@dev-anywhere/relay 0.9.1 → 0.9.3

package/assets/web/sw.js

@@ -1 +1 @@
-if(!self.define){let e,s={};const i=(i,n)=>(i=new URL(i+".js",n).href,s[i]||new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=i,e.onload=s,document.head.appendChild(e)}else e=i,importScripts(i),s()}).then(()=>{let e=s[i];if(!e)throw new Error(`Module ${i} didn’t register its module`);return e}));self.define=(n,r)=>{const t=e||("document"in self?document.currentScript.src:"")||location.href;if(s[t])return;let o={};const c=e=>i(e,t),l={module:{uri:t},exports:o,require:c};s[t]=Promise.all(n.map(e=>l[e]||c(e))).then(e=>(r(...e),o))}}define(["./workbox-10a3128e"],function(e){"use strict";importScripts("notification-sw.js"),self.skipWaiting(),e.clientsClaim(),e.precacheAndRoute([{url:"registerSW.js",revision:"1872c500de691dce40960bb85481de07"},{url:"notification-sw.js",revision:"ee0be62f4c1f36625b92680b3060becb"},{url:"index.html",revision:"4bc84aa98e8598d7707aac11006c5e6e"},{url:"assets/jmuxer.min-BMedIzGm.js",revision:null},{url:"assets/index-CTJCtPHc.css",revision:null},{url:"assets/index-Buv7a7PI.js",revision:null},{url:"assets/fvad-DreiJBJr.js",revision:null},{url:"assets/fvad-DYxbW2my.wasm",revision:null},{url:"assets/__vite-browser-external-D7Ct-6yo.js",revision:null},{url:"brand-icon.svg",revision:"efe8505a7b7ef12cbb3a4bcd286254bd"},{url:"maskable-icon-512x512.png",revision:"e762ff07cdedcd78f8650f59c6881727"},{url:"pwa-192x192.png",revision:"4e4603ce0f22528eded553ba7f2ffbc5"},{url:"pwa-512x512.png",revision:"e762ff07cdedcd78f8650f59c6881727"},{url:"pwa-64x64.png",revision:"d322160ad1dc08ba9e133cb3d296ae63"},{url:"manifest.webmanifest",revision:"4daa295c44052f4ce59a1fcfd6f06ab8"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("/index.html"),{denylist:[/^\/proxy(\/|$|\?)/,/^\/client(\/|$|\?)/,/^\/voice(\/|$|\?)/,/^\/fonts\//,/^\/health/,/^\/status/,/^\/api\//]})),e.registerRoute(/^\/fonts\/.*\.(woff2|woff|ttf|otf|css)$/,new e.CacheFirst({cacheName:"dev-anywhere-fonts",plugins:[new e.ExpirationPlugin({maxEntries:40,maxAgeSeconds:15552e3})]}),"GET")});
+if(!self.define){let e,s={};const i=(i,n)=>(i=new URL(i+".js",n).href,s[i]||new Promise(s=>{if("document"in self){const e=document.createElement("script");e.src=i,e.onload=s,document.head.appendChild(e)}else e=i,importScripts(i),s()}).then(()=>{let e=s[i];if(!e)throw new Error(`Module ${i} didn’t register its module`);return e}));self.define=(n,r)=>{const o=e||("document"in self?document.currentScript.src:"")||location.href;if(s[o])return;let t={};const l=e=>i(e,o),c={module:{uri:o},exports:t,require:l};s[o]=Promise.all(n.map(e=>c[e]||l(e))).then(e=>(r(...e),t))}}define(["./workbox-10a3128e"],function(e){"use strict";importScripts("notification-sw.js"),self.skipWaiting(),e.clientsClaim(),e.precacheAndRoute([{url:"registerSW.js",revision:"1872c500de691dce40960bb85481de07"},{url:"notification-sw.js",revision:"ee0be62f4c1f36625b92680b3060becb"},{url:"index.html",revision:"bb20b4ecbecb601d7f08075e68281105"},{url:"assets/jmuxer.min-CqkQ8MXd.js",revision:null},{url:"assets/index-BVDmlZok.css",revision:null},{url:"assets/index-BDBa51VR.js",revision:null},{url:"assets/fvad-okuu-1HD.js",revision:null},{url:"assets/fvad-DYxbW2my.wasm",revision:null},{url:"assets/__vite-browser-external