndex < viewIndex && viewIndex < rendererIndex);
+  assert.match(html, /id="deviceList"[^>]*role="tree"[^>]*tabindex="0"[^>]*aria-activedescendant/);
+  assert.match(html, /id="deviceResults"[^>]*role="status"[^>]*aria-live="polite"/);
+});
+
+test('renderer uses one hierarchy request and no parallel flat discovery', () => {
+  const renderer = read('renderer.js');
+  assert.match(renderer, /electronAPI\.getDeviceHierarchy\(\)/);
+  assert.doesNotMatch(renderer, /electronAPI\.getDevices\(|electronAPI\.getDeviceSites\(|Promise\.all\(\s*\[\s*window\.electronAPI\.get/);
+  assert.doesNotMatch(renderer, /\ballDevices\b|\ballSites\b|\bcollapsedSites\b|groupDevicesBySite/);
+  assert.match(renderer, /loadGeneration/);
+  assert.match(renderer, /generation\s*!==\s*loadGeneration/);
+});
+
+test('renderer uses delegated tree events, throttled scroll, and debounced search', () => {
+  const renderer = read('renderer.js');
+  assert.equal((renderer.match(/deviceList\.addEventListener\('click'/g) || []).length, 1);
+  assert.equal((renderer.match(/deviceList\.addEventListener\('keydown'/g) || []).length, 1);
+  assert.equal((renderer.match(/deviceList\.addEventListener\('scroll'/g) || []).length, 1);
+  assert.match(renderer, /requestAnimationFrame/);
+  assert.match(renderer, /setTimeout\([^,]+,\s*125\)/s);
+});
+
+test('virtual row descriptors stay bounded for 1,500 and 5,000 visible rows', () => {
+  for (const count of [1_500, 5_000]) {
+    const descriptors = describeVirtualRows(syntheticSnapshot(count), { activeDeviceIds: new Set() });
+    assert.ok(descriptors.length <= 80, `${count} rows mounted ${descriptors.length} descriptors`);
+    assert.equal(descriptors[0].role, 'treeitem');
+    assert.equal(descriptors[0].aria.level, 3);
+    assert.match(descriptors[0].domId, /^apt-tree-row-/);
+  }
+});
+
+test('view descriptors preserve selection and refresh proxy/status classes without rebuilding rows', () => {
+  const snapshot = syntheticSnapshot(1_500);
+  const selectedId = snapshot.rows[4].id;
+  const before = describeVirtualRows(snapshot, { activeDeviceIds: new Set() });
+  const camera = before.find((row) => row.kind === 'camera');
+  const after = describeVirtualRows(snapshot, { activeDeviceIds: new Set([camera.deviceId]), isOnline: () => true });
+  assert.ok(after.find((row) => row.key === camera.key).classes.includes('proxy-active'));
+  assert.ok(after.find((row) => row.key === camera.key).classes.includes('online'));
+  assert.equal(snapshot.rows[4].id, selectedId);
+  assert.equal(snapshot.rows.hiddenSelected, true);
+});
diff --git a/test/sidebar-controller.test.js b/test/sidebar-controller.test.js
index 1fcda70..893d2cc 100644
--- a/test/sidebar-controller.test.js
+++ b/test/sidebar-controller.test.js
@@ -81,6 +81,11 @@ test('controller commits exactly once per dispatch through view adapter', () =>
   assert.equal(commits.length, 2);
   assert.equal(commits[1].state.expandedKeys.has('site:s'), true);
   assert.ok(Array.isArray(commits[1].window.rows));
+  const modelReference = controller.getSnapshot().rows;
+  controller.refresh();
+  assert.equal(commits.length, 3);
+  assert.notEqual(controller.getSnapshot().rows, modelReference);
+  assert.equal(controller.getSnapshot().rows.length, modelReference.length);
 });
 
 test('active and selected state survive virtualization and selection is indicated when hidden', () => {

From 3b5e2acb75b19528385f23a6667602355515f7b8 Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Thu, 20 Aug 2026 01:26:00 +0000
Subject: [PATCH 18/22] fix: harden hierarchy keys and virtual navigation

---
 device-tree.js                  |  73 ++++++++++++++-----
 sidebar-controller.js           |  26 +++++--
 test/device-tree.test.js        |  92 +++++++++++++++++++-----
 test/sidebar-controller.test.js | 120 +++++++++++++++++++++++++++-----
 4 files changed, 255 insertions(+), 56 deletions(-)

diff --git a/device-tree.js b/device-tree.js
index 05abce2..abbdbd9 100644
--- a/device-tree.js
+++ b/device-tree.js
@@ -16,6 +16,11 @@
     return text(value).normalize('NFKD').toLocaleLowerCase();
   }
 
+  function keyPart(value) {
+    const encoded = encodeURIComponent(String(value));
+    return `${encoded.length}:${encoded}`;
+  }
+
   function compareNodes(left, right) {
     const nameOrder = left.normalizedName === right.normalizedName
       ? 0
@@ -41,16 +46,24 @@
   }
 
   function makeSite(id, name, ordinal, extra) {
+    const syntheticType = extra && extra.syntheticType;
     return Object.assign({
       kind: 'site', id, canonicalId: id, name, normalizedName: normalized(name), ordinal,
-      key: `site:${id}`, pendingDeletion: false, groups: [], synthetic: false,
+      key: syntheticType
+        ? `site:s:${keyPart(syntheticType)}:${keyPart(id)}`
+        : `site:t:${keyPart(id)}`,
+      pendingDeletion: false, groups: [], synthetic: false,
     }, extra);
   }
 
   function makeGroup(site, id, name, ordinal, extra) {
+    const syntheticType = extra && extra.syntheticType;
     return Object.assign({
       kind: 'group', id, canonicalId: id, name, normalizedName: normalized(name), ordinal,
-      key: `group:${site.id}:${id}`, parentKey: site.key, site, cameras: [],
+      key: syntheticType
+        ? `group:s:${keyPart(syntheticType)}:${keyPart(site.key)}:${keyPart(id)}`
+        : `group:t:${keyPart(site.key)}:${keyPart(id)}`,
+      parentKey: site.key, site, cameras: [],
       pendingDeletion: false, synthetic: false,
     }, extra);
   }
@@ -68,8 +81,28 @@
     const groupOccurrences = new Map();
     const siteOccurrences = new Map();
     const cameraOccurrences = new Map();
+    const syntheticSites = new Map();
     let syntheticOrdinal = sourceSites.length + sourceGroups.length + sourceDevices.length;
 
+    function registerRow(node) {
+      if (!rowByKey.has(node.key)) {
+        rowByKey.set(node.key, node);
+        return true;
+      }
+      const collidedKey = node.key;
+      let collisionOrdinal = 2;
+      do {
+        node.key = `${collidedKey}:collision:${collisionOrdinal}`;
+        collisionOrdinal += 1;
+      } while (rowByKey.has(node.key));
+      diagnostics.push({
+        code: 'row-key-collision', key: collidedKey, resolvedKey: node.key,
+        kind: node.kind, id: node.canonicalId,
+      });
+      rowByKey.set(node.key, node);
+      return false;
+    }
+
     sourceSites.forEach((item, ordinal) => {
       const safe = item && typeof item === 'object' ? item : {};
       const identity = createIdentity('site', safe, ordinal, siteOccurrences, diagnostics);
@@ -79,19 +112,24 @@
         source: safe,
       });
       sites.push(site);
-      rowByKey.set(site.key, site);
+      registerRow(site);
       if (identity.rawId && !siteByRawId.has(identity.rawId)) siteByRawId.set(identity.rawId, site);
     });
 
     function ensureUnknownSite(rawSiteId) {
       const labelId = text(rawSiteId);
       const id = labelId ? `${SPECIAL.UNKNOWN_SITE_PREFIX}${labelId}` : SPECIAL.ORPHAN_SITE;
-      let site = rowByKey.get(`site:${id}`);
+      const syntheticType = labelId ? 'unknown-site' : 'orphan';
+      const identity = `${syntheticType}:${keyPart(labelId)}`;
+      let site = syntheticSites.get(identity);
       if (!site) {
         const name = labelId ? `Unknown site: ${labelId}` : 'Orphaned cameras';
-        site = makeSite(id, name, syntheticOrdinal++, { synthetic: true, hierarchyStatus: labelId ? 'unknown-site' : 'orphan' });
+        site = makeSite(id, name, syntheticOrdinal++, {
+          synthetic: true, syntheticType, hierarchyStatus: syntheticType,
+        });
         sites.push(site);
-        rowByKey.set(site.key, site);
+        registerRow(site);
+        syntheticSites.set(identity, site);
       }
       return site;
     }
@@ -109,23 +147,24 @@
         source: safe,
       });
       site.groups.push(group);
-      rowByKey.set(group.key, group);
+      registerRow(group);
       if (identity.rawId && !groupByRawId.has(identity.rawId)) groupByRawId.set(identity.rawId, group);
     });
 
     function ensureGroup(site, id, name, status, template) {
-      const key = `group:${site.id}:${id}`;
+      const syntheticType = status === 'conflict' ? 'conflict' : status;
+      const key = `group:s:${keyPart(syntheticType)}:${keyPart(site.key)}:${keyPart(id)}`;
       let group = rowByKey.get(key);
       if (!group) {
         group = makeGroup(site, id, name, syntheticOrdinal++, {
-          synthetic: true,
+          synthetic: true, syntheticType,
           hierarchyStatus: status,
           canonicalId: template ? template.canonicalId : id,
           pendingDeletion: template ? template.pendingDeletion : false,
           source: template ? template.source : undefined,
         });
         site.groups.push(group);
-        rowByKey.set(group.key, group);
+        registerRow(group);
       }
       return group;
     }
@@ -133,6 +172,7 @@
     sourceDevices.forEach((item, ordinal) => {
       const safe = item && typeof item === 'object' ? item : {};
       const identity = createIdentity('camera', safe, ordinal, cameraOccurrences, diagnostics);
+      const cameraKey = `camera:t:${keyPart(identity.uniqueId)}`;
       const directSiteId = text(safe.siteId);
       const requestedGroupId = text(safe.deviceGroupId);
       const knownGroup = requestedGroupId ? groupByRawId.get(requestedGroupId) : undefined;
@@ -156,11 +196,11 @@
       } else if (!knownGroup) {
         group = ensureGroup(site, `${SPECIAL.UNKNOWN_GROUP_PREFIX}${requestedGroupId}`, `Unknown group: ${requestedGroupId}`, 'unknown-group');
         if (hierarchyStatus !== 'unknown-site') hierarchyStatus = 'unknown-group';
-        diagnostics.push({ code: 'unknown-group', key: `camera:${identity.uniqueId}`, id: requestedGroupId });
+        diagnostics.push({ code: 'unknown-group', key: cameraKey, id: requestedGroupId });
       } else if (knownGroup.site !== site) {
         group = ensureGroup(site, knownGroup.id, knownGroup.name, 'conflict', knownGroup);
         hierarchyStatus = 'conflict';
-        diagnostics.push({ code: 'site-group-conflict', key: `camera:${identity.uniqueId}`, siteId: directSiteId, groupId: requestedGroupId, groupSiteId: knownGroup.site.canonicalId });
+        diagnostics.push({ code: 'site-group-conflict', key: cameraKey, siteId: directSiteId, groupId: requestedGroupId, groupSiteId: knownGroup.site.canonicalId });
       } else {
         group = knownGroup;
       }
@@ -168,15 +208,15 @@
       const name = text(safe.name) || identity.canonicalId;
       const camera = {
         kind: 'camera', id: identity.uniqueId, canonicalId: identity.canonicalId,
-        key: `camera:${identity.uniqueId}`, name, normalizedName: normalized(name), ordinal,
+        key: cameraKey, name, normalizedName: normalized(name), ordinal,
         parentKey: group.key, site, group, hierarchyStatus, source: safe,
       };
       camera.searchCorpus = normalized([
         name, identity.canonicalId, safe.model, safe.type, safe.address, site.name, group.name,
       ].map(text).join(' '));
       group.cameras.push(camera);
+      registerRow(camera);
       cameraByKey.set(camera.key, camera);
-      rowByKey.set(camera.key, camera);
     });
 
     sites.forEach((site) => {
@@ -238,15 +278,16 @@
   function calculateVirtualWindow(rows, options = {}) {
     const rowHeight = Number.isFinite(options.rowHeight) && options.rowHeight > 0 ? options.rowHeight : 28;
     const viewportHeight = Number.isFinite(options.viewportHeight) && options.viewportHeight >= 0 ? options.viewportHeight : 0;
-    const scrollTop = Math.max(0, Number.isFinite(options.scrollTop) ? options.scrollTop : 0);
+    const requestedScrollTop = Math.max(0, Number.isFinite(options.scrollTop) ? options.scrollTop : 0);
     const overscan = Math.max(0, Number.isInteger(options.overscan) ? options.overscan : 16);
+    const scrollTop = Math.min(requestedScrollTop, Math.max(0, (rows.length * rowHeight) - viewportHeight));
     const visibleStart = Math.floor(scrollTop / rowHeight);
     const visibleEnd = Math.ceil((scrollTop + viewportHeight) / rowHeight);
     const startIndex = Math.max(0, Math.min(rows.length, visibleStart - overscan));
     const endIndex = Math.max(startIndex, Math.min(rows.length, visibleEnd + overscan));
     return {
       rows: rows.slice(startIndex, endIndex), startIndex, endIndex,
-      offsetTop: startIndex * rowHeight, totalHeight: rows.length * rowHeight,
+      offsetTop: startIndex * rowHeight, totalHeight: rows.length * rowHeight, scrollTop,
     };
   }
 
diff --git a/sidebar-controller.js b/sidebar-controller.js
index 6219a3b..ec802e0 100644
--- a/sidebar-controller.js
+++ b/sidebar-controller.js
@@ -35,13 +35,20 @@
     return rows.find((row) => row && row.key === key) || null;
   }
 
+  function expansionState(state) {
+    return state.searchQuery && state.searchExpandedKeys instanceof Set
+      ? { field: 'searchExpandedKeys', keys: state.searchExpandedKeys }
+      : { field: 'expandedKeys', keys: state.expandedKeys };
+  }
+
   function changeExpansion(state, row, force) {
     if (!row || row.kind === 'camera') return state;
-    const expandedKeys = copySet(state.expandedKeys);
+    const current = expansionState(state);
+    const expandedKeys = copySet(current.keys);
     const shouldExpand = force === undefined ? !expandedKeys.has(row.key) : force;
     if (shouldExpand) expandedKeys.add(row.key);
     else expandedKeys.delete(row.key);
-    return Object.assign({}, state, { expandedKeys, activeKey: row.key });
+    return Object.assign({}, state, { [current.field]: expandedKeys, activeKey: row.key });
   }
 
   function activate(state, row) {
@@ -101,8 +108,13 @@
     }
     if (!rows.length) return state;
     let index = rows.findIndex((row) => row.key === state.activeKey);
-    if (index < 0) index = 0;
+    if (index < 0) {
+      if (action.key === 'ArrowDown' || action.key === 'Home') return moveActive(state, rows, 0);
+      if (action.key === 'ArrowUp' || action.key === 'End') return moveActive(state, rows, rows.length - 1);
+      index = 0;
+    }
     const row = rows[index];
+    const expandedKeys = expansionState(state).keys;
     switch (action.key) {
       case 'ArrowDown': return moveActive(state, rows, index + 1);
       case 'ArrowUp': return moveActive(state, rows, index - 1);
@@ -110,12 +122,12 @@
       case 'End': return moveActive(state, rows, rows.length - 1);
       case 'ArrowRight': {
         if (row.kind === 'camera') return state;
-        if (!state.expandedKeys.has(row.key)) return changeExpansion(state, row, true);
+        if (!expandedKeys.has(row.key)) return changeExpansion(state, row, true);
         const child = rows[index + 1];
         return child && child.parentKey === row.key ? Object.assign({}, state, { activeKey: child.key }) : state;
       }
       case 'ArrowLeft':
-        if (row.kind !== 'camera' && state.expandedKeys.has(row.key)) return changeExpansion(state, row, false);
+        if (row.kind !== 'camera' && expandedKeys.has(row.key)) return changeExpansion(state, row, false);
         return row.parentKey && validKey(row.parentKey) ? Object.assign({}, state, { activeKey: row.parentKey }) : state;
       case 'Enter':
       case ' ':
@@ -150,6 +162,10 @@
         matchCameraKeys: state.searchQuery ? state.searchCameraKeys : null,
       });
       const activeIndex = rows.findIndex((row) => row.key === state.activeKey);
+      const maximumScrollTop = Math.max(0, (rows.length * rowHeight) - state.viewportHeight);
+      if (state.scrollTop > maximumScrollTop) {
+        state = Object.assign({}, state, { scrollTop: maximumScrollTop });
+      }
       if (activeIndex >= 0 && state.viewportHeight > 0) {
         const activeTop = activeIndex * rowHeight;
         const activeBottom = activeTop + rowHeight;
diff --git a/test/device-tree.test.js b/test/device-tree.test.js
index f850d1f..39b950e 100644
--- a/test/device-tree.test.js
+++ b/test/device-tree.test.js
@@ -33,18 +33,19 @@ function baseFixture() {
 
 test('builds deterministic hierarchy with explicit exceptional buckets and diagnostics', () => {
   const model = buildDeviceTree(baseFixture());
+  const camera = (id) => [...model.cameraByKey.values()].find((entry) => entry.canonicalId === id);
   assert.deepEqual(model.sites.map((site) => site.name), ['Alpha', 'Orphaned cameras', 'Unknown site: missing-s', 'Zulu']);
   assert.equal(model.sites[0].pendingDeletion, true);
   assert.deepEqual(model.sites[0].groups.map((group) => group.name), ['Doors', 'Lobby', 'Ungrouped', 'Unknown group: missing-g']);
   assert.equal(model.sites[0].groups.find((group) => group.id === 'g1').pendingDeletion, true);
   assert.deepEqual(model.sites[3].groups[0].cameras.map((camera) => camera.name), ['Inferred']);
 
