@hackerai/local 0.5.1 → 0.6.0

package/dist/index.js

@@ -3,8 +3,8 @@
 /**
  * HackerAI Local Sandbox Client
  *
- * Connects to HackerAI backend via Convex and executes commands
- * on the local machine (either in Docker or directly on the host OS).
+ * Connects to HackerAI backend via Convex for connection lifecycle
+ * and uses Centrifugo for real-time command relay and streaming output.
  *
  * Usage:
  *   npx @hackerai/local --token TOKEN --name "My Laptop"
@@ -15,12 +15,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const browser_1 = require("convex/browser");
+const centrifuge_1 = require("centrifuge");
 const child_process_1 = require("child_process");
 const os_1 = __importDefault(require("os"));
 const utils_1 = require("./utils");
 const DEFAULT_SHELL = (0, utils_1.getDefaultShell)(os_1.default.platform());
 // Idle timeout: auto-terminate after 1 hour without commands
 const IDLE_TIMEOUT_MS = 60 * 60 * 1000; // 1 hour
+// Idle check interval: check every 5 minutes
+const IDLE_CHECK_INTERVAL_MS = 5 * 60 * 1000;
 /**
  * Runs a shell command using spawn for better output control.
  * Collects stdout/stderr and handles timeouts gracefully.
@@ -64,7 +67,7 @@ function runShellCommand(command, options = {}) {
         proc.on("close", (code) => {
             if (timeoutId)
                 clearTimeout(timeoutId);
-            // Final truncation to fit Convex limits
+            // Final truncation
             const truncatedStdout = (0, utils_1.truncateOutput)(stdout, maxOutputSize);
             const truncatedStderr = (0, utils_1.truncateOutput)(stderr, maxOutputSize);
             if (killed) {
@@ -113,11 +116,8 @@ const DEFAULT_IMAGE = "hackerai/sandbox";
 const api = {
     localSandbox: {
         connect: "localSandbox:connect",
-        heartbeat: "localSandbox:heartbeat",
         disconnect: "localSandbox:disconnect",
-        getPendingCommands: "localSandbox:getPendingCommands",
-        markCommandExecuting: "localSandbox:markCommandExecuting",
-        submitResult: "localSandbox:submitResult",
+        refreshCentrifugoToken: "localSandbox:refreshCentrifugoToken",
     },
 };
 // ANSI color codes for terminal output
@@ -132,19 +132,19 @@ const chalk = {
 };
 class LocalSandboxClient {
     config;
-    convex;
+    convexHttp;
+    centrifuge;
+    subscription;
     containerId;
-    containerShell = "/bin/bash"; // Detected shell, defaults to bash
+    containerShell = "/bin/bash";
     userId;
     connectionId;
-    session;
-    heartbeatInterval;
-    commandSubscription;
     isShuttingDown = false;
     lastActivityTime;
+    idleCheckInterval;
     constructor(config) {
         this.config = config;
-        this.convex = new browser_1.ConvexClient(config.convexUrl);
+        this.convexHttp = new browser_1.ConvexHttpClient(config.convexUrl);
         this.lastActivityTime = Date.now();
     }
     async start() {
@@ -160,7 +160,6 @@ class LocalSandboxClient {
             console.log(chalk.green("✓ Docker is available"));
             this.containerId = await this.createContainer();
             console.log(chalk.green(`✓ Container: ${this.containerId.slice(0, 12)}`));
-            // Detect available shell (bash or sh fallback for Alpine/minimal images)
             await this.detectContainerShell();
         }
         else {
@@ -169,8 +168,6 @@ class LocalSandboxClient {
         await this.connect();
     }
     getContainerName() {
-        // Generate a predictable container name for --persist mode
-        // Sanitize the connection name to be docker-compatible
         const sanitized = this.config.name
             .toLowerCase()
             .replace(/[^a-z0-9-]/g, "-")
@@ -179,7 +176,6 @@ class LocalSandboxClient {
         return `hackerai-sandbox-${sanitized || "default"}`;
     }
     async findExistingContainer(containerName) {
-        // Check if container with this name exists
         const result = await runShellCommand(`docker ps -a --filter "name=^${containerName}$" --format "{{.ID}}|{{.State}}"`, { timeout: 5000 });
         if (result.exitCode !== 0 || !result.stdout.trim()) {
             return null;
@@ -188,7 +184,6 @@ class LocalSandboxClient {
         return { id, running: state === "running" };
     }
     async createContainer() {
-        // In persist mode, try to reuse existing container
         if (this.config.persist) {
             const containerName = this.getContainerName();
             const existing = await this.findExistingContainer(containerName);
@@ -198,14 +193,12 @@ class LocalSandboxClient {
                     return existing.id;
                 }
                 else {
-                    // Container exists but stopped - start it
                     console.log(chalk.blue(`Starting existing container: ${containerName}`));
                     const startResult = await runShellCommand(`docker start ${existing.id}`, { timeout: 30000 });
                     if (startResult.exitCode === 0) {