-D7Ct-6yo.js",revision:null},{url:"brand-icon.svg",revision:"efe8505a7b7ef12cbb3a4bcd286254bd"},{url:"maskable-icon-512x512.png",revision:"e762ff07cdedcd78f8650f59c6881727"},{url:"pwa-192x192.png",revision:"4e4603ce0f22528eded553ba7f2ffbc5"},{url:"pwa-512x512.png",revision:"e762ff07cdedcd78f8650f59c6881727"},{url:"pwa-64x64.png",revision:"d322160ad1dc08ba9e133cb3d296ae63"},{url:"manifest.webmanifest",revision:"4daa295c44052f4ce59a1fcfd6f06ab8"}],{}),e.cleanupOutdatedCaches(),e.registerRoute(new e.NavigationRoute(e.createHandlerBoundToURL("/index.html"),{denylist:[/^\/proxy(\/|$|\?)/,/^\/client(\/|$|\?)/,/^\/voice(\/|$|\?)/,/^\/fonts\//,/^\/health/,/^\/status/,/^\/api\//]})),e.registerRoute(/^\/fonts\/.*\.(woff2|woff|ttf|otf|css)$/,new e.CacheFirst({cacheName:"dev-anywhere-fonts",plugins:[new e.ExpirationPlugin({maxEntries:40,maxAgeSeconds:15552e3})]}),"GET")});

package/dist/{chunk-JLLMBFAB.js → chunk-PMXR723R.js}

@@ -130,7 +130,7 @@ function createSessionIdentitySchema(commonFields) {
       kind: z4.literal("terminal"),
       mode: z4.literal("pty"),
       provider: z4.literal("claude"),
-      ptyOwner: z4.literal("local-terminal")
+      ptyOwner: z4.literal("proxy-hosted")
     }).strict()
   ]);
 }
@@ -489,7 +489,7 @@ var ProxyUpgradeBootstrapResponseSchema = z9.object({
   bootstrapVersion: z9.literal(PROXY_UPGRADE_BOOTSTRAP_VERSION),
   relayVersion: StableVersionSchema,
   controlProtocolVersion: z9.number().int().positive()
-}).strict();
+});
 
 // ../../packages/shared/dist/schemas/web-preview.js
 import { z as z10 } from "zod";
@@ -1446,7 +1446,7 @@ var SessionCreateSuccessResponseSchema = z13.discriminatedUnion("mode", [
       kind: z13.literal("terminal"),
       mode: z13.literal("pty"),
       provider: z13.literal("claude"),
-      ptyOwner: z13.literal("local-terminal")
+      ptyOwner: z13.literal("proxy-hosted")
     }).strict()
   ])
 ]);
@@ -2109,6 +2109,29 @@ var RelayCloseCode = {
   DEVICE_STREAM_BINDING_REJECTED: 4404,
   PROXY_PROTOCOL_REJECTED: 4405
 };
+var RelayProtocolRejectReason = {
+  PAGE_OUTDATED: "page_outdated",
+  SERVICE_OUTDATED: "service_outdated",
+  PROTOCOL_MISMATCH: "protocol_mismatch"
+};
+var ProxyProtocolAdmissionDirection = {
+  COMPATIBLE: "compatible",
+  PROXY_OUTDATED: "proxy_outdated",
+  RELAY_OUTDATED: "relay_outdated",
+  PROTOCOL_MISMATCH: "protocol_mismatch"
+};
+function isPositiveSafeProtocolVersion(value) {
+  return Number.isSafeInteger(value) && value > 0;
+}
+function compareProxyRelayProtocolVersions(proxyProtocolVersion, relayProtocolVersion) {
+  if (!isPositiveSafeProtocolVersion(proxyProtocolVersion) || !isPositiveSafeProtocolVersion(relayProtocolVersion)) {
+    return ProxyProtocolAdmissionDirection.PROTOCOL_MISMATCH;
+  }
+  if (proxyProtocolVersion === relayProtocolVersion) {
+    return ProxyProtocolAdmissionDirection.COMPATIBLE;
+  }
+  return proxyProtocolVersion < relayProtocolVersion ? ProxyProtocolAdmissionDirection.PROXY_OUTDATED : ProxyProtocolAdmissionDirection.RELAY_OUTDATED;
+}
 
 // ../../packages/shared/dist/constants/wire-limits.js
 var RELAY_JSON_MESSAGE_MAX_BYTES = 8 * 1024 * 1024;
@@ -2628,8 +2651,8 @@ var RelayRegistry = class {
   }
   getAllClientWs() {
     const clients = [];
