@floegence/flowersec-core 0.24.0 → 0.25.0

package/README.md

@@ -27,6 +27,12 @@ Start with the [TypeScript cookbook](https://github.com/floegence/flowersec/tree
 
 High-level WebSocket connections require TLS by default. Use `AllowPlaintextForLoopback` only for literal local development targets.
 
+## Node Proxy Server
+
+The Node entrypoint exports `serveProxySession(...)`, `serveProxyStream(...)`, and `ProxyServerOptions`. Request bodies remain bounded per request by `maxBodyBytes`; `maxBufferedRequestBodyBytes` additionally caps the total buffered request-body bytes owned by one proxy session. WebSocket frames remain bounded by `maxWsFrameBytes`; `maxWsQueuedBytes` additionally caps upstream-to-Yamux queued bytes per connection, while the reverse direction waits for each Node `ws` send callback.
+
+The defaults keep one session request-body budget equal to `maxBodyBytes` and one queued WebSocket frame plus its proxy header. Raise either limit only when the deployment has a matching memory budget.
+
 ## Runtime Boundaries
 
 TypeScript owns browser and Service Worker integration. Shared tunnel, proxy gateway, and helper binaries remain Go-owned.

package/dist/client-connect/transportSecurity.js

@@ -35,7 +35,7 @@ export async function enforceTransportSecurity(args) {
     const policy = args.policy ?? RequireTLS;
     try {
         if (typeof policy === "function") {
-            allowed = await policy(input);
+            allowed = await policy(input) === true;
         }
         else {
             allowed = evaluatePreset(policy, target);

