@buildautomaton/cli 0.1.61 → 0.1.62

package/dist/index.js

@@ -22625,18 +22625,6 @@ var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
 var wrapper_default = import_websocket.default;
 
-// src/net/apply-cli-outbound-network-prefs.ts
-import dns from "node:dns";
-var applied = false;
-function applyCliOutboundNetworkPreferences() {
-  if (applied) return;
-  applied = true;
-  try {
-    dns.setDefaultResultOrder("ipv4first");
-  } catch {
-  }
-}
-
 // src/connection/cli-ws-client.ts
 import https from "node:https";
 var CLI_WEBSOCKET_CLIENT_PING_MS = 25e3;
@@ -22738,7 +22726,6 @@ function createWsBridge(options) {
     onCompactHeartbeatAck,
     isActiveSocket
   } = options;
-  applyCliOutboundNetworkPreferences();
   const ws = new wrapper_default(url2, buildCliWebSocketClientOptions(url2));
   let clearClientPing = null;
   function disposeClientPing() {
@@ -24855,6 +24842,71 @@ async function createSdkStdioAcpClient(options) {
   });
 }
 
+// src/firehose/proxy/constants.ts
+var LOCAL_PROXY_REQUEST_TIMEOUT_MS = 3e4;
+
+// src/firehose/proxy/prepare-local-proxy-request-headers.ts
+var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailers",
+  "transfer-encoding",
+  "upgrade"
+]);
+var BODY_HEADERS = /* @__PURE__ */ new Set(["content-length", "content-type", "content-encoding"]);
+function methodAllowsRequestBody(method) {
+  const normalized = method.toUpperCase();
+  return normalized !== "GET" && normalized !== "HEAD";
+}
+function prepareLocalProxyRequestHeaders(method, headers, sendingBody) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers ?? {})) {
+    const lower = key.toLowerCase();
+    if (lower === "host") continue;
+    if (HOP_BY_HOP_HEADERS.has(lower)) continue;
+    if (lower === "origin" || lower === "referer") continue;
+    if (!sendingBody && BODY_HEADERS.has(lower)) continue;
+    out[key] = value;
+  }
+  return out;
+}
+
+// src/firehose/proxy/build-local-proxy-http-request.ts
+var ALLOWED_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "::1"]);
+function willSendLocalProxyBody(request) {
+  if (!methodAllowsRequestBody(request.method)) return false;
+  return request.body !== void 0 && request.body !== null;
+}
+function buildLocalProxyHttpRequest(request) {
+  let url2;
+  try {
+    url2 = new URL(request.url);
+  } catch {
+    return { error: `Invalid URL: ${request.url}` };
+  }
+  const hostname2 = url2.hostname.replace(/^\[|\]$/g, "");
+  if (!ALLOWED_HOSTS.has(url2.hostname) && !ALLOWED_HOSTS.has(hostname2)) {
+    return { error: "Only localhost requests are allowed" };
+  }
+  const sendingBody = willSendLocalProxyBody(request);
+  const headers = prepareLocalProxyRequestHeaders(request.method, request.headers, sendingBody);
+  headers.host = url2.host;
+  const isHttps = url2.protocol === "https:";
+  const port = url2.port ? Number(url2.port) : isHttps ? 443 : 80;
+  return {
+    method: request.method,
+    hostname: url2.hostname,
+    port,
+    path: `${url2.pathname}${url2.search}`,
+    headers,
+    sendingBody,
+    body: sendingBody ? request.body : void 0
+  };
+}
+
 // src/net/transient-local-fetch-retry.ts
 var LOCAL_PREVIEW_FETCH_RETRY_DELAYS_MS = [30, 100, 200, 400];
 function sleepMs(ms) {
@@ -24879,148 +24931,151 @@ function isTransientLocalServiceError(err) {
   if (!text) return false;
   return text.includes("fetch failed") || text.includes("econnrefused") || text.includes("econnreset") || text.includes("epipe") || text.includes("etimedout") || text.includes("socket hang up") || text.includes("network connection lost") || text.includes("ecanceled") || text.includes("aborted") || text.includes("und_err_socket") || text.includes("other side closed") || text.includes("eai_again");
 }
-function isIdempotentHttpMethod(method) {
-  const m = method.toUpperCase();
-  return m === "GET" || m === "HEAD" || m === "OPTIONS";
-}
-async function fetchWithLocalTransientRetries(url2, init, options) {
-  const method = (init?.method ?? "GET").toUpperCase();
-  const allowRetry = isIdempotentHttpMethod(method);
-  const delays = options?.delaysMs ?? LOCAL_PREVIEW_FETCH_RETRY_DELAYS_MS;
-  const maxAttempts = options?.maxAttempts ?? (allowRetry ? Math.max(1, delays.length + 1) : 1);
-  let lastErr;
-  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-    try {
-      return await fetch(url2, init);
-    } catch (e) {
-      lastErr = e;
-      const canRetry = allowRetry && attempt < maxAttempts - 1 && isTransientLocalServiceError(e);
-      if (!canRetry) throw e;
-      const waitMs = delays[Math.min(attempt, delays.length - 1)] ?? 100;
-      await sleepMs(waitMs);
-    }
+
+// src/firehose/proxy/incoming-message-headers.ts
+function incomingMessageHeaders(res) {
+  const headers = {};
+  for (const [k, v] of Object.entries(res.headers)) {
+    if (typeof v === "string") headers[k] = v;
+    else if (Array.isArray(v) && v[0]) headers[k] = v[0];
   }
-  throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+  return headers;
 }
 
