@getpaseo/server 0.1.62 → 0.1.65

package/dist/server/server/websocket-server.js

@@ -1,18 +1,21 @@
 import { WebSocketServer } from "ws";
 import { basename, join } from "path";
 import { hostname as getHostname } from "node:os";
+import { applyMutableProviderConfigToOverrides } from "./daemon-config-store.js";
 import { WSInboundMessageSchema, wrapSessionMessage, } from "./messages.js";
-import { asUint8Array, decodeTerminalStreamFrame } from "../shared/terminal-stream-protocol.js";
+import { asUint8Array, decodeTerminalStreamFrame } from "../shared/binary-frames/index.js";
 import { isHostnameAllowed } from "./hostnames.js";
 import { Session } from "./session.js";
 import { ProviderSnapshotManager } from "./agent/provider-snapshot-manager.js";
-import { buildProviderRegistry } from "./agent/provider-registry.js";
+import { buildProviderRegistry, createClientsFromRegistry } from "./agent/provider-registry.js";
 import { buildWorkspaceGitMetadataFromSnapshot } from "./workspace-git-metadata.js";
 import { PushTokenStore } from "./push/token-store.js";
 import { PushService } from "./push/push-service.js";
 import { computeNotificationPlan } from "./agent-attention-policy.js";
 import { buildAgentAttentionNotificationPayload, findLatestPermissionRequest, } from "../shared/agent-attention-notification.js";
 import { createGitHubService } from "../services/github-service.js";
+import { extractWsBearerProtocol, extractWsBearerToken, isBearerTokenValid, } from "./auth.js";
+const WS_CLOSE_DAEMON_AUTH_FAILED = 4401;
 function createFallbackWorkspaceGitSnapshot(cwd) {
     return {
         cwd,
@@ -44,6 +47,15 @@ function createFallbackWorkspaceGitService() {
             unsubscribe: () => { },
         }),
         peekSnapshot: () => null,
+        getCheckout: async (cwd) => ({
+            cwd,
+            isGit: false,
+            currentBranch: null,
+            remoteUrl: null,
+            worktreeRoot: null,
+            isPaseoOwnedWorktree: false,
+            mainRepoRoot: null,
+        }),
         getSnapshot: async (cwd) => createFallbackWorkspaceGitSnapshot(cwd),
         getCheckoutDiff: async () => ({ diff: "" }),
         validateBranchRef: async () => ({ kind: "not-found" }),
@@ -169,11 +181,27 @@ export class MissingDaemonVersionError extends Error {
         this.name = "MissingDaemonVersionError";
     }
 }
+function requireWebSocketServices(params) {
+    const { chatService, loopService, scheduleService, checkoutDiffManager } = params;
+    if (!chatService) {
+        throw new Error("VoiceAssistantWebSocketServer requires a chat service.");
+    }
+    if (!loopService) {
+        throw new Error("VoiceAssistantWebSocketServer requires a loop service.");
+    }
+    if (!scheduleService) {
+        throw new Error("VoiceAssistantWebSocketServer requires a schedule service.");
+    }
+    if (!checkoutDiffManager) {
+        throw new Error("VoiceAssistantWebSocketServer requires a checkout diff manager.");
+    }
+    return { chatService, loopService, scheduleService, checkoutDiffManager };
+}
 /**
  * WebSocket server that only accepts sockets + parses/forwards messages to the session layer.
