@floegence/flowersec-core 2.5.2 → 2.5.4

package/dist/framing/jsonframe.d.ts

@@ -9,6 +9,6 @@ type ReadExactlyFn = (n: number) => Promise<Uint8Array>;
 type ReadExactlyLike = Readonly<{
     readExactly: (n: number) => Promise<Uint8Array>;
 }>;
-export declare function writeJsonFrame(write: WriteFn | WriteLike, v: unknown): Promise<void>;
+export declare function writeJsonFrame(write: WriteFn | WriteLike, v: unknown, maxBytes?: number): Promise<void>;
 export declare function readJsonFrame(readExactly: ReadExactlyFn | ReadExactlyLike, maxBytes: number): Promise<unknown>;
 export {};

package/dist/framing/jsonframe.js

@@ -13,8 +13,10 @@ function normalizeReadExactly(readExactly) {
     return typeof readExactly === "function" ? readExactly : (n) => readExactly.readExactly(n);
 }
 // writeJsonFrame encodes a JSON payload with a 4-byte length prefix.
-export async function writeJsonFrame(write, v) {
+export async function writeJsonFrame(write, v, maxBytes = 0) {
     const json = te.encode(JSON.stringify(v));
+    if (maxBytes > 0 && json.length > maxBytes)
+        throw new JsonFramingError("frame too large");
     const hdr = u32be(json.length);
     const out = new Uint8Array(4 + json.length);
     out.set(hdr, 0);

package/dist/node/acceptor.js

@@ -1,5 +1,5 @@
 import { RpcRouter } from "../rpc/server.js";
-import { assertRpcError } from "../rpc/validate.js";
+import { assertRpcError, assertRpcTypeId } from "../rpc/validate.js";
 import { acceptReceivedSessionV2, receiveSessionAdmissionV2, rejectSessionAdmissionV2, } from "../connector/sessionAcceptor.js";
 import { nodeSessionRuntimeV2 } from "./sessionRuntime.js";
 import { startNodeWebSocketServer, } from "./webSocketServer.js";
@@ -85,10 +85,13 @@ function registerNotification(state, typeId, handler) {
     state.notifications.set(typeId, handler);
 }
 function validateRPCRegistration(typeId, handler) {
-    if (!Number.isSafeInteger(typeId)
-        || typeId < 1
-        || typeId > 0xffff_ffff
-        || typeof handler !== "function") {
+    try {
+        assertRpcTypeId(typeId);
+    }
+    catch {
+        throw new HandlerRegistrationError("invalid_handler");
+    }
+    if (typeof handler !== "function") {
         throw new HandlerRegistrationError("invalid_handler");
     }
 }
@@ -443,12 +446,31 @@ export async function createAcceptor(options) {
         const abort = () => controller.abort(operation.signal?.reason);
         operation.signal?.addEventListener("abort", abort, { once: true });
         try {
-            return await Promise.any(listeners.map(async (listener, index) => {
-                const selected = listeners[(index + cursor) % listeners.length];
-                return await selected.accept({ signal: controller.signal });
-            })).finally(() => {
-                cursor = (cursor + 1) % listeners.length;
-                controller.abort();
+            return await new Promise((resolve, reject) => {
+                let settled = false;
+                let remaining = listeners.length;
+                const errors = [];
+                listeners.forEach((listener, index) => {
+                    const selected = listeners[(index + cursor) % listeners.length];
+                    void selected.accept({ signal: controller.signal }).then((carrier) => {
+                        if (!settled) {
+                            settled = true;
+                            cursor = (cursor + 1) % listeners.length;
+                            controller.abort();
+                            resolve(carrier);
+                        }
+                        else {
+                            carrier.abort({ code: 1000, reason: "accept race lost" });
+                        }
+                    }, (error) => {
+                        errors.push(error);
+                        remaining -= 1;
+                        if (!settled && remaining === 0) {
+                            settled = true;
+                            reject(new AggregateError(errors, "all listeners failed to accept"));
+                        }
+                    });
+                });
             });
         }
         finally {