                         console.log(chalk.green(`✓ Container started: ${containerName}`));
                         return existing.id;
                     }
-                    // If start failed, remove and create fresh
                     console.log(chalk.yellow(`⚠️  Failed to start, creating new container...`));
                     await runShellCommand(`docker rm -f ${existing.id}`, {
                         timeout: 5000,
@@ -230,7 +223,6 @@ class LocalSandboxClient {
             process.exit(1);
         }
         console.log(chalk.blue("Creating Docker container..."));
-        // Build docker run command with capabilities for penetration testing tools
         const dockerCommand = (0, utils_1.buildDockerRunCommand)({
             image: DEFAULT_IMAGE,
             containerName: this.config.persist ? this.getContainerName() : undefined,
@@ -261,23 +253,15 @@ class LocalSandboxClient {
         }
         return "Docker";
     }
-    /**
-     * Detects which shell is available in the container.
-     * Tries bash first, falls back to sh if bash is not available.
-     * This handles Alpine/BusyBox images that don't have bash installed.
-     */
     async detectContainerShell() {
         if (!this.containerId)
             return;
-        // Try to detect available shell using 'command -v' (POSIX compliant)
-        // We use 'sh' to run the detection since it's guaranteed to exist
         const result = await runShellCommand(`docker exec ${this.containerId} sh -c 'command -v bash || command -v sh || echo /bin/sh'`, { timeout: 5000 });
         if (result.exitCode === 0) {
             this.containerShell = (0, utils_1.parseShellDetectionOutput)(result.stdout);
             console.log(chalk.green(`✓ Shell: ${this.containerShell}`));
         }
         else {
-            // Fallback to /bin/sh if detection failed
             this.containerShell = "/bin/sh";
             console.log(chalk.yellow(`⚠️  Shell detection failed, using ${this.containerShell}`));
         }
@@ -285,7 +269,7 @@ class LocalSandboxClient {
     async connect() {
         console.log(chalk.blue("Connecting to HackerAI..."));
         try {
-            const result = (await this.convex.mutation(api.localSandbox.connect, {
+            const result = (await this.convexHttp.mutation(api.localSandbox.connect, {
                 token: this.config.token,
                 connectionName: this.config.name,
                 containerId: this.containerId,
@@ -293,18 +277,19 @@ class LocalSandboxClient {
                 mode: this.getMode(),
                 osInfo: this.config.dangerous ? this.getOsInfo() : undefined,
             }));
-            if (!result.success || !result.session) {
+            if (!result.success ||
+                !result.centrifugoToken ||
+                !result.centrifugoWsUrl) {
                 throw new Error(result.error || "Authentication failed");
             }
             this.userId = result.userId;
             this.connectionId = result.connectionId;
-            this.session = result.session;
             console.log(chalk.green("✓ Authenticated"));
             console.log(chalk.bold(chalk.green("🎉 Local sandbox is ready!")));
             console.log(chalk.gray(`Connection: ${this.connectionId}`));
             console.log(chalk.gray(`Mode: ${this.getModeDisplay()}${this.config.persist ? " (persistent)" : ""}`));
-            this.startHeartbeat();
-            this.startCommandSubscription();
+            this.setupCentrifugo(result.centrifugoWsUrl, result.centrifugoToken);
+            this.startIdleCheck();
         }
         catch (error) {
             const err = error;
@@ -318,52 +303,89 @@ class LocalSandboxClient {
             process.exit(1);
         }
     }
-    startCommandSubscription() {
-        if (!this.connectionId || !this.userId || !this.session)
-            return;
-        // Use Convex subscription for real-time command updates
-        this.commandSubscription = this.convex.onUpdate(api.localSandbox.getPendingCommands, {
-            connectionId: this.connectionId,
-            // Pass signed session for secure verification without DB lookups
-            session: {
-                userId: this.userId,
-                expiresAt: this.session.expiresAt,
-                signature: this.session.signature,
+    setupCentrifugo(wsUrl, initialToken) {
+        this.centrifuge = new centrifuge_1.Centrifuge(wsUrl, {
+            token: initialToken,
+            getToken: async () => {
+                if (!this.connectionId) {
+                    throw new Error("Cannot refresh token: connectionId is null");
+                }
+                try {
+                    const result = (await this.convexHttp.mutation(api.localSandbox.refreshCentrifugoToken, {
+                        token: this.config.token,
+                        connectionId: this.connectionId,
+                    }));
+                    return result.centrifugoToken;
+                }