  */
 export class VoiceAssistantWebSocketServer {
-    constructor(server, logger, serverId, agentManager, agentStorage, downloadTokenStore, paseoHome, daemonConfigStore, mcpBaseUrl, wsConfig, speech, terminalManager, dictation, agentProviderRuntimeSettings, providerOverrides, isDev, daemonVersion, onLifecycleIntent, projectRegistry, workspaceRegistry, chatService, loopService, scheduleService, checkoutDiffManager, scriptRouteStore, scriptRuntimeStore, onBranchChanged, getDaemonTcpPort, getDaemonTcpHost, resolveScriptHealth, workspaceGitService, github) {
+    constructor(server, logger, serverId, agentManager, agentStorage, downloadTokenStore, paseoHome, daemonConfigStore, mcpBaseUrl, wsConfig, auth, speech, terminalManager, dictation, agentProviderRuntimeSettings, providerOverrides, isDev, daemonVersion, onLifecycleIntent, projectRegistry, workspaceRegistry, chatService, loopService, scheduleService, checkoutDiffManager, scriptRouteStore, scriptRuntimeStore, onBranchChanged, getDaemonTcpPort, getDaemonTcpHost, resolveScriptHealth, workspaceGitService, github) {
         this.pendingConnections = new Map();
         this.sessions = new Map();
         this.externalSessionsByKey = new Map();
@@ -220,47 +248,43 @@ export class VoiceAssistantWebSocketServer {
         this.agentStorage = agentStorage;
         this.projectRegistry = projectRegistry ?? createNoopProjectRegistry();
         this.workspaceRegistry = workspaceRegistry ?? createNoopWorkspaceRegistry();
-        if (!chatService) {
-            throw new Error("VoiceAssistantWebSocketServer requires a chat service.");
-        }
-        this.chatService = chatService;
-        if (!loopService) {
-            throw new Error("VoiceAssistantWebSocketServer requires a loop service.");
-        }
-        this.loopService = loopService;
-        if (!scheduleService) {
-            throw new Error("VoiceAssistantWebSocketServer requires a schedule service.");
-        }
-        this.scheduleService = scheduleService;
-        if (!checkoutDiffManager) {
-            throw new Error("VoiceAssistantWebSocketServer requires a checkout diff manager.");
-        }
-        this.checkoutDiffManager = checkoutDiffManager;
+        const requiredServices = requireWebSocketServices({
+            chatService,
+            loopService,
+            scheduleService,
+            checkoutDiffManager,
+        });
+        this.chatService = requiredServices.chatService;
+        this.loopService = requiredServices.loopService;
+        this.scheduleService = requiredServices.scheduleService;
+        this.checkoutDiffManager = requiredServices.checkoutDiffManager;
         this.github = github ?? createGitHubService();
         this.workspaceGitService = workspaceGitService ?? createFallbackWorkspaceGitService();
         this.downloadTokenStore = downloadTokenStore;
         this.paseoHome = paseoHome;
         this.daemonConfigStore = daemonConfigStore;
         this.mcpBaseUrl = mcpBaseUrl;
-        this.speech = speech ?? null;
-        this.terminalManager = terminalManager ?? null;
-        this.dictation = dictation ?? null;
-        this.agentProviderRuntimeSettings = agentProviderRuntimeSettings;
-        this.providerOverrides = providerOverrides;
-        this.isDev = isDev === true;
+        this.assignOptionalServices({
+            speech,
+            terminalManager,
+            dictation,
+            agentProviderRuntimeSettings,
+            providerOverrides,
+            isDev,
+            onLifecycleIntent,
+            scriptRouteStore,
+            scriptRuntimeStore,
+            onBranchChanged,
+            getDaemonTcpPort,
+            getDaemonTcpHost,
+            resolveScriptHealth,
+        });
         const providerSnapshotLogger = this.logger.child({ module: "provider-snapshot-manager" });
         this.providerSnapshotManager = new ProviderSnapshotManager(buildProviderRegistry(providerSnapshotLogger, {