package/dist/proxy/runtime.js

@@ -45,11 +45,34 @@ function normalizeTimeout(input) {
     }
     return input;
 }
+class InvalidProxyPathError extends TypeError {
+}
 function normalizePath(input) {
-    if (input !== input.trim() || !input.startsWith("/") || input.startsWith("//") || /[\u0000-\u0020]/u.test(input) || input.includes("://")) {
-        throw new TypeError("proxy path must be an origin-relative path");
+    if (input !== input.trim() || !input.startsWith("/") || input.startsWith("//") || /[\u0000-\u0020]/u.test(input) || input.includes("://") || input.includes("#")) {
+        throw new InvalidProxyPathError("proxy path must be an origin-relative path");
     }
-    return input;
+    let parsed;
+    try {
+        parsed = new URL(input, "https://flowersec.invalid/");
+    }
+    catch {
+        throw new InvalidProxyPathError("proxy path must be an origin-relative path");
+    }
+    const pathname = normalizePercentEscapes(parsed.pathname, true).replace(/\/{2,}/gu, "/");
+    const search = normalizePercentEscapes(parsed.search, false);
+    return pathname + search;
+}
+function normalizePercentEscapes(input, rejectEncodedSeparators) {
+    if (/%(?![0-9a-f]{2})/iu.test(input))
+        throw new InvalidProxyPathError("proxy path contains invalid percent encoding");
+    return input.replace(/%([0-9a-f]{2})/giu, (_match, hex) => {
+        const value = Number.parseInt(hex, 16);
+        if (rejectEncodedSeparators && (value === 0x2f || value === 0x5c)) {
+            throw new InvalidProxyPathError("proxy path contains an encoded separator");
+        }
+        const character = String.fromCharCode(value);
+        return /[A-Za-z0-9\-._~]/u.test(character) ? character : `%${hex.toUpperCase()}`;
+    });
 }
 function pathName(path) {
     const query = path.indexOf("?");
@@ -176,11 +199,19 @@ class StreamAdmission {
             return Promise.reject(new SessionError("resource_exhausted"));
         }
         return new Promise((resolve, reject) => {
+            let cleaned = false;
+            const cleanup = () => {
+                if (cleaned)
+                    return;
+                cleaned = true;
+                signal?.removeEventListener("abort", onAbort);
+            };
             const entry = {
                 bytes,
                 ...(signal === undefined ? {} : { signal }),
-                resolve,
-                reject: (error) => reject(error),
+                cleanup,
+                resolve: (release) => { cleanup(); resolve(release); },
+                reject: (error) => { cleanup(); reject(error); },
             };
             const onAbort = () => {
                 const index = this.queue.indexOf(entry);
@@ -188,7 +219,7 @@ class StreamAdmission {
                     return;
                 this.queue.splice(index, 1);
                 this.queuedBytes -= bytes;
-                reject(new SessionError("canceled"));
+                entry.reject(new SessionError("canceled"));
             };
             signal?.addEventListener("abort", onAbort, { once: true });
             this.queue.push(entry);
@@ -251,6 +282,8 @@ async function* readChunks(reader, maxChunkBytes, maxBodyBytes) {
 function publicFailure(error) {
     if (error instanceof ProxyPolicyError)
         return { status: 403, code: "policy_denied", message: "proxy request denied" };
+    if (error instanceof InvalidProxyPathError)
+        return { status: 400, code: "invalid_request", message: "invalid proxy request" };
     if (error instanceof SessionError && (error.code === "resource_exhausted" || error.code === "closed" || error.code === "going_away")) {
         return { status: 503, code: error.code, message: "proxy service unavailable" };
     }

package/dist/proxy/serviceWorker.d.ts

@@ -15,6 +15,8 @@ export type ProxyServiceWorkerScriptOptions = Readonly<{
     sameOriginOnly?: boolean;
     maxRequestBodyBytes?: number;
     maxInjectHTMLBytes?: number;
+    responseMetadataTimeoutMs?: number;
+    responseBodyInactivityTimeoutMs?: number;
     passthrough?: ProxyServiceWorkerPassthroughOptions;
     proxyPathPrefix?: string;
     stripProxyPathPrefix?: boolean;

