@hyperdrive.bot/paseo-server 0.2.6

package/dist/server/server/websocket-server.js

@@ -0,0 +1,1768 @@
+import { WebSocketServer } from "ws";
+import { basename, join } from "path";
+import { hostname as getHostname } from "node:os";
+import { randomUUID } from "node:crypto";
+import { monitorEventLoopDelay } from "node:perf_hooks";
+import { WORKFLOWS_FEATURE_ENABLED } from "./workflow/workflow-feature.js";
+import { WSInboundMessageSchema, wrapSessionMessage, } from "./messages.js";
+import { asUint8Array, decodeBinaryFrame, } from "@hyperdrive.bot/paseo-protocol/binary-frames/index";
+import { isHostnameAllowed } from "./hostnames.js";
+import { Session } from "./session.js";
+import { buildWorkspaceGitMetadataFromSnapshot } from "./workspace-git-metadata.js";
+import { PushTokenStore } from "./push/token-store.js";
+import { createPushNotificationSender } from "./push/notifications.js";
+import { computeNotificationPlan, isPushEligibleAttentionReason, } from "./agent-attention-policy.js";
+import { buildAgentAttentionNotificationPayload, findLatestPermissionRequest, } from "@hyperdrive.bot/paseo-protocol/agent-attention-notification";
+import { createGitHubService } from "../services/github-service.js";
+import { extractWsBearerProtocol, extractWsBearerToken, isBearerTokenValid, } from "./auth.js";
+import { WebSocketRuntimeMetricsWindow, } from "./websocket/runtime-metrics.js";
+import { ProviderUsageService } from "../services/quota-fetcher/service.js";
+import { getProcessMemoryDiagnostics, getProcessUptimeSeconds } from "./process-diagnostics.js";
+import { CLIENT_SHUTDOWN_RPC_REASON, normalizeClientRestartRpcReason, } from "./lifecycle-reasons.js";
+import { CLIENT_CAPS } from "@hyperdrive.bot/paseo-protocol/client-capabilities";
+import { BrowserAutomationHostCapabilitySchema, } from "@hyperdrive.bot/paseo-protocol/browser-automation/capabilities";
+const WS_CLOSE_DAEMON_AUTH_FAILED = 4401;
+function resolveTerminalAttentionReason(input) {
+    if (input.attentionReason === "finished")
+        return "finished";
+    if (input.attentionReason === "needs_input")
+        return "needs_input";
+    if (input.state === "attention")
+        return "needs_input";
+    if (input.previousState === "working" && input.state === "idle")
+        return "finished";
+    return null;
+}
+function terminalAttentionTitle(reason) {
+    return reason === "needs_input" ? "Terminal needs input" : "Terminal finished";
+}
+function createFallbackWorkspaceGitSnapshot(cwd) {
+    return {
+        cwd,
+        git: {
+            isGit: false,
+            repoRoot: null,
+            mainRepoRoot: null,
+            currentBranch: null,
+            remoteUrl: null,
+            isPaseoOwnedWorktree: false,
+            isDirty: null,
+            baseRef: null,
+            aheadBehind: null,
+            aheadOfOrigin: null,
+            behindOfOrigin: null,
+            hasRemote: false,
+            diffStat: null,
+        },
+        github: {
+            featuresEnabled: false,
+            pullRequest: null,
+            error: null,
+        },
+    };
+}
+function createFallbackWorkspaceGitService() {
+    return {
+        registerWorkspace: () => ({
+            unsubscribe: () => { },
+        }),
+        onSnapshotUpdated: () => ({
+            unsubscribe: () => { },
+        }),
+        peekSnapshot: () => null,
+        getCheckout: async (cwd) => ({
+            cwd,
+            isGit: false,
+            currentBranch: null,
+            remoteUrl: null,
+            worktreeRoot: null,
+            isPaseoOwnedWorktree: false,
+            mainRepoRoot: null,
+        }),
+        getSnapshot: async (cwd) => createFallbackWorkspaceGitSnapshot(cwd),
+        getCheckoutDiff: async () => ({ diff: "" }),
+        validateBranchRef: async () => ({ kind: "not-found" }),
+        hasLocalBranch: async () => false,
+        suggestBranchesForCwd: async () => [],
+        listStashes: async () => [],
+        listWorktrees: async () => [],
+        getWorkspaceGitMetadata: async (cwd, options) => {
+            const snapshot = createFallbackWorkspaceGitSnapshot(cwd);
+            return buildWorkspaceGitMetadataFromSnapshot({
+                cwd,
+                directoryName: options?.directoryName ?? basename(cwd),
+                isGit: snapshot.git.isGit,
+                repoRoot: snapshot.git.repoRoot,
+                mainRepoRoot: snapshot.git.mainRepoRoot,
+                currentBranch: snapshot.git.currentBranch,
+                remoteUrl: snapshot.git.remoteUrl,
+            });
+        },
+        resolveRepoRoot: async (cwd) => cwd,
+        resolveDefaultBranch: async () => "main",
+        resolveRepoRemoteUrl: async () => null,