-  const conflict = model.cameraByKey.get('camera:c3');
+  const conflict = camera('c3');
   assert.equal(conflict.site.id, 's1');
   assert.equal(conflict.group.name, 'Doors');
   assert.equal(conflict.hierarchyStatus, 'conflict');
-  assert.equal(model.cameraByKey.get('camera:c2').hierarchyStatus, 'inferred-site');
-  assert.ok(model.diagnostics.some((entry) => entry.code === 'site-group-conflict' && entry.key === 'camera:c3'));
+  assert.equal(camera('c2').hierarchyStatus, 'inferred-site');
+  assert.ok(model.diagnostics.some((entry) => entry.code === 'site-group-conflict' && entry.key === conflict.key));
 });
 
 test('duplicate and malformed IDs get stable unique keys and diagnostics', () => {
@@ -67,44 +68,49 @@ test('duplicate and malformed IDs get stable unique keys and diagnostics', () =>
 
 test('sites start collapsed; expansion produces levels and complete ARIA metadata', () => {
   const model = buildDeviceTree(baseFixture());
-  let rows = flattenVisibleRows(model, { expandedKeys: new Set(), selectedKey: 'camera:c1' });
+  const site = model.sites.find((entry) => entry.canonicalId === 's1' && !entry.synthetic);
+  const group = site.groups.find((entry) => entry.canonicalId === 'g1' && !entry.synthetic);
+  const selected = [...model.cameraByKey.values()].find((entry) => entry.canonicalId === 'c1');
+  let rows = flattenVisibleRows(model, { expandedKeys: new Set(), selectedKey: selected.key });
   assert.equal(rows.length, 4);
   assert.ok(rows.every((row) => row.kind === 'site' && row.aria.level === 1 && row.aria.expanded === false));
   assert.ok(rows.every((row) => row.aria.setsize === 4));
   assert.equal(rows.hiddenSelected, true);
 
-  rows = flattenVisibleRows(model, { expandedKeys: new Set(['site:s1']) });
+  rows = flattenVisibleRows(model, { expandedKeys: new Set([site.key]) });
   assert.deepEqual(rows.slice(0, 5).map((row) => row.kind), ['site', 'group', 'group', 'group', 'group']);
   assert.ok(rows.slice(1, 5).every((row) => row.aria.level === 2 && row.aria.expanded === false));
 
   rows = flattenVisibleRows(model, {
-    expandedKeys: new Set(['site:s1', 'group:s1:g1']),
-    selectedKey: 'camera:c1',
+    expandedKeys: new Set([site.key, group.key]),
+    selectedKey: selected.key,
   });
-  const camera = rows.find((row) => row.key === 'camera:c1');
-  assert.equal(camera.parentKey, 'group:s1:g1');
+  const camera = rows.find((row) => row.key === selected.key);
+  assert.equal(camera.parentKey, group.key);
   assert.deepEqual(camera.aria, { level: 3, expanded: undefined, selected: true, posinset: 1, setsize: 1 });
   assert.equal(rows.hiddenSelected, false);
 });
 
 test('search covers camera fields and ancestors without mutating saved expansion', async () => {
   const model = buildDeviceTree(baseFixture());
+  const site = (id) => model.sites.find((entry) => entry.canonicalId === id && !entry.synthetic);
+  const camera = (id) => [...model.cameraByKey.values()].find((entry) => entry.canonicalId === id);
   const scheduled = [];
   const runner = createSearchRunner({ scheduler: (work) => scheduled.push(work), chunkSize: 2 });
-  const saved = new Set(['site:s2']);
+  const saved = new Set([site('s2').key]);
   const promise = runner.search(model, 'alpha lobby 10.0.0.1', { expandedKeys: saved });
   while (scheduled.length) scheduled.shift()();
   const result = await promise;
   assert.equal(result.count, 1);
-  assert.deepEqual([...result.cameraKeys], ['camera:c1']);
-  assert.ok(result.expandedKeys.has('site:s1'));
-  assert.ok(result.expandedKeys.has('group:s1:g1'));
-  assert.deepEqual([...saved], ['site:s2']);
+  assert.deepEqual([...result.cameraKeys], [camera('c1').key]);
+  assert.ok(result.expandedKeys.has(site('s1').key));
+  assert.ok(result.expandedKeys.has(camera('c1').group.key));
+  assert.deepEqual([...saved], [site('s2').key]);
 
   const ancestorPromise = runner.search(model, 'zulu', { expandedKeys: new Set() });
   while (scheduled.length) scheduled.shift()();
   const ancestor = await ancestorPromise;
-  assert.deepEqual([...ancestor.cameraKeys], ['camera:c2']);
+  assert.deepEqual([...ancestor.cameraKeys], [camera('c2').key]);
 });
 
 test('new search cancels stale chunked generation', async () => {
@@ -132,7 +138,9 @@ test('virtual window remains structurally bounded for 5,000 expanded shuffled ca
     [devices[i], devices[j]] = [devices[j], devices[i]];
   }
   const model = buildDeviceTree({ sites: [{ id: 's', name: 'Large' }], groups: [], devices });
-  const rows = flattenVisibleRows(model, { expandedKeys: new Set(['site:s', 'group:s:__ungrouped__']) });
+  const rows = flattenVisibleRows(model, {
+    expandedKeys: new Set([model.sites[0].key, model.sites[0].groups[0].key]),
+  });
   const window = calculateVirtualWindow(rows, { scrollTop: 50000, viewportHeight: 320, rowHeight: 28 });
   assert.ok(window.rows.length >= 40 && window.rows.length <= 50, `mounted ${window.rows.length}`);
   assert.equal(window.totalHeight, rows.length * 28);
@@ -146,3 +154,55 @@ test('1,500-site/group fixture has deterministic stable ordering', () => {
   const namesAndIds = model.sites.map((site) => `${site.normalizedName}|${site.id}`);
   assert.deepEqual(namesAndIds, [...namesAndIds].sort((a, b) => a.localeCompare(b)));
 });
+
+test('tenant and synthetic namespaces stay distinct for reserved and ambiguous IDs', () => {
+  const model = buildDeviceTree({
+    sites: [
+      { id: '__orphaned__', name: 'Tenant Reserved Site' },
+      { id: '__unknown_site__:missing', name: 'Tenant Unknown-shaped Site' },
+      { id: 'a', name: 'A' },
+      { id: 'a:b', name: 'A colon B' },
+      { id: 'percent%:site', name: 'Percent Site' },
+    ],
+    groups: [
+      { id: '__ungrouped__', name: 'Tenant Reserved Group', parentId: '__orphaned__' },
+      { id: 'b:c', name: 'Tuple One', parentId: 'a' },
+      { id: 'c', name: 'Tuple Two', parentId: 'a:b' },
+      { id: 'g:%', name: 'Escaped Group', parentId: 'percent%:site' },
+    ],
+    devices: [
+      { id: 'tenant-group', siteId: '__orphaned__', deviceGroupId: '__ungrouped__' },
+      { id: 'synthetic-group', siteId: '__orphaned__' },
+      { id: 'orphan' },
+      { id: 'unknown-site', siteId: 'missing' },
+      { id: 'tuple-one', siteId: 'a', deviceGroupId: 'b:c' },
+      { id: 'tuple-two', siteId: 'a:b', deviceGroupId: 'c' },
+      { id: 'escaped', siteId: 'percent%:site', deviceGroupId: 'g:%' },
+    ],
+  });
+
+  const tenantReserved = model.sites.find((site) => !site.synthetic && site.id === '__orphaned__');
+  const orphanBucket = model.sites.find((site) => site.synthetic && site.hierarchyStatus === 'orphan');
+  const unknownBucket = model.sites.find((site) => site.synthetic && site.hierarchyStatus === 'unknown-site');
+  assert.ok(tenantReserved && orphanBucket && unknownBucket);
+  assert.notEqual(tenantReserved.key, orphanBucket.key);
+  const camera = (id) => [...model.cameraByKey.values()].find((entry) => entry.canonicalId === id);
+  assert.notEqual(camera('tenant-group').group.key, camera('synthetic-group').group.key);
+  assert.notEqual(camera('tuple-one').group.key, camera('tuple-two').group.key);
+  assert.equal(model.rowByKey.size, model.sites.length +
+    model.sites.reduce((count, site) => count + site.groups.length, 0) + model.cameraCount);
+  assert.ok([...model.rowByKey.keys()].every((key) => !/\s/.test(key)));
+});
+
+test('virtual window clamps an obsolete scroll offset after rows shrink', () => {
+  const rows = [{ key: 'only-row' }];
+  const window = calculateVirtualWindow(rows, {
+    scrollTop: 10000,
+    viewportHeight: 320,
+    rowHeight: 28,
+    overscan: 0,
+  });
+  assert.deepEqual(window.rows, rows);
+  assert.equal(window.startIndex, 0);
+  assert.equal(window.endIndex, 1);
+});
diff --git a/test/sidebar-controller.test.js b/test/sidebar-controller.test.js
index 893d2cc..f60c88c 100644
--- a/test/sidebar-controller.test.js
+++ b/test/sidebar-controller.test.js
@@ -21,65 +21,76 @@ function visible(model, state) {
   return flattenVisibleRows(model, state);
 }
 
+function fixtureKeys(model) {
+  const site = model.sites[0];
+  const group = site.groups[0];
+  const cameras = Object.fromEntries(group.cameras.map((camera) => [camera.canonicalId, camera.key]));
+  return { site: site.key, group: group.key, cameras };
+}
+
 test('reducer expands, navigates, selects, collapses, and preserves hidden selection', () => {
   const model = fixture();
+  const keys = fixtureKeys(model);
   let state = createInitialState();
   let rows = visible(model, state);
   state = reduceSidebar(state, { type: 'KEY', key: 'Home' }, rows);
-  assert.equal(state.activeKey, 'site:s');
+  assert.equal(state.activeKey, keys.site);
   state = reduceSidebar(state, { type: 'KEY', key: 'ArrowRight' }, rows);
-  assert.ok(state.expandedKeys.has('site:s'));
+  assert.ok(state.expandedKeys.has(keys.site));
 
   rows = visible(model, state);
   state = reduceSidebar(state, { type: 'KEY', key: 'ArrowDown' }, rows);
-  assert.equal(state.activeKey, 'group:s:g');
+  assert.equal(state.activeKey, keys.group);
   state = reduceSidebar(state, { type: 'KEY', key: 'ArrowRight' }, rows);
   rows = visible(model, state);
   state = reduceSidebar(state, { type: 'KEY', key: 'ArrowDown' }, rows);
   state = reduceSidebar(state, { type: 'KEY', key: 'Enter' }, rows);
-  assert.equal(state.selectedKey, 'camera:a');
+  assert.equal(state.selectedKey, keys.cameras.a);
 
-  state = reduceSidebar(state, { type: 'ACTIVATE', rowKey: 'site:s' }, rows);
-  assert.equal(state.selectedKey, 'camera:a');
+  state = reduceSidebar(state, { type: 'ACTIVATE', rowKey: keys.site }, rows);
+  assert.equal(state.selectedKey, keys.cameras.a);
   assert.equal(visible(model, state).hiddenSelected, true);
 });
 
 test('keyboard Left/Right parent behavior, bounds, Space and Escape', () => {
   const model = fixture();
+  const keys = fixtureKeys(model);
   let state = createInitialState({
-    expandedKeys: new Set(['site:s', 'group:s:g']),
-    activeKey: 'camera:a',
+    expandedKeys: new Set([keys.site, keys.group]),
+    activeKey: keys.cameras.a,
     searchQuery: 'alpha',
   });
   let rows = visible(model, state);
   state = reduceSidebar(state, { type: 'KEY', key: 'ArrowLeft' }, rows);
-  assert.equal(state.activeKey, 'group:s:g');
+  assert.equal(state.activeKey, keys.group);
   state = reduceSidebar(state, { type: 'KEY', key: 'ArrowLeft' }, rows);
-  assert.equal(state.expandedKeys.has('group:s:g'), false);
+  assert.equal(state.expandedKeys.has(keys.group), false);
   state = reduceSidebar(state, { type: 'KEY', key: 'End' }, visible(model, state));
-  assert.equal(state.activeKey, 'group:s:g');
+  assert.equal(state.activeKey, keys.group);
   state = reduceSidebar(state, { type: 'KEY', key: ' ' }, visible(model, state));
-  assert.equal(state.expandedKeys.has('group:s:g'), true);
+  assert.equal(state.expandedKeys.has(keys.group), true);
   state = reduceSidebar(state, { type: 'KEY', key: 'Escape' }, visible(model, state));
   assert.equal(state.searchQuery, '');
 });
 
 test('malformed and unknown delegated row keys are no-ops', () => {
-  const state = createInitialState({ activeKey: 'site:s' });
-  const rows = visible(fixture(), state);
+  const model = fixture();
+  const state = createInitialState({ activeKey: fixtureKeys(model).site });
+  const rows = visible(model, state);
   assert.equal(reduceSidebar(state, { type: 'ACTIVATE', rowKey: '__proto__' }, rows), state);
   assert.equal(reduceSidebar(state, { type: 'CLICK', rowKey: 'camera:not-there' }, rows), state);
 });
 
 test('controller commits exactly once per dispatch through view adapter', () => {
   const model = fixture();
+  const keys = fixtureKeys(model);
   const commits = [];
   const view = { commit: (snapshot) => commits.push(snapshot) };
   const controller = createSidebarController({ model, view, rowHeight: 28, overscan: 3 });
   assert.equal(commits.length, 1);
-  controller.dispatch({ type: 'ACTIVATE', rowKey: 'site:s' });
+  controller.dispatch({ type: 'ACTIVATE', rowKey: keys.site });
   assert.equal(commits.length, 2);
-  assert.equal(commits[1].state.expandedKeys.has('site:s'), true);
+  assert.equal(commits[1].state.expandedKeys.has(keys.site), true);
   assert.ok(Array.isArray(commits[1].window.rows));
   const modelReference = controller.getSnapshot().rows;
   controller.refresh();
@@ -90,17 +101,19 @@ test('controller commits exactly once per dispatch through view adapter', () =>
 