package/dist/proxy/serviceWorker.js

@@ -17,6 +17,12 @@ function bounded(name, value, fallback, maximum) {
         throw new TypeError(`${name} is invalid`);
     return result;
 }
+function optionalBounded(name, value, maximum) {
+    const result = value ?? 0;
+    if (!Number.isSafeInteger(result) || result < 0 || result > maximum)
+        throw new TypeError(`${name} is invalid`);
+    return result;
+}
 function token(name, value, fallback = "") {
     const result = value ?? fallback;
     if (result !== result.trim() || /[\u0000-\u0020\u007f]/u.test(result) || result.length > 512)
@@ -42,6 +48,8 @@ function normalizeOptions(options) {
         sameOriginOnly: options.sameOriginOnly ?? true,
         maxRequestBodyBytes: bounded("maxRequestBodyBytes", options.maxRequestBodyBytes, 64 * 1024 * 1024, 256 * 1024 * 1024),
         maxInjectHTMLBytes: bounded("maxInjectHTMLBytes", options.maxInjectHTMLBytes, 8 * 1024 * 1024, 32 * 1024 * 1024),
+        responseMetadataTimeoutMs: bounded("responseMetadataTimeoutMs", options.responseMetadataTimeoutMs, 10_000, 300_000),
+        responseBodyInactivityTimeoutMs: optionalBounded("responseBodyInactivityTimeoutMs", options.responseBodyInactivityTimeoutMs, 300_000),
         passthroughPaths: strings("passthrough.paths", options.passthrough?.paths),
         passthroughPrefixes: strings("passthrough.prefixes", options.passthrough?.prefixes),
         proxyPathPrefix,
@@ -127,6 +135,8 @@ function serviceWorkerMain(config) {
                 return new Response("proxy runtime unavailable", { status: 503 });
             }
             let body;
+            if (request.signal.aborted)
+                return new Response("proxy request canceled", { status: 499 });
             if (request.method !== "GET" && request.method !== "HEAD") {
                 const requestBody = await request.clone().arrayBuffer();
                 if (requestBody.byteLength > config.maxRequestBodyBytes)
@@ -138,16 +148,54 @@ function serviceWorkerMain(config) {
                 let metadata = null;
                 let controller = null;
                 let finished = false;
-                const finishError = (status, message) => {
+                let remoteAbortSent = false;
+                let bodyInactivityTimer;
+                const abortRemote = () => {
+                    if (remoteAbortSent)
+                        return;
+                    remoteAbortSent = true;
+                    try {
+                        channel.port1.postMessage({ type: "flowersec-proxy:abort" });
+                    }
+                    catch { /* Port already failed. */ }
+                };
+                const cleanup = () => {
+                    clearTimeout(metadataTimer);
+                    clearTimeout(bodyInactivityTimer);
+                    clearInterval(runtimeWatchdog);
+                    request.signal.removeEventListener("abort", requestAborted);
+                    channel.port1.close();
+                };
+                const finishError = (status, message, cancelRemote = false) => {
                     if (finished)
                         return;
                     finished = true;
+                    if (cancelRemote)
+                        abortRemote();
                     if (controller !== null)
                         controller.error(new Error(message));
                     else
                         resolve(new Response(message, { status }));
-                    channel.port1.close();
+                    cleanup();
+                };
+                const requestAborted = () => finishError(499, "proxy request canceled", true);
+                const armBodyInactivityTimer = () => {
+                    clearTimeout(bodyInactivityTimer);
+                    if (config.responseBodyInactivityTimeoutMs === 0)
+                        return;
+                    bodyInactivityTimer = setTimeout(() => finishError(504, "proxy response body timed out", true), config.responseBodyInactivityTimeoutMs);
                 };
+                const metadataTimer = setTimeout(() => finishError(504, "proxy response timed out", true), config.responseMetadataTimeoutMs);