package/dist/endpoint/index.js

@@ -1,5 +1,6 @@
 import { Role as ControlRole, assertChannelInitGrant } from "../gen/flowersec/controlplane/v1.gen.js";
 import { Role as TunnelRole } from "../gen/flowersec/tunnel/v1.gen.js";
+import { withAbortAndTimeout } from "../client-connect/common.js";
 import { assertTunnelGrantContract, assertValidPSK, prepareChannelId } from "../client-connect/contract.js";
 import { enforceTransportSecurity } from "../client-connect/transportSecurity.js";
 import { SDK_DEFAULTS } from "../defaults.js";
@@ -12,7 +13,7 @@ import { isYamuxPingTimeoutError } from "../yamux/errors.js";
 import { YamuxSession } from "../yamux/session.js";
 import { RpcServer } from "../rpc/server.js";
 import { base64urlDecode, base64urlEncode } from "../utils/base64url.js";
-import { AbortError, FlowersecError } from "../utils/errors.js";
+import { AbortError, FlowersecError, TimeoutError, throwIfAborted } from "../utils/errors.js";
 import { WebSocketBinaryTransport } from "../ws-client/binaryTransport.js";
 export class Session {
     secure;
@@ -152,15 +153,46 @@ export class Session {
     }
 }
 export async function acceptDirect(websocket, handshake, options = {}) {
+    const handshakeTimeoutMs = options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs;
+    if (!Number.isFinite(handshakeTimeoutMs) || handshakeTimeoutMs < 0) {
+        throw new FlowersecError({
+            path: "direct",
+            stage: "validate",
+            code: "invalid_option",
+            message: "handshakeTimeoutMs must be a non-negative number",
+        });
+    }
     await enforceIncomingDirectTransport(options);
+    const deadline = createHandshakeDeadline(handshakeTimeoutMs);
     const transport = new WebSocketBinaryTransport(websocket, webSocketTransportOptions(options));
-    return await establishSession("direct", transport, handshake, options);
+    return await establishSession("direct", transport, handshake, options, undefined, deadline);
 }
 export async function acceptDirectResolved(websocket, resolver, options = {}) {
+    const handshakeTimeoutMs = options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs;
+    if (!Number.isFinite(handshakeTimeoutMs) || handshakeTimeoutMs < 0) {
+        throw new FlowersecError({
+            path: "direct",
+            stage: "validate",
+            code: "invalid_option",
+            message: "handshakeTimeoutMs must be a non-negative number",
+        });
+    }
     await enforceIncomingDirectTransport(options);
+    const deadline = createHandshakeDeadline(handshakeTimeoutMs);
     const transport = new WebSocketBinaryTransport(websocket, webSocketTransportOptions(options));
-    const first = await transport.readBinary(readOptions(options));
+    let first;
+    try {
+        first = await runHandshakeStep(deadline, options.signal, () => transport.readBinary({
+            ...(options.signal === undefined ? {} : { signal: options.signal }),
+            timeoutMs: remainingHandshakeTimeoutMs(deadline),
+        }));
+    }
+    catch (error) {
+        transport.close();
+        throw endpointHandshakeError("direct", error, "failed to read handshake init");
+    }
     let init;
+    let channelId;
     try {
         const decoded = decodeHandshakeFrame(first, options.maxHandshakePayload ?? SDK_DEFAULTS.e2ee.maxHandshakePayloadBytes);
         if (decoded.handshakeType !== HANDSHAKE_TYPE_INIT)
@@ -168,30 +200,44 @@ export async function acceptDirectResolved(websocket, resolver, options = {}) {
         init = JSON.parse(new TextDecoder().decode(decoded.payloadJsonUtf8));
         if (init.version !== PROTOCOL_VERSION || init.role !== 1 || (init.suite !== 1 && init.suite !== 2))
             throw new Error("invalid handshake init");
+        channelId = prepareChannelId(init.channel_id, "direct");
+        if (channelId !== init.channel_id) {
+            throw new FlowersecError({
+                path: "direct",
+                stage: "validate",
+                code: "invalid_input",
+                message: "channel_id must not have leading or trailing whitespace",
+            });
+        }
     }
     catch (error) {
         transport.close();
+        if (error instanceof FlowersecError)
+            throw error;
         throw new FlowersecError({ path: "direct", stage: "handshake", code: "handshake_failed", message: "invalid handshake init", cause: error });
     }