+                catch (error) {
+                    console.error(chalk.red("Failed to refresh Centrifugo token:"), error);
+                    throw error;
+                }
             },
-        }, async (data) => {
+        });
+        const channel = `sandbox:user#${this.userId}`;
+        this.subscription = this.centrifuge.newSubscription(channel);
+        this.subscription.on("publication", (ctx) => {
             if (this.isShuttingDown)
                 return;
-            // Handle session auth errors - client needs to re-authenticate
-            if (data?.authError) {
-                console.debug("Session expired or invalid, will refresh on next heartbeat");
-                return;
+            const message = ctx.data;
+            if (message.type === "command") {
+                if (message.targetConnectionId &&
+                    message.targetConnectionId !== this.connectionId) {
+                    return;
+                }
+                this.lastActivityTime = Date.now();
+                this.handleCommand(message).catch((error) => {
+                    const errorMsg = error instanceof Error ? error.message : JSON.stringify(error);
+                    console.error(chalk.red(`Error handling command: ${errorMsg}`));
+                });
             }
-            if (!data?.commands)
-                return;
-            for (const cmd of data.commands) {
-                await this.executeCommand(cmd);
+        });
+        this.centrifuge.on("disconnected", (ctx) => {
+            if (!this.isShuttingDown) {
+                const isConnectionLimit = ctx.reason?.includes("connection limit") || ctx.code === 4503;
+                if (isConnectionLimit) {
+                    console.error(chalk.red("❌ Connection limit reached. The server has too many active connections."));
+                    console.error(chalk.yellow("Please try again later or contact support."));
+                    this.cleanup().then(() => process.exit(1));
+                }
+                else {
+                    console.log(chalk.yellow(`⚠️  Disconnected from Centrifugo: ${ctx.reason}`));
+                }
             }
         });
+        this.centrifuge.on("connected", () => {
+            console.log(chalk.green("✓ Connected to command relay"));
+        });
+        this.subscription.subscribe();
+        this.centrifuge.connect();
     }
-    async executeCommand(cmd) {
-        const { command_id, command, env, cwd, timeout, background, display_name } = cmd;
-        const startTime = Date.now();
-        // Update activity time to prevent idle timeout
-        this.lastActivityTime = Date.now();
+    async publishToChannel(data) {
+        if (!this.subscription) {
+            console.error(chalk.red("Cannot publish: no active subscription"));
+            return;
+        }
+        try {
+            await this.subscription.publish(data);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : JSON.stringify(err);
+            console.error(chalk.red(`Publish failed: ${msg}`));
+            throw err;
+        }
+    }
+    async handleCommand(msg) {
+        const { commandId, command, env, cwd, timeout, background, displayName } = msg;
         // Determine what to show in console:
-        // - display_name === "" (empty string): hide command entirely
-        // - display_name === "something": show that instead of command
-        // - display_name === undefined: show actual command
-        const shouldShow = display_name !== "";
-        const displayText = display_name || command;
+        // - displayName === "" (empty string): hide command entirely
+        // - displayName === "something": show that instead of command
+        // - displayName === undefined: show actual command
+        const shouldShow = displayName !== "";
+        const displayText = displayName || command;
         if (shouldShow) {
             console.log(chalk.cyan(`▶ ${background ? "[BG] " : ""}${displayText}`));
         }
         try {
-            await this.convex.mutation(api.localSandbox.markCommandExecuting, {
-                token: this.config.token,
-                commandId: command_id,
-            });
             let fullCommand = command;
             if (cwd && cwd.trim() !== "") {
                 fullCommand = `cd "${cwd}" 2>/dev/null && ${fullCommand}`;
@@ -371,7 +393,6 @@ class LocalSandboxClient {
             if (env) {
                 const envString = Object.entries(env)
                     .map(([k, v]) => {
-                    // Escape quotes, backticks, and $ to prevent shell injection
                     const escaped = v
                         .replace(/\\/g, "\\\\")
                         .replace(/"/g, '\\"')
@@ -382,93 +403,152 @@ class LocalSandboxClient {
                     .join("; ");
                 fullCommand = `${envString}; ${fullCommand}`;
             }
-            // Handle background mode - spawn and return immediately with PID