-    for (const ws of this.connectedClients.keys()) {
-      if (ws.readyState === WebSocket.OPEN) {
+    for (const [ws, metadata] of this.connectedClients) {
+      if (metadata.clientId && ws.readyState === WebSocket.OPEN) {
         clients.push(ws);
       }
     }
@@ -2718,9 +2741,11 @@ function healthRouter(registry, options = {}) {
   const proxyTokenRequired = options.proxyTokenRequired ?? false;
   const clientTokenRequired = options.clientTokenRequired ?? false;
   router.get("/health", (_req, res) => {
+    res.setHeader("Cache-Control", "no-store");
     res.json({
       status: "ok",
       version: RELAY_VERSION,
+      controlProtocolVersion: RELAY_CONTROL_PROTOCOL_VERSION,
       uptime: process.uptime(),
       auth: {
         proxyTokenRequired,
@@ -3223,6 +3248,8 @@ var PREVIEW_PUSH_TYPES = /* @__PURE__ */ new Set([
   "device_preview_state_push",
   "device_preview_removed_push"
 ]);
+var DEFAULT_PROXY_ADMISSION_TIMEOUT_MS = 1e4;
+var RETRYABLE_PROXY_ADMISSION_TIMEOUT_CLOSE_CODE = 1013;
 function isPreviewEventMessage(message) {
   return PREVIEW_EVENT_TYPES.has(message.type);
 }
@@ -3303,28 +3330,60 @@ function rejectNotRegistered(ws) {
     })
   );
 }
-function closeRejectedProxyProtocol(ws) {
-  ws.close(RelayCloseCode.PROXY_PROTOCOL_REJECTED, "proxy protocol rejected");
+function closeRejectedProxyProtocol(ws, direction = ProxyProtocolAdmissionDirection.PROTOCOL_MISMATCH) {
+  if (ws.admissionPhase === "rejected") return;
+  ws.admissionPhase = "rejected";
+  ws.close(RelayCloseCode.PROXY_PROTOCOL_REJECTED, direction);
+}
+function classifyInitialProxyProtocol(raw) {
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    return ProxyProtocolAdmissionDirection.PROTOCOL_MISMATCH;
+  }
+  if (!value || typeof value !== "object" || value.type !== "proxy_register") {
+    return ProxyProtocolAdmissionDirection.PROTOCOL_MISMATCH;
+  }
+  const direction = compareProxyRelayProtocolVersions(
+    value.protocolVersion,
+    RELAY_CONTROL_PROTOCOL_VERSION
+  );
+  return direction === ProxyProtocolAdmissionDirection.COMPATIBLE ? null : direction;
 }
 function isCurrentProxySocket(ws, registry) {
   return ws.proxyId !== void 0 && registry.getProxy(ws.proxyId) === ws;
 }
-function handleProxyConnection(ws, registry, logger, ptySnapshotRoutes, sessionHistoryRoutes, webPreviewRoutes, devicePreviewBridge, chaos, remoteFileBridge) {
+function handleProxyConnection(ws, registry, logger, ptySnapshotRoutes, sessionHistoryRoutes, webPreviewRoutes, devicePreviewBridge, chaos, remoteFileBridge, proxyAdmissionTimeoutMs = DEFAULT_PROXY_ADMISSION_TIMEOUT_MS) {
   const proxyWs = ws;
   proxyWs.isAlive = true;
+  proxyWs.admissionPhase = "awaiting";
   let registrationCompleted = false;
-  let upgradeBootstrapStarted = false;
   let initialFrameReceived = false;
+  const effectiveAdmissionTimeoutMs = Number.isSafeInteger(proxyAdmissionTimeoutMs) && proxyAdmissionTimeoutMs > 0 ? proxyAdmissionTimeoutMs : DEFAULT_PROXY_ADMISSION_TIMEOUT_MS;
+  let admissionTimeout = setTimeout(() => {
+    admissionTimeout = null;
+    if (proxyWs.admissionPhase !== "awaiting" || proxyWs.readyState !== WebSocket4.OPEN) return;
+    proxyWs.admissionPhase = "rejected";
+    logger.warn({ timeoutMs: effectiveAdmissionTimeoutMs }, "Proxy registration timed out");