     let credential;
     try {
-        credential = await resolver({
-            channelId: prepareChannelId(init.channel_id, "direct"),
+        credential = await runHandshakeStep(deadline, options.signal, () => resolver({
+            channelId,
             version: init.version,
             suite: init.suite,
             clientFeatures: init.client_features >>> 0,
-        });
+        }));
     }
     catch (error) {
         transport.close();
+        const interrupted = endpointHandshakeInterruption("direct", error);
+        if (interrupted != null)
+            throw interrupted;
         throw new FlowersecError({ path: "direct", stage: "validate", code: "resolve_failed", message: "credential resolution failed", cause: error });
     }
     const replay = new PrefetchedTransport(transport, first);
     return await establishSession("direct", replay, {
-        channelId: init.channel_id,
+        channelId,
         suite: init.suite,
         ...credential,
-    }, options);
+    }, options, undefined, deadline);
 }
 export async function connectTunnel(grantInput, options) {
     let grant;
@@ -202,6 +248,7 @@ export async function connectTunnel(grantInput, options) {
         throw new FlowersecError({ path: "tunnel", stage: "validate", code: "invalid_input", message: "invalid ChannelInitGrant", cause: error });
     }
     assertTunnelGrantContract(grant, ControlRole.Role_server);
+    const channelId = prepareChannelId(grant.channel_id, "tunnel");
     const tunnelUrl = grant.tunnel_url.trim();
     if (tunnelUrl === "")
         throw new FlowersecError({ path: "tunnel", stage: "validate", code: "missing_tunnel_url", message: "missing tunnel_url" });
@@ -212,35 +259,63 @@ export async function connectTunnel(grantInput, options) {
     const origin = options.origin.trim();
     if (origin === "")
         throw new FlowersecError({ path: "tunnel", stage: "validate", code: "missing_origin", message: "missing origin" });
+    const connectTimeoutMs = options.connectTimeoutMs ?? SDK_DEFAULTS.transport.connectTimeoutMs;
+    if (!Number.isFinite(connectTimeoutMs) || connectTimeoutMs < 0) {
+        throw new FlowersecError({
+            path: "tunnel",
+            stage: "validate",
+            code: "invalid_option",
+            message: "connectTimeoutMs must be a non-negative number",
+        });
+    }
+    const handshakeTimeoutMs = options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs;
+    if (!Number.isFinite(handshakeTimeoutMs) || handshakeTimeoutMs < 0) {
+        throw new FlowersecError({
+            path: "tunnel",
+            stage: "validate",
+            code: "invalid_option",
+            message: "handshakeTimeoutMs must be a non-negative number",
+        });
+    }
+    const psk = assertValidPSK(grant.e2ee_psk_b64u, "tunnel");
     await enforceTransportSecurity({ rawUrl: tunnelUrl, path: "tunnel", ...(options.transportSecurityPolicy === undefined ? {} : { policy: options.transportSecurityPolicy }) });
     const endpointInstanceId = normalizeEndpointInstanceId(options.endpointInstanceId);
-    const websocket = options.wsFactory(tunnelUrl, origin);
-    const transport = new WebSocketBinaryTransport(websocket, webSocketTransportOptions(options));
+    let transport;
     try {
-        await waitForOpen(websocket, options.connectTimeoutMs ?? SDK_DEFAULTS.transport.connectTimeoutMs, options.signal);
+        throwIfAborted(options.signal, "connect aborted");
+        const websocket = options.wsFactory(tunnelUrl, origin);
+        transport = new WebSocketBinaryTransport(websocket, webSocketTransportOptions(options));
+        await waitForOpen(websocket, connectTimeoutMs, options.signal);
+        throwIfAborted(options.signal, "connect aborted");
         const attach = {
             v: 1,
-            channel_id: prepareChannelId(grant.channel_id, "tunnel"),
+            channel_id: channelId,
             role: TunnelRole.Role_server,
             token: grant.token.trim(),
             endpoint_instance_id: endpointInstanceId,
         };
         websocket.send(JSON.stringify(attach));
         return await establishSession("tunnel", transport, {
-            channelId: grant.channel_id,
+            channelId,
             suite: grant.default_suite,
-            psk: assertValidPSK(grant.e2ee_psk_b64u, "tunnel"),
+            psk,
             initExpireAtUnixS: grant.channel_init_expire_at_unix_s,