 test('active and selected state survive virtualization and selection is indicated when hidden', () => {
   const model = fixture();
+  const keys = fixtureKeys(model);
   const commits = [];
   const controller = createSidebarController({ model, view: { commit: (value) => commits.push(value) } });
-  controller.dispatch({ type: 'SET_SELECTION', rowKey: 'camera:b' });
+  controller.dispatch({ type: 'SET_SELECTION', rowKey: keys.cameras.b });
   controller.dispatch({ type: 'SET_VIEWPORT', scrollTop: 9999, viewportHeight: 20 });
   const snapshot = commits.at(-1);
-  assert.equal(snapshot.state.selectedKey, 'camera:b');
+  assert.equal(snapshot.state.selectedKey, keys.cameras.b);
   assert.equal(snapshot.rows.hiddenSelected, true);
 });
 
 test('controller search temporarily expands matches with one completion commit', async () => {
   const model = fixture();
+  const keys = fixtureKeys(model);
   const commits = [];
   const scheduled = [];
   const controller = createSidebarController({
@@ -114,6 +127,75 @@ test('controller search temporarily expands matches with one completion commit',
   const result = await pending;
   assert.equal(result.count, 1);
   assert.equal(commits.length, 2);
-  assert.deepEqual(commits.at(-1).rows.map((row) => row.key), ['site:s', 'group:s:g', 'camera:b']);
+  assert.deepEqual(commits.at(-1).rows.map((row) => row.key), [keys.site, keys.group, keys.cameras.b]);
   assert.equal(controller.getState().expandedKeys.size, 0);
 });
+
+test('first arrow press chooses the directional edge when no row is active', () => {
+  const model = buildDeviceTree({
+    sites: [{ id: 'b', name: 'B' }, { id: 'a', name: 'A' }, { id: 'c', name: 'C' }],
+  });
+  const rows = visible(model, createInitialState());
+  assert.equal(reduceSidebar(createInitialState(), { type: 'KEY', key: 'ArrowDown' }, rows).activeKey, rows[0].key);
+  assert.equal(reduceSidebar(createInitialState(), { type: 'KEY', key: 'ArrowUp' }, rows).activeKey, rows.at(-1).key);
+});
+
+test('collapse clamps stale scroll and keyboard navigation scrolls active rows into the virtual window', () => {
+  const model = buildDeviceTree({
+    sites: [{ id: 'large', name: 'Large' }],
+    groups: [],
+    devices: Array.from({ length: 500 }, (_, index) => ({ id: `c${index}`, name: `Camera ${index}`, siteId: 'large' })),
+  });
+  const site = model.sites[0];
+  const group = site.groups[0];
+  const controller = createSidebarController({
+    model,
+    view: { commit() {} },
+    rowHeight: 20,
+    overscan: 0,
+    initialState: { expandedKeys: new Set([site.key, group.key]), scrollTop: 10000, viewportHeight: 100 },
+  });
+
+  controller.dispatch({ type: 'ACTIVATE', rowKey: site.key });
+  let snapshot = controller.getSnapshot();
+  assert.deepEqual(snapshot.window.rows.map((row) => row.key), [site.key]);
+  assert.equal(snapshot.state.scrollTop, 0);
+
+  controller.dispatch({ type: 'ACTIVATE', rowKey: site.key });
+  controller.dispatch({ type: 'SET_ACTIVE', rowKey: site.key });
+  controller.dispatch({ type: 'KEY', key: 'End' });
+  snapshot = controller.getSnapshot();
+  assert.equal(snapshot.window.rows.some((row) => row.key === snapshot.state.activeKey), true);
+  assert.ok(snapshot.state.scrollTop > 0);
+});
+
+test('search expansion controls rendered temporary state and restores saved expansion', async () => {
+  const model = fixture();
+  const scheduled = [];
+  const site = model.sites[0];
+  const group = site.groups[0];
+  const controller = createSidebarController({
+    model,
+    view: { commit() {} },
+    scheduler: (work) => scheduled.push(work),
+    initialState: { expandedKeys: new Set([site.key]) },
+  });
+  const pending = controller.search('alpha');
+  while (scheduled.length) scheduled.shift()();
+  await pending;
+
+  controller.dispatch({ type: 'SET_ACTIVE', rowKey: group.key });
+  controller.dispatch({ type: 'KEY', key: 'ArrowLeft' });
+  assert.equal(controller.getState().searchExpandedKeys.has(group.key), false);
+  assert.equal(controller.getSnapshot().rows.some((row) => row.kind === 'camera'), false);
+  assert.deepEqual(controller.getState().expandedKeys, new Set([site.key]));
+
+  controller.dispatch({ type: 'KEY', key: 'ArrowRight' });
+  assert.equal(controller.getState().searchExpandedKeys.has(group.key), true);
+  assert.equal(controller.getSnapshot().rows.some((row) => row.kind === 'camera'), true);
+  assert.deepEqual(controller.getState().expandedKeys, new Set([site.key]));
+
+  await controller.search('');
+  assert.deepEqual(controller.getState().expandedKeys, new Set([site.key]));
+  assert.equal(controller.getState().searchExpandedKeys, null);
+});

From 7d484a3998883be8a0ea3f8aab135fc5d4ccd5f2 Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Thu, 20 Aug 2026 01:44:23 +0000
Subject: [PATCH 19/22] fix: contain malformed metadata and stale discovery

---
 device-tree.js                 | 33 ++++++++++--
 index.html                     |  1 +
 main.js                        |  5 +-
 package.json                   |  1 +
 src/device-projection.js       |  9 ++--
 src/electron-runtime.js        | 54 ++++++++++++++++++--
 test/device-projection.test.js | 26 ++++++++++
 test/device-tree.test.js       | 27 ++++++++++
 test/runtime-contract.test.js  | 91 ++++++++++++++++++++++++++++++++++
 well-formed-string.js          | 42 ++++++++++++++++
 10 files changed, 276 insertions(+), 13 deletions(-)
 create mode 100644 well-formed-string.js

diff --git a/device-tree.js b/device-tree.js
index abbdbd9..9f8b4ff 100644
--- a/device-tree.js
+++ b/device-tree.js
@@ -1,6 +1,9 @@
 'use strict';
 
 (function exposeDeviceTree(globalScope) {
+  const { toWellFormedString } = typeof module !== 'undefined' && module.exports
+    ? require('./well-formed-string')
+    : globalScope.AptWellFormedString;
   const SPECIAL = Object.freeze({
     ORPHAN_SITE: '__orphaned__',
     UNGROUPED: '__ungrouped__',
@@ -9,7 +12,7 @@
   });
 
   function text(value) {
-    return value === null || value === undefined ? '' : String(value).trim();
+    return value === null || value === undefined ? '' : toWellFormedString(value).trim();
   }
 
   function normalized(value) {
@@ -17,7 +20,7 @@
   }
 
   function keyPart(value) {
-    const encoded = encodeURIComponent(String(value));
+    const encoded = encodeURIComponent(toWellFormedString(value));
     return `${encoded.length}:${encoded}`;
   }
 
@@ -109,7 +112,11 @@
       const site = makeSite(identity.uniqueId, text(safe.name) || identity.canonicalId, ordinal, {
         canonicalId: identity.canonicalId,
         pendingDeletion: safe.pendingDeletion === true || Boolean(text(safe.pendingDeletionStart)),
-        source: safe,
+        source: {
+          id: identity.canonicalId,
+          name: text(safe.name),
+          pendingDeletionStart: text(safe.pendingDeletionStart) || null,
+        },
       });
       sites.push(site);
       registerRow(site);
@@ -144,7 +151,12 @@
         canonicalId: identity.canonicalId,
         rawParentId: parentId,
         pendingDeletion: safe.pendingDeletion === true || Boolean(text(safe.pendingDeletionStart)),
-        source: safe,
+        source: {
+          id: identity.canonicalId,
+          name: text(safe.name),
+          parentId,
+          pendingDeletionStart: text(safe.pendingDeletionStart) || null,
+        },
       });
       site.groups.push(group);
       registerRow(group);
@@ -206,10 +218,21 @@
       }
 
       const name = text(safe.name) || identity.canonicalId;
+      const source = {
+        id: identity.canonicalId,
+        name,
+        type: text(safe.type) || null,
+        model: text(safe.model) || null,
+        address: text(safe.address) || null,
+        siteId: directSiteId || null,
+        deviceGroupId: requestedGroupId || null,
+        displayStatus: text(safe.displayStatus) || null,
+        localStorage: typeof safe.localStorage === 'boolean' ? safe.localStorage : null,
+      };
       const camera = {
         kind: 'camera', id: identity.uniqueId, canonicalId: identity.canonicalId,
         key: cameraKey, name, normalizedName: normalized(name), ordinal,
-        parentKey: group.key, site, group, hierarchyStatus, source: safe,
+        parentKey: group.key, site, group, hierarchyStatus, source,
       };
       camera.searchCorpus = normalized([
         name, identity.canonicalId, safe.model, safe.type, safe.address, site.name, group.name,
diff --git a/index.html b/index.html
index 66d89d1..e8b21cb 100644
--- a/index.html
+++ b/index.html
@@ -108,6 +108,7 @@
         </div>
     </div>
 
+    <script src="well-formed-string.js"></script>
     <script src="renderer-controller.js"></script>
     <script src="device-tree.js"></script>
     <script src="sidebar-controller.js"></script>
diff --git a/main.js b/main.js
index 29b18c6..c12e1f8 100644
--- a/main.js
+++ b/main.js
@@ -118,7 +118,10 @@ function startBridgeServer() {
   const handler = createBridgeHandler({
     bridgeAuth: pairingController.bridgeAuth,
     sessionStore: runtime.sessionStore,
-    onConnectionStateChanged: sendConnectionState,
+    onConnectionStateChanged: () => {
+      runtime.onSessionChanged();
+      sendConnectionState();
+    },
   });
   bridgeServer = http.createServer((request, response) => {
     handler(request, response).catch(() => {
diff --git a/package.json b/package.json
index d222b54..00a80c8 100644
--- a/package.json
+++ b/package.json
@@ -25,6 +25,7 @@
       "preload.js",
       "renderer.js",
       "renderer-controller.js",
+      "well-formed-string.js",
       "device-tree.js",
       "sidebar-controller.js",
       "sidebar-view.js",
diff --git a/src/device-projection.js b/src/device-projection.js
index fdebb16..88285d5 100644
--- a/src/device-projection.js
+++ b/src/device-projection.js
@@ -1,6 +1,7 @@
 'use strict';
 
 const { validateDeviceId } = require('./proxy-launch');
+const { toWellFormedString } = require('../well-formed-string');
 
 const MAX_PROJECTED_PAYLOAD_BYTES = 8 * 1024 * 1024;
 
@@ -11,11 +12,11 @@ function projectionError(code, message) {
 }
 
 function nullableString(value) {
-  return typeof value === 'string' ? value : null;
+  return typeof value === 'string' ? toWellFormedString(value) : null;
 }
 
 function nullableId(value) {
-  return typeof value === 'string' && value.length > 0 ? value : null;
+  return typeof value === 'string' && value.length > 0 ? toWellFormedString(value) : null;
 }
 
 function nullableBoolean(value) {
@@ -78,7 +79,9 @@ function projectArray(values, projector) {
 }
 
 function safeMetadataError(value) {
-  return typeof value === 'string' && value.length > 0 ? value.slice(0, 512) : null;
+  return typeof value === 'string' && value.length > 0
+    ? Array.from(toWellFormedString(value)).slice(0, 512).join('')
+    : null;
 }
 
 function projectDeviceHierarchy({ devices = [], sites = [], groups = [], metadataErrors = {} } = {}) {
diff --git a/src/electron-runtime.js b/src/electron-runtime.js
index 9c0324a..832af90 100644
--- a/src/electron-runtime.js
+++ b/src/electron-runtime.js
@@ -214,6 +214,8 @@ class AppRuntime {
     this.openExternal = openExternal;
     this.discoveryTimeoutMs = discoveryTimeoutMs;
     this.allowedDeviceIds = new Set();
+    this.allowedDeviceDiscovery = null;
+    this.discoveryGeneration = 0;
     this.proxyByDevice = new Map();
   }
 
@@ -233,16 +235,55 @@ class AppRuntime {
     return tracked.filter((proxy) => this.proxyByDevice.get(proxy.deviceId) === proxy.processId);
   }
 
-  _setAllowedDevices(devices) {
+  _setAllowedDevices(devices, discovery) {
     this.allowedDeviceIds = new Set(devices.map((device) => device.id));
+    this.allowedDeviceDiscovery = discovery;
+  }
+
+  _beginDiscovery() {
+    const state = this.sessionStore.describe();
+    this.allowedDeviceIds.clear();
+    this.allowedDeviceDiscovery = null;
+    return Object.freeze({
+      generation: ++this.discoveryGeneration,
+      connected: state.connected,
+      origin: state.origin,
+    });
+  }
+
+  _isCurrentDiscovery(discovery) {
+    const state = this.sessionStore.describe();
+    return discovery.generation === this.discoveryGeneration &&
+      discovery.connected === state.connected && discovery.origin === state.origin;
+  }
+
+  _staleDiscoveryResult() {
+    return {
+      success: false,
+      stale: true,
+      hierarchy: { devices: [], sites: [], groups: [] },
+      message: 'Alta device discovery result is stale',
+    };
+  }
+
+  invalidateDiscovery() {
+    this.discoveryGeneration += 1;
+    this.allowedDeviceIds.clear();
+    this.allowedDeviceDiscovery = null;
+  }
+
+  onSessionChanged() {
+    this.invalidateDiscovery();
   }
 
   async getDevices() {
+    const discovery = this._beginDiscovery();
     try {
       const hierarchy = projectDeviceHierarchy({
         devices: await this.altaClient.getDevices(), sites: [], groups: [],
       });
-      this._setAllowedDevices(hierarchy.devices);
+      if (!this._isCurrentDiscovery(discovery)) return this._staleDiscoveryResult();
+      this._setAllowedDevices(hierarchy.devices, discovery);
       return { success: true, devices: hierarchy.devices };
     } catch (error) {
       return { success: false, devices: [], message: safeErrorMessage(error, 'Failed to get devices') };
@@ -268,6 +309,7 @@ class AppRuntime {
   }
 
   async getDeviceHierarchy() {
+    const discoveryState = this._beginDiscovery();
     let timer;
     try {
       const discovery = Promise.allSettled([
@@ -298,9 +340,11 @@ class AppRuntime {
         groups: groupResult.status === 'fulfilled' ? groupResult.value : [],
         metadataErrors,
       });
-      this._setAllowedDevices(hierarchy.devices);
+      if (!this._isCurrentDiscovery(discoveryState)) return this._staleDiscoveryResult();
+      this._setAllowedDevices(hierarchy.devices, discoveryState);
       return { success: true, hierarchy };
     } catch (error) {
+      if (!this._isCurrentDiscovery(discoveryState)) return this._staleDiscoveryResult();
       this.allowedDeviceIds.clear();
       const message = error && error.code === 'DISCOVERY_TIMEOUT'
         ? 'Alta device discovery timed out'
@@ -324,7 +368,8 @@ class AppRuntime {
       const validatedId = validateDeviceId(deviceId);
       const validatedUsername = validateUsername(username);
       this._reconcileProxies();
-      if (!this.allowedDeviceIds.has(validatedId)) {
+      if (!this.allowedDeviceDiscovery || !this._isCurrentDiscovery(this.allowedDeviceDiscovery) ||
+          !this.allowedDeviceIds.has(validatedId)) {
         return { success: false, message: 'Select a device from the current Alta device list.' };
       }
       if (this.proxyByDevice.has(validatedId)) {
@@ -364,6 +409,7 @@ class AppRuntime {
   }
 
   async disconnect() {
+    this.invalidateDiscovery();
     const tracked = this._reconcileProxies();
     await Promise.all(tracked.map(async (proxy) => {
       try {
diff --git a/test/device-projection.test.js b/test/device-projection.test.js
index 78722a9..3fa29c5 100644
--- a/test/device-projection.test.js
+++ b/test/device-projection.test.js
@@ -72,6 +72,32 @@ test('malformed hierarchy metadata does not hide valid cameras', () => {
   assert.equal(payload.diagnostics.sites.error, 'Unavailable');
 });
 