+    proxyWs.close(RETRYABLE_PROXY_ADMISSION_TIMEOUT_CLOSE_CODE, "proxy registration timeout");
+  }, effectiveAdmissionTimeoutMs);
+  admissionTimeout.unref?.();
+  const clearAdmissionTimeout = () => {
+    if (!admissionTimeout) return;
+    clearTimeout(admissionTimeout);
+    admissionTimeout = null;
+  };
   proxyWs.on("pong", () => {
     proxyWs.isAlive = true;
   });
   proxyWs.on("message", (data, isBinary) => {
-    if (upgradeBootstrapStarted) return;
+    if (proxyWs.admissionPhase === "quarantined" || proxyWs.admissionPhase === "rejected") return;
     const isInitialFrame = !initialFrameReceived;
     initialFrameReceived = true;
     if (isBinary) {
       if (!proxyWs.proxyId) {
-        closeRejectedProxyProtocol(proxyWs);
+        closeRejectedProxyProtocol(proxyWs, ProxyProtocolAdmissionDirection.PROTOCOL_MISMATCH);
         return;
       }
       if (!isCurrentProxySocket(proxyWs, registry)) {
@@ -3366,13 +3425,16 @@ function handleProxyConnection(ws, registry, logger, ptySnapshotRoutes, sessionH
         { size: data.length, proxyId: proxyWs.proxyId },
         "JSON message rejected: exceeds max size"
       );
-      if (!proxyWs.proxyId) closeRejectedProxyProtocol(proxyWs);
+      if (!proxyWs.proxyId) {
+        closeRejectedProxyProtocol(proxyWs, ProxyProtocolAdmissionDirection.PROTOCOL_MISMATCH);
+      }
       return;
     }
     const raw = data.toString();
     const upgradeBootstrap = isInitialFrame ? parseProxyUpgradeBootstrapRequest(raw, RELAY_VERSION) : null;
     if (upgradeBootstrap) {
-      upgradeBootstrapStarted = true;
+      proxyWs.admissionPhase = "quarantined";
+      clearAdmissionTimeout();
       logger.info(
         {
           proxyId: upgradeBootstrap.proxyId,
@@ -3384,6 +3446,14 @@ function handleProxyConnection(ws, registry, logger, ptySnapshotRoutes, sessionH
       sendProxyUpgradeBootstrapResponse(proxyWs, RELAY_VERSION);
       return;
     }
+    if (isInitialFrame) {
+      const rejection = classifyInitialProxyProtocol(raw);
+      if (rejection) {
+        logger.warn({ direction: rejection }, "Proxy control protocol rejected before admission");
+        closeRejectedProxyProtocol(proxyWs, rejection);
+        return;
+      }
+    }
     const result = parseMessage(raw);
     if (result.kind === "control" && result.message.type === "proxy_register") {
       if (registrationCompleted) {
@@ -3391,10 +3461,12 @@ function handleProxyConnection(ws, registry, logger, ptySnapshotRoutes, sessionH
           { proxyId: proxyWs.proxyId, requestedProxyId: result.message.proxyId },
           "Repeated Proxy registration on the same socket rejected"
         );
-        closeRejectedProxyProtocol(proxyWs);
+        closeRejectedProxyProtocol(proxyWs, ProxyProtocolAdmissionDirection.PROTOCOL_MISMATCH);
         return;
       }
       const { proxyId, name, proxyVersion } = result.message;
+      proxyWs.admissionPhase = "ready";
+      clearAdmissionTimeout();
       const status = registry.registerProxy(proxyId, proxyWs, proxyVersion, name);
       proxyWs.proxyId = proxyId;
       registrationCompleted = true;
@@ -3421,8 +3493,7 @@ function handleProxyConnection(ws, registry, logger, ptySnapshotRoutes, sessionH
       return;