-// src/firehose/proxy/local-proxy.ts
-var ALLOWED_HOSTS = ["localhost", "127.0.0.1", "::1"];
-function isAllowedHost(host) {
-  const h = host.replace(/^\[|\]$/g, "");
-  return ALLOWED_HOSTS.includes(host) || ALLOWED_HOSTS.includes(h);
-}
-function isIdempotentProxyMethod(method) {
-  const m = method.toUpperCase();
-  return m === "GET" || m === "HEAD" || m === "OPTIONS";
-}
-function checkUrlAndHost(request) {
-  let url2;
-  try {
-    url2 = new URL(request.url);
-  } catch {
-    return { error: `Invalid URL: ${request.url}` };
-  }
-  if (!isAllowedHost(url2.hostname)) {
-    return { error: "Only localhost requests are allowed" };
-  }
-  return { url: url2 };
+// src/firehose/proxy/run-local-http-request.ts
+async function loadHttpModule(isHttps) {
+  return isHttps ? import("https") : import("http");
 }
-async function proxyToLocal(request) {
-  const checked = checkUrlAndHost(request);
-  if ("error" in checked) {
-    return { id: request.id, statusCode: 0, headers: {}, body: "", error: checked.error };
-  }
-  const { url: url2 } = checked;
-  const isHttps = url2.protocol === "https:";
-  const mod = isHttps ? await import("https") : await import("http");
-  const opts = {
-    method: request.method,
-    hostname: url2.hostname,
-    port: url2.port || (isHttps ? 443 : 80),
-    path: url2.pathname + url2.search,
-    headers: request.headers
+function buildLocalHttpRequestOptions(built) {
+  return {
+    method: built.method,
+    hostname: built.hostname,
+    port: built.port,
+    path: built.path,
+    headers: built.headers
   };
-  const maxAttempts = isIdempotentProxyMethod(request.method) ? LOCAL_PREVIEW_FETCH_RETRY_DELAYS_MS.length + 1 : 1;
-  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-    const once = await new Promise((resolve35) => {
-      const req = mod.request(opts, (res) => {
-        const chunks = [];
-        res.on("data", (c) => chunks.push(c));
-        res.on("end", () => {
-          const body = Buffer.concat(chunks).toString("utf8");
-          const headers = {};
-          for (const [k, v] of Object.entries(res.headers)) {
-            if (typeof v === "string") headers[k] = v;
-            else if (Array.isArray(v) && v[0]) headers[k] = v[0];
-          }
-          resolve35({
-            id: request.id,
-            statusCode: res.statusCode ?? 0,
-            headers,
-            body
-          });
+}
+function runLocalHttpRequestOnce(mod, built) {
+  const opts = buildLocalHttpRequestOptions(built);
+  return new Promise((resolve35) => {
+    const req = mod.request(opts, (res) => {
+      const chunks = [];
+      res.on("data", (chunk) => chunks.push(chunk));
+      res.on("end", () => {
+        resolve35({
+          statusCode: res.statusCode ?? 0,
+          headers: incomingMessageHeaders(res),
+          body: Buffer.concat(chunks)
         });
       });
-      req.on("error", (err) => {
+      res.on("error", (err) => {
         resolve35({
-          id: request.id,
           statusCode: 0,
           headers: {},
-          body: "",
+          body: Buffer.alloc(0),
           error: err.message
         });
       });
-      const method = request.method.toUpperCase();
-      if (request.body && method !== "GET" && method !== "HEAD") req.write(request.body);
-      req.end();
     });
+    req.setTimeout(LOCAL_PROXY_REQUEST_TIMEOUT_MS, () => {
+      req.destroy(new Error(`Local preview request timed out after ${LOCAL_PROXY_REQUEST_TIMEOUT_MS}ms`));
+    });
+    req.on("error", (err) => {
+      resolve35({
+        statusCode: 0,
+        headers: {},
+        body: Buffer.alloc(0),
+        error: err.message
+      });
+    });
+    if (built.sendingBody && built.body != null) {
+      req.write(built.body);
+    }
+    req.end();
+  });
+}
+
+// src/firehose/proxy/proxy-to-local.ts
+function isIdempotentProxyMethod(method) {