+test('repairs lone UTF-16 surrogates without changing valid Unicode or hiding cameras', () => {
+  const payload = projectDeviceHierarchy({
+    devices: [rawDevice(8, {
+      name: 'Front \ud800 camera',
+      model: 'Model \udc00',
+      address: 'Hall \ud800\udc00 / \udc00',
+      server_group_id: 'site-\ud800',
+      device_group_id: 'group-\udc00',
+    })],
+    sites: [{ id: 'site-\ud800', name: 'Valid \ud83d\udcf7 \udc00', pending_deletion_start: '\ud800' }],
+    groups: [{ id: 'group-\udc00', name: 'Group \ud83d\udcf7 \ud800', parent_id: 'site-\ud800' }],
+    metadataErrors: { sites: 'warning \ud800', groups: 'warning \udc00' },
+  });
+
+  assert.equal(payload.devices.length, 1);
+  assert.equal(payload.devices[0].name, 'Front \ufffd camera');
+  assert.equal(payload.devices[0].model, 'Model \ufffd');
+  assert.equal(payload.devices[0].address, 'Hall \ud800\udc00 / \ufffd');
+  assert.equal(payload.devices[0].siteId, 'site-\ufffd');
+  assert.equal(payload.devices[0].deviceGroupId, 'group-\ufffd');
+  assert.deepEqual(payload.sites, [{ id: 'site-\ufffd', name: 'Valid \ud83d\udcf7 \ufffd', pendingDeletionStart: '\ufffd' }]);
+  assert.deepEqual(payload.groups, [{ id: 'group-\ufffd', name: 'Group \ud83d\udcf7 \ufffd', parentId: 'site-\ufffd', pendingDeletionStart: null }]);
+  assert.equal(payload.diagnostics.sites.error, 'warning \ufffd');
+  assert.doesNotMatch(JSON.stringify(payload), /[\ud800-\udfff]/u);
+});
+
 test('rejects a projected hierarchy payload above 8 MiB', () => {
   const devices = Array.from({ length: 10_000 }, (_, index) => rawDevice(index, {
     name: `Camera ${index} ${'x'.repeat(900)}`,
diff --git a/test/device-tree.test.js b/test/device-tree.test.js
index 39b950e..0920080 100644
--- a/test/device-tree.test.js
+++ b/test/device-tree.test.js
@@ -194,6 +194,33 @@ test('tenant and synthetic namespaces stay distinct for reserved and ambiguous I
   assert.ok([...model.rowByKey.keys()].every((key) => !/\s/.test(key)));
 });
 
+test('malformed Unicode metadata builds deterministically and remains searchable and visible', async () => {
+  const fixture = {
+    sites: [{ id: 'site-\ud800', name: 'Site \ud83d\udcf7 \udc00' }],
+    groups: [{ id: 'group-\udc00', name: 'Group \ud83d\udcf7 \ud800', parentId: 'site-\ud800' }],
+    devices: [{
+      id: 'camera-valid', name: 'Lobby \ud800 camera', siteId: 'site-\ud800',
+      deviceGroupId: 'group-\udc00', address: 'Floor \udc00',
+    }],
+  };
+
+  const first = buildDeviceTree(fixture);
+  const second = buildDeviceTree(fixture);
+  assert.equal(first.cameraCount, 1);
+  assert.deepEqual([...first.rowByKey.keys()], [...second.rowByKey.keys()]);
+  assert.doesNotMatch([...first.rowByKey.keys()].join(''), /[\ud800-\udfff]/u);
+  const camera = [...first.cameraByKey.values()][0];
+  assert.equal(camera.name, 'Lobby \ufffd camera');
+  assert.equal(camera.site.name, 'Site \ud83d\udcf7 \ufffd');
+  assert.equal(camera.group.name, 'Group \ud83d\udcf7 \ufffd');
+  assert.equal(camera.source.address, 'Floor \ufffd');
+  assert.doesNotMatch(JSON.stringify(camera.source), /[\ud800-\udfff]/u);
+  assert.match(camera.searchCorpus, /floor \ufffd/);
+
+  const result = await createSearchRunner().search(first, 'lobby \ufffd');
+  assert.deepEqual([...result.cameraKeys], [camera.key]);
+});
+
 test('virtual window clamps an obsolete scroll offset after rows shrink', () => {
   const rows = [{ key: 'only-row' }];
   const window = calculateVirtualWindow(rows, {
diff --git a/test/runtime-contract.test.js b/test/runtime-contract.test.js
index f2f3036..58664c6 100644
--- a/test/runtime-contract.test.js
+++ b/test/runtime-contract.test.js
@@ -162,6 +162,96 @@ test('runtime enforces a bounded whole-discovery deadline', async () => {
   });
 });
 
+test('newest hierarchy discovery owns the launch allowlist when completions arrive out of order', async () => {
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://customer.avasecurity.com', 'synthetic-cookie');
+  const deviceA = '550e8400-e29b-41d4-a716-44665544000a';
+  const deviceB = '550e8400-e29b-41d4-a716-44665544000b';
+  const pending = [];
+  const launches = [];
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: {
+      getDevices: () => new Promise((resolve) => pending.push(resolve)),
+      getDeviceSites: async () => [],
+      getDeviceGroups: async () => [],
+    },
+    proxyManager: {
+      launchProxy(request) {
+        launches.push(request.deviceId);
+        return { processId: 5000 + launches.length, deviceId: request.deviceId, status: 'running' };
+      },
+      listTrackedProxies: () => [],
+    },
+  });
+
+  const staleA = runtime.getDeviceHierarchy();
+  const freshB = runtime.getDeviceHierarchy();
+  pending[1]([{ guid: deviceB }]);
+  assert.equal((await freshB).success, true);
+  assert.equal((await runtime.launchProxy(deviceB, 'operator@example.com')).success, true);
+  pending[0]([{ guid: deviceA }]);
+  assert.deepEqual(await staleA, {
+    success: false,
+    stale: true,
+    hierarchy: { devices: [], sites: [], groups: [] },
+    message: 'Alta device discovery result is stale',
+  });
+  assert.equal((await runtime.launchProxy(deviceA, 'operator@example.com')).success, false);
+  assert.deepEqual(launches, [deviceB]);
+});
+
+test('disconnect and session changes invalidate pending discovery without repopulating the allowlist', async () => {
+  const deviceId = '550e8400-e29b-41d4-a716-44665544000c';
+  for (const invalidate of ['disconnect', 'session-change']) {
+    const sessionStore = createSessionStore();
+    sessionStore.establish('https://first.avasecurity.com', 'synthetic-cookie');
+    let resolveDevices;
+    const runtime = new AppRuntime({
+      sessionStore,
+      altaClient: {
+        getDevices: () => new Promise((resolve) => { resolveDevices = resolve; }),
+        getDeviceSites: async () => [],
+        getDeviceGroups: async () => [],
+      },
+      proxyManager: { listTrackedProxies: () => [] },
+    });
+    const discovery = runtime.getDeviceHierarchy();
+    if (invalidate === 'disconnect') {
+      assert.equal((await runtime.disconnect()).success, true);
+    } else {
+      sessionStore.establish('https://second.avasecurity.com', 'replacement-cookie');
+      runtime.onSessionChanged();
+    }
+    resolveDevices([{ guid: deviceId }]);
+    assert.equal((await discovery).stale, true, invalidate);
+    assert.equal(runtime.allowedDeviceIds.size, 0, invalidate);
+  }
+});
+
+test('launch allowlist remains bound to the session origin that produced it', async () => {
+  const deviceId = '550e8400-e29b-41d4-a716-44665544000d';
+  const sessionStore = createSessionStore();
+  sessionStore.establish('https://first.avasecurity.com', 'synthetic-cookie');
+  let launches = 0;
+  const runtime = new AppRuntime({
+    sessionStore,
+    altaClient: {
+      getDevices: async () => [{ guid: deviceId }],
+      getDeviceSites: async () => [],
+      getDeviceGroups: async () => [],
+    },
+    proxyManager: {
+      listTrackedProxies: () => [],
+      launchProxy() { launches += 1; },
+    },
+  });
+  assert.equal((await runtime.getDeviceHierarchy()).success, true);
+  sessionStore.establish('https://second.avasecurity.com', 'replacement-cookie');
+  assert.equal((await runtime.launchProxy(deviceId, 'operator@example.com')).success, false);
+  assert.equal(launches, 0);
+});
+
 test('runtime rejects discovery deadlines above 60 seconds', () => {
   assert.throws(() => new AppRuntime({ discoveryTimeoutMs: 60_001 }), /discovery timeout/i);
 });
@@ -439,6 +529,7 @@ test('preload and renderer expose only narrow, credential-free contracts', () =>
   assert.doesNotMatch(preload, /launchProxy:\s*\([^)]*(?:cookie|origin)/i);
   assert.doesNotMatch(renderer, /cookieValue|sessionData\.cookies|cookies\s*:/);
   assert.match(renderer, /state\.connected\s*&&\s*\(!wasConnected\s*\|\|\s*state\.origin\s*!==\s*previousOrigin\)/);
+  assert.match(read('main.js'), /onConnectionStateChanged:\s*\(\)\s*=>\s*\{\s*runtime\.onSessionChanged\(\)/);
   assert.doesNotMatch(html, /id="cookieKey"|updateProgress|Install Update/);
   assert.match(html, /id="altaUsername"/);
   assert.match(renderer, /openFixedReleasesPage/);
diff --git a/well-formed-string.js b/well-formed-string.js
new file mode 100644
index 0000000..3dfb60c
--- /dev/null
+++ b/well-formed-string.js
@@ -0,0 +1,42 @@
+'use strict';
+
+(function exposeWellFormedString(root, factory) {
+  const api = factory();
+  if (typeof module !== 'undefined' && module.exports) module.exports = api;
+  if (root) root.AptWellFormedString = api;
+}(typeof window !== 'undefined' ? window : undefined, function wellFormedStringFactory() {
+  function manualToWellFormed(value) {
+    let result = '';
+    for (let index = 0; index < value.length; index += 1) {
+      const codeUnit = value.charCodeAt(index);
+      if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
+        const next = value.charCodeAt(index + 1);
+        if (next >= 0xdc00 && next <= 0xdfff) {
+          result += value[index] + value[index + 1];
+          index += 1;
+        } else {
+          result += '\ufffd';
+        }
+      } else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
+        result += '\ufffd';
+      } else {
+        result += value[index];
+      }
+    }
+    return result;
+  }
+
+  function toWellFormedString(value, fallback = '') {
+    let string;
+    try {
+      string = String(value);
+    } catch {
+      string = String(fallback);
+    }
+    return typeof string.toWellFormed === 'function'
+      ? string.toWellFormed()
+      : manualToWellFormed(string);
+  }
+
+  return Object.freeze({ toWellFormedString });
+}));

From 43892865c3571601a561ef38a533d29dd1008791 Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Thu, 20 Aug 2026 01:54:21 +0000
Subject: [PATCH 20/22] fix: allow manual virtual tree scrolling

---
 sidebar-controller.js           | 12 ++++++-----
 test/sidebar-controller.test.js | 37 +++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 5 deletions(-)

diff --git a/sidebar-controller.js b/sidebar-controller.js
index ec802e0..4e55061 100644
--- a/sidebar-controller.js
+++ b/sidebar-controller.js
@@ -155,7 +155,7 @@
       return state.searchQuery && state.searchExpandedKeys ? state.searchExpandedKeys : state.expandedKeys;
     }
 
-    function commit() {
+    function commit(options = {}) {
       const rows = treeApi.flattenVisibleRows(model, {
         expandedKeys: effectiveExpandedKeys(),
         selectedKey: state.selectedKey,
@@ -163,10 +163,11 @@
       });
       const activeIndex = rows.findIndex((row) => row.key === state.activeKey);
       const maximumScrollTop = Math.max(0, (rows.length * rowHeight) - state.viewportHeight);
-      if (state.scrollTop > maximumScrollTop) {
-        state = Object.assign({}, state, { scrollTop: maximumScrollTop });
+      const clampedScrollTop = Math.max(0, Math.min(state.scrollTop, maximumScrollTop));
+      if (clampedScrollTop !== state.scrollTop) {
+        state = Object.assign({}, state, { scrollTop: clampedScrollTop });
       }
-      if (activeIndex >= 0 && state.viewportHeight > 0) {
+      if (options.ensureActive === true && activeIndex >= 0 && state.viewportHeight > 0) {
         const activeTop = activeIndex * rowHeight;
         const activeBottom = activeTop + rowHeight;
         let scrollTop = state.scrollTop;
@@ -192,7 +193,8 @@
       const next = reduceSidebar(state, safeAction, visibleRows);
       if (next === state) return lastSnapshot;
       state = next;
-      return commit();
+      const ensureActive = safeAction.type === 'KEY' || safeAction.type === 'SET_ACTIVE';
+      return commit({ ensureActive });
     }
 
     async function search(query) {
diff --git a/test/sidebar-controller.test.js b/test/sidebar-controller.test.js
index f60c88c..d558e74 100644
--- a/test/sidebar-controller.test.js
+++ b/test/sidebar-controller.test.js
@@ -140,6 +140,43 @@ test('first arrow press chooses the directional edge when no row is active', ()
   assert.equal(reduceSidebar(createInitialState(), { type: 'KEY', key: 'ArrowUp' }, rows).activeKey, rows.at(-1).key);
 });
 
+test('manual viewport scrolling may virtualize selection until keyboard navigation restores the active row', () => {
+  const model = buildDeviceTree({
+    sites: [{ id: 'large', name: 'Large' }],
+    groups: [],
+    devices: Array.from({ length: 1500 }, (_, index) => ({
+      id: `c${String(index).padStart(4, '0')}`,
+      name: `Camera ${String(index).padStart(4, '0')}`,
+      siteId: 'large',
+    })),
+  });
+  const site = model.sites[0];
+  const group = site.groups[0];
+  const firstCamera = group.cameras[0];
+  const controller = createSidebarController({
+    model,
+    view: { commit() {} },
+    rowHeight: 20,
+    overscan: 0,
+    initialState: { expandedKeys: new Set([site.key, group.key]), viewportHeight: 100 },
+  });
+
+  controller.dispatch({ type: 'SET_SELECTION', rowKey: firstCamera.key });
+  controller.dispatch({ type: 'SET_VIEWPORT', scrollTop: 30000, viewportHeight: 100 });
+  let snapshot = controller.getSnapshot();
+  assert.equal(snapshot.state.selectedKey, firstCamera.key);
+  assert.equal(snapshot.state.activeKey, firstCamera.key);
+  assert.equal(snapshot.state.scrollTop, 29940);
+  assert.equal(snapshot.window.rows.some((row) => row.key === firstCamera.key), false);
+  assert.equal(snapshot.rows.hiddenSelected, false);
+
+  controller.dispatch({ type: 'KEY', key: 'Home' });
+  snapshot = controller.getSnapshot();
+  assert.equal(snapshot.state.activeKey, site.key);
+  assert.equal(snapshot.state.scrollTop, 0);
+  assert.equal(snapshot.window.rows.some((row) => row.key === site.key), true);
+});
+
 test('collapse clamps stale scroll and keyboard navigation scrolls active rows into the virtual window', () => {
   const model = buildDeviceTree({
     sites: [{ id: 'large', name: 'Large' }],

From c08d2ad38151e70b1a552e1dd004ec101cd8ad9c Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Thu, 20 Aug 2026 02:07:38 +0000
Subject: [PATCH 21/22] chore: version APT hierarchy test build 1.2.0