             runtimeSettings: this.agentProviderRuntimeSettings,
             providerOverrides: this.providerOverrides,
             isDev: this.isDev,
         }), providerSnapshotLogger);
-        this.onLifecycleIntent = onLifecycleIntent ?? null;
-        this.scriptRouteStore = scriptRouteStore ?? null;
-        this.scriptRuntimeStore = scriptRuntimeStore ?? null;
-        this.onBranchChanged = onBranchChanged ?? null;
-        this.getDaemonTcpPort = getDaemonTcpPort ?? null;
-        this.getDaemonTcpHost = getDaemonTcpHost ?? null;
-        this.resolveScriptHealth = resolveScriptHealth ?? null;
         this.serverCapabilities = buildServerCapabilities({
             readiness: this.speech?.getReadiness() ?? null,
         });
@@ -269,6 +293,15 @@ export class VoiceAssistantWebSocketServer {
                 this.publishSpeechReadiness(snapshot);
             }) ?? null;
         this.unsubscribeDaemonConfigChange = this.daemonConfigStore.onChange((config) => {
+            this.providerOverrides = applyMutableProviderConfigToOverrides(this.providerOverrides, config.providers);
+            const registry = buildProviderRegistry(providerSnapshotLogger, {
+                runtimeSettings: this.agentProviderRuntimeSettings,
+                providerOverrides: this.providerOverrides,
+                isDev: this.isDev,
+            });
+            const clients = createClientsFromRegistry(registry, providerSnapshotLogger);
+            this.providerSnapshotManager.replaceRegistry(registry);
+            this.agentManager.updateProviderRegistry({ providerDefinitions: registry, clients });
             this.broadcastDaemonConfigChanged(config);
         });
         const pushLogger = this.logger.child({ module: "push" });
@@ -279,42 +312,84 @@ export class VoiceAssistantWebSocketServer {
                 this.logger.warn({ err, agentId: params.agentId }, "Failed to broadcast agent attention");
             });
         });
+        this.wss = this.createWebSocketServer(server, wsConfig, auth);
+        this.startRuntimeMetricsInterval();
+        this.logger.info("WebSocket server initialized on /ws");
+    }
+    assignOptionalServices(params) {
+        this.speech = params.speech ?? null;
+        this.terminalManager = params.terminalManager ?? null;
+        this.dictation = params.dictation ?? null;
+        this.agentProviderRuntimeSettings = params.agentProviderRuntimeSettings;
+        this.providerOverrides = params.providerOverrides;
+        this.isDev = params.isDev === true;
+        this.onLifecycleIntent = params.onLifecycleIntent ?? null;
+        this.scriptRouteStore = params.scriptRouteStore ?? null;
+        this.scriptRuntimeStore = params.scriptRuntimeStore ?? null;
+        this.onBranchChanged = params.onBranchChanged ?? null;
+        this.getDaemonTcpPort = params.getDaemonTcpPort ?? null;
+        this.getDaemonTcpHost = params.getDaemonTcpHost ?? null;
+        this.resolveScriptHealth = params.resolveScriptHealth ?? null;
+    }
+    createWebSocketServer(server, wsConfig, auth) {
         const { allowedOrigins, hostnames } = wsConfig;
-        this.wss = new WebSocketServer({
+        const password = auth?.password;
+        const wss = new WebSocketServer({
             server,
             path: "/ws",
+            handleProtocols: (protocols) => selectWebSocketProtocol(protocols, password),
             verifyClient: ({ req }, callback) => {
-                const requestMetadata = extractSocketRequestMetadata(req);
-                const origin = requestMetadata.origin;
-                const requestHost = requestMetadata.host ?? null;
-                if (requestHost && !isHostnameAllowed(requestHost, hostnames)) {
-                    this.incrementRuntimeCounter("hostRejected");
-                    this.logger.warn({ ...requestMetadata, host: requestHost }, "Rejected connection from disallowed host");