+  const m = method.toUpperCase();
+  return m === "GET" || m === "HEAD" || m === "OPTIONS";
+}
+async function proxyToLocal(request) {
+  const built = buildLocalProxyHttpRequest(request);
+  if ("error" in built) {
+    return { id: request.id, statusCode: 0, headers: {}, body: "", error: built.error };
+  }
+  const isHttps = request.url.startsWith("https:");
+  const mod = await loadHttpModule(isHttps);
+  const maxAttempts = isIdempotentProxyMethod(request.method) ? LOCAL_PREVIEW_FETCH_RETRY_DELAYS_MS.length + 1 : 1;
+  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+    const once = await runLocalHttpRequestOnce(mod, built);
     const errMsg = once.error ?? "";
     const canRetry = attempt < maxAttempts - 1 && errMsg !== "" && isTransientLocalServiceError(new Error(errMsg));
-    if (!canRetry) return once;
+    if (!canRetry) {
+      return {
+        id: request.id,
+        statusCode: once.statusCode,
+        headers: once.headers,
+        body: once.body.toString("utf8"),
+        error: once.error
+      };
+    }
     const waitMs = LOCAL_PREVIEW_FETCH_RETRY_DELAYS_MS[Math.min(attempt, LOCAL_PREVIEW_FETCH_RETRY_DELAYS_MS.length - 1)] ?? 100;
     await sleepMs(waitMs);
   }
   throw new Error("Local proxy retry loop exited unexpectedly");
 }
+
+// src/firehose/proxy/proxy-to-local-streaming.ts
 async function proxyToLocalStreaming(request, callbacks) {
-  const checked = checkUrlAndHost(request);
-  if ("error" in checked) {
-    callbacks.onError(checked.error);
+  const built = buildLocalProxyHttpRequest(request);
+  if ("error" in built) {
+    callbacks.onError(built.error);
     return;
   }
-  try {
-    const method = request.method.toUpperCase();
-    const init = {
-      method: request.method,
-      headers: request.headers
-    };
-    if (request.body !== void 0 && request.body !== null && method !== "GET" && method !== "HEAD") {
-      init.body = request.body;
-    }
-    const res = await fetchWithLocalTransientRetries(request.url, init);
-    const headers = {};
-    res.headers.forEach((value, key) => {
-      headers[key] = value;
-    });
-    callbacks.onStart(res.status, headers);
-    const reader = res.body?.getReader();
-    if (!reader) {
-      callbacks.onEnd();
-      return;
-    }
-    try {
-      for (; ; ) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        callbacks.onChunk(value);
+  const isHttps = request.url.startsWith("https:");
+  const mod = await loadHttpModule(isHttps);
+  const opts = buildLocalHttpRequestOptions(built);
+  await new Promise((resolve35) => {
+    const req = mod.request(opts, (res) => {
+      try {
+        callbacks.onStart(res.statusCode ?? 0, incomingMessageHeaders(res));
+      } catch (err) {
+        req.destroy();
+        callbacks.onError(err instanceof Error ? err.message : String(err));
+        resolve35();
+        return;
       }
-    } finally {
-      reader.releaseLock();
+      res.on("data", (chunk) => {
+        try {
+          callbacks.onChunk(new Uint8Array(chunk));
+        } catch (err) {
+          req.destroy();
+          callbacks.onError(err instanceof Error ? err.message : String(err));
+        }
+      });
+      res.on("end", () => {
+        callbacks.onEnd();
+        resolve35();
+      });
+      res.on("error", (err) => {
+        callbacks.onError(err.message);
+        resolve35();
+      });
+    });
+    req.setTimeout(LOCAL_PROXY_REQUEST_TIMEOUT_MS, () => {
+      req.destroy(new Error(`Local preview request timed out after ${LOCAL_PROXY_REQUEST_TIMEOUT_MS}ms`));
+    });
+    req.on("error", (err) => {
+      callbacks.onError(err.message);
+      resolve35();
+    });
+    if (built.sendingBody && built.body != null) {
+      req.write(built.body);
     }
-    callbacks.onEnd();
-  } catch (err) {
-    callbacks.onError(err instanceof Error ? err.message : String(err));
-  }
+    req.end();
+  });
 }
 