---
 chrome-extension/manifest.json | 2 +-
 package-lock.json              | 4 ++--
 package.json                   | 2 +-
 test/build-contract.test.js    | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/chrome-extension/manifest.json b/chrome-extension/manifest.json
index fe64b1f..522b3e1 100644
--- a/chrome-extension/manifest.json
+++ b/chrome-extension/manifest.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Alta Proxy Tool Bridge",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Send Alta session cookies to a paired Alta Proxy Tool desktop app.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt4EZdkSgOsyiy5DRe0JkX+BpK94FpMjBU59NVIqDPO8QBDwvqNDWT/UjqHK/0aqSxzed5KibX6MdAvc495+u1sCybFdjDdXyBewEvg+PDqGiJketlZKC9dcR1RXHuPgAoM3NaNbMb3TqYcS9J4iGq0UwadxubkQrEcPiuyR6oriOkop8q9/5DWGb15wOGmiCuVmlXfUjNJIvNBm9P/ZHtgFBYDI2PuSSI5GI4j04VFpEyfNlFCrpi8GQ7bYZzezigZWXRjhhNwkx39bNHlkAWYa8XGZseCpKKvi0EaeCoBPjoYSAt161SM1dqX+/UC61/sLOU/SpDB1SYGTm5DC+7wIDAQAB",
   "permissions": ["cookies", "activeTab", "clipboardWrite", "storage"],
diff --git a/package-lock.json b/package-lock.json
index d199b5c..6d12c56 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "alta-api-client",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "alta-api-client",
-      "version": "1.1.0",
+      "version": "1.2.0",
       "license": "MIT",
       "dependencies": {
         "axios": "1.19.0"
diff --git a/package.json b/package.json
index 00a80c8..88b45bc 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "alta-api-client",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Secure Windows Electron client for the Alta Camera Proxy",
   "main": "main.js",
   "scripts": {
diff --git a/test/build-contract.test.js b/test/build-contract.test.js
index f40c6e1..0b25f65 100644
--- a/test/build-contract.test.js
+++ b/test/build-contract.test.js
@@ -11,7 +11,7 @@ const ROOT = path.join(__dirname, '..');
 const read = (name) => fs.readFileSync(path.join(ROOT, name), 'utf8');
 const readJson = (name) => JSON.parse(read(name));
 
-function writeKit(root, { version = '1.1.0', legacy = false } = {}) {
+function writeKit(root, { version = '1.2.0', legacy = false } = {}) {
   const extension = path.join(root, 'chrome-extension');
   fs.mkdirSync(extension, { recursive: true });
   fs.writeFileSync(path.join(root, 'AltaCameraProxy.exe'), 'synthetic executable');
@@ -31,7 +31,7 @@ test('application and extension versions and supported dependencies stay coordin
   const lock = readJson('package-lock.json');
   const manifest = readJson('chrome-extension/manifest.json');
 
-  assert.equal(pkg.version, '1.1.0');
+  assert.equal(pkg.version, '1.2.0');
   assert.equal(manifest.version, pkg.version);
   assert.equal(lock.version, pkg.version);
   assert.equal(lock.packages[''].version, pkg.version);

From ace4568f819509e7b79643e7fa7e91ac5c7c0799 Mon Sep 17 00:00:00 2001
From: PageZ948 <zpage948@gmail.com>
Date: Sat, 22 Aug 2026 16:20:12 +0000
Subject: [PATCH 22/22] feat: release passwordless hierarchical APT v1.2.5

---
 CLAUDE.md                                     |  2 +-
 README.md                                     |  5 +-
 chrome-extension/manifest.json                |  2 +-
 chrome-extension/options.css                  |  6 --
 chrome-extension/options.html                 |  4 +-
 chrome-extension/popup.css                    |  8 ---
 chrome-extension/popup.html                   |  1 -
 chrome-extension/popup.js                     |  8 +--
 .../2026-08-19-apt-security-foundation.md     |  2 +-
 docs/security/2026-08-security-baseline.md    |  4 ++
 index.html                                    | 10 ++--
 main.js                                       |  2 +-
 package-lock.json                             |  4 +-
 package.json                                  |  2 +-
 preload.js                                    |  2 +-
 renderer-controller.js                        | 11 +++-
 renderer.js                                   | 51 +++++++++++++---
 src/device-projection.js                      | 11 +++-
 src/electron-runtime.js                       |  9 ++-
 src/proxy-launch.js                           | 31 +++++-----
 test/build-contract.test.js                   |  4 +-
 test/device-projection.test.js                | 58 +++++++++++++++++--
 test/extension-contract.test.js               | 12 ++--
 test/proxy-launch.test.js                     | 44 +++++++-------
 test/renderer-controller.test.js              | 10 +++-
 test/renderer-hierarchy.test.js               |  1 +
 test/runtime-contract.test.js                 | 50 +++++-----------
 27 files changed, 209 insertions(+), 145 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 0444294..c1abb0a 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -27,7 +27,7 @@ npm run build
 - IPC methods are narrow and sender-validated against the main local file frame.
 - Bridge is exactly `127.0.0.1:18247`, exact committed extension origin, and `X-APT-Pairing` authenticated.
 - Persist only the pairing hash envelope under Electron `userData`; plaintext is shown once after first run/rotation.
-- Proxy helper launches directly with `shell: false`; stop only app-owned child processes.
+- Proxy helper launches directly with `shell: false`; passwordless launch uses the main-owned paired session only through the helper's required `-k` argument. Never expose that cookie to renderer IPC, UI, logs, files, shell commands, or tracked process metadata; stop only app-owned child processes.
 - Update behavior is check-only against the exact GitPeji API. The only follow-up action opens the fixed GitPeji releases page externally.
 - Never add download/install/replace logic, arbitrary URLs, redirect following, shell scripts, broad process killing, hardcoded bridge secrets, or credential-bearing renderer state.
 - Synthetic tests only: never use a real tenant or Alta session.
diff --git a/README.md b/README.md
index 48a4dc6..805924c 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ APT is a Windows Electron desktop app that imports an existing Alta Video sessio
 - The renderer receives only connection origin/state, device/site/auth responses, and owned proxy metadata. It never receives or supplies the Alta session value.
 - The bridge listens only on `127.0.0.1:18247`, accepts only the committed extension origin, requires the `X-APT-Pairing` secret, limits concurrent/body/deadline work, and validates an exact canonical Alta HTTPS origin.
 - The pairing envelope is a scrypt hash stored atomically under Electron `userData` with restrictive permissions. The plaintext secret is shown once on first run or rotation. Revoke invalidates it.
-- Proxy launch is a direct, detached `spawn` of the fixed helper with `shell: false`. Its exact arguments are deployment host, non-secret Alta username/email, and selected device UUID; no session bearer, password, or 2FA value reaches the command line. Stop actions can target only children owned by this app.
+- Proxy launch is a direct, detached `spawn` of the fixed helper with `shell: false`. APT passes the main-process-only paired Alta session through the helper's supported `-k` cookie mode so users are not prompted for Alta credentials again. The cookie never crosses renderer IPC, enters a shell, or reaches logs, files, tracked process metadata, or UI state; it is necessarily present in the helper process arguments because the external helper exposes no pipe/stdin credential interface. Stop actions can target only children owned by this app.
 - Updates are **check-only**. APT checks the exact GitPeji release API and can open only `https://git.pejicorp.com/peji/Alta-Proxy-Tool/releases` in the system browser. It never downloads, replaces, or executes an update.
 
 ## Requirements
@@ -30,8 +30,7 @@ npm start
 2. Start APT. Under **Bridge Pairing**, copy the one-time secret.
 3. Open the extension pairing settings, paste the secret, and save it.
 4. Visit your Alta deployment in Chrome and use **Send to APT**.
-5. Select a local camera, enter your Alta username/email, and choose **Start Proxy**.
-6. Complete the password and 2FA prompts in the helper's visible Windows console. APT does not collect or pass those secrets.
+5. Select a local camera and choose **Start Proxy**. APT reuses the paired Chrome session; no Alta username, password, or 2FA prompt is required.
 
 Use **Generate / Rotate** if a pairing may have been exposed, then update the extension. Use **Revoke** to immediately disable bridge authentication.
 
diff --git a/chrome-extension/manifest.json b/chrome-extension/manifest.json
index 522b3e1..b1f7f52 100644
--- a/chrome-extension/manifest.json
+++ b/chrome-extension/manifest.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "Alta Proxy Tool Bridge",
-  "version": "1.2.0",
+  "version": "1.2.5",
   "description": "Send Alta session cookies to a paired Alta Proxy Tool desktop app.",
   "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt4EZdkSgOsyiy5DRe0JkX+BpK94FpMjBU59NVIqDPO8QBDwvqNDWT/UjqHK/0aqSxzed5KibX6MdAvc495+u1sCybFdjDdXyBewEvg+PDqGiJketlZKC9dcR1RXHuPgAoM3NaNbMb3TqYcS9J4iGq0UwadxubkQrEcPiuyR6oriOkop8q9/5DWGb15wOGmiCuVmlXfUjNJIvNBm9P/ZHtgFBYDI2PuSSI5GI4j04VFpEyfNlFCrpi8GQ7bYZzezigZWXRjhhNwkx39bNHlkAWYa8XGZseCpKKvi0EaeCoBPjoYSAt161SM1dqX+/UC61/sLOU/SpDB1SYGTm5DC+7wIDAQAB",
   "permissions": ["cookies", "activeTab", "clipboardWrite", "storage"],
diff --git a/chrome-extension/options.css b/chrome-extension/options.css
index 51251b2..d659ef4 100644
--- a/chrome-extension/options.css
+++ b/chrome-extension/options.css
@@ -75,9 +75,3 @@ button:disabled { cursor: not-allowed; opacity: 0.45; }
   padding-top: 14px;
   border-top: 1px solid #3c3c3c;
 }
-
-.privacy-note {
-  margin-top: 24px;
-  color: #aaa;
-  font-size: 12px;
-}
diff --git a/chrome-extension/options.html b/chrome-extension/options.html
index 0879681..c3a5c29 100644
--- a/chrome-extension/options.html
+++ b/chrome-extension/options.html
@@ -10,7 +10,7 @@
 <body>
   <main class="options-card">
     <h1>Pair with Alta Proxy Tool</h1>
-    <p>In the desktop app, create a one-time pairing secret. Paste it below on this computer. Treat it like a password.</p>
+    <p>Create a one-time pairing secret in APT, then paste it below.</p>
     <form id="pairingForm">
       <label for="pairingSecret">One-time pairing secret</label>
       <input id="pairingSecret" name="pairingSecret" type="password" inputmode="text" autocomplete="off" spellcheck="false" required>
@@ -22,7 +22,7 @@
       <p id="currentState">Checking...</p>
       <button id="forgetBtn" type="button" class="danger-btn" disabled>Forget pairing</button>
     </section>
-    <p class="privacy-note">The secret is stored only in Chrome extension local storage. It is never displayed again or copied automatically.</p>
+
   </main>
   <script src="options.js"></script>
 </body>
diff --git a/chrome-extension/popup.css b/chrome-extension/popup.css
index 6f4387b..3bc2b57 100644
--- a/chrome-extension/popup.css
+++ b/chrome-extension/popup.css
@@ -88,14 +88,6 @@ h1 {
   opacity: 0.45;
 }
 
-.copy-warning {
-  margin: 10px 0 0;
-  padding: 8px 10px;
-  border-left: 3px solid #f0a33a;
-  background: rgba(240, 163, 58, 0.08);
-  color: #d7c29f;
-  font-size: 12px;
-}
 
 .status-msg {
   display: none;
diff --git a/chrome-extension/popup.html b/chrome-extension/popup.html
index a859867..25214ac 100644
--- a/chrome-extension/popup.html
+++ b/chrome-extension/popup.html
@@ -17,7 +17,6 @@
       <button id="sendBtn" class="primary-btn" type="button" disabled>Send to APT</button>
       <button id="copyBtn" class="secondary-btn" type="button" disabled>Copy VA Token</button>
     </div>
-    <p id="copyWarning" class="copy-warning">Copying exposes the full bearer token. Clipboard history or sync may retain it. A confirmation is required.</p>
     <div id="statusMsg" class="status-msg" role="status" aria-live="polite"></div>
   </main>
   <script src="popup.js"></script>
diff --git a/chrome-extension/popup.js b/chrome-extension/popup.js
index 9af6a92..fb91d9b 100644
--- a/chrome-extension/popup.js
+++ b/chrome-extension/popup.js
@@ -45,7 +45,6 @@ function createPopupController({
   const pairingInfo = documentApi.getElementById('pairingInfo');
   const sendBtn = documentApi.getElementById('sendBtn');
   const copyBtn = documentApi.getElementById('copyBtn');
-  const copyWarning = documentApi.getElementById('copyWarning');
   const statusMsg = documentApi.getElementById('statusMsg');
   const openOptionsBtn = documentApi.getElementById('openOptionsBtn');
 
@@ -159,9 +158,7 @@ function createPopupController({
 
   async function copyToken() {
     if (!detectedOrigin || !pairingSecret || busy) return;
-    const confirmed = confirmCopy(
-      'Copy the full VA bearer token? Clipboard history or sync may retain it. Continue only if you will paste it into a trusted destination.'
-    );
+    const confirmed = confirmCopy('Copy VA token?');
     if (!confirmed) {
       showStatus('Copy cancelled. The VA token was not read.', 'info');
       return;
@@ -172,7 +169,7 @@ function createPopupController({
     try {
       cookieValue = await getVaCookieValue();
       await navigatorApi.clipboard.writeText(cookieValue);
-      showStatus('VA token copied. Clear your clipboard after use.', 'success');
+      showStatus('VA token copied.', 'success');
     } catch (error) {
       showCookieError(error, true);
     } finally {
@@ -182,7 +179,6 @@ function createPopupController({
   }
 
   async function init() {
-    copyWarning.textContent = 'Copying exposes the full bearer token. Clipboard history or sync may retain it. A confirmation is required.';
     sendBtn.addEventListener('click', sendToApt);
     copyBtn.addEventListener('click', copyToken);
     openOptionsBtn.addEventListener('click', () => chromeApi.runtime.openOptionsPage());
diff --git a/docs/plans/2026-08-19-apt-security-foundation.md b/docs/plans/2026-08-19-apt-security-foundation.md
index dba08e9..4b5f61b 100644
--- a/docs/plans/2026-08-19-apt-security-foundation.md
+++ b/docs/plans/2026-08-19-apt-security-foundation.md
@@ -40,7 +40,7 @@ Feature discovery begins only after Phase A passes independent security review a
 - Use a fresh worktree from GitPeji `master` at `a80074ac57b7a4517837b5d95754f5e6433df3ac` or newer.
 - Preserve current Tool Hub downloads and production visibility until Zac approves replacement.
 - Do not use real Alta cookies in automated tests; use conspicuous synthetic sentinels.
-- Do not write cookies to logs, disk, command files, shell strings, crash reports, analytics, or test artifacts.
+- Do not write cookies to logs, disk, command files, shell strings, crash reports, analytics, or test artifacts. The sole accepted exception is the fixed helper's required `-k` argv value for Zac's explicitly required paired-extension passwordless proxy flow; keep it main-process-only, direct-spawned with `shell: false`, redacted from errors, and absent from renderer IPC and tracked metadata.
 - No production release until the exact candidate passes controller verification plus independent security and release reviews.
 - Mac distribution remains approval-gated under Kanban task `t_42bad4d3`.
 