     }
     if (!proxyWs.proxyId) {
-      rejectNotRegistered(proxyWs);
-      closeRejectedProxyProtocol(proxyWs);
+      closeRejectedProxyProtocol(proxyWs, ProxyProtocolAdmissionDirection.PROTOCOL_MISMATCH);
       return;
     }
     if (!isCurrentProxySocket(proxyWs, registry)) {
@@ -3722,6 +3793,7 @@ function handleProxyConnection(ws, registry, logger, ptySnapshotRoutes, sessionH
     }
   });
   proxyWs.on("close", (code, reason) => {
+    clearAdmissionTimeout();
     if (!proxyWs.proxyId) return;
     const closeMeta = { code, reason: reason.toString() || void 0 };
     const current = registry.getProxy(proxyWs.proxyId);
@@ -4486,15 +4558,45 @@ var DevicePreviewRouteRegistry = class extends PreviewRouteRegistry {
   }
 };
 
-// src/handlers/client.ts
-function isMalformedClientRegister(raw) {
+// src/client-registration-admission.ts
+function inspectClientRegistrationAdmission(raw) {
+  let value;
   try {
-    const parsed = JSON.parse(raw);
-    return parsed !== null && typeof parsed === "object" && parsed.type === "client_register";
+    value = JSON.parse(raw);
   } catch {
-    return false;
+    return { kind: "not_client_registration" };
+  }
+  if (value === null || typeof value !== "object") {
+    return { kind: "not_client_registration" };
+  }
+  const candidate = value;
+  if (candidate.type !== "client_register") {
+    return { kind: "not_client_registration" };
+  }
+  const clientId = typeof candidate.clientId === "string" ? candidate.clientId : void 0;
+  if (!("protocolVersion" in candidate)) {
+    return {
+      kind: "unversioned_client_registration",
+      ...clientId !== void 0 ? { clientId } : {}
+    };
+  }
+  return {
+    kind: "versioned_client_registration",
+    ...clientId !== void 0 ? { clientId } : {},
+    protocolVersion: candidate.protocolVersion
+  };
+}
+function classifyClientRegistrationProtocol(clientVersion, relayVersion = RELAY_CONTROL_PROTOCOL_VERSION) {
+  if (typeof clientVersion !== "number" || !Number.isSafeInteger(clientVersion) || clientVersion <= 0) {
+    return RelayProtocolRejectReason.PROTOCOL_MISMATCH;
   }
+  if (clientVersion === relayVersion) return null;
+  return clientVersion < relayVersion ? RelayProtocolRejectReason.PAGE_OUTDATED : RelayProtocolRejectReason.SERVICE_OUTDATED;
 }
+
+// src/handlers/client.ts
+var DEFAULT_CLIENT_ADMISSION_TIMEOUT_MS = 1e4;
+var RETRYABLE_CLIENT_ADMISSION_TIMEOUT_CLOSE_CODE = 1013;
 function handleClientRegister(registration, clientWs, registry, logger, webPreviewRoutes, devicePreviewBridge) {
   const { clientId } = registration;
   if (clientWs.clientId && clientWs.clientId !== clientId) {
@@ -4849,8 +4951,36 @@ function validatePreviewScope(ws, registry, requestId, scope) {
   rejectStaleBinding(ws, requestId);
   return false;
 }
-function closeRejectedClientProtocol(ws) {
-  ws.close(RelayCloseCode.CLIENT_PROTOCOL_REJECTED, "client protocol rejected");
+function closeRejectedClientProtocol(ws, reason = RelayProtocolRejectReason.PROTOCOL_MISMATCH) {
+  if (!beginClientRejection(ws)) return;
+  ws.close(RelayCloseCode.CLIENT_PROTOCOL_REJECTED, reason);
+}
+function beginClientRejection(ws) {
+  if (ws.admissionPhase === "rejected") return false;
+  ws.admissionPhase = "rejected";