             if (background) {
                 const pid = await this.spawnBackground(fullCommand);
-                const duration = Date.now() - startTime;
-                await this.convex.mutation(api.localSandbox.submitResult, {
-                    commandId: command_id,
-                    token: this.config.token,
-                    stdout: "",
-                    stderr: "",
+                await this.publishToChannel({
+                    type: "exit",
+                    commandId,
                     exitCode: 0,
                     pid,
-                    duration,
                 });
                 console.log(chalk.green(`✓ Background process started with PID: ${pid}`));
                 return;
             }
-            let result;
+            await this.streamCommand(commandId, fullCommand, timeout, shouldShow, displayText);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            await this.publishToChannel({
+                type: "error",
+                commandId,
+                message: (0, utils_1.truncateOutput)(message),
+            });
+            console.log(chalk.red(`✗ ${displayText}: ${message}`));
+        }
+    }
+    async streamCommand(commandId, fullCommand, timeout, shouldShow, displayText) {
+        const startTime = Date.now();
+        const commandTimeout = timeout ?? 30000;
+        return new Promise((resolve) => {
+            let killed = false;
+            let timeoutId;
+            let accumulatedStdout = "";
+            let accumulatedStderr = "";
+            let proc;
             if (this.config.dangerous) {
-                result = await runShellCommand(fullCommand, {
-                    timeout: timeout ?? 30000,
-                    // Use platform-appropriate shell (powershell on Windows, bash on Unix)
+                proc = (0, child_process_1.spawn)(DEFAULT_SHELL.shell, [DEFAULT_SHELL.shellFlag, fullCommand], {
+                    stdio: ["ignore", "pipe", "pipe"],
                 });
             }
             else {
-                // Use single quotes to prevent host shell from interpreting $(), backticks, etc.
-                // This ensures ALL command execution happens inside the Docker container
                 const escapedCommand = fullCommand.replace(/'/g, "'\\''");
-                // Extract shell name (e.g., "bash" from "/bin/bash" or "/usr/bin/bash")
                 const shellName = this.containerShell.split("/").pop() || "sh";
-                result = await runShellCommand(`docker exec ${this.containerId} ${shellName} -c '${escapedCommand}'`, { timeout: timeout ?? 30000 });
+                proc = (0, child_process_1.spawn)("docker", ["exec", this.containerId, shellName, "-c", escapedCommand], { stdio: ["ignore", "pipe", "pipe"] });
             }
-            const duration = Date.now() - startTime;
-            await this.convex.mutation(api.localSandbox.submitResult, {
-                commandId: command_id,
-                token: this.config.token,
-                stdout: result.stdout,
-                stderr: result.stderr,
-                exitCode: result.exitCode,
-                duration,
+            if (commandTimeout > 0) {
+                timeoutId = setTimeout(() => {
+                    killed = true;
+                    proc.kill("SIGTERM");
+                    setTimeout(() => {
+                        if (!proc.killed) {
+                            proc.kill("SIGKILL");
+                        }
+                    }, 2000);
+                }, commandTimeout);
+            }
+            proc.stdout?.on("data", (data) => {
+                const chunk = data.toString();
+                accumulatedStdout += chunk;
+                this.publishToChannel({
+                    type: "stdout",
+                    commandId,
+                    data: chunk,
+                }).catch((err) => {
+                    console.error(chalk.red(`[ERROR] Failed to publish stdout: ${err instanceof Error ? err.message : String(err)}`));
+                });
             });
-            if (shouldShow) {
-                if (result.exitCode === 0) {
-                    console.log(chalk.green(`✓ ${displayText} ${chalk.gray(`(${duration}ms)`)}`));
+            proc.stderr?.on("data", (data) => {
+                const chunk = data.toString();
+                accumulatedStderr += chunk;
+                this.publishToChannel({
+                    type: "stderr",
+                    commandId,
+                    data: chunk,
+                }).catch((err) => {
+                    console.error(chalk.red(`[ERROR] Failed to publish stderr: ${err instanceof Error ? err.message : String(err)}`));
+                });
+            });
+            proc.on("close", (code) => {
+                if (timeoutId)
+                    clearTimeout(timeoutId);
+                const duration = Date.now() - startTime;
+                const exitCode = killed ? 124 : (code ?? 1);