diff --git a/docs/security/2026-08-security-baseline.md b/docs/security/2026-08-security-baseline.md
index df20ddb..5a5defb 100644
--- a/docs/security/2026-08-security-baseline.md
+++ b/docs/security/2026-08-security-baseline.md
@@ -16,3 +16,7 @@
 - Synthetic sentinel credentials only in tests.
 - Work remains on the isolated hardening branch until review gates pass.
 - No feature additions until Critical/Important security closure.
+
+## Accepted passwordless proxy exception
+
+Zac explicitly requires the paired-extension **Connect → select camera → Start Proxy** flow without re-entering Alta credentials. The external `aware-cam-proxy.exe` helper supports cookie authentication only through `-k`; it exposes no stdin, named-pipe, environment-variable, or credential-file interface. APT therefore passes the validated main-owned session directly to the fixed helper as one argv value. This exception remains bounded by direct `shell: false` spawn, trusted-device allowlisting, no renderer/IPC credential parameter, no logs/files/shells, redacted launch errors, safe tracked metadata, and synthetic regression tests.
diff --git a/index.html b/index.html
index e8b21cb..465aadb 100644
--- a/index.html
+++ b/index.html
@@ -51,11 +51,12 @@
                     </div>
                     <div class="connection-controls">
                         <button type="button" id="disconnectBtn" class="btn-outline" disabled>Disconnect</button>
+                        <button type="button" id="managePairingBtn" class="btn-outline" hidden>Manage Pairing</button>
                     </div>
                     <div id="connectionStatus" class="status-message"></div>
                 </section>
 
-                <section class="content-section pairing-section">
+                <section id="pairingSection" class="content-section pairing-section" hidden>
                     <h2>Bridge Pairing</h2>
                     <p class="section-help">Only the committed APT Chrome extension can send a session. Pair it with a one-time secret.</p>
                     <div class="status-row">
@@ -70,6 +71,7 @@
                     <div class="proxy-buttons">
                         <button type="button" id="rotatePairingBtn" class="btn-primary">Generate / Rotate</button>
                         <button type="button" id="revokePairingBtn" class="btn-outline">Revoke</button>
+                        <button type="button" id="hidePairingBtn" class="btn-outline" hidden>Done</button>
                     </div>
                 </section>
 
@@ -80,11 +82,7 @@
                             <label for="selectedDeviceId">Device UUID:</label>
                             <input type="text" id="selectedDeviceId" placeholder="Select a device from the list" readonly>
                         </div>
-                        <div class="input-row">
-                            <label for="altaUsername">Alta username / email:</label>
-                            <input type="text" id="altaUsername" maxlength="254" placeholder="name@example.com" autocomplete="username" spellcheck="false">
-                        </div>
-                        <p class="section-help">The proxy helper opens a Windows console and prompts for your password and 2FA. APT never sends those secrets on its command line.</p>
+                        <p class="section-help">APT uses the paired Chrome extension session. Select a camera, then start the proxy—no Alta credentials need to be entered again.</p>
                         <div class="proxy-buttons">
                             <button type="button" id="startProxyBtn" class="btn-primary" disabled>Start Proxy</button>
                             <button type="button" id="stopProxyBtn" class="btn-outline" disabled>Stop Proxy</button>
diff --git a/main.js b/main.js
index c12e1f8..15203f7 100644
--- a/main.js
+++ b/main.js
@@ -81,7 +81,7 @@ function registerIpcHandlers() {
   registerIpc('get-device-groups', () => runtime.getDeviceGroups());
   registerIpc('get-device-hierarchy', () => runtime.getDeviceHierarchy());
   registerIpc('get-auth-info', () => runtime.getAuthInfo());
-  registerIpc('launch-proxy', (deviceId, username) => runtime.launchProxy(deviceId, username));
+  registerIpc('launch-proxy', (deviceId) => runtime.launchProxy(deviceId));
   registerIpc('stop-proxy', async (key) => {
     const result = await runtime.stopProxy(key);
     sendConnectionState();
diff --git a/package-lock.json b/package-lock.json
index 6d12c56..715defb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "alta-api-client",
-  "version": "1.2.0",
+  "version": "1.2.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "alta-api-client",
-      "version": "1.2.0",
+      "version": "1.2.5",
       "license": "MIT",
       "dependencies": {
         "axios": "1.19.0"
diff --git a/package.json b/package.json
index 88b45bc..cec0eeb 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "alta-api-client",
-  "version": "1.2.0",
+  "version": "1.2.5",
   "description": "Secure Windows Electron client for the Alta Camera Proxy",
   "main": "main.js",
   "scripts": {
diff --git a/preload.js b/preload.js
index bd60372..1d1b77c 100644
--- a/preload.js
+++ b/preload.js
@@ -15,7 +15,7 @@ contextBridge.exposeInMainWorld('electronAPI', Object.freeze({
   getDeviceGroups: () => ipcRenderer.invoke('get-device-groups'),
   getDeviceHierarchy: () => ipcRenderer.invoke('get-device-hierarchy'),
   getAuthInfo: () => ipcRenderer.invoke('get-auth-info'),
-  launchProxy: (deviceId, username) => ipcRenderer.invoke('launch-proxy', deviceId, username),
+  launchProxy: (deviceId) => ipcRenderer.invoke('launch-proxy', deviceId),
   stopProxy: (key) => ipcRenderer.invoke('stop-proxy', key),
   disconnect: () => ipcRenderer.invoke('disconnect'),
   getConnectionState: () => ipcRenderer.invoke('get-connection-state'),
diff --git a/renderer-controller.js b/renderer-controller.js
index 84fded4..942c602 100644
--- a/renderer-controller.js
+++ b/renderer-controller.js
@@ -1,6 +1,15 @@
 'use strict';
 
 (function exposeRendererController(globalScope) {
+  function shouldShowPairingOnboarding({
+    paired = false,
+    secretVisible = false,
+    connected = false,
+    manuallyOpen = false,
+  } = {}) {
+    return manuallyOpen || !paired || (secretVisible && !connected);
+  }
+
   function createRendererController({
     disconnect,
     renderConnectionState,
@@ -35,7 +44,7 @@
     });
   }
 
-  const api = Object.freeze({ createRendererController });
+  const api = Object.freeze({ createRendererController, shouldShowPairingOnboarding });
   if (typeof module !== 'undefined' && module.exports) module.exports = api;
   if (globalScope) globalScope.AptRendererController = api;
 }(typeof window !== 'undefined' ? window : undefined));
diff --git a/renderer.js b/renderer.js
index 70bd3f8..e0ea6b2 100644
--- a/renderer.js
+++ b/renderer.js
@@ -10,7 +10,6 @@ const statusIndicator = document.getElementById('statusIndicator');
 const deviceSearch = document.getElementById('deviceSearch');
 const disconnectBtn = document.getElementById('disconnectBtn');
 const selectedDeviceId = document.getElementById('selectedDeviceId');
-const altaUsername = document.getElementById('altaUsername');
 const startProxyBtn = document.getElementById('startProxyBtn');
 const stopProxyBtn = document.getElementById('stopProxyBtn');
 const checkUpdateBtn = document.getElementById('checkUpdateBtn');
@@ -18,11 +17,14 @@ const updateNotice = document.getElementById('updateNotice');
 const updateMessage = document.getElementById('updateMessage');
 const openReleasesBtn = document.getElementById('openReleasesBtn');
 const dismissUpdateBtn = document.getElementById('dismissUpdateBtn');
+const pairingSection = document.getElementById('pairingSection');
+const managePairingBtn = document.getElementById('managePairingBtn');
 const pairingState = document.getElementById('pairingState');
 const pairingSecret = document.getElementById('pairingSecret');
 const pairingSecretRow = document.getElementById('pairingSecretRow');
 const rotatePairingBtn = document.getElementById('rotatePairingBtn');
 const revokePairingBtn = document.getElementById('revokePairingBtn');
+const hidePairingBtn = document.getElementById('hidePairingBtn');
 
 const ROW_HEIGHT = window.AptSidebarView.ROW_HEIGHT;
 let connection = { connected: false, origin: null, activeProxies: [] };
@@ -32,6 +34,17 @@ let sidebarController = null;
 let loadGeneration = 0;
 let searchTimer = null;
 let scrollFrame = null;
+let pairingView = { paired: false, secretVisible: false, manuallyOpen: false };
+
+function renderPairingVisibility() {
+  const visible = window.AptRendererController.shouldShowPairingOnboarding({
+    ...pairingView,
+    connected: connection.connected,
+  });
+  pairingSection.hidden = !visible;
+  managePairingBtn.hidden = visible || !pairingView.paired;
+  hidePairingBtn.hidden = !pairingView.paired;
+}
 
 function showStatus(element, message, type) {
   element.textContent = message;
@@ -51,8 +64,7 @@ function deviceStatusFor(device) {
 function updateProxyButtons() {
   const id = selectedDevice && selectedDevice.id;
   const active = id ? activeDeviceIds().has(id.toLowerCase()) : false;
-  const hasUsername = altaUsername.value.trim().length > 0;
-  startProxyBtn.disabled = !connection.connected || !id || !hasUsername || active;
+  startProxyBtn.disabled = !connection.connected || !id || active;
   stopProxyBtn.disabled = !id || !active;
 }
 
@@ -67,6 +79,13 @@ function renderConnectionState(state) {
   dot.className = `status-dot ${connection.connected ? 'online' : 'offline'}`;
   text.textContent = connection.connected ? 'Connected' : 'Disconnected';
   disconnectBtn.disabled = !connection.connected;
+  if (connection.connected) {
+    pairingView.secretVisible = false;
+    pairingView.manuallyOpen = false;
+    pairingSecret.value = '';
+    pairingSecretRow.style.display = 'none';
+  }
+  renderPairingVisibility();
   updateProxyButtons();
   if (sidebarController) sidebarController.refresh();
 }
@@ -145,10 +164,9 @@ function installHierarchy(hierarchy) {
       const count = snapshot.state.searchQuery && snapshot.state.searchCameraKeys
         ? snapshot.state.searchCameraKeys.size
         : hierarchyModel.cameraCount;
-      const hidden = snapshot.rows.hiddenSelected ? ' Selected camera is hidden by the current view.' : '';
       deviceResults.textContent = snapshot.state.searchQuery
-        ? `${count} exact search result${count === 1 ? '' : 's'}.${hidden}`
-        : `${count} camera${count === 1 ? '' : 's'}.${hidden}`;
+        ? `${count} exact search result${count === 1 ? '' : 's'}.`
+        : `${count} camera${count === 1 ? '' : 's'}.`;
     },
   });
   sidebarController = window.AptSidebarController.createSidebarController({
@@ -201,7 +219,6 @@ const rendererController = window.AptRendererController.createRendererController
   disconnect: () => window.electronAPI.disconnect(),
   renderConnectionState,
   clearDisconnectedState: () => {
-    altaUsername.value = '';
     clearHierarchy();
   },
   showConnectionStatus: (message, type) => showStatus(connectionStatus, message, type),
@@ -216,7 +233,7 @@ async function handleStartProxy() {
   if (!id) return;
   startProxyBtn.disabled = true;
   showStatus(connectionStatus, `Starting proxy for ${selectedDevice.name || 'selected device'}...`, 'info');
-  const result = await window.electronAPI.launchProxy(id, altaUsername.value);
+  const result = await window.electronAPI.launchProxy(id);
   if (result.success) {
     renderConnectionState(await window.electronAPI.getConnectionState());
     showStatus(connectionStatus, 'Camera proxy started.', 'success');
@@ -259,6 +276,11 @@ async function checkForUpdates(showCurrent = true) {
 }
 
 function renderPairingStatus(result) {
+  pairingView = {
+    paired: result.paired === true,
+    secretVisible: Boolean(result.secret),
+    manuallyOpen: Boolean(result.secret) || result.paired !== true,
+  };
   pairingState.textContent = result.paired ? 'Paired' : 'Revoked / not paired';
   pairingState.className = result.paired ? 'paired' : 'unpaired';
   revokePairingBtn.disabled = !result.paired;
@@ -270,6 +292,7 @@ function renderPairingStatus(result) {
     pairingSecret.value = '';
     pairingSecretRow.style.display = 'none';
   }
+  renderPairingVisibility();
 }
 
 async function runSearch(query) {
@@ -340,10 +363,20 @@ deviceSearch.addEventListener('keydown', (event) => {
 disconnectBtn.addEventListener('click', handleDisconnect);
 startProxyBtn.addEventListener('click', handleStartProxy);
 stopProxyBtn.addEventListener('click', handleStopProxy);
-altaUsername.addEventListener('input', updateProxyButtons);
 checkUpdateBtn.addEventListener('click', () => checkForUpdates(true));
 openReleasesBtn.addEventListener('click', () => window.electronAPI.openFixedReleasesPage());
 dismissUpdateBtn.addEventListener('click', () => { updateNotice.style.display = 'none'; });
 rotatePairingBtn.addEventListener('click', async () => renderPairingStatus(await window.electronAPI.rotatePairing()));
 revokePairingBtn.addEventListener('click', async () => renderPairingStatus(await window.electronAPI.revokePairing()));
+managePairingBtn.addEventListener('click', () => {
+  pairingView.manuallyOpen = true;
+  renderPairingVisibility();
+});
+hidePairingBtn.addEventListener('click', () => {
+  pairingView.manuallyOpen = false;
+  pairingView.secretVisible = false;
+  pairingSecret.value = '';
+  pairingSecretRow.style.display = 'none';
+  renderPairingVisibility();
+});
 document.addEventListener('DOMContentLoaded', () => { initialize().catch(() => showStatus(connectionStatus, 'Application initialization failed.', 'error')); });
diff --git a/src/device-projection.js b/src/device-projection.js
index 88285d5..e29e14e 100644
--- a/src/device-projection.js
+++ b/src/device-projection.js
@@ -37,7 +37,9 @@ function projectDevice(raw) {
     type: nullableString(raw.type),
     model: nullableString(raw.model),
     address: nullableString(raw.address),
-    siteId: nullableId(raw.server_group_id),
+    // server_group_id identifies the Alta server/cloud connector, not a device site.
+    // The tree infers the site through device_group_id -> deviceGroups.parent_id.
+    siteId: null,
     deviceGroupId: nullableId(raw.device_group_id),
     displayStatus: nullableString(raw.live && raw.live.display_status),
     localStorage: nullableBoolean(raw.capabilities && raw.capabilities.localStorage),
@@ -89,17 +91,20 @@ function projectDeviceHierarchy({ devices = [], sites = [], groups = [], metadat
     throw new TypeError('Hierarchy projection requires arrays');
   }
   const deviceProjection = projectArray(devices, projectDevice);
+  const eligibleDevices = deviceProjection.projected.filter((device) => device.localStorage !== true);
+  const cloudNativeExcluded = deviceProjection.projected.length - eligibleDevices.length;
   const siteProjection = projectArray(sites, projectSite);
   const groupProjection = projectArray(groups, projectGroup);
   const payload = {
-    devices: deviceProjection.projected,
+    devices: eligibleDevices,
     sites: siteProjection.projected,
     groups: groupProjection.projected,
     diagnostics: {
       devices: {
         received: devices.length,
-        eligible: deviceProjection.projected.length,
+        eligible: eligibleDevices.length,
         invalid: deviceProjection.invalid,
+        cloudNativeExcluded,
       },
       sites: {
         received: sites.length,
diff --git a/src/electron-runtime.js b/src/electron-runtime.js
index 832af90..d0cdc74 100644
--- a/src/electron-runtime.js
+++ b/src/electron-runtime.js
@@ -11,7 +11,7 @@ const {
 } = require('./bridge-auth');
 const { RELEASES_PAGE_URL } = require('./update-policy');
 const { projectDeviceHierarchy, projectGroup, projectSite } = require('./device-projection');
-const { validateDeviceId, validateUsername } = require('./proxy-launch');
+const { validateCookie, validateDeviceId } = require('./proxy-launch');
 
 const DEFAULT_DISCOVERY_TIMEOUT_MS = 60_000;
 