+                const runtimeWatchdog = setInterval(() => {
+                    void worker.clients.get(target.id).then((current) => {
+                        if (current !== null || finished)
+                            return;
+                        if (config.windowTarget === "registered_runtime")
+                            runtimeClientId = "";
+                        finishError(503, "proxy runtime unavailable", true);
+                    }).catch(() => finishError(503, "proxy runtime unavailable", true));
+                }, 250);
+                request.signal.addEventListener("abort", requestAborted, { once: true });
                 channel.port1.onmessage = (message) => {
                     const value = message.data;
                     if (value === null || typeof value !== "object" || finished)
@@ -162,13 +210,21 @@ function serviceWorkerMain(config) {
                                     headers.append(entry.name, entry.value);
                             }
                         metadata = { status: value.status, headers };
+                        clearTimeout(metadataTimer);
+                        armBodyInactivityTimer();
                         const stream = new ReadableStream({
                             start(valueController) {
                                 controller = valueController;
                                 channel.port1.postMessage({ type: "flowersec-proxy:response_credit" });
                             },
                             pull() { channel.port1.postMessage({ type: "flowersec-proxy:response_credit" }); },
-                            cancel() { channel.port1.postMessage({ type: "flowersec-proxy:abort" }); channel.port1.close(); },
+                            cancel() {
+                                if (finished)
+                                    return;
+                                finished = true;
+                                abortRemote();
+                                cleanup();
+                            },
                         });
                         resolve(new Response(stream, { status: metadata.status, headers: metadata.headers }));
                         return;
@@ -177,19 +233,20 @@ function serviceWorkerMain(config) {
                         if (controller === null || !(value.data instanceof ArrayBuffer))
                             return finishError(502, "invalid proxy response");
                         controller.enqueue(new Uint8Array(value.data));
+                        armBodyInactivityTimer();
                         return;
                     }
                     if (value.type === "flowersec-proxy:response_end") {
                         finished = true;
                         controller?.close();
-                        channel.port1.close();
+                        cleanup();
                         return;
                     }
                     if (value.type === "flowersec-proxy:response_error") {
                         finishError(Number.isInteger(value.status) ? value.status : 502, typeof value.message === "string" ? value.message : "proxy request failed");
                     }
                 };
-                channel.port1.onmessageerror = () => finishError(502, "proxy request failed");
+                channel.port1.onmessageerror = () => finishError(502, "proxy request failed", true);
                 const headers = Array.from(request.headers.entries()).map(([name, value]) => ({ name, value }));
                 try {
                     target.postMessage({
@@ -207,8 +264,7 @@ function serviceWorkerMain(config) {
                 catch {
                     if (config.windowTarget === "registered_runtime")
                         runtimeClientId = "";
-                    channel.port1.close();
-                    resolve(new Response("proxy runtime unavailable", { status: 503 }));
+                    finishError(503, "proxy runtime unavailable");
                 }
             });
             const injection = config.injectHTML;

package/dist/proxy/windowBridge.d.ts

@@ -12,6 +12,7 @@ export declare class MessagePortByteStream implements ByteStream {
     private buffered;
     private readBuffered;
     private ended;
+    private writeClosed;
     private closed;
     constructor(port: MessagePort);
     read(options?: OperationOptions): Promise<Uint8Array | null>;
@@ -22,6 +23,7 @@ export declare class MessagePortByteStream implements ByteStream {
     private handle;
     private finish;
     private fail;
+    private settleWrite;
 }
 export type RegisterProxyAppWindowOptions = Readonly<{
     controllerOrigin: string;

package/dist/proxy/windowBridge.js

@@ -18,6 +18,7 @@ export class MessagePortByteStream {
     buffered = 0;
     readBuffered = 0;
     ended = false;
+    writeClosed = false;
     closed = false;
     constructor(port) {
         this.port = port;
@@ -38,12 +39,17 @@ export class MessagePortByteStream {
         if (this.terminalError !== undefined)
             throw this.terminalError;
         return await new Promise((resolve, reject) => {
-            const waiter = { resolve, reject };
+            const cleanup = () => options.signal?.removeEventListener("abort", onAbort);
+            const waiter = {
+                resolve: (value) => { cleanup(); resolve(value); },
+                reject: (error) => { cleanup(); reject(error); },
+            };
             const onAbort = () => {
                 const index = this.readWaiters.indexOf(waiter);
-                if (index >= 0)
-                    this.readWaiters.splice(index, 1);
-                reject(new SessionError("canceled"));
+                if (index < 0)
+                    return;
+                this.readWaiters.splice(index, 1);
+                waiter.reject(new SessionError("canceled"));
             };
             options.signal?.addEventListener("abort", onAbort, { once: true });
             this.readWaiters.push(waiter);
@@ -52,6 +58,8 @@ export class MessagePortByteStream {
     async write(data, options = {}) {
         if (this.closed || this.terminalError !== undefined)
             throw this.terminalError ?? new SessionError("closed");
+        if (this.writeClosed)
+            throw new SessionError("operation_failed");
         if (options.signal?.aborted === true)
             throw new SessionError("canceled");
         if (data.length === 0)
@@ -63,24 +71,27 @@ export class MessagePortByteStream {
         const copy = data.slice();
         this.buffered += copy.length;
         await new Promise((resolve, reject) => {
+            const onAbort = () => this.settleWrite(id, new SessionError("canceled"));
             this.writeWaiters.set(id, {
-                resolve: () => { this.buffered -= copy.length; resolve(); },
-                reject: (error) => { this.buffered -= copy.length; reject(error); },
+                bytes: copy.length,
+                ...(options.signal === undefined ? {} : { signal: options.signal, onAbort }),
+                resolve,
+                reject,
             });
+            options.signal?.addEventListener("abort", onAbort, { once: true });
             try {
                 this.port.postMessage({ type: "chunk", id, data: copy.buffer }, [copy.buffer]);
             }
             catch {
-                this.writeWaiters.delete(id);
-                this.buffered -= copy.length;
-                reject(new SessionError("operation_failed"));
+                this.settleWrite(id, new SessionError("operation_failed"));
             }
         });
         return data.length;
     }
     async closeWrite() {
-        if (this.closed)
+        if (this.closed || this.writeClosed)
             return;
+        this.writeClosed = true;
         this.port.postMessage({ type: "end" });
     }
     async reset() {
@@ -100,6 +111,10 @@ export class MessagePortByteStream {
             return;
         const message = value;
         if (message.type === "chunk") {
+            if (this.ended || this.closed) {
+                this.fail(new SessionError("operation_failed"));
+                return;
+            }
             if (!Number.isSafeInteger(message.id) || !(message.data instanceof ArrayBuffer) || message.data.byteLength > MAX_BRIDGE_CHUNK_BYTES) {
                 this.fail(new SessionError("operation_failed"));
                 return;
@@ -122,14 +137,12 @@ export class MessagePortByteStream {
             return;
         }
         if (message.type === "ack" && Number.isSafeInteger(message.id)) {
-            const waiter = this.writeWaiters.get(message.id);
-            if (waiter !== undefined) {
-                this.writeWaiters.delete(message.id);
-                waiter.resolve();
-            }
+            this.settleWrite(message.id);
             return;
         }
         if (message.type === "end") {
+            if (this.ended)
+                return;
             this.ended = true;
             for (const waiter of this.readWaiters.splice(0))
                 waiter.resolve(null);
@@ -149,9 +162,8 @@ export class MessagePortByteStream {
         this.readBuffered = 0;
         for (const waiter of this.readWaiters.splice(0))
             waiter.resolve(null);
-        for (const waiter of this.writeWaiters.values())
-            waiter.reject(new SessionError("closed"));
-        this.writeWaiters.clear();
+        for (const id of [...this.writeWaiters.keys()])
+            this.settleWrite(id, new SessionError("closed"));
         this.port.close();
     }
     fail(error) {
@@ -163,11 +175,22 @@ export class MessagePortByteStream {
         this.readBuffered = 0;
         for (const waiter of this.readWaiters.splice(0))
             waiter.reject(error);
-        for (const waiter of this.writeWaiters.values())
-            waiter.reject(error);
-        this.writeWaiters.clear();
+        for (const id of [...this.writeWaiters.keys()])
+            this.settleWrite(id, error);
         this.port.close();
     }
+    settleWrite(id, error) {
+        const waiter = this.writeWaiters.get(id);
+        if (waiter === undefined)
+            return;
+        this.writeWaiters.delete(id);
+        waiter.signal?.removeEventListener("abort", waiter.onAbort);
+        this.buffered = Math.max(0, this.buffered - waiter.bytes);
+        if (error === undefined)
+            waiter.resolve();
+        else
+            waiter.reject(error);
+    }
 }
 function bridgeLimits(maxWsFrameBytes, maxWsBufferedAmountBytes) {
     const wsFrame = maxWsFrameBytes ?? SDK_DEFAULTS.proxy.maxWsFrameBytes;
@@ -219,20 +242,39 @@ export function registerProxyAppWindow(options) {
         openWebSocketStream: async (path, openOptions = {}) => {
             if (disposed)
                 throw new SessionError("closed");
+            if (openOptions.signal?.aborted === true)
+                throw new SessionError("canceled");
             const channel = new MessageChannel();
             const response = new Promise((resolve, reject) => {
-                const timer = setTimeout(() => { channel.port1.close(); reject(new SessionError("timeout")); }, 10_000);
+                let settled = false;
+                const finish = (error, opened) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    clearTimeout(timer);
+                    openOptions.signal?.removeEventListener("abort", abort);
+                    if (error !== undefined) {
+                        channel.port1.close();
+                        reject(error);
+                    }
+                    else
+                        resolve(opened);
+                };
+                const abort = () => {
+                    channel.port1.postMessage({ type: "reset" });
+                    finish(new SessionError("canceled"));
+                };
+                const timer = setTimeout(() => finish(new SessionError("timeout")), 10_000);
                 channel.port1.onmessage = (event) => {
                     if (event.data?.type !== WEBSOCKET_ACK_MESSAGE)
                         return;
-                    clearTimeout(timer);
                     if (event.data.ok !== true) {
-                        channel.port1.close();
-                        reject(new SessionError("operation_failed"));
+                        finish(new SessionError("operation_failed"));
                         return;
                     }
-                    resolve(Object.freeze({ stream: new MessagePortByteStream(channel.port1), protocol: typeof event.data.protocol === "string" ? event.data.protocol : "" }));
+                    finish(undefined, Object.freeze({ stream: new MessagePortByteStream(channel.port1), protocol: typeof event.data.protocol === "string" ? event.data.protocol : "" }));
                 };
+                openOptions.signal?.addEventListener("abort", abort, { once: true });
             });
             controller.postMessage({
                 type: WEBSOCKET_OPEN_MESSAGE,
@@ -241,9 +283,6 @@ export function registerProxyAppWindow(options) {
                 protocols: openOptions.protocols ?? [],
                 ...(nonce === undefined ? {} : { capabilityNonce: nonce }),
             }, origin, [channel.port2]);
-            if (openOptions.signal !== undefined) {
-                openOptions.signal.addEventListener("abort", () => channel.port1.close(), { once: true });
-            }
             return await response;
         },
         dispose: () => { disposed = true; },
@@ -253,33 +292,65 @@ export function registerProxyAppWindow(options) {
         dispose: () => { disposed = true; },
     });
 }
-async function bridgeStreams(runtimeStream, port) {
+async function bridgeStreams(runtimeStream, port, signal) {
     const bridge = new MessagePortByteStream(port);
+    const controller = new AbortController();
+    let resetTask;
+    const resetBoth = () => {
+        resetTask ??= Promise.allSettled([
+            Promise.resolve().then(async () => await runtimeStream.reset()),
+            Promise.resolve().then(async () => await bridge.reset()),
+        ]);
+        return resetTask;
+    };
+    const abort = () => {
+        controller.abort(signal?.reason ?? new SessionError("canceled"));
+        void resetBoth();
+    };
+    if (signal?.aborted === true)
+        abort();
+    else
+        signal?.addEventListener("abort", abort, { once: true });
     const left = (async () => {
         while (true) {
-            const chunk = await runtimeStream.read();
+            const chunk = await runtimeStream.read({ signal: controller.signal });
             if (chunk === null) {
                 await bridge.closeWrite();
                 return;
             }
-            await bridge.write(chunk);
+            await bridge.write(chunk, { signal: controller.signal });
         }
-    })();
+    })().catch((error) => { controller.abort(error); void resetBoth(); throw error; });
     const right = (async () => {
         while (true) {
-            const chunk = await bridge.read();
+            const chunk = await bridge.read({ signal: controller.signal });
             if (chunk === null) {
                 await runtimeStream.closeWrite();
                 return;
             }
             let offset = 0;
             while (offset < chunk.length)
-                offset += await runtimeStream.write(chunk.subarray(offset));
+                offset += await runtimeStream.write(chunk.subarray(offset), { signal: controller.signal });
         }
-    })();
-    await Promise.all([left, right]);
-    await runtimeStream.close();
-    await bridge.close();
+    })().catch((error) => { controller.abort(error); void resetBoth(); throw error; });
+    try {
+        const settled = await Promise.allSettled([left, right]);
+        const failure = settled.find((result) => result.status === "rejected");
+        if (failure !== undefined) {
+            await resetBoth();
+            throw failure.reason;
+        }
+        try {
+            await Promise.all([runtimeStream.close(), bridge.close()]);
+        }
+        catch (error) {
+            await resetBoth();
+            throw error;
+        }
+    }
+    finally {
+        signal?.removeEventListener("abort", abort);
+    }
 }
 export function registerProxyControllerWindow(options) {
     const target = options.targetWindow ?? globalThis.window;
@@ -289,6 +360,7 @@ export function registerProxyControllerWindow(options) {
     }
     const nonce = capability(options.capabilityNonce);
     let disposed = false;
+    const active = new Set();
     const onMessage = (event) => {
         if (disposed || !allowed.has(event.origin) || (options.expectedSource !== undefined && event.source !== options.expectedSource))
             return;
@@ -303,22 +375,51 @@ export function registerProxyControllerWindow(options) {
         }
         if (event.data?.type === WEBSOCKET_OPEN_MESSAGE && event.data.version === 2) {
             void (async () => {
+                let canceled = false;
+                const openController = new AbortController();
+                active.add(openController);
+                port.onmessage = (message) => {
+                    if (message.data?.type === "reset" ||
+                        message.data?.type === "close") {
+                        canceled = true;
+                        openController.abort();
+                        port.close();
+                    }
+                };
                 try {
                     const opened = await options.runtime.openWebSocketStream(String(event.data.path ?? ""), {
                         protocols: Array.isArray(event.data.protocols) ? event.data.protocols.map(String) : [],
+                        signal: openController.signal,
                     });
+                    if (canceled) {
+                        await opened.stream.reset();
+                        return;
+                    }
                     port.postMessage({ type: WEBSOCKET_ACK_MESSAGE, ok: true, protocol: opened.protocol });
-                    await bridgeStreams(opened.stream, port);
+                    await bridgeStreams(opened.stream, port, openController.signal);
                 }
                 catch {
-                    port.postMessage({ type: WEBSOCKET_ACK_MESSAGE, ok: false });
+                    try {
+                        port.postMessage({ type: WEBSOCKET_ACK_MESSAGE, ok: false });
+                    }
+                    catch { /* Port is already closed. */ }
                     port.close();
                 }
+                finally {
+                    active.delete(openController);
+                }
             })();
         }
     };
     target.addEventListener("message", onMessage);
-    return Object.freeze({ dispose: () => { disposed = true; target.removeEventListener("message", onMessage); } });
+    return Object.freeze({
+        dispose: () => {
+            disposed = true;
+            target.removeEventListener("message", onMessage);
+            for (const controller of active)
+                controller.abort(new SessionError("closed"));
+        },
+    });
 }
 export async function registerProxyAppWindowWithServiceWorkerControl(options) {
     await registerServiceWorkerAndEnsureControl({