+                if (killed) {
+                    this.publishToChannel({
+                        type: "stderr",
+                        commandId,
+                        data: "\n[Command timed out and was terminated]",
+                    }).catch((err) => {
+                        console.error(chalk.red(`[ERROR] Failed to publish timeout stderr: ${err instanceof Error ? err.message : String(err)}`));
+                    });
                 }
-                else {
-                    console.log(chalk.red(`✗ ${displayText} ${chalk.gray(`(exit ${result.exitCode}, ${duration}ms)`)}`));
-                    if (result.stderr.trim()) {
-                        // Indent each line of stderr for readability
-                        const indented = result.stderr
-                            .trim()
-                            .split("\n")
-                            .map((l) => `  ${l}`)
-                            .join("\n");
-                        console.log(chalk.red(indented));
+                this.publishToChannel({
+                    type: "exit",
+                    commandId,
+                    exitCode,
+                }).catch((err) => {
+                    console.error(chalk.red(`[CRITICAL] Failed to publish EXIT message: ${err instanceof Error ? err.message : String(err)}`));
+                });
+                if (shouldShow) {
+                    if (exitCode === 0) {
+                        console.log(chalk.green(`✓ ${displayText} ${chalk.gray(`(${duration}ms)`)}`));
+                    }
+                    else {
+                        console.log(chalk.red(`✗ ${displayText} ${chalk.gray(`(exit ${exitCode}, ${duration}ms)`)}`));
+                        if (accumulatedStderr.trim()) {
+                            const indented = accumulatedStderr
+                                .trim()
+                                .split("\n")
+                                .map((l) => `  ${l}`)
+                                .join("\n");
+                            console.log(chalk.red(indented));
+                        }
                     }
                 }
-            }
-        }
-        catch (error) {
-            const duration = Date.now() - startTime;
-            const message = error instanceof Error ? error.message : String(error);
-            await this.convex.mutation(api.localSandbox.submitResult, {
-                commandId: command_id,
-                token: this.config.token,
-                stdout: "",
-                stderr: (0, utils_1.truncateOutput)(message),
-                exitCode: 1,
-                duration,
+                resolve();
             });
-            console.log(chalk.red(`✗ ${displayText} ${chalk.gray(`(${duration}ms)`)}: ${message}`));
-        }
+            proc.on("error", (error) => {
+                if (timeoutId)
+                    clearTimeout(timeoutId);
+                this.publishToChannel({
+                    type: "error",
+                    commandId,
+                    message: error.message,
+                }).catch((err) => {
+                    console.error(chalk.red(`[ERROR] Failed to publish error message: ${err instanceof Error ? err.message : String(err)}`));
+                });
+                this.publishToChannel({
+                    type: "exit",
+                    commandId,
+                    exitCode: 1,
+                }).catch((err) => {
+                    console.error(chalk.red(`[CRITICAL] Failed to publish EXIT after process error: ${err instanceof Error ? err.message : String(err)}`));
+                });
+                resolve();
+            });
+        });
     }
     async spawnBackground(fullCommand) {
         if (this.config.dangerous) {
-            // Spawn directly on host in dangerous mode using platform-appropriate shell
             const child = (0, child_process_1.spawn)(DEFAULT_SHELL.shell, [DEFAULT_SHELL.shellFlag, fullCommand], {
-                detached: os_1.default.platform() !== "win32", // detached doesn't work the same on Windows
+                detached: os_1.default.platform() !== "win32",
                 stdio: "ignore",
             });
             child.unref();
             return child.pid ?? -1;
         }
         else {
-            // For Docker, start the process in background inside container and get its PID
-            // Using 'nohup command & echo $!' to get the container process PID
             const escapedCommand = fullCommand.replace(/'/g, "'\\''");
-            // Extract shell name (e.g., "bash" from "/bin/bash" or "/usr/bin/bash")
             const shellName = this.containerShell.split("/").pop() || "sh";
             const result = await runShellCommand(`docker exec ${this.containerId} ${shellName} -c 'nohup ${escapedCommand} > /dev/null 2>&1 & echo $!'`, { timeout: 5000 });
             if (result.exitCode === 0 && result.stdout.trim()) {
@@ -478,74 +558,36 @@ class LocalSandboxClient {