 // src/skills/preview.ts
@@ -25272,7 +25327,7 @@ function installBridgeProcessResilience() {
 }
 
 // src/cli-version.ts
-var CLI_VERSION = "0.1.61".length > 0 ? "0.1.61" : "0.0.0-dev";
+var CLI_VERSION = "0.1.62".length > 0 ? "0.1.62" : "0.0.0-dev";
 
 // src/connection/heartbeat/constants.ts
 var BRIDGE_APP_HEARTBEAT_INTERVAL_MS = 1e4;
@@ -26654,38 +26709,38 @@ function readCodeNavCacheMigrationSql(filename) {
 }
 
 // src/sqlite/run-sqlite-migrations.ts
-function checkpointSatisfiedByLegacyChain(applied2, replacesLegacyMigrations) {
-  return Array.isArray(replacesLegacyMigrations) && replacesLegacyMigrations.length > 0 && replacesLegacyMigrations.every((n) => applied2.has(n));
+function checkpointSatisfiedByLegacyChain(applied, replacesLegacyMigrations) {
+  return Array.isArray(replacesLegacyMigrations) && replacesLegacyMigrations.length > 0 && replacesLegacyMigrations.every((n) => applied.has(n));
 }
-function recordMigrationAndPruneCheckpointLegacy(db, migration, applied2) {
+function recordMigrationAndPruneCheckpointLegacy(db, migration, applied) {
   db.run("INSERT INTO __migrations (name) VALUES (?)", [migration.name]);
-  applied2.add(migration.name);
+  applied.add(migration.name);
   if (migration.checkpoint !== true) return;
   const legacy = migration.replacesLegacyMigrations;
   if (!legacy?.length) return;
   for (const legacyName of legacy) {
     if (legacyName === migration.name) continue;
     db.run("DELETE FROM __migrations WHERE name = ?", [legacyName]);
-    applied2.delete(legacyName);
+    applied.delete(legacyName);
   }
 }
 function runSqliteMigrations(db, migrations, bootstrapSql, label) {
   db.exec(bootstrapSql);
   const appliedRows = db.all("SELECT name FROM __migrations");
-  const applied2 = new Set(appliedRows.map((r) => r.name));
+  const applied = new Set(appliedRows.map((r) => r.name));
   for (const migration of migrations) {
-    if (applied2.has(migration.name)) continue;
-    if (migration.checkpoint === true && checkpointSatisfiedByLegacyChain(applied2, migration.replacesLegacyMigrations)) {
-      recordMigrationAndPruneCheckpointLegacy(db, migration, applied2);
+    if (applied.has(migration.name)) continue;
+    if (migration.checkpoint === true && checkpointSatisfiedByLegacyChain(applied, migration.replacesLegacyMigrations)) {
+      recordMigrationAndPruneCheckpointLegacy(db, migration, applied);
       continue;
     }
     if (migration.alreadyApplied?.(db)) {
-      recordMigrationAndPruneCheckpointLegacy(db, migration, applied2);
+      recordMigrationAndPruneCheckpointLegacy(db, migration, applied);
       continue;
     }
     try {
       migration.migrate(db);
-      recordMigrationAndPruneCheckpointLegacy(db, migration, applied2);
+      recordMigrationAndPruneCheckpointLegacy(db, migration, applied);
     } catch (e) {
       console.error(`[${label}] Migration failed: ${migration.name}`, e);
       throw e;
@@ -34832,6 +34887,9 @@ function envForSpawn(base, userEnv, ports) {
   });
   if (ports.length > 0) {
     out.PORTS = ports.join(",");
+    if (!userKeys.has("PORT")) {
+      out.PORT = String(ports[0]);
+    }
   }
   if (!userKeys.has("NO_COLOR")) {
     delete out.NO_COLOR;
@@ -35734,6 +35792,12 @@ function createBridgePreviewStack(options) {
   return { previewEnvironmentManager, scheduleInitialIndexBuildsOnce, identifyReportedPaths };
 }
 
+// src/firehose/build-cli-ws-url.ts
+function buildFirehoseCliWsUrl(baseUrl) {
+  const base = baseUrl.startsWith("https") ? baseUrl.replace(/^https/, "wss") : baseUrl.replace(/^http/, "ws");
+  return `${base.replace(/\/$/, "")}/ws`;
+}
+
 // src/firehose/proxy/start-streaming-proxy.ts
 function startStreamingProxy(ws, log2, pr) {
   proxyToLocalStreaming(pr, {
@@ -35741,15 +35805,7 @@ function startStreamingProxy(ws, log2, pr) {
       if (ws.readyState !== wrapper_default.OPEN) {
         throw new Error("Preview stream interrupted (firehose connection closed)");
       }
-      const forwardedHeaders = { ...headers };
-      const ce = "content-encoding";
-      const cl = "content-length";
-      const keys = Object.keys(forwardedHeaders).filter(
-        (k) => k.toLowerCase() !== ce && k.toLowerCase() !== cl
-      );
-      const filtered = {};
-      for (const k of keys) if (forwardedHeaders[k] != null) filtered[k] = forwardedHeaders[k];
-      sendWsMessage(ws, { type: "proxy_result_start", id: pr.id, statusCode, headers: filtered });
+      sendWsMessage(ws, { type: "proxy_result_start", id: pr.id, statusCode, headers });
     },
     onChunk: (chunk) => {
       const idBuf = Buffer.from(pr.id, "utf8");
@@ -35766,10 +35822,19 @@ function startStreamingProxy(ws, log2, pr) {
   });
 }
 
-// src/firehose/build-cli-ws-url.ts
-function buildFirehoseCliWsUrl(baseUrl) {
-  const base = baseUrl.startsWith("https") ? baseUrl.replace(/^https/, "wss") : baseUrl.replace(/^http/, "ws");
-  return `${base.replace(/\/$/, "")}/ws`;
+// src/firehose/create-firehose-message-deps.ts
+function createFirehoseMessageDeps(ws, log2, previewEnvironmentManager) {
+  const pendingProxyBody = /* @__PURE__ */ new Map();
+  const earlyProxyBinaryBody = /* @__PURE__ */ new Map();
+  const deps = {
+    ws,
+    log: log2,
+    previewEnvironmentManager,
+    pendingProxyBody,
+    earlyProxyBinaryBody,
+    startStreamingProxy: (pr) => startStreamingProxy(ws, log2, pr)
+  };
+  return deps;
 }
 