         }, options, endpointInstanceId);
     }
     catch (error) {
-        transport.close();
+        transport?.close();
         if (error instanceof FlowersecError)
             throw error;
+        if (error instanceof TimeoutError) {
+            throw new FlowersecError({ path: "tunnel", stage: "connect", code: "timeout", message: "endpoint tunnel connect timed out", cause: error });
+        }
+        if (error instanceof AbortError) {
+            throw new FlowersecError({ path: "tunnel", stage: "connect", code: "canceled", message: "endpoint tunnel connect canceled", cause: error });
+        }
         throw new FlowersecError({ path: "tunnel", stage: "connect", code: "dial_failed", message: "endpoint tunnel connect failed", cause: error });
     }
 }
-async function establishSession(path, transport, handshake, options, endpointInstanceId) {
+async function establishSession(path, transport, handshake, options, endpointInstanceId, deadline) {
     let psk;
     try {
         psk = normalizePSK(handshake.psk, path);
@@ -250,7 +325,7 @@ async function establishSession(path, transport, handshake, options, endpointIns
         throw error;
     }
     try {
-        const secure = await serverHandshake(transport, options.handshakeCache ?? new ServerHandshakeCache(), {
+        const startHandshake = () => serverHandshake(transport, options.handshakeCache ?? new ServerHandshakeCache(), {
             channelId: prepareChannelId(handshake.channelId, path),
             suite: handshake.suite,
             psk,
@@ -262,25 +337,52 @@ async function establishSession(path, transport, handshake, options, endpointIns
             outboundRecordChunkBytes: options.outboundRecordChunkBytes ?? SDK_DEFAULTS.e2ee.outboundRecordChunkBytes,
             maxBufferedBytes: options.maxBufferedBytes ?? SDK_DEFAULTS.e2ee.maxInboundBufferedBytes,
             maxOutboundBufferedBytes: options.maxOutboundBufferedBytes ?? SDK_DEFAULTS.e2ee.maxOutboundBufferedBytes,
-            timeoutMs: options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs,
+            timeoutMs: deadline == null
+                ? options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs
+                : remainingHandshakeTimeoutMs(deadline),
             ...(options.signal === undefined ? {} : { signal: options.signal }),
         });
+        const secure = deadline == null
+            ? await startHandshake()
+            : await runHandshakeStep(deadline, options.signal, startHandshake);
         try {
-            await handshake.commitAuthenticated?.();
+            if (handshake.commitAuthenticated != null) {
+                if (deadline == null) {
+                    await handshake.commitAuthenticated();
+                }
+                else {
+                    await runHandshakeStep(deadline, options.signal, handshake.commitAuthenticated);
+                }
+            }
         }
         catch (error) {
             secure.close();
+            const interrupted = endpointHandshakeInterruption(path, error);
+            if (interrupted != null)
+                throw interrupted;
             throw new FlowersecError({ path, stage: "handshake", code: "credential_commit_failed", message: "credential commit failed", cause: error });
         }
-        return Session.create(path, secure, {
-            ...(options.yamuxLimits === undefined ? {} : { yamuxLimits: options.yamuxLimits }),
-            ...(endpointInstanceId === undefined ? {} : { endpointInstanceId }),
-        });
+        try {
+            throwIfAborted(options.signal, "handshake canceled");
+            if (deadline != null)
+                remainingHandshakeTimeoutMs(deadline);
+            return Session.create(path, secure, {
+                ...(options.yamuxLimits === undefined ? {} : { yamuxLimits: options.yamuxLimits }),
+                ...(endpointInstanceId === undefined ? {} : { endpointInstanceId }),
+            });
+        }
+        catch (error) {
+            secure.close();
+            throw error;
+        }
     }
     catch (error) {
         transport.close();
         if (error instanceof FlowersecError)
             throw error;
+        const interrupted = endpointHandshakeInterruption(path, error);
+        if (interrupted != null)
+            throw interrupted;
         throw new FlowersecError({ path, stage: "handshake", code: "handshake_failed", message: "endpoint handshake failed", cause: error });