+  return ws.readyState !== WebSocket7.CLOSING && ws.readyState !== WebSocket7.CLOSED;
+}
+function closeUnversionedClientProtocol(ws) {
+  if (!beginClientRejection(ws)) return;
+  ws.send(
+    JSON.stringify({
+      type: "relay_client_kicked",
+      reason: "\u9875\u9762\u7248\u672C\u5DF2\u66F4\u65B0\uFF0C\u8BF7\u5237\u65B0"
+    })
+  );
+  ws.close(RelayCloseCode.CLIENT_KICKED, "client refresh required");
+}
+function rejectVersionedClientProtocol(ws, clientProtocolVersion, reason, clientId, logger) {
+  logger.warn(
+    {
+      ...clientId !== void 0 ? { clientId } : {},
+      clientProtocolVersion,
+      relayProtocolVersion: RELAY_CONTROL_PROTOCOL_VERSION,
+      reason
+    },
+    "Client control protocol rejected at admission"
+  );
+  closeRejectedClientProtocol(ws, reason);
 }
 function rejectProxySelect(ws, requestId, proxyId) {
   ws.send(
@@ -4903,14 +5033,33 @@ function sendRemoteFileUploadUrlFailure(ws, requestId, sessionId, error, errorCo
     })
   );
 }
-function handleClientConnection(ws, registry, logger, ptySnapshotRoutes, sessionHistoryRoutes, webPreviewRoutes, devicePreviewBridge, chaos, voiceConfigStore, voiceProviders, remoteFileBridge, connectionInfo = {}) {
+function handleClientConnection(ws, registry, logger, ptySnapshotRoutes, sessionHistoryRoutes, webPreviewRoutes, devicePreviewBridge, chaos, voiceConfigStore, voiceProviders, remoteFileBridge, connectionInfo = {}, clientAdmissionTimeoutMs = DEFAULT_CLIENT_ADMISSION_TIMEOUT_MS) {
   const clientWs = ws;
   clientWs.isAlive = true;
+  clientWs.admissionPhase = "awaiting";
   registry.addClientWs(clientWs, connectionInfo);
+  const effectiveAdmissionTimeoutMs = Number.isSafeInteger(clientAdmissionTimeoutMs) && clientAdmissionTimeoutMs > 0 ? clientAdmissionTimeoutMs : DEFAULT_CLIENT_ADMISSION_TIMEOUT_MS;
+  let admissionTimeout = setTimeout(() => {
+    admissionTimeout = null;
+    if (clientWs.admissionPhase !== "awaiting" || clientWs.readyState !== WebSocket7.OPEN) return;
+    if (!beginClientRejection(clientWs)) return;
+    logger.warn(
+      { timeoutMs: effectiveAdmissionTimeoutMs, remoteAddress: connectionInfo.remoteAddress },
+      "Client registration timed out"
+    );
+    clientWs.close(RETRYABLE_CLIENT_ADMISSION_TIMEOUT_CLOSE_CODE, "client registration timeout");
+  }, effectiveAdmissionTimeoutMs);
+  admissionTimeout.unref?.();
+  const clearAdmissionTimeout = () => {
+    if (!admissionTimeout) return;
+    clearTimeout(admissionTimeout);
+    admissionTimeout = null;
+  };
   clientWs.on("pong", () => {
     clientWs.isAlive = true;
   });
   clientWs.on("message", (data, isBinary) => {
+    if (clientWs.admissionPhase === "rejected") return;
     if (isBinary) {
       if (!clientWs.clientId) closeRejectedClientProtocol(clientWs);
       return;
@@ -4924,6 +5073,32 @@ function handleClientConnection(ws, registry, logger, ptySnapshotRoutes, session
       return;
     }
     const raw = data.toString();
+    const registrationAdmission = inspectClientRegistrationAdmission(raw);
+    if (registrationAdmission.kind === "unversioned_client_registration") {
+      logger.warn(
+        {
+          ...registrationAdmission.clientId !== void 0 ? { clientId: registrationAdmission.clientId } : {}
+        },