 // src/firehose/routing/firehose-message-router.ts
@@ -35810,25 +35875,27 @@ var handleProxyMessage = (msg, deps) => {
   if (!proxy || typeof proxy !== "object") return;
   const pr = proxy;
   if (pr.streamResponse) {
-    const bodyLength = pr.bodyLength ?? 0;
+    const bodyLength = methodAllowsRequestBody(pr.method) ? pr.bodyLength ?? 0 : 0;
+    const streamingRequest = {
+      id: pr.id,
+      method: pr.method,
+      url: pr.url,
+      headers: pr.headers,
+      streamResponse: true
+    };
     if (bodyLength > 0) {
-      deps.pendingProxyBody.set(pr.id, {
-        pr: {
-          id: pr.id,
-          method: pr.method,
-          url: pr.url,
-          headers: pr.headers,
-          streamResponse: true
-        }
-      });
+      const earlyBody = deps.earlyProxyBinaryBody.get(pr.id);
+      if (earlyBody !== void 0) {
+        deps.earlyProxyBinaryBody.delete(pr.id);
+        deps.startStreamingProxy({
+          ...streamingRequest,
+          body: earlyBody.length > 0 ? earlyBody : void 0
+        });
+      } else {
+        deps.pendingProxyBody.set(pr.id, { pr: streamingRequest });
+      }
     } else {
-      deps.startStreamingProxy({
-        id: pr.id,
-        method: pr.method,
-        url: pr.url,
-        headers: pr.headers,
-        streamResponse: true
-      });
+      deps.startStreamingProxy(streamingRequest);
     }
     return;
   }
@@ -35859,37 +35926,63 @@ function dispatchFirehoseJsonMessage(msg, deps) {
 
 // src/firehose/routing/try-consume-binary-proxy-body.ts
 var PROXY_ID_BYTES = 36;
+var PROXY_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function tryConsumeBinaryProxyBody(raw, deps) {
   if (raw.length < PROXY_ID_BYTES) return false;
   const id = raw.slice(0, PROXY_ID_BYTES).toString("utf8");
-  const pending2 = deps.pendingProxyBody.get(id);
-  if (!pending2) return false;
-  deps.pendingProxyBody.delete(id);
+  if (!PROXY_ID_RE.test(id)) return false;
   const body = raw.slice(PROXY_ID_BYTES);
-  deps.startStreamingProxy({
-    ...pending2.pr,
-    body: body.length > 0 ? new Uint8Array(body) : void 0
-  });
+  const bodyBytes = body.length > 0 ? new Uint8Array(body) : new Uint8Array(0);
+  const pending2 = deps.pendingProxyBody.get(id);
+  if (pending2) {
+    deps.pendingProxyBody.delete(id);
+    deps.startStreamingProxy({
+      ...pending2.pr,
+      body: bodyBytes.length > 0 ? bodyBytes : void 0
+    });
+    return true;
+  }
+  deps.earlyProxyBinaryBody.set(id, bodyBytes);
   return true;
 }
 