@@ -23,7 +23,7 @@ function safeErrorMessage(error, fallback) {
     'INVALID_ALTA_RESPONSE', 'INVALID_ALTA_RESPONSE_DATA', 'ALTA_RESPONSE_TOO_LARGE',
     'ALTA_RESPONSE_TOO_MANY_OBJECTS', 'PROJECTED_PAYLOAD_TOO_LARGE',
     'UNSAFE_ALTA_REDIRECT', 'TOO_MANY_ALTA_REDIRECTS', 'HELPER_NOT_FOUND',
-    'UNSUPPORTED_PLATFORM', 'INVALID_DEVICE_ID', 'INVALID_USERNAME', 'SPAWN_FAILED',
+    'UNSUPPORTED_PLATFORM', 'INVALID_DEVICE_ID', 'INVALID_SESSION_COOKIE', 'SPAWN_FAILED',
   ]);
   return error && allowed.has(error.code) && typeof error.message === 'string'
     ? error.message
@@ -363,10 +363,9 @@ class AppRuntime {
     }
   }
 
-  async launchProxy(deviceId, username) {
+  async launchProxy(deviceId) {
     try {
       const validatedId = validateDeviceId(deviceId);
-      const validatedUsername = validateUsername(username);
       this._reconcileProxies();
       if (!this.allowedDeviceDiscovery || !this._isCurrentDiscovery(this.allowedDeviceDiscovery) ||
           !this.allowedDeviceIds.has(validatedId)) {
@@ -378,7 +377,7 @@ class AppRuntime {
       const session = this.sessionStore.requireSession();
       const result = this.proxyManager.launchProxy({
         deploymentHost: new URL(session.origin).hostname,
-        username: validatedUsername,
+        cookie: validateCookie(session.cookie),
         deviceId: validatedId,
       });
       this.proxyByDevice.set(validatedId, result.processId);
diff --git a/src/proxy-launch.js b/src/proxy-launch.js
index 58dffb2..f5da56d 100644
--- a/src/proxy-launch.js
+++ b/src/proxy-launch.js
@@ -5,7 +5,7 @@ const nodePath = require('node:path');
 const { spawn: nodeSpawn } = require('node:child_process');
 
 const HELPER_FILENAME = 'aware-cam-proxy.exe';
-const MAX_USERNAME_LENGTH = 254;
+const MAX_COOKIE_LENGTH = 4096;
 const MAX_HOST_LENGTH = 253;
 const DEVICE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const DNS_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -42,19 +42,20 @@ function validateDeviceId(value) {
   return value.toLowerCase();
 }
 
-function validateUsername(value) {
-  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_USERNAME_LENGTH || value.trim().length === 0) {
-    throw new ProxyLaunchError('Alta username is invalid.', 'INVALID_USERNAME');
+function validateCookie(value) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_COOKIE_LENGTH) {
+    throw new ProxyLaunchError('Alta session cookie is invalid.', 'INVALID_SESSION_COOKIE');
   }
-  if (/[\u0000-\u001f\u007f-\u009f]/.test(value)) {
-    throw new ProxyLaunchError('Alta username must not contain control characters.', 'INVALID_USERNAME');
+  if (/[;\u0000-\u001f\u007f-\u009f]/.test(value)) {
+    throw new ProxyLaunchError('Alta session cookie must not contain separators or control characters.', 'INVALID_SESSION_COOKIE');
   }
   return value;
 }
 
-function safeProcessError(error) {
+function safeProcessError(error, secret) {
   const source = error && typeof error.message === 'string' ? error.message : 'Unknown process error';
-  return source.replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ').slice(0, 512);
+  const redacted = secret ? source.split(secret).join('[REDACTED]') : source;
+  return redacted.replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ').slice(0, 512);
 }
 
 function safeMetadata(entry, status = entry.status) {
@@ -129,7 +130,7 @@ function createProxyManager({
 
     const deploymentHost = validateDeploymentHost(request.deploymentHost);
     const deviceId = validateDeviceId(request.deviceId);
-    const username = validateUsername(request.username);
+    const cookie = validateCookie(request.cookie);
 
     if (!fs.existsSync(helperPath)) {
       throw new ProxyLaunchError('Proxy helper was not found in the approved application directory.', 'HELPER_NOT_FOUND');
@@ -139,17 +140,17 @@ function createProxyManager({
     try {
       child = spawn(
         helperPath,
-        ['-a', deploymentHost, '-u', username, '-d', deviceId],
+        ['-a', deploymentHost, '-d', deviceId, '-k', cookie],
         {
           shell: false,
           detached: true,
-          stdio: 'inherit',
+          stdio: 'ignore',
           windowsHide: false
         }
       );
     } catch (error) {
       throw new ProxyLaunchError(
-        `Failed to launch proxy helper: ${safeProcessError(error)}`,
+        `Failed to launch proxy helper: ${safeProcessError(error, cookie)}`,
         'SPAWN_FAILED'
       );
     }
@@ -268,10 +269,10 @@ function createProxyManager({
 module.exports = {
   DEFAULT_STOP_TIMEOUT_MS,
   HELPER_FILENAME,
-  MAX_USERNAME_LENGTH,
+  MAX_COOKIE_LENGTH,
   ProxyLaunchError,
   createProxyManager,
+  validateCookie,
   validateDeploymentHost,
-  validateDeviceId,
-  validateUsername
+  validateDeviceId
 };
diff --git a/test/build-contract.test.js b/test/build-contract.test.js
index 0b25f65..46a7a47 100644
--- a/test/build-contract.test.js
+++ b/test/build-contract.test.js
@@ -11,7 +11,7 @@ const ROOT = path.join(__dirname, '..');
 const read = (name) => fs.readFileSync(path.join(ROOT, name), 'utf8');
 const readJson = (name) => JSON.parse(read(name));
 
-function writeKit(root, { version = '1.2.0', legacy = false } = {}) {
+function writeKit(root, { version = '1.2.5', legacy = false } = {}) {
   const extension = path.join(root, 'chrome-extension');
   fs.mkdirSync(extension, { recursive: true });
   fs.writeFileSync(path.join(root, 'AltaCameraProxy.exe'), 'synthetic executable');
@@ -31,7 +31,7 @@ test('application and extension versions and supported dependencies stay coordin
   const lock = readJson('package-lock.json');
   const manifest = readJson('chrome-extension/manifest.json');
 
-  assert.equal(pkg.version, '1.2.0');
+  assert.equal(pkg.version, '1.2.5');
   assert.equal(manifest.version, pkg.version);
   assert.equal(lock.version, pkg.version);
   assert.equal(lock.packages[''].version, pkg.version);
diff --git a/test/device-projection.test.js b/test/device-projection.test.js
index 3fa29c5..64abe1a 100644
--- a/test/device-projection.test.js
+++ b/test/device-projection.test.js
@@ -6,6 +6,7 @@ const {
   MAX_PROJECTED_PAYLOAD_BYTES,
   projectDeviceHierarchy,
 } = require('../src/device-projection');
+const { buildDeviceTree } = require('../device-tree');
 
 function uuid(index) {
   return `00000000-0000-4000-8000-${index.toString(16).padStart(12, '0')}`;
@@ -18,7 +19,7 @@ function rawDevice(index, overrides = {}) {
     type: 'camera',
     model: 'Synthetic',
     address: `10.0.${Math.floor(index / 255)}.${index % 255}`,
-    server_group_id: 'site-1',
+    server_group_id: 'server-group-1',
     device_group_id: 'group-1',
     capabilities: { localStorage: index % 2 === 0, secretCapability: 'drop-me' },
     live: { display_status: 'online', private: 'drop-me' },
@@ -29,25 +30,68 @@ function rawDevice(index, overrides = {}) {
 
 test('projects only allowlisted fields and honestly diagnoses ineligible devices', () => {
   const payload = projectDeviceHierarchy({
-    devices: [rawDevice(1), rawDevice(2, { guid: 'not-a-uuid' })],
+    devices: [
+      rawDevice(1),
+      rawDevice(2, { guid: 'not-a-uuid' }),
+      rawDevice(4),
+    ],
     sites: [{ id: 'site-1', name: 'HQ', pending_deletion_start: null, secret: 'drop-me' }],
     groups: [{ id: 'group-1', name: 'Lobby', parent_id: null, pending_deletion_start: null, secret: 'drop-me' }],
   });
 
   assert.deepEqual(payload.devices, [{
     id: uuid(1), name: 'Camera 1', type: 'camera', model: 'Synthetic', address: '10.0.0.1',
-    siteId: 'site-1', deviceGroupId: 'group-1', displayStatus: 'online', localStorage: false,
+    siteId: null, deviceGroupId: 'group-1', displayStatus: 'online', localStorage: false,
   }]);
   assert.deepEqual(payload.sites, [{ id: 'site-1', name: 'HQ', pendingDeletionStart: null }]);
   assert.deepEqual(payload.groups, [{ id: 'group-1', name: 'Lobby', parentId: null, pendingDeletionStart: null }]);
-  assert.deepEqual(payload.diagnostics.devices, { received: 2, eligible: 1, invalid: 1 });
+  assert.deepEqual(payload.diagnostics.devices, {
+    received: 3, eligible: 1, invalid: 1, cloudNativeExcluded: 1,
+  });
   assert.doesNotMatch(JSON.stringify(payload), /drop-me|cookie|secretCapability|private/);
 });
 
+test('infers camera sites from device-group parents instead of server groups', () => {
+  const payload = projectDeviceHierarchy({
+    devices: [rawDevice(3, {
+      name: 'Front Door',
+      server_group_id: 'cloud-connector-server-group',
+      device_group_id: 'entrances',
+    })],
+    sites: [{ id: 'test-site', name: 'Test Site' }],
+    groups: [{ id: 'entrances', name: 'Entrances', parent_id: 'test-site' }],
+  });
+  const model = buildDeviceTree(payload);
+  const camera = [...model.cameraByKey.values()][0];
+
+  assert.equal(payload.devices[0].siteId, null);
+  assert.equal(camera.site.canonicalId, 'test-site');
+  assert.equal(camera.group.canonicalId, 'entrances');
+  assert.equal(camera.hierarchyStatus, 'inferred-site');
+  assert.deepEqual(model.diagnostics, []);
+});
+
+test('excludes cloud-native cameras while retaining Cloud Connector and unknown-storage devices', () => {
+  const payload = projectDeviceHierarchy({
+    devices: [
+      rawDevice(10, { name: 'Cloud Native', capabilities: { localStorage: true } }),
+      rawDevice(11, { name: 'Cloud Connector', capabilities: { localStorage: false } }),
+      rawDevice(12, { name: 'Unknown Storage', capabilities: {} }),
+    ],
+  });
+
+  assert.deepEqual(payload.devices.map((device) => device.name), ['Cloud Connector', 'Unknown Storage']);
+  assert.deepEqual(payload.diagnostics.devices, {
+    received: 3, eligible: 2, invalid: 0, cloudNativeExcluded: 1,
+  });
+});
+
 test('projects synthetic 1,500 and 10,000 camera deployments below the 8 MiB IPC cap', () => {
   for (const count of [1_500, 10_000]) {
     const payload = projectDeviceHierarchy({
-      devices: Array.from({ length: count }, (_, index) => rawDevice(index)),
+      devices: Array.from({ length: count }, (_, index) => rawDevice(index, {
+        capabilities: { localStorage: false },
+      })),
       sites: [],
       groups: [],
     });
@@ -80,6 +124,7 @@ test('repairs lone UTF-16 surrogates without changing valid Unicode or hiding ca
       address: 'Hall \ud800\udc00 / \udc00',
       server_group_id: 'site-\ud800',
       device_group_id: 'group-\udc00',
+      capabilities: { localStorage: false },
     })],
     sites: [{ id: 'site-\ud800', name: 'Valid \ud83d\udcf7 \udc00', pending_deletion_start: '\ud800' }],
     groups: [{ id: 'group-\udc00', name: 'Group \ud83d\udcf7 \ud800', parent_id: 'site-\ud800' }],
@@ -90,7 +135,7 @@ test('repairs lone UTF-16 surrogates without changing valid Unicode or hiding ca
   assert.equal(payload.devices[0].name, 'Front \ufffd camera');
   assert.equal(payload.devices[0].model, 'Model \ufffd');
   assert.equal(payload.devices[0].address, 'Hall \ud800\udc00 / \ufffd');
-  assert.equal(payload.devices[0].siteId, 'site-\ufffd');
+  assert.equal(payload.devices[0].siteId, null);
   assert.equal(payload.devices[0].deviceGroupId, 'group-\ufffd');
   assert.deepEqual(payload.sites, [{ id: 'site-\ufffd', name: 'Valid \ud83d\udcf7 \ufffd', pendingDeletionStart: '\ufffd' }]);
   assert.deepEqual(payload.groups, [{ id: 'group-\ufffd', name: 'Group \ud83d\udcf7 \ufffd', parentId: 'site-\ufffd', pendingDeletionStart: null }]);
@@ -101,6 +146,7 @@ test('repairs lone UTF-16 surrogates without changing valid Unicode or hiding ca
 test('rejects a projected hierarchy payload above 8 MiB', () => {
   const devices = Array.from({ length: 10_000 }, (_, index) => rawDevice(index, {
     name: `Camera ${index} ${'x'.repeat(900)}`,
+    capabilities: { localStorage: false },
   }));
   assert.throws(
     () => projectDeviceHierarchy({ devices, sites: [], groups: [] }),
diff --git a/test/extension-contract.test.js b/test/extension-contract.test.js
index 6c47b53..b42e7e7 100644
--- a/test/extension-contract.test.js
+++ b/test/extension-contract.test.js
@@ -39,10 +39,11 @@ function makeElement() {
 
 function makePopupHarness({ paired = true, confirmCopy = false, clipboardReject = null, validServerProof = true } = {}) {
   const elements = Object.fromEntries(
-    ['tabInfo', 'pairingInfo', 'sendBtn', 'copyBtn', 'statusMsg', 'copyWarning', 'confirmCopy', 'openOptionsBtn']
+    ['tabInfo', 'pairingInfo', 'sendBtn', 'copyBtn', 'statusMsg', 'openOptionsBtn']
       .map((id) => [id, makeElement()])
   );
   const clipboardWrites = [];
+  const confirmationMessages = [];
   const fetchCalls = [];
   let cookieReads = 0;
   const chromeApi = {
@@ -65,7 +66,7 @@ function makePopupHarness({ paired = true, confirmCopy = false, clipboardReject
     chromeApi,
     documentApi,
     navigatorApi,
-    confirmCopy: () => confirmCopy,
+    confirmCopy: (message) => { confirmationMessages.push(message); return confirmCopy; },
     cryptoApi: crypto.webcrypto,
     fetchImpl: async (...args) => {
       fetchCalls.push(args);
@@ -81,7 +82,7 @@ function makePopupHarness({ paired = true, confirmCopy = false, clipboardReject
       return { ok: true, json: async () => ({ success: true }) };
     }
   });
-  return { controller, elements, clipboardWrites, fetchCalls, get cookieReads() { return cookieReads; } };
+  return { controller, elements, clipboardWrites, confirmationMessages, fetchCalls, get cookieReads() { return cookieReads; } };
 }
 
 test('manifest commits only a public key, stable ID, local storage, and exact loopback host access', () => {
@@ -174,11 +175,11 @@ test('copy cancellation occurs before cookie access and never writes the token',
   assert.match(harness.elements.statusMsg.textContent, /cancelled/i);
 });
 