-                    callback(false, 403, "Host not allowed");
-                    return;
-                }
-                const sameOrigin = !!origin &&
-                    !!requestHost &&
-                    (origin === `http://${requestHost}` || origin === `https://${requestHost}`);
-                if (!origin || allowedOrigins.has("*") || allowedOrigins.has(origin) || sameOrigin) {
-                    callback(true);
-                }
-                else {
-                    this.incrementRuntimeCounter("originRejected");
-                    this.logger.warn({ ...requestMetadata, origin }, "Rejected connection from origin");
-                    callback(false, 403, "Origin not allowed");
-                }
+                this.verifyWsUpgrade(req, allowedOrigins, hostnames, callback);
             },
         });
-        this.wss.on("connection", (ws, request) => {
-            void this.attachSocket(ws, request);
+        wss.on("connection", (ws, request) => {
+            void this.attachAuthenticatedSocket(ws, request, password);
         });
+        return wss;
+    }
+    startRuntimeMetricsInterval() {
         const runtimeMetricsInterval = setInterval(() => {
             this.flushRuntimeMetrics();
         }, WS_RUNTIME_METRICS_FLUSH_MS);
         this.runtimeMetricsInterval = runtimeMetricsInterval;
         runtimeMetricsInterval.unref?.();
-        this.logger.info("WebSocket server initialized on /ws");
+    }
+    verifyWsUpgrade(req, allowedOrigins, hostnames, callback) {
+        const requestMetadata = extractSocketRequestMetadata(req);
+        const origin = requestMetadata.origin;
+        const requestHost = requestMetadata.host ?? null;
+        if (requestHost && !isHostnameAllowed(requestHost, hostnames)) {
+            this.incrementRuntimeCounter("hostRejected");
+            this.logger.warn({ ...requestMetadata, host: requestHost }, "Rejected connection from disallowed host");
+            callback(false, 403, "Host not allowed");
+            return;
+        }
+        const sameOrigin = !!origin &&
+            !!requestHost &&
+            (origin === `http://${requestHost}` || origin === `https://${requestHost}`);
+        if (!origin || allowedOrigins.has("*") || allowedOrigins.has(origin) || sameOrigin) {
+            callback(true);
+        }
+        else {
+            this.incrementRuntimeCounter("originRejected");
+            this.logger.warn({ ...requestMetadata, origin }, "Rejected connection from origin");
+            callback(false, 403, "Origin not allowed");
+        }
+    }
+    async attachAuthenticatedSocket(ws, request, password) {
+        if (password) {
+            const requestMetadata = extractSocketRequestMetadata(request);
+            const protocol = extractWsBearerProtocol(request.headers["sec-websocket-protocol"]);
+            const token = extractWsBearerToken(protocol);
+            const isAuthorized = isBearerTokenValid({ password, token });
+            if (!isAuthorized) {
+                const reason = token === null ? "Password required" : "Incorrect password";
+                this.logger.warn({ ...requestMetadata, hasToken: token !== null }, "Rejected WebSocket connection with invalid daemon password");
+                ws.close(WS_CLOSE_DAEMON_AUTH_FAILED, reason);
+                return;
+            }
+        }
+        await this.attachSocket(ws, request);
     }
     broadcast(message) {
         const payload = JSON.stringify(message);
@@ -406,18 +481,31 @@ export class VoiceAssistantWebSocketServer {
         this.wss.close();
     }
     sendToClient(ws, message) {
-        // WebSocket.OPEN = 1
-        if (ws.readyState === 1) {
+        // WebSocket.OPEN = 1. The check is a fast path; the socket can still
+        // transition to closed between here and ws.send(), so guard the send too —
+        // a synchronous throw here would propagate as an uncaughtException.