-// src/firehose/connect-firehose.ts
-function connectFirehose(options) {
+// src/firehose/handle-inbound-firehose-frame.ts
+function handleInboundFirehoseFrame(raw, deps) {
+  if (Buffer.isBuffer(raw) && tryConsumeBinaryProxyBody(raw, deps)) {
+    return;
+  }
+  let msg;
+  try {
+    const text = Buffer.isBuffer(raw) ? raw.toString("utf8") : String(raw);
+    msg = JSON.parse(text);
+  } catch {
+    return;
+  }
+  if (msg.type === "proxy") {
+    dispatchFirehoseJsonMessage(msg, deps);
+    return;
+  }
+  setImmediate(() => {
+    dispatchFirehoseJsonMessage(msg, deps);
+  });
+}
+
+// src/firehose/wire-firehose-websocket.ts
+function wireFirehoseWebSocket(options) {
   const {
-    firehoseServerUrl,
+    ws,
+    deps,
+    log: log2,
+    previewEnvironmentManager,
     workspaceId,
     bridgeName,
     proxyPorts,
-    log: log2,
-    previewEnvironmentManager,
     onOpen,
     onClose,
     suppressWebSocketErrors
   } = options;
-  const wsUrl = buildFirehoseCliWsUrl(firehoseServerUrl);
-  applyCliOutboundNetworkPreferences();
-  const ws = new wrapper_default(wsUrl, buildCliWebSocketClientOptions(wsUrl));
   let clearClientPing = null;
+  let identifyParams = { workspaceId, bridgeName, proxyPorts };
   function disposeClientPing() {
     clearClientPing?.();
     clearClientPing = null;
@@ -35897,36 +35990,32 @@ function connectFirehose(options) {
   const firehoseSend = (payload) => {
     sendWsMessage(ws, payload);
   };
-  const pendingProxyBody = /* @__PURE__ */ new Map();
-  const deps = {
-    ws,
-    log: log2,
-    previewEnvironmentManager,
-    pendingProxyBody,
-    startStreamingProxy: (pr) => startStreamingProxy(ws, log2, pr)
-  };
+  function sendIdentify(params) {
+    identifyParams = params;
+    if (ws.readyState !== wrapper_default.OPEN) return;
+    sendWsMessage(ws, {
+      type: "identify",
+      workspaceId: params.workspaceId,
+      bridgeName: params.bridgeName,
+      proxyPorts: params.proxyPorts
+    });
+  }
+  function detachPreviewEnvironmentManager() {
+    previewEnvironmentManager.detachFirehose();
+  }
   ws.on("open", () => {
     disposeClientPing();
     clearClientPing = attachWebSocketClientPing(ws, CLI_WEBSOCKET_CLIENT_PING_MS);
     onOpen?.();
     previewEnvironmentManager.attachFirehose(firehoseSend);
-    sendWsMessage(ws, { type: "identify", workspaceId, bridgeName, proxyPorts });
+    sendIdentify(identifyParams);
   });
   ws.on("message", (raw) => {
-    if (Buffer.isBuffer(raw) && tryConsumeBinaryProxyBody(raw, deps)) {
-      return;
-    }
-    setImmediate(() => {
-      try {
-        const text = Buffer.isBuffer(raw) ? raw.toString("utf8") : String(raw);
-        dispatchFirehoseJsonMessage(JSON.parse(text), deps);
-      } catch {
-      }
-    });
+    handleInboundFirehoseFrame(raw, deps);
   });
   ws.on("close", (code, reason) => {
     disposeClientPing();
-    previewEnvironmentManager.detachFirehose();
+    detachPreviewEnvironmentManager();
     const reasonStr = typeof reason === "string" ? reason : reason.toString();
     onClose?.(code, reasonStr);
   });
@@ -35939,25 +36028,64 @@ function connectFirehose(options) {
       safeCloseWebSocket(ws);
     }
   });
+  return { disposeClientPing, sendIdentify, detachPreviewEnvironmentManager };
+}
+
+// src/firehose/connect-firehose.ts
+function connectFirehose(options) {
+  const {
+    firehoseServerUrl,
+    workspaceId,
+    bridgeName,
+    proxyPorts,
+    log: log2,
+    previewEnvironmentManager,
+    onOpen,
+    onClose,
+    suppressWebSocketErrors
+  } = options;
+  const wsUrl = buildFirehoseCliWsUrl(firehoseServerUrl);
+  const ws = new wrapper_default(wsUrl, buildCliWebSocketClientOptions(wsUrl));
+  const deps = createFirehoseMessageDeps(ws, log2, previewEnvironmentManager);
+  const wired = wireFirehoseWebSocket({
+    ws,
+    deps,
+    log: log2,
+    previewEnvironmentManager,
+    workspaceId,
+    bridgeName,
+    proxyPorts,
+    onOpen,
+    onClose,
+    suppressWebSocketErrors
+  });
   return {
     close() {
-      disposeClientPing();
-      previewEnvironmentManager.detachFirehose();
+      wired.disposeClientPing();
+      wired.detachPreviewEnvironmentManager();
       safeCloseWebSocket(ws);
     },
-    isConnected: () => ws.readyState === wrapper_default.OPEN
+    isConnected: () => ws.readyState === wrapper_default.OPEN,
+    updateIdentify: wired.sendIdentify
   };
 }
 
-// src/connection/attach-firehose-after-identified.ts
-function attachFirehoseAfterIdentified(ctx, params) {
-  const { state, previewEnvironmentManager, logFn } = ctx;
-  function clearFirehoseReconnectTimer() {
-    if (state.firehoseReconnectTimeout != null) {
-      clearTimeout(state.firehoseReconnectTimeout);
-      state.firehoseReconnectTimeout = null;
-    }
-  }
+// src/connection/firehose/compare-firehose-params.ts
+function proxyPortsEqual(a, b) {
+  if (a.length !== b.length) return false;
+  const sa = [...a].sort((x, y) => x - y);
+  const sb = [...b].sort((x, y) => x - y);
+  return sa.every((v, i) => v === sb[i]);
+}
+function sameFirehoseBridge(a, b) {
+  return a.firehoseServerUrl === b.firehoseServerUrl && a.workspaceId === b.workspaceId && a.bridgeName === b.bridgeName;
+}
+function shouldReuseOpenFirehoseConnection(prev, next, isConnected) {
+  return Boolean(prev && sameFirehoseBridge(prev, next) && isConnected());
+}
+
+// src/connection/firehose/create-firehose-connect-callbacks.ts
+function createFirehoseConnectCallbacks(state, myGen, logFn, scheduleFirehoseRetryAfterDrop) {
   function firehoseCtx() {
     return {
       closedByUser: state.closedByUser,
@@ -35966,6 +36094,55 @@ function attachFirehoseAfterIdentified(ctx, params) {
       firehoseQuiet: state.firehoseQuiet
     };
   }
+  return {
+    onOpen: () => {
+      if (myGen !== state.firehoseGeneration) return;
+      try {
+        clearFirehoseReconnectQuietOnOpen(
+          {
+            firehoseQuiet: state.firehoseQuiet,
+            firehoseOutage: state.firehoseOutage,
+            lastFirehoseReconnectCloseMeta: state.lastFirehoseReconnectCloseMeta
+          },
+          logFn
+        );
+      } catch {
+      }
+      const logOpenAsFirehoseReconnect = state.firehoseReconnectAttempt > 0;
+      state.firehoseReconnectAttempt = 0;
+      if (!logOpenAsFirehoseReconnect) {
+        try {
+          logFn("Connected to preview tunnel (local HTTP proxy and dev logs).");
+        } catch {
+        }
+      }
+    },
+    onClose: (code, reason) => {
+      if (myGen !== state.firehoseGeneration) return;
+      state.firehoseHandle = null;
+      if (state.closedByUser) return;
+      state.lastFirehoseReconnectCloseMeta = { code, reason };
+      try {
+        beginFirehoseDeferredDisconnect(firehoseCtx(), code, reason, logFn);
+      } catch {
+      }
+      try {
+        scheduleFirehoseRetryAfterDrop({ code, reason });
+      } catch {
+      }
+    }
+  };
+}
+
+// src/connection/firehose/create-firehose-reconnect-scheduler.ts
+function createFirehoseReconnectScheduler(ctx, reconnect) {
+  const { state, logFn } = ctx;
+  function clearFirehoseReconnectTimer() {
+    if (state.firehoseReconnectTimeout != null) {
+      clearTimeout(state.firehoseReconnectTimeout);
+      state.firehoseReconnectTimeout = null;
+    }
+  }
   function scheduleFirehoseRetryAfterDrop(closeMeta) {
     if (state.closedByUser) return;
     const meta = closeMeta ?? state.lastFirehoseReconnectCloseMeta ?? void 0;
@@ -35987,30 +36164,60 @@ function attachFirehoseAfterIdentified(ctx, params) {
         state.firehoseReconnectTimeout = id;
       },
       shouldAbortBeforeRun: () => state.closedByUser,
-      run: () => {
-        const p = state.lastFirehoseParams;
-        if (!p) return;
-        attachFirehoseAfterIdentified(ctx, p);
-      },
+      run: reconnect,
       reschedule: () => {
         scheduleFirehoseRetryAfterDrop();
       }
     });
   }
-  state.lastFirehoseParams = params;
-  clearFirehoseReconnectTimer();
-  if (state.firehoseReconnectAttempt === 0) {
-    try {
-      logFn("Connecting to preview tunnel (local HTTP proxy and dev logs)\u2026");
-    } catch {
-    }
+  return { clearFirehoseReconnectTimer, scheduleFirehoseRetryAfterDrop };
+}
+function logInitialFirehoseConnect(state, logFn) {
+  if (state.firehoseReconnectAttempt !== 0) return;
+  try {
+    logFn("Connecting to preview tunnel (local HTTP proxy and dev logs)\u2026");
+  } catch {
   }
+}
+function replaceFirehoseHandle(state) {
   state.firehoseGeneration += 1;
   const myGen = state.firehoseGeneration;
   if (state.firehoseHandle) {
     state.firehoseHandle.close();
     state.firehoseHandle = null;
   }
+  return myGen;
+}
+
+// src/connection/firehose/attach-firehose-after-identified.ts
+function attachFirehoseAfterIdentified(ctx, params) {
+  const { state, previewEnvironmentManager, logFn } = ctx;
+  const prev = state.lastFirehoseParams;
+  if (shouldReuseOpenFirehoseConnection(prev, params, () => state.firehoseHandle?.isConnected() ?? false)) {
+    state.lastFirehoseParams = params;
+    if (prev && !proxyPortsEqual(prev.proxyPorts, params.proxyPorts)) {
+      state.firehoseHandle?.updateIdentify(params);
+    }
+    return;
+  }
+  const { clearFirehoseReconnectTimer, scheduleFirehoseRetryAfterDrop } = createFirehoseReconnectScheduler(
+    ctx,
+    () => {
+      const p = state.lastFirehoseParams;
+      if (!p) return;
+      attachFirehoseAfterIdentified(ctx, p);
+    }
+  );
+  state.lastFirehoseParams = params;
+  clearFirehoseReconnectTimer();
+  logInitialFirehoseConnect(state, logFn);
+  const myGen = replaceFirehoseHandle(state);
+  const { onOpen, onClose } = createFirehoseConnectCallbacks(
+    state,
+    myGen,
+    logFn,
+    scheduleFirehoseRetryAfterDrop
+  );
   state.firehoseHandle = connectFirehose({
     firehoseServerUrl: params.firehoseServerUrl,
     workspaceId: params.workspaceId,
@@ -36019,45 +36226,17 @@ function attachFirehoseAfterIdentified(ctx, params) {
     log: logFn,
     previewEnvironmentManager,
     suppressWebSocketErrors: () => !state.closedByUser && state.firehoseOutage.startedAt != null,
-    onOpen: () => {
-      if (myGen !== state.firehoseGeneration) return;
-      try {
-        clearFirehoseReconnectQuietOnOpen(
-          {
-            firehoseQuiet: state.firehoseQuiet,
-            firehoseOutage: state.firehoseOutage,
-            lastFirehoseReconnectCloseMeta: state.lastFirehoseReconnectCloseMeta
-          },
-          logFn
-        );
-      } catch {
-      }
-      const logOpenAsFirehoseReconnect = state.firehoseReconnectAttempt > 0;
-      state.firehoseReconnectAttempt = 0;
-      if (!logOpenAsFirehoseReconnect) {
-        try {
-          logFn("Connected to preview tunnel (local HTTP proxy and dev logs).");
-        } catch {
-        }
-      }
-    },
-    onClose: (code, reason) => {
-      if (myGen !== state.firehoseGeneration) return;
-      state.firehoseHandle = null;
-      if (state.closedByUser) return;
-      state.lastFirehoseReconnectCloseMeta = { code, reason };
-      try {
-        beginFirehoseDeferredDisconnect(firehoseCtx(), code, reason, logFn);
-      } catch {
-      }
-      try {
-        scheduleFirehoseRetryAfterDrop({ code, reason });
-      } catch {
-      }
-    }
+    onOpen,
+    onClose
   });
 }
 