     }
     finally {
@@ -352,22 +454,25 @@ function unwrapServerGrant(input) {
 function webSocketTransportOptions(options) {
     return options.webSocketLimits === undefined ? {} : { webSocketLimits: options.webSocketLimits };
 }
-function readOptions(options) {
-    return {
-        timeoutMs: options.handshakeTimeoutMs ?? SDK_DEFAULTS.transport.handshakeTimeoutMs,
-        ...(options.signal === undefined ? {} : { signal: options.signal }),
-    };
-}
 async function enforceIncomingDirectTransport(options) {
     const rawUrl = options.secureTransport === false ? "ws://127.0.0.1/" : "wss://127.0.0.1/";
     await enforceTransportSecurity({ rawUrl, path: "direct", ...(options.transportSecurityPolicy === undefined ? {} : { policy: options.transportSecurityPolicy }) });
 }
 function waitForOpen(websocket, timeoutMs, signal) {
-    if (websocket.readyState === 1)
-        return Promise.resolve();
     if (!Number.isFinite(timeoutMs) || timeoutMs < 0)
         return Promise.reject(new RangeError("connectTimeoutMs must be non-negative"));
+    try {
+        throwIfAborted(signal, "connect aborted");
+    }
+    catch (error) {
+        return Promise.reject(error);
+    }
+    if (websocket.readyState === 1)
+        return Promise.resolve();
+    if (websocket.readyState >= 2)
+        return Promise.reject(new Error("websocket closed before open"));
     return new Promise((resolve, reject) => {
+        let settled = false;
         let timer;
         const cleanup = () => {
             if (timer != null)
@@ -378,6 +483,9 @@ function waitForOpen(websocket, timeoutMs, signal) {
             signal?.removeEventListener("abort", onAbort);
         };
         const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
             cleanup();
             if (error == null)
                 resolve();
@@ -392,14 +500,58 @@ function waitForOpen(websocket, timeoutMs, signal) {
         websocket.addEventListener("error", onError);
         websocket.addEventListener("close", onClose);
         signal?.addEventListener("abort", onAbort, { once: true });
-        if (timeoutMs > 0)
-            timer = setTimeout(() => finish(new Error("websocket open timeout")), timeoutMs);
+        if (signal?.aborted) {
+            onAbort();
+        }
+        else if (websocket.readyState === 1) {
+            onOpen();
+        }
+        else if (websocket.readyState >= 2) {
+            onClose();
+        }
+        if (!settled && timeoutMs > 0)
+            timer = setTimeout(() => finish(new TimeoutError("websocket open timeout")), timeoutMs);
     });
 }
 function cleanupWaiter(waiter) {
     if (waiter.onAbort != null)
         waiter.signal?.removeEventListener("abort", waiter.onAbort);
 }
+function createHandshakeDeadline(timeoutMs) {
+    return timeoutMs > 0 ? { expiresAtMs: Date.now() + timeoutMs } : {};
+}
+function remainingHandshakeTimeoutMs(deadline) {
+    if (deadline.expiresAtMs === undefined)
+        return 0;
+    const remaining = deadline.expiresAtMs - Date.now();
+    if (remaining <= 0)
+        throw new TimeoutError("handshake timeout");
+    return remaining;
+}
+async function runHandshakeStep(deadline, signal, operation) {
+    throwIfAborted(signal, "handshake canceled");
+    const timeoutMs = remainingHandshakeTimeoutMs(deadline);
+    const result = await withAbortAndTimeout(Promise.resolve().then(operation), {
+        timeoutMs,
+        ...(signal === undefined ? {} : { signal }),
+    });
+    throwIfAborted(signal, "handshake canceled");
+    remainingHandshakeTimeoutMs(deadline);
+    return result;
+}
+function endpointHandshakeInterruption(path, error) {
+    if (error instanceof TimeoutError) {
+        return new FlowersecError({ path, stage: "handshake", code: "timeout", message: "endpoint handshake timed out", cause: error });
+    }
+    if (error instanceof AbortError) {
+        return new FlowersecError({ path, stage: "handshake", code: "canceled", message: "endpoint handshake canceled", cause: error });
+    }
+    return undefined;
+}
+function endpointHandshakeError(path, error, message) {
+    return endpointHandshakeInterruption(path, error)
+        ?? new FlowersecError({ path, stage: "handshake", code: "handshake_failed", message, cause: error });
+}
 function asError(error) {
     return error instanceof Error ? error : new Error(String(error));
 }