+        if (ws.readyState !== 1) {
+            return;
+        }
+        try {
             ws.send(JSON.stringify(message));
             this.recordOutboundMessage(message, ws);
         }
+        catch (err) {
+            this.logger.warn({ err }, "ws_send_failed");
+        }
     }
     sendBinaryToClient(ws, frame) {
         if (ws.readyState !== 1) {
             return;
         }
-        ws.send(frame);
-        this.recordOutboundBinaryFrame(ws);
+        try {
+            ws.send(frame);
+            this.recordOutboundBinaryFrame(ws);
+        }
+        catch (err) {
+            this.logger.warn({ err }, "ws_send_binary_failed");
+        }
     }
     sendToConnection(connection, message) {
         for (const ws of connection.sockets) {
@@ -475,11 +563,12 @@ export class VoiceAssistantWebSocketServer {
         }, "Client connected; awaiting hello");
     }
     createSessionConnection(params) {
-        const { ws, clientId, appVersion, connectionLogger } = params;
+        const { ws, clientId, appVersion, clientCapabilities, connectionLogger } = params;
         let connection = null;
         const session = new Session({
             clientId,
             appVersion,
+            clientCapabilities,
             onMessage: (msg) => {
                 if (!connection) {
                     return;
@@ -554,6 +643,7 @@ export class VoiceAssistantWebSocketServer {
             session,
             clientId,
             appVersion,
+            clientCapabilities,
             connectionLogger,
             sockets: new Set([ws]),
             externalDisconnectCleanupTimeout: null,
@@ -613,6 +703,12 @@ export class VoiceAssistantWebSocketServer {
                 existing.appVersion = newAppVersion;
                 existing.session.updateAppVersion(newAppVersion);
             }
+            const newClientCapabilities = message.capabilities ?? null;
+            if (JSON.stringify(existing.clientCapabilities ?? null) !==
+                JSON.stringify(newClientCapabilities ?? null)) {
+                existing.clientCapabilities = newClientCapabilities;
+                existing.session.updateClientCapabilities(newClientCapabilities);
+            }
             existing.sockets.add(ws);
             this.sessions.set(ws, existing);
             this.sendToClient(ws, this.createServerInfoMessage());
@@ -629,6 +725,7 @@ export class VoiceAssistantWebSocketServer {
             ws,
             clientId,
             appVersion: message.appVersion ?? null,
+            clientCapabilities: message.capabilities ?? null,
             connectionLogger,
         });
         this.sessions.set(ws, connection);
@@ -678,16 +775,20 @@ export class VoiceAssistantWebSocketServer {
         this.broadcast(this.createDaemonConfigChangedMessage(config));
     }
     bindSocketHandlers(ws) {
-        ws.on("message", (data) => {
+        ws.on("message", (...args) => {
+            const data = args[0];
             void this.handleRawMessage(ws, data);
         });
-        ws.on("close", async (code, reason) => {
+        ws.on("close", async (...args) => {
+            const code = args[0];
+            const reason = args[1];
             await this.detachSocket(ws, {
                 code: typeof code === "number" ? code : undefined,
                 reason,
             });
         });
-        ws.on("error", async (error) => {
+        ws.on("error", async (...args) => {
+            const error = args[0];
             const err = error instanceof Error ? error : new Error(String(error));
             const active = this.sessions.get(ws);
             const pending = this.pendingConnections.get(ws);
@@ -768,81 +869,126 @@ export class VoiceAssistantWebSocketServer {
         connection.connectionLogger.trace({ clientId: connection.clientId, totalSessions: this.sessions.size }, logMessage);
         await connection.session.cleanup();
     }
+    handleInvalidInboundMessage(args) {
+        const { ws, parsed, parsedMessage, pendingConnection, activeConnection, log } = args;
+        this.incrementRuntimeCounter("validationFailed");
+        if (pendingConnection) {
+            pendingConnection.connectionLogger.warn({ error: parsedMessage.error.message }, "Rejected pending message before hello");
+            this.clearPendingConnection(ws);
+            try {
+                ws.close(WS_CLOSE_INVALID_HELLO, "Invalid hello");
+            }
+            catch {
+                // ignore close errors
+            }
+            return;
+        }
+        const requestInfo = extractRequestInfoFromUnknownWsInbound(parsed);
+        const isUnknownSchema = requestInfo?.requestId != null &&
+            typeof parsed === "object" &&
+            parsed != null &&
+            "type" in parsed &&
+            parsed.type === "session";
+        log.warn({
+            clientId: activeConnection?.clientId,
+            requestId: requestInfo?.requestId,
+            requestType: requestInfo?.requestType,
+            error: parsedMessage.error.message,
+        }, "WS inbound message validation failed");
+        if (requestInfo) {
+            this.sendToClient(ws, wrapSessionMessage({
+                type: "rpc_error",
+                payload: {
+                    requestId: requestInfo.requestId,
+                    requestType: requestInfo.requestType,
+                    error: isUnknownSchema ? "Unknown request schema" : "Invalid message",
+                    code: isUnknownSchema ? "unknown_schema" : "invalid_message",
+                },
+            }));
+            return;
+        }
+        const errorMessage = `Invalid message: ${parsedMessage.error.message}`;
+        this.sendToClient(ws, wrapSessionMessage({
+            type: "status",
+            payload: {
+                status: "error",
+                message: errorMessage,
+            },
+        }));
+    }
+    maybeHandleBinaryFrame(params) {
+        const { ws, buffer, activeConnection, log } = params;
+        const asBytes = asUint8Array(buffer);
+        if (!asBytes) {
+            return false;
+        }
+        const frame = decodeTerminalStreamFrame(asBytes);
+        if (!frame) {
+            return false;
+        }
+        if (!activeConnection) {
+            this.incrementRuntimeCounter("binaryBeforeHelloRejected");
+            log.warn("Rejected binary frame before hello");
+            this.clearPendingConnection(ws);
+            try {
+                ws.close(WS_CLOSE_INVALID_HELLO, "Session message before hello");
+            }
+            catch {
+                // ignore close errors
+            }
+            return true;
+        }
+        activeConnection.session.handleBinaryFrame(frame);
+        return true;
+    }
+    handlePendingConnectionMessage(params) {
+        const { ws, message, pendingConnection } = params;
+        if (message.type === "hello") {
+            this.handleHello({
+                ws,
+                message,
+                pending: pendingConnection,
+            });
+            return;
+        }
+        pendingConnection.connectionLogger.warn({
+            messageType: message.type,
+        }, "Rejected pending message before hello");
+        this.incrementRuntimeCounter("pendingMessageRejectedBeforeHello");
+        this.clearPendingConnection(ws);
+        try {
+            ws.close(WS_CLOSE_INVALID_HELLO, "Session message before hello");
+        }
+        catch {
+            // ignore close errors
+        }
+    }
     async handleRawMessage(ws, data) {
         const activeConnection = this.sessions.get(ws);
         const pendingConnection = this.pendingConnections.get(ws);
         const log = activeConnection?.connectionLogger ?? pendingConnection?.connectionLogger ?? this.logger;
         try {
             const buffer = bufferFromWsData(data);
-            const asBytes = asUint8Array(buffer);
-            if (asBytes) {
-                const frame = decodeTerminalStreamFrame(asBytes);
-                if (frame) {
-                    if (!activeConnection) {
-                        this.incrementRuntimeCounter("binaryBeforeHelloRejected");
-                        log.warn("Rejected binary frame before hello");
-                        this.clearPendingConnection(ws);
-                        try {
-                            ws.close(WS_CLOSE_INVALID_HELLO, "Session message before hello");
-                        }
-                        catch {
-                            // ignore close errors
-                        }
-                        return;
-                    }
-                    activeConnection.session.handleBinaryFrame(frame);
-                    return;
-                }
+            const binaryHandled = this.maybeHandleBinaryFrame({
+                ws,
+                buffer,
+                activeConnection,
+                log,
+            });
+            if (binaryHandled) {
+                return;
             }
             const parsed = JSON.parse(buffer.toString());
             const parsedMessage = WSInboundMessageSchema.safeParse(parsed);
             if (!parsedMessage.success) {
-                this.incrementRuntimeCounter("validationFailed");
-                if (pendingConnection) {
-                    pendingConnection.connectionLogger.warn({
-                        error: parsedMessage.error.message,
-                    }, "Rejected pending message before hello");
-                    this.clearPendingConnection(ws);
-                    try {
-                        ws.close(WS_CLOSE_INVALID_HELLO, "Invalid hello");
-                    }
-                    catch {
-                        // ignore close errors
-                    }
-                    return;
-                }
-                const requestInfo = extractRequestInfoFromUnknownWsInbound(parsed);
-                const isUnknownSchema = requestInfo?.requestId != null &&
-                    typeof parsed === "object" &&
-                    parsed != null &&
-                    "type" in parsed &&
-                    parsed.type === "session";
-                log.warn({
-                    clientId: activeConnection?.clientId,
-                    requestId: requestInfo?.requestId,
-                    requestType: requestInfo?.requestType,
-                    error: parsedMessage.error.message,
-                }, "WS inbound message validation failed");
-                if (requestInfo) {
-                    this.sendToClient(ws, wrapSessionMessage({
-                        type: "rpc_error",
-                        payload: {
-                            requestId: requestInfo.requestId,
-                            requestType: requestInfo.requestType,
-                            error: isUnknownSchema ? "Unknown request schema" : "Invalid message",
-                            code: isUnknownSchema ? "unknown_schema" : "invalid_message",
-                        },
-                    }));
-                    return;
-                }
-                const errorMessage = `Invalid message: ${parsedMessage.error.message}`;
-                this.sendToClient(ws, wrapSessionMessage({
-                    type: "status",
-                    payload: {
-                        status: "error",
-                        message: errorMessage,
-                    },
-                }));
+                this.handleInvalidInboundMessage({
+                    ws,
+                    parsed,
+                    parsedMessage,
+                    pendingConnection,
+                    activeConnection,
+                    log,
+                });
                 return;
             }
             const message = parsedMessage.data;
@@ -855,25 +1001,11 @@ export class VoiceAssistantWebSocketServer {
                 return;
             }
             if (pendingConnection) {
-                if (message.type === "hello") {
-                    this.handleHello({
-                        ws,
-                        message,
-                        pending: pendingConnection,
-                    });
-                    return;
-                }
-                pendingConnection.connectionLogger.warn({
-                    messageType: message.type,
-                }, "Rejected pending message before hello");
-                this.incrementRuntimeCounter("pendingMessageRejectedBeforeHello");
-                this.clearPendingConnection(ws);
-                try {
-                    ws.close(WS_CLOSE_INVALID_HELLO, "Session message before hello");
-                }
-                catch {
-                    // ignore close errors
-                }
+                this.handlePendingConnectionMessage({
+                    ws,
+                    message,
+                    pendingConnection,
+                });
                 return;
             }
             if (!activeConnection) {
@@ -893,74 +1025,85 @@ export class VoiceAssistantWebSocketServer {
                 return;
             }
             if (message.type === "session") {
-                this.recordInboundSessionRequestType(message.message.type);
-                const startMs = performance.now();
-                await activeConnection.session.handleMessage(message.message);
-                const durationMs = performance.now() - startMs;
-                this.recordRequestLatency(message.message.type, durationMs);
-                if (durationMs >= SLOW_REQUEST_THRESHOLD_MS) {
-                    activeConnection.connectionLogger.warn({
-                        requestType: message.message.type,
-                        durationMs: Math.round(durationMs),
-                        inflightRequests: activeConnection.session.getRuntimeMetrics().inflightRequests,
-                    }, "ws_slow_request");
-                }
+                await this.dispatchSessionMessage(activeConnection, message);
             }
         }
         catch (error) {
-            const err = error instanceof Error ? error : new Error(String(error));
-            let rawPayload = null;
-            let parsedPayload = null;
+            this.handleRawMessageError({ ws, data, error, log });
+        }
+    }
+    async dispatchSessionMessage(activeConnection, message) {
+        this.recordInboundSessionRequestType(message.message.type);
+        const startMs = performance.now();
+        await activeConnection.session.handleMessage(message.message);
+        const durationMs = performance.now() - startMs;
+        this.recordRequestLatency(message.message.type, durationMs);
+        if (durationMs >= SLOW_REQUEST_THRESHOLD_MS) {
+            activeConnection.connectionLogger.warn({
+                requestType: message.message.type,
+                durationMs: Math.round(durationMs),
+                inflightRequests: activeConnection.session.getRuntimeMetrics().inflightRequests,
+            }, "ws_slow_request");
+        }
+    }
+    handleRawMessageError(params) {
+        const { ws, data, error, log } = params;
+        const err = error instanceof Error ? error : new Error(String(error));
+        const { rawPayload, parsedPayload } = this.decodeRawMessagePayloadForError(data);
+        const trimmedRawPayload = typeof rawPayload === "string" && rawPayload.length > 2000
+            ? `${rawPayload.slice(0, 2000)}... (truncated)`
+            : rawPayload;
+        log.error({
+            err,
+            rawPayload: trimmedRawPayload,
+            parsedPayload,
+        }, "Failed to parse/handle message");
+        if (this.pendingConnections.has(ws)) {
+            this.clearPendingConnection(ws);
             try {
-                const buffer = bufferFromWsData(data);
-                rawPayload = buffer.toString();
-                parsedPayload = JSON.parse(rawPayload);
-            }
-            catch (payloadError) {
-                rawPayload = rawPayload ?? "<unreadable>";
-                parsedPayload = parsedPayload ?? rawPayload;
-                const payloadErr = payloadError instanceof Error ? payloadError : new Error(String(payloadError));
-                this.logger.error({ err: payloadErr }, "Failed to decode raw payload");
-            }
-            const trimmedRawPayload = typeof rawPayload === "string" && rawPayload.length > 2000
-                ? `${rawPayload.slice(0, 2000)}... (truncated)`
-                : rawPayload;
-            log.error({
-                err,
-                rawPayload: trimmedRawPayload,
-                parsedPayload,
-            }, "Failed to parse/handle message");
-            if (this.pendingConnections.has(ws)) {
-                this.clearPendingConnection(ws);
-                try {
-                    ws.close(WS_CLOSE_INVALID_HELLO, "Invalid hello");
-                }
-                catch {
-                    // ignore close errors
-                }
-                return;
+                ws.close(WS_CLOSE_INVALID_HELLO, "Invalid hello");
             }
-            const requestInfo = extractRequestInfoFromUnknownWsInbound(parsedPayload);
-            if (requestInfo) {
-                this.sendToClient(ws, wrapSessionMessage({
-                    type: "rpc_error",
-                    payload: {
-                        requestId: requestInfo.requestId,
-                        requestType: requestInfo.requestType,
-                        error: "Invalid message",
-                        code: "invalid_message",
-                    },
-                }));
-                return;
+            catch {
+                // ignore close errors
             }
+            return;
+        }
+        const requestInfo = extractRequestInfoFromUnknownWsInbound(parsedPayload);
+        if (requestInfo) {
             this.sendToClient(ws, wrapSessionMessage({
-                type: "status",
+                type: "rpc_error",
                 payload: {
-                    status: "error",
-                    message: `Invalid message: ${err.message}`,
+                    requestId: requestInfo.requestId,
+                    requestType: requestInfo.requestType,
+                    error: "Invalid message",
+                    code: "invalid_message",
                 },
             }));
+            return;
         }
+        this.sendToClient(ws, wrapSessionMessage({
+            type: "status",
+            payload: {
+                status: "error",
+                message: `Invalid message: ${err.message}`,
+            },
+        }));
+    }
+    decodeRawMessagePayloadForError(data) {
+        let rawPayload = null;
+        let parsedPayload = null;
+        try {
+            const buffer = bufferFromWsData(data);
+            rawPayload = buffer.toString();
+            parsedPayload = JSON.parse(rawPayload);
+        }
+        catch (payloadError) {
+            rawPayload = rawPayload ?? "<unreadable>";
+            parsedPayload = parsedPayload ?? rawPayload;
+            const payloadErr = payloadError instanceof Error ? payloadError : new Error(String(payloadError));
+            this.logger.error({ err: payloadErr }, "Failed to decode raw payload");
+        }
+        return { rawPayload, parsedPayload };
     }
     incrementRuntimeCounter(counter) {
         this.runtimeCounters[counter] += 1;
@@ -1198,6 +1341,18 @@ function extractSocketRequestMetadata(request) {
         ...(remoteAddress ? { remoteAddress } : {}),
     };
 }
+function selectWebSocketProtocol(protocols, password) {
+    if (!password) {
+        return protocols.values().next().value ?? false;
+    }
+    for (const protocol of protocols) {
+        const token = extractWsBearerToken(protocol);
+        if (token !== null) {
+            return protocol;
+        }
+    }
+    return false;
+}
 function stringifyCloseReason(reason) {
     if (typeof reason === "string") {
         return reason.length > 0 ? reason : null;