+        refresh: async () => { },
+        requestWorkingTreeWatch: async () => ({
+            repoRoot: null,
+            unsubscribe: () => { },
+        }),
+        scheduleRefreshForCwd: () => { },
+        onWorkspaceStateMayHaveChanged: () => { },
+        dispose: () => { },
+    };
+}
+function createNoopProjectRegistry() {
+    return {
+        initialize: async () => { },
+        existsOnDisk: async () => true,
+        list: async () => [],
+        get: async () => null,
+        upsert: async () => { },
+        archive: async () => { },
+        remove: async () => { },
+    };
+}
+function createNoopWorkspaceRegistry() {
+    return {
+        initialize: async () => { },
+        existsOnDisk: async () => true,
+        list: async () => [],
+        get: async () => null,
+        upsert: async () => { },
+        archive: async () => { },
+        remove: async () => { },
+    };
+}
+function toServerCapabilityState(params) {
+    const { state, reason } = params;
+    return {
+        enabled: state.enabled,
+        reason,
+    };
+}
+function resolveCapabilityReason(params) {
+    const { state, readiness } = params;
+    if (state.available) {
+        return "";
+    }
+    if (readiness.voiceFeature.reasonCode === "model_download_in_progress") {
+        const baseMessage = readiness.voiceFeature.message.trim();
+        if (baseMessage.includes("Try again in a few minutes")) {
+            return baseMessage;
+        }
+        return `${baseMessage} Try again in a few minutes.`;
+    }
+    return state.message;
+}
+function buildServerCapabilities(params) {
+    const readiness = params.readiness;
+    if (!readiness) {
+        return undefined;
+    }
+    return {
+        voice: {
+            dictation: toServerCapabilityState({
+                state: readiness.dictation,
+                reason: resolveCapabilityReason({
+                    state: readiness.dictation,
+                    readiness,
+                }),
+            }),
+            voice: toServerCapabilityState({
+                state: readiness.realtimeVoice,
+                reason: resolveCapabilityReason({
+                    state: readiness.realtimeVoice,
+                    readiness,
+                }),
+            }),
+        },
+    };
+}
+function areServerCapabilitiesEqual(current, next) {
+    return JSON.stringify(current ?? null) === JSON.stringify(next ?? null);
+}
+function bufferFromWsData(data) {
+    if (typeof data === "string")
+        return Buffer.from(data, "utf8");
+    if (Array.isArray(data)) {
+        return Buffer.concat(data.map((item) => (Buffer.isBuffer(item) ? item : Buffer.from(item))));
+    }
+    if (Buffer.isBuffer(data))
+        return data;
+    return Buffer.from(data);
+}
+function getBrowserHostCapability(capabilities) {
+    const parsed = BrowserAutomationHostCapabilitySchema.safeParse(capabilities?.[CLIENT_CAPS.browserHost]);
+    return parsed.success ? parsed.data : null;
+}
+const SLOW_REQUEST_THRESHOLD_MS = 500;
+const EXTERNAL_SESSION_DISCONNECT_GRACE_MS = 90000;
+const HELLO_TIMEOUT_MS = 15000;
+const WS_CLOSE_HELLO_TIMEOUT = 4001;
+const WS_CLOSE_INVALID_HELLO = 4002;
+const WS_CLOSE_INCOMPATIBLE_PROTOCOL = 4003;
+const WS_PROTOCOL_VERSION = 1;
+const WS_RUNTIME_METRICS_FLUSH_MS = 30000;
+export class MissingDaemonVersionError extends Error {
+    constructor() {
+        super("VoiceAssistantWebSocketServer requires a non-empty daemonVersion.");
+        this.name = "MissingDaemonVersionError";
+    }
+}
+function requireWebSocketServices(params) {
+    const { chatService, loopService, scheduleService, checkoutDiffManager } = params;
+    if (!chatService) {
+        throw new Error("VoiceAssistantWebSocketServer requires a chat service.");
+    }
+    if (!loopService) {
+        throw new Error("VoiceAssistantWebSocketServer requires a loop service.");
+    }
+    if (!scheduleService) {
+        throw new Error("VoiceAssistantWebSocketServer requires a schedule service.");
+    }
+    if (!checkoutDiffManager) {
+        throw new Error("VoiceAssistantWebSocketServer requires a checkout diff manager.");
+    }
+    return { chatService, loopService, scheduleService, checkoutDiffManager };
+}
+/**
+ * WebSocket server that only accepts sockets + parses/forwards messages to the session layer.
+ */
+export class VoiceAssistantWebSocketServer {
+    constructor(server, logger, serverId, agentManager, agentStorage, downloadTokenStore, paseoHome, daemonConfigStore, mcpBaseUrl, wsConfig, workspaceAutoName, auth, speech, terminalManager, dictation, daemonVersion, onLifecycleIntent, projectRegistry, workspaceRegistry, chatService, loopService, scheduleService, checkoutDