@clawchatsai/connector 0.0.18 → 0.0.20

package/dist/auth-handler.js

@@ -25,7 +25,7 @@ const blockedConnections = new Map(); // connectionId → unblock timestamp
 let lastUsedTotpStep = 0;
 /** Max nonces to prevent memory leaks from connection storms */
 const MAX_PENDING_NONCES = 10;
-const AUTH_TIMEOUT_MS = 30_000;
+const AUTH_TIMEOUT_MS = 60_000; // 60s — enough time to open authenticator app and enter code
 const MAX_FAILURES = 5;
 const BLOCK_DURATION_MS = 60_000;
 // ---------------------------------------------------------------------------

package/dist/index.d.ts

@@ -10,7 +10,7 @@
  * Spec: specs/multitenant-p2p.md sections 6.1-6.2
  */
 export declare const PLUGIN_ID = "connector";
-export declare const PLUGIN_VERSION = "0.0.18";
+export declare const PLUGIN_VERSION = "0.0.20";
 interface PluginServiceContext {
     stateDir: string;
     logger: {

package/dist/index.js

@@ -22,7 +22,7 @@ import { generateSessionSecret } from './session-token.js';
 // Inline from shared/api-version.ts to avoid rootDir conflict
 const CURRENT_API_VERSION = 1;
 export const PLUGIN_ID = 'connector';
-export const PLUGIN_VERSION = '0.0.18';
+export const PLUGIN_VERSION = '0.0.20';
 /** Max DataChannel message size (~256KB, leave room for envelope) */
 const MAX_DC_MESSAGE_SIZE = 256 * 1024;
 /** Active DataChannel connections: connectionId → send function */
@@ -327,7 +327,15 @@ function setupDataChannelHandler(dc, connectionId, ctx) {
                     // Pre-auth non-auth message — drop silently
                     return;
                 case 'pass':
-                    // Already authenticated — process message normally
+                    // Already authenticated — but verify this connection is actually
+                    // in connectedClients. If auth_timeout deleted the session but the
+                    // DC is still open, we'd get 'pass' for an un-authed connection.
+                    // Re-initiate auth instead of processing the message.
+                    if (!connectedClients.has(connectionId)) {
+                        ctx.logger.warn(`Stale connection ${connectionId} — re-initiating auth`);
+                        initAuth(dc, connectionId);
+                        return;
+                    }
                     break;
             }
             // Authenticated message processing

package/dist/shim.d.ts

@@ -56,6 +56,11 @@ declare class FakeRes extends Writable {
 }
 /**
  * Dispatch an RPC request through handleRequest and return the response.
+ *
+ * Safety nets:
+ * 1. If handleRequest() throws, we return a 500 with the error message.
+ * 2. If res.finished never resolves (handleRequest forgot to call res.end()),
+ *    we time out after RPC_TIMEOUT_MS and return a 504.
  */
 export declare function dispatchRpc(rpc: RpcRequest, handleRequest: HandleRequestFn): Promise<RpcResponse>;
 export {};

package/dist/shim.js

@@ -137,14 +137,51 @@ function tryJsonParse(buf) {
         return buf.toString('base64');
     }
 }
+/** RPC dispatch timeout — if handleRequest doesn't call res.end() within
+ *  this window, we return a 504 so the browser isn't left hanging. */
+const RPC_TIMEOUT_MS = 30_000;
 /**
  * Dispatch an RPC request through handleRequest and return the response.
+ *
+ * Safety nets:
+ * 1. If handleRequest() throws, we return a 500 with the error message.
+ * 2. If res.finished never resolves (handleRequest forgot to call res.end()),
+ *    we time out after RPC_TIMEOUT_MS and return a 504.
  */
 export async function dispatchRpc(rpc, handleRequest) {
     const req = new FakeReq(rpc);
     const res = new FakeRes();
-    await handleRequest(req, res);
-    const result = await res.finished;
+    try {
+        await handleRequest(req, res);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        const stack = err instanceof Error ? err.stack : undefined;
+        console.error(`[RPC] handleRequest threw for ${rpc.method} ${rpc.url}: ${message}`);
+        if (stack)
+            console.error(stack);
+        return {
+            id: rpc.id,
+            status: 500,
+            headers: {},
+            body: JSON.stringify({ error: 'Internal server error', detail: message }),
+        };
+    }
+    // Wait for res.finished, but give up after RPC_TIMEOUT_MS
+    const result = await Promise.race([
+        res.finished,
+        new Promise((_, reject) => setTimeout(() => reject(new Error('RPC_TIMEOUT')), RPC_TIMEOUT_MS)),
+    ]).catch((err) => {
+        console.error(`[RPC] Response never completed for ${rpc.method} ${rpc.url}: ${err.message}`);
+        return {
+            status: 504,
+            headers: {},
+            body: Buffer.from(JSON.stringify({
+                error: 'Gateway timeout',
+                detail: `Plugin did not respond within ${RPC_TIMEOUT_MS / 1000}s for ${rpc.method} ${rpc.url}`,
+            })),
+        };
+    });
     return {
         id: rpc.id,
         status: result.status,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawchatsai/connector",
-  "version": "0.0.18",
+  "version": "0.0.20",
   "type": "module",
   "description": "ClawChats OpenClaw plugin — P2P tunnel + local API bridge",
   "main": "dist/index.js",