-test('confirmed copy warns about clipboard history and reports success without exposing token', async () => {
+test('confirmed copy uses one concise prompt and reports success without exposing token', async () => {
   const harness = makePopupHarness({ paired: true, confirmCopy: true });
   await harness.controller.init();
-  assert.match(harness.elements.copyWarning.textContent, /clipboard (?:history|sync)/i);
   await harness.controller.copyToken();
+  assert.deepEqual(harness.confirmationMessages, ['Copy VA token?']);
   assert.deepEqual(harness.clipboardWrites, ['sensitive-va-token']);
   assert.match(harness.elements.statusMsg.textContent, /copied/i);
   assert.equal(harness.elements.statusMsg.textContent.includes('sensitive-va-token'), false);
@@ -201,6 +202,7 @@ test('options UI stores a validated pairing secret locally and can forget pairin
   const js = read('options.js');
   assert.match(html, /pairingSecret/);
   assert.match(html, /type="password"/);
+  assert.doesNotMatch(html, /treat it like a password|privacy-note/i);
   assert.match(js, /chrome\.storage\.local\.set/);
   assert.match(js, /chrome\.storage\.local\.remove/);
   assert.match(js, /aptPairingSecret/);
diff --git a/test/proxy-launch.test.js b/test/proxy-launch.test.js
index 10c4e64..73d603e 100644
--- a/test/proxy-launch.test.js
+++ b/test/proxy-launch.test.js
@@ -11,7 +11,7 @@ const APPROVED_DIRECTORY = 'C:\\Program Files\\Alta Proxy Tool';
 const APPROVED_HELPER = 'C:\\Program Files\\Alta Proxy Tool\\aware-cam-proxy.exe';
 const VALID_HOST = 'tenant.avasecurity.com';
 const VALID_DEVICE_ID = '123e4567-e89b-42d3-a456-426614174000';
-const VALID_USERNAME = 'proxy.operator+apt@example.com';
+const SYNTHETIC_COOKIE = 'HERMES_SENTINEL_SESSION_COOKIE';
 
 function loadModule() {
   return require(MODULE_PATH);
@@ -67,7 +67,7 @@ function validRequest(overrides = {}) {
   return {
     deploymentHost: VALID_HOST,
     deviceId: VALID_DEVICE_ID,
-    username: VALID_USERNAME,
+    cookie: SYNTHETIC_COOKIE,
     ...overrides
   };
 }
@@ -76,18 +76,18 @@ test('exports the proxy manager module', () => {
   assert.doesNotThrow(() => loadModule());
 });
 
-test('launches the approved helper directly in a visible interactive console', () => {
+test('launches the approved helper directly with the paired Alta session', () => {
   const { manager, calls } = createHarness();
 
   const result = manager.launchProxy(validRequest());
 
   assert.deepEqual(calls, [[
     APPROVED_HELPER,
-    ['-a', VALID_HOST, '-u', VALID_USERNAME, '-d', VALID_DEVICE_ID],
+    ['-a', VALID_HOST, '-d', VALID_DEVICE_ID, '-k', SYNTHETIC_COOKIE],
     {
       shell: false,
       detached: true,
-      stdio: 'inherit',
+      stdio: 'ignore',
       windowsHide: false
     }
   ]]);
@@ -100,16 +100,15 @@ test('launches the approved helper directly in a visible interactive console', (
   });
 });
 
-test('passes username punctuation literally in argv without invoking a shell', () => {
-  const username = 'proxy+apt&literal|name@example.com';
+test('passes the paired cookie literally without invoking a shell or console prompt', () => {
+  const cookie = 'abc_DEF-123.456==';
   const { manager, calls } = createHarness();
 
-  manager.launchProxy(validRequest({ username }));
+  manager.launchProxy(validRequest({ cookie }));
 
-  assert.equal(calls[0][1][3], username);
+  assert.equal(calls[0][1][5], cookie);
   assert.equal(calls[0][2].shell, false);
-  assert.equal(calls[0][2].stdio, 'inherit');
-  assert.notEqual(calls[0][2].stdio, 'ignore');
+  assert.equal(calls[0][2].stdio, 'ignore');
 });
 
 test('rejects the CRLF calc.exe reproducer in every structured input', () => {
@@ -117,8 +116,8 @@ test('rejects the CRLF calc.exe reproducer in every structured input', () => {
   const attacks = [
     { deploymentHost: `${VALID_HOST}\r\ncalc.exe` },
     { deviceId: `${VALID_DEVICE_ID}\r\ncalc.exe` },
-    { username: `${VALID_USERNAME}\r\ncalc.exe` },
-    { username: `${VALID_USERNAME}\0calc.exe` }
+    { cookie: `${SYNTHETIC_COOKIE}\r\ncalc.exe` },
+    { cookie: `${SYNTHETIC_COOKIE}\0calc.exe` }
   ];
 
   for (const attack of attacks) {
@@ -191,10 +190,10 @@ test('normalizes a valid Alta hostname to lowercase', () => {
   assert.equal(calls[0][1][1], 'tenant.avigilon.com');
 });
 
-test('rejects empty, oversized, non-string, and control-character usernames', () => {
-  for (const username of ['', 'x'.repeat(255), 42, 'user\nname', 'user\rname', 'user\0name', 'user\u007fname']) {
+test('rejects empty, oversized, non-string, and control-character cookies', () => {
+  for (const cookie of ['', 'x'.repeat(4097), 42, 'abc\nxyz', 'abc\rxyz', 'abc\0xyz', 'abc;xyz']) {
     const { manager } = createHarness();
-    assert.throws(() => manager.launchProxy(validRequest({ username })), /username/i);
+    assert.throws(() => manager.launchProxy(validRequest({ cookie })), /cookie/i);
   }
 });
 
@@ -218,25 +217,27 @@ test('requires an absolute approved application directory and Windows platform',
   );
 });
 
-test('reports a bounded spawn failure without credential redaction machinery', () => {
+test('redacts the cookie if spawn throws an error containing it', () => {
   const { createProxyManager } = loadModule();
   const manager = createProxyManager({
     appDirectory: APPROVED_DIRECTORY,
     fs: { existsSync: () => true },
     platform: 'win32',
-    spawn: () => { throw new Error('spawn failed'); }
+    spawn: () => { throw new Error(`spawn failed for ${SYNTHETIC_COOKIE}`); }
   });
 
   assert.throws(
     () => manager.launchProxy(validRequest()),
     (error) => {
       assert.match(error.message, /spawn failed/);
+      assert.match(error.message, /\[REDACTED\]/);
+      assert.doesNotMatch(error.message, /HERMES_SENTINEL_SESSION_COOKIE/);
       return true;
     }
   );
 });
 
-test('tracks only safe process metadata and never exposes usernames', () => {
+test('tracks only safe process metadata and never exposes cookies', () => {
   const { manager } = createHarness();
   manager.launchProxy(validRequest());
 
@@ -247,7 +248,7 @@ test('tracks only safe process metadata and never exposes usernames', () => {
     startedAt: 1_777_777_777_777,
     status: 'running'
   }]);
-  assert.doesNotMatch(JSON.stringify(tracked), /proxy\.operator/);
+  assert.doesNotMatch(JSON.stringify(tracked), /HERMES_SENTINEL_SESSION_COOKIE/);
 });
 
 test('stopping one tracked process waits for confirmed exit and leaves the other alive', async () => {
@@ -381,9 +382,8 @@ test('exit events remove only the matching owned child', () => {
   assert.deepEqual(manager.listTrackedProxies().map((item) => item.processId), [4101]);
 });
 
-test('source contains no bearer argv, shell launchers, broad process killers, or persistence APIs', () => {
+test('source contains no shell launchers, broad process killers, or credential persistence APIs', () => {
   const source = fs.readFileSync(path.join(__dirname, '..', 'src', 'proxy-launch.js'), 'utf8');
-  assert.doesNotMatch(source, /cookie|bearer|token|-k/i);
   assert.doesNotMatch(source, /\b(?:cmd(?:\.exe)?|powershell|taskkill|pkill|wmic)\b/i);
   assert.doesNotMatch(source, /\.(?:bat|command)\b/i);
   assert.doesNotMatch(source, /(?:writeFile|appendFile|mkdtemp|tmpdir)/);
diff --git a/test/renderer-controller.test.js b/test/renderer-controller.test.js
index 841097e..b335241 100644
--- a/test/renderer-controller.test.js
+++ b/test/renderer-controller.test.js
@@ -2,7 +2,7 @@
 
 const test = require('node:test');
 const assert = require('node:assert/strict');
-const { createRendererController } = require('../renderer-controller');
+const { createRendererController, shouldShowPairingOnboarding } = require('../renderer-controller');
 
 function harness(result) {
   const calls = [];
@@ -39,3 +39,11 @@ test('successful disconnect renders disconnected state and clears device state',
     ['status', 'Disconnected from Alta.', 'info'],
   ]);
 });
+
+test('pairing onboarding is temporary but remains recoverable', () => {
+  assert.equal(shouldShowPairingOnboarding({ paired: false }), true);
+  assert.equal(shouldShowPairingOnboarding({ paired: true, secretVisible: true }), true);
+  assert.equal(shouldShowPairingOnboarding({ paired: true }), false);
+  assert.equal(shouldShowPairingOnboarding({ paired: true, secretVisible: true, connected: true }), false);
+  assert.equal(shouldShowPairingOnboarding({ paired: true, connected: true, manuallyOpen: true }), true);
+});
diff --git a/test/renderer-hierarchy.test.js b/test/renderer-hierarchy.test.js
index 0eebc29..8bf9998 100644
--- a/test/renderer-hierarchy.test.js
+++ b/test/renderer-hierarchy.test.js
@@ -40,6 +40,7 @@ test('renderer uses one hierarchy request and no parallel flat discovery', () =>
   assert.match(renderer, /electronAPI\.getDeviceHierarchy\(\)/);
   assert.doesNotMatch(renderer, /electronAPI\.getDevices\(|electronAPI\.getDeviceSites\(|Promise\.all\(\s*\[\s*window\.electronAPI\.get/);
   assert.doesNotMatch(renderer, /\ballDevices\b|\ballSites\b|\bcollapsedSites\b|groupDevicesBySite/);
+  assert.doesNotMatch(renderer, /Selected camera is hidden|hidden by the current view/i);
   assert.match(renderer, /loadGeneration/);
   assert.match(renderer, /generation\s*!==\s*loadGeneration/);
 });
diff --git a/test/runtime-contract.test.js b/test/runtime-contract.test.js
index 58664c6..7491144 100644
--- a/test/runtime-contract.test.js
+++ b/test/runtime-contract.test.js
@@ -92,14 +92,11 @@ test('runtime keeps Alta credentials in main-owned modules and exposes only non-
       localStorage: null,
     }],
   });
-  const launched = await runtime.launchProxy(
-    '550e8400-e29b-41d4-a716-446655440000',
-    'proxy.operator@example.com'
-  );
+  const launched = await runtime.launchProxy('550e8400-e29b-41d4-a716-446655440000');
   assert.equal(launched.success, true);
   assert.deepEqual(calls[0], {
     deploymentHost: 'customer.avasecurity.com',
-    username: 'proxy.operator@example.com',
+    cookie: 'top-secret-cookie',
     deviceId: '550e8400-e29b-41d4-a716-446655440000',
   });
   assert.deepEqual(runtime.getConnectionState(), {
@@ -189,7 +186,7 @@ test('newest hierarchy discovery owns the launch allowlist when completions arri
   const freshB = runtime.getDeviceHierarchy();
   pending[1]([{ guid: deviceB }]);
   assert.equal((await freshB).success, true);
-  assert.equal((await runtime.launchProxy(deviceB, 'operator@example.com')).success, true);
+  assert.equal((await runtime.launchProxy(deviceB)).success, true);
   pending[0]([{ guid: deviceA }]);
   assert.deepEqual(await staleA, {
     success: false,
@@ -197,7 +194,7 @@ test('newest hierarchy discovery owns the launch allowlist when completions arri
     hierarchy: { devices: [], sites: [], groups: [] },
     message: 'Alta device discovery result is stale',
   });
-  assert.equal((await runtime.launchProxy(deviceA, 'operator@example.com')).success, false);
+  assert.equal((await runtime.launchProxy(deviceA)).success, false);
   assert.deepEqual(launches, [deviceB]);
 });
 
@@ -248,7 +245,7 @@ test('launch allowlist remains bound to the session origin that produced it', as
   });
   assert.equal((await runtime.getDeviceHierarchy()).success, true);
   sessionStore.establish('https://second.avasecurity.com', 'replacement-cookie');
-  assert.equal((await runtime.launchProxy(deviceId, 'operator@example.com')).success, false);
+  assert.equal((await runtime.launchProxy(deviceId)).success, false);
   assert.equal(launches, 0);
 });
 
@@ -256,28 +253,6 @@ test('runtime rejects discovery deadlines above 60 seconds', () => {
   assert.throws(() => new AppRuntime({ discoveryTimeoutMs: 60_001 }), /discovery timeout/i);
 });
 
-test('runtime rejects invalid usernames before calling the proxy manager', async () => {
-  const sessionStore = createSessionStore();
-  sessionStore.establish('https://customer.avasecurity.com', 'top-secret-cookie');
-  const deviceId = '550e8400-e29b-41d4-a716-446655440000';
-  let launches = 0;
-  const runtime = new AppRuntime({
-    sessionStore,
-    altaClient: { getDevices: async () => [{ guid: deviceId }] },
-    proxyManager: {
-      launchProxy() { launches += 1; },
-      listTrackedProxies() { return []; },
-    },
-  });
-  await runtime.getDevices();
-
-  for (const username of ['', 'x'.repeat(255), 'operator@example.com\r\n-k secret', null]) {
-    const result = await runtime.launchProxy(deviceId, username);
-    assert.equal(result.success, false);
-    assert.match(result.message, /username/i);
-  }
-  assert.equal(launches, 0);
-});
 
 test('bridge authenticates itself before accepting a one-time HMAC cookie request', async () => {
   const protect = (value) => Buffer.from(`protected:${value}`);
@@ -403,10 +378,10 @@ test('runtime reconciles exited children and permits relaunch for the same devic
     },
   });
   await runtime.getDevices();
-  assert.equal((await runtime.launchProxy(deviceId, 'operator@example.com')).processId, 4101);
+  assert.equal((await runtime.launchProxy(deviceId)).processId, 4101);
   tracked.length = 0;
   assert.deepEqual(runtime.getConnectionState().activeProxies, []);
-  assert.equal((await runtime.launchProxy(deviceId, 'operator@example.com')).processId, 4102);
+  assert.equal((await runtime.launchProxy(deviceId)).processId, 4102);
 });
 
 test('disconnect stops every owned proxy before clearing the Alta session', async () => {
@@ -474,7 +449,7 @@ test('kill request without exit keeps proxy tracked and session connected until
     setTimeout(callback) { timeoutCallback = callback; return 1; },
     clearTimeout() {},
   });
-  proxyManager.launchProxy({ deploymentHost: 'customer.avasecurity.com', username: 'operator@example.com', deviceId });
+  proxyManager.launchProxy({ deploymentHost: 'customer.avasecurity.com', cookie: 'synthetic-cookie', deviceId });
   const runtime = new AppRuntime({ sessionStore, altaClient: {}, proxyManager });
 
   const firstDisconnect = runtime.disconnect();
@@ -525,13 +500,16 @@ test('preload and renderer expose only narrow, credential-free contracts', () =>
   ];
   for (const method of expectedMethods) assert.match(preload, new RegExp(`\\b${method}\\b`));
   assert.doesNotMatch(preload, /downloadAndInstall|download-and-install|onUpdateDownloadProgress|onExtensionCookie/);
-  assert.match(preload, /launchProxy:\s*\(deviceId, username\)/);
+  assert.match(preload, /launchProxy:\s*\(deviceId\)/);
   assert.doesNotMatch(preload, /launchProxy:\s*\([^)]*(?:cookie|origin)/i);
   assert.doesNotMatch(renderer, /cookieValue|sessionData\.cookies|cookies\s*:/);
   assert.match(renderer, /state\.connected\s*&&\s*\(!wasConnected\s*\|\|\s*state\.origin\s*!==\s*previousOrigin\)/);
   assert.match(read('main.js'), /onConnectionStateChanged:\s*\(\)\s*=>\s*\{\s*runtime\.onSessionChanged\(\)/);
-  assert.doesNotMatch(html, /id="cookieKey"|updateProgress|Install Update/);
-  assert.match(html, /id="altaUsername"/);
+  assert.doesNotMatch(html, /id="cookieKey"|id="altaUsername"|type="password"|updateProgress|Install Update/);
+  assert.match(html, /paired Chrome extension session/i);
+  assert.match(html, /id="pairingSection"[^>]*hidden/);
+  assert.match(html, /id="managePairingBtn"/);
+  assert.match(renderer, /shouldShowPairingOnboarding/);
   assert.match(renderer, /openFixedReleasesPage/);
   assert.match(html, /Bridge Pairing/);
 });