+// src/connection/firehose/update-firehose-identify-on-open-connection.ts
+function updateFirehoseIdentifyOnOpenConnection(state, params) {
+  state.lastFirehoseParams = params;
+  state.firehoseHandle?.updateIdentify(params);
+}
+
 // src/connection/create-bridge-identified-handler.ts
 function createOnBridgeIdentified(opts) {
   const { previewEnvironmentManager, firehoseServerUrl, workspaceId, state, logFn } = opts;
@@ -36094,6 +36273,7 @@ function createBridgeMessageDeps(params) {
     reportAutoDetectedAgents,
     warmupAgentCapabilitiesOnConnect: warmupAgentCapabilitiesOnConnect2,
     previewEnvironmentManager,
+    updateFirehoseProxyPorts,
     e2ee,
     cloudApiBaseUrl,
     getCloudAccessToken
@@ -36112,6 +36292,7 @@ function createBridgeMessageDeps(params) {
     reportAutoDetectedAgents,
     warmupAgentCapabilitiesOnConnect: warmupAgentCapabilitiesOnConnect2,
     previewEnvironmentManager,
+    updateFirehoseProxyPorts,
     e2ee,
     cloudApiBaseUrl,
     getCloudAccessToken
@@ -36372,6 +36553,11 @@ function createBridgeRuntimeMessageSetup(options) {
       getWs
     }),
     previewEnvironmentManager,
+    updateFirehoseProxyPorts: (proxyPorts) => {
+      const p = state.lastFirehoseParams;
+      if (!p) return;
+      updateFirehoseIdentifyOnOpenConnection(state, { ...p, proxyPorts });
+    },
     e2ee,
     cloudApiBaseUrl: apiUrl,
     getCloudAccessToken: () => tokens.accessToken
@@ -43641,16 +43827,16 @@ async function applySessionWipToPreviewCheckouts(options) {
       return;
     }
     await gitResetWorktreeToBranch(previewCheckout, deployBranch);
-    const applied2 = await applyWorkingTreeWip(
+    const applied = await applyWorkingTreeWip(
       previewCheckout,
       state.sessionCheckout,
       state.wip,
       log2
     );
-    if (!applied2.ok) {
+    if (!applied.ok) {
       failure = {
         ok: false,
-        error: applied2.error ?? `Failed to apply session WIP to preview (${state.repoPathRelativeToWorkspaceRoot})`
+        error: applied.error ?? `Failed to apply session WIP to preview (${state.repoPathRelativeToWorkspaceRoot})`
       };
     }
   });
@@ -43749,7 +43935,7 @@ async function deploySessionToPreviewEnvironment(options) {
     return { ok: false, error: "Failed to create preview environment worktrees" };
   }
   await yieldToEventLoop2();
-  const applied2 = await applySessionWipToPreviewCheckouts({
+  const applied = await applySessionWipToPreviewCheckouts({
     previewWorktreeManager,
     environmentId: eid,
     deployBranch,
@@ -43757,8 +43943,8 @@ async function deploySessionToPreviewEnvironment(options) {
     repoStates,
     log: log2
   });
-  if (!applied2.ok) {
-    return { ok: false, error: applied2.error };
+  if (!applied.ok) {
+    return { ok: false, error: applied.error };
   }
   log2(
     `[worktrees] Deployed session ${sid.slice(0, 8)}\u2026 to preview ${eid.slice(0, 8)}\u2026 on branch ${deployBranch}.`
@@ -46179,12 +46365,17 @@ var handlePreviewEnvironmentControl = (msg, deps) => {
 };
 
 // src/routing/handlers/preview-environments-config.ts
+var VALID_PORT = (p) => typeof p === "number" && Number.isInteger(p) && p > 0 && p < 65536;
 var handlePreviewEnvironmentsConfig = (msg, deps) => {
   const previewEnvironments = msg.previewEnvironments;
+  const proxyPorts = Array.isArray(msg.proxyPorts) ? msg.proxyPorts.filter(VALID_PORT) : void 0;
   setImmediate(() => {
     deps.previewEnvironmentManager?.applyConfig(previewEnvironments ?? []);
     const environmentIds = parsePreviewEnvironmentDefs(previewEnvironments ?? []).map((d) => d.environmentId);
     void deps.previewWorktreeManager?.syncConfiguredEnvironments(environmentIds);
+    if (proxyPorts !== void 0) {
+      deps.updateFirehoseProxyPorts?.(proxyPorts);
+    }
   });
 };