+        "Unversioned client registration rejected"
+      );
+      closeUnversionedClientProtocol(clientWs);
+      return;
+    }
+    if (registrationAdmission.kind === "versioned_client_registration") {
+      const registrationProtocolIssue = classifyClientRegistrationProtocol(
+        registrationAdmission.protocolVersion
+      );
+      if (registrationProtocolIssue) {
+        rejectVersionedClientProtocol(
+          clientWs,
+          registrationAdmission.protocolVersion,
+          registrationProtocolIssue,
+          registrationAdmission.clientId,
+          logger
+        );
+        return;
+      }
+    }
     const result = parseMessage(raw);
     if (result.kind === "control") {
       const msg = result.message;
@@ -4940,6 +5115,8 @@ function handleClientConnection(ws, registry, logger, ptySnapshotRoutes, session
           webPreviewRoutes,
           devicePreviewBridge
         );
+        clientWs.admissionPhase = "ready";
+        clearAdmissionTimeout();
         return;
       }
       if (!clientWs.clientId) {
@@ -5457,7 +5634,13 @@ function handleClientConnection(ws, registry, logger, ptySnapshotRoutes, session
       routeClientMessage(raw, clientWs.boundProxyId, clientWs, registry, logger, chaos);
       return;
     }
-    logger.error({ error: result.error, raw: raw.slice(0, 200) }, "Invalid message from client");
+    const isRegistrationAttempt = registrationAdmission.kind !== "not_client_registration";
+    const logContext = {
+      error: result.error,
+      raw: raw.slice(0, 200),
+      ...registrationAdmission.kind !== "not_client_registration" && registrationAdmission.clientId !== void 0 ? { clientId: registrationAdmission.clientId } : {}
+    };
+    logger.error(logContext, "Invalid message from client");
     clientWs.send(
       JSON.stringify({
         type: "relay_error",
@@ -5465,11 +5648,13 @@ function handleClientConnection(ws, registry, logger, ptySnapshotRoutes, session
         message: `${result.error} | raw: ${raw.slice(0, 200)}`
       })
     );
-    if (isMalformedClientRegister(raw) || !clientWs.clientId) {
+    if (isRegistrationAttempt || !clientWs.clientId) {
       closeRejectedClientProtocol(clientWs);
     }
   });
   clientWs.on("close", (code, reason) => {
+    clearAdmissionTimeout();
+    clientWs.admissionPhase = "rejected";
     ptySnapshotRoutes.abandonSocket(clientWs);
     sessionHistoryRoutes.abandonSocket(clientWs);
     webPreviewRoutes.abandonSocket(clientWs);
@@ -8568,7 +8753,8 @@ function createRelayServer(options) {
       webPreviewRoutes,
       devicePreviewBridge,
       relayChaos,
-      remoteFileBridge
+      remoteFileBridge,
+      options.proxyAdmissionTimeoutMs
     );
   });
   devicePreviewStreamWss.on("connection", (ws) => {
@@ -8590,7 +8776,8 @@ function createRelayServer(options) {
       {
         userAgent: firstHeaderValue(request.headers["user-agent"]),
         remoteAddress: requestRemoteAddress(request)
-      }
+      },
+      options.clientAdmissionTimeoutMs
     );
   });
   voiceAsrWss.on("connection", (ws) => {
@@ -8697,4 +8884,4 @@ export {
   parseRelayChaosFromEnv,
   createRelayServer
 };
-//# sourceMappingURL=chunk-JLLMBFAB.js.map
+//# sourceMappingURL=chunk-PMXR723R.js.map