             return -1;
         }
     }
-    scheduleNextHeartbeat() {
-        // Add jitter (±10s) to prevent thundering herd when multiple clients connect
-        const baseInterval = 60000; // 1 minute
-        const jitter = Math.floor(Math.random() * 20000) - 10000; // -10000 to +10000
-        const interval = baseInterval + jitter;
-        this.heartbeatInterval = setTimeout(async () => {
-            if (this.connectionId && !this.isShuttingDown) {
-                // Check for idle timeout
-                const idleTime = Date.now() - this.lastActivityTime;
-                if (idleTime >= IDLE_TIMEOUT_MS) {
-                    const idleMinutes = Math.floor(idleTime / 60000);
-                    console.log(chalk.yellow(`\n⏰ Idle timeout: No commands received for ${idleMinutes} minutes`));
-                    console.log(chalk.yellow("Auto-terminating to save resources..."));
-                    await this.cleanup();
-                    process.exit(0);
-                }
-                try {
-                    const result = (await this.convex.mutation(api.localSandbox.heartbeat, {
-                        token: this.config.token,
-                        connectionId: this.connectionId,
-                    }));
-                    if (!result.success) {
-                        console.log(chalk.red("\n❌ Connection invalidated (token may have been regenerated)"));
-                        console.log(chalk.yellow("Shutting down..."));
-                        await this.cleanup();
-                        process.exit(1);
-                    }
-                    // Refresh session and restart subscription with new session
-                    if (result.session) {
-                        this.session = result.session;
-                        this.restartCommandSubscription();
-                    }
-                }
-                catch (error) {
-                    const message = error instanceof Error ? error.message : String(error);
-                    console.debug(`Heartbeat error (will retry): ${message}`);
-                }
+    startIdleCheck() {
+        this.idleCheckInterval = setInterval(() => {
+            const idleTime = Date.now() - this.lastActivityTime;
+            if (idleTime >= IDLE_TIMEOUT_MS) {
+                const idleMinutes = Math.floor(idleTime / 60000);
+                console.log(chalk.yellow(`\n⏰ Idle timeout: No commands received for ${idleMinutes} minutes`));
+                console.log(chalk.yellow("Auto-terminating to save resources..."));
+                this.cleanup().then(() => process.exit(0));
             }
-            // Schedule next heartbeat with fresh jitter
-            if (!this.isShuttingDown) {
-                this.scheduleNextHeartbeat();
-            }
-        }, interval);
-    }
-    startHeartbeat() {
-        this.scheduleNextHeartbeat();
+        }, IDLE_CHECK_INTERVAL_MS);
     }
-    stopHeartbeat() {
-        if (this.heartbeatInterval) {
-            clearTimeout(this.heartbeatInterval);
-            this.heartbeatInterval = undefined;
+    stopIdleCheck() {
+        if (this.idleCheckInterval) {
+            clearInterval(this.idleCheckInterval);
+            this.idleCheckInterval = undefined;
         }
     }
-    stopCommandSubscription() {
-        if (this.commandSubscription) {
-            this.commandSubscription();
-            this.commandSubscription = undefined;
-        }
-    }
-    restartCommandSubscription() {
-        this.stopCommandSubscription();
-        this.startCommandSubscription();
-    }
     async cleanup() {
         console.log(chalk.blue("\n🧹 Cleaning up..."));
         this.isShuttingDown = true;
-        this.stopHeartbeat();
-        this.stopCommandSubscription();
+        this.stopIdleCheck();
+        // Disconnect Centrifugo
+        if (this.subscription) {
+            this.subscription.unsubscribe();
+            this.subscription = undefined;
+        }
+        if (this.centrifuge) {
+            this.centrifuge.disconnect();
+            this.centrifuge = undefined;
+        }
         // Set up force-exit timeout (5 seconds)
         const forceExitTimeout = setTimeout(() => {
             console.log(chalk.yellow("⚠️  Force exiting after 5 second timeout..."));
@@ -554,7 +596,7 @@ class LocalSandboxClient {
         try {
             if (this.connectionId) {
                 try {
-                    await this.convex.mutation(api.localSandbox.disconnect, {
+                    await this.convexHttp.mutation(api.localSandbox.disconnect, {
                         token: this.config.token,
                         connectionId: this.connectionId,
                     });
@@ -582,8 +624,6 @@ class LocalSandboxClient {
                     }
                 }
             }
-            // Close the Convex client to clean up WebSocket connection
-            await this.convex.close();
         }
         finally {
             clearTimeout(forceExitTimeout);