package/dist/proxy/appWindow.js

@@ -1,6 +1,6 @@
 import { createServiceWorkerControllerGuard, } from "./controllerGuard.js";
 import { createMessagePortBackedStream } from "./portStream.js";
-import { PROXY_WINDOW_FETCH_FORWARD_MSG_TYPE, PROXY_WINDOW_FETCH_MSG_TYPE, PROXY_WINDOW_WS_ERROR_MSG_TYPE, PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE, PROXY_WINDOW_WS_OPEN_MSG_TYPE, PROXY_WINDOW_WS_WRITE_ACK_CAPABILITY, } from "./windowBridgeProtocol.js";
+import { PROXY_WINDOW_FETCH_FORWARD_MSG_TYPE, PROXY_WINDOW_FETCH_MSG_TYPE, PROXY_WINDOW_STREAM_RESET_MSG_TYPE, PROXY_WINDOW_WS_ERROR_MSG_TYPE, PROXY_WINDOW_WS_BIDIRECTIONAL_ACK_CAPABILITY, PROXY_WINDOW_WS_OPEN_ACK_MSG_TYPE, PROXY_WINDOW_WS_OPEN_MSG_TYPE, } from "./windowBridgeProtocol.js";
 function resolveTargetWindow(raw) {
     const target = raw ?? globalThis.window;
     if (target == null)
@@ -59,6 +59,8 @@ export function registerProxyAppWindow(opts) {
     const targetWindow = resolveTargetWindow(opts.targetWindow);
     const controllerWindow = resolveControllerWindow(targetWindow, opts.controllerWindow);
     const capabilityNonce = normalizeCapabilityNonce(opts.capabilityNonce);
+    const activeWebSocketBridges = new Set();
+    let disposed = false;
     const sw = targetWindow.navigator?.serviceWorker;
     const onServiceWorkerMessage = (ev) => {
         const data = ev.data;
@@ -90,15 +92,32 @@ export function registerProxyAppWindow(opts) {
                 : { maxWsBufferedAmountBytes: opts.maxWsBufferedAmountBytes }),
         },
         openWebSocketStream: async (path, wsOpts = {}) => {
+            if (disposed)
+                throw new Error("proxy app Window bridge is disposed");
             const channel = new MessageChannel();
             const port = channel.port1;
             port.start?.();
             return await new Promise((resolve, reject) => {
                 let settled = false;
+                let terminal = false;
+                let stream = null;
+                const cleanup = () => {
+                    activeWebSocketBridges.delete(bridge);
+                    if (wsOpts.signal != null)
+                        wsOpts.signal.removeEventListener("abort", onAbort);
+                };
+                const finishTerminal = () => {
+                    if (terminal)
+                        return false;
+                    terminal = true;
+                    cleanup();
+                    return true;
+                };
                 const finishReject = (error) => {
                     if (settled)
                         return;
                     settled = true;
+                    finishTerminal();
                     try {
                         port.close();
                     }
@@ -107,16 +126,76 @@ export function registerProxyAppWindow(opts) {
                     }
                     reject(error instanceof Error ? error : new Error(String(error)));
                 };
+                const disposeBridge = (error) => {
+                    if (!finishTerminal())
+                        return;
+                    if (stream != null) {
+                        try {
+                            void Promise.resolve(stream.reset(error)).catch(() => {
+                                // The bridge is already terminal.
+                            });
+                        }
+                        catch {
+                            // The bridge is already terminal.
+                        }
+                        return;
+                    }
+                    try {
+                        port.postMessage({
+                            type: PROXY_WINDOW_STREAM_RESET_MSG_TYPE,
+                            message: error.message,
+                        });
+                    }
+                    catch {
+                        // Best-effort.
+                    }
+                    if (!settled) {
+                        settled = true;
+                        reject(error);
+                    }
+                    try {
+                        port.close();
+                    }
+                    catch {
+                        // Best-effort.
+                    }
+                };
+                const bridge = { dispose: disposeBridge };
+                const onAbort = () => {
+                    const reason = wsOpts.signal?.reason;
+                    disposeBridge(reason instanceof Error ? reason : new Error(String(reason ?? "aborted")));
+                };
+                activeWebSocketBridges.add(bridge);
                 const finishResolve = (ack) => {
-                    if (settled)
+                    if (settled || terminal)
                         return;
-                    settled = true;
                     const capabilities = Array.isArray(ack.capabilities)
                         ? ack.capabilities.filter((value) => typeof value === "string")
                         : [];
-                    const writeAcknowledgements = capabilities.includes(PROXY_WINDOW_WS_WRITE_ACK_CAPABILITY);
+                    if (!capabilities.includes(PROXY_WINDOW_WS_BIDIRECTIONAL_ACK_CAPABILITY)) {
+                        try {
+                            port.postMessage({
+                                type: PROXY_WINDOW_STREAM_RESET_MSG_TYPE,
+                                message: "proxy Window bridge capability mismatch",
+                            });
+                        }
+                        catch {
+                            // The capability error remains authoritative.
+                        }
+                        finishReject(new Error("proxy Window bridge does not support bidirectional stream acknowledgements"));
+                        return;
+                    }
+                    if (disposed) {
+                        disposeBridge(new Error("proxy app Window bridge is disposed"));
+                        return;
+                    }
+                    settled = true;
+                    stream = createMessagePortBackedStream(port, {
+                        maxBufferedBytes: opts.maxWsBufferedAmountBytes ?? 4 * (1 << 20),
+                        onTerminal: finishTerminal,
+                    });
                     resolve({
-                        stream: createMessagePortBackedStream(port, { writeAcknowledgements }),
+                        stream,
                         protocol: String(ack.protocol ?? ""),
                     });
                 };
@@ -135,15 +214,16 @@ export function registerProxyAppWindow(opts) {
                 };
                 if (wsOpts.signal != null) {
                     if (wsOpts.signal.aborted) {
-                        finishReject(wsOpts.signal.reason ?? new Error("aborted"));
+                        onAbort();
                         return;
                     }
-                    wsOpts.signal.addEventListener("abort", () => finishReject(wsOpts.signal?.reason ?? new Error("aborted")), { once: true });
+                    wsOpts.signal.addEventListener("abort", onAbort, { once: true });
                 }
                 try {
                     controllerWindow.postMessage({
                         type: PROXY_WINDOW_WS_OPEN_MSG_TYPE,
                         path,
+                        capabilities: [PROXY_WINDOW_WS_BIDIRECTIONAL_ACK_CAPABILITY],
                         ...(wsOpts.protocols === undefined ? {} : { protocols: wsOpts.protocols }),
                         ...(capabilityNonce === "" ? {} : { capabilityNonce }),
                     }, controllerOrigin, [channel.port2]);
@@ -157,7 +237,13 @@ export function registerProxyAppWindow(opts) {
     return {
         runtime,
         dispose: () => {
+            if (disposed)
+                return;
+            disposed = true;
             sw?.removeEventListener("message", onServiceWorkerMessage);
+            const error = new Error("proxy app Window bridge is disposed");
+            for (const bridge of [...activeWebSocketBridges])
+                bridge.dispose(error);
         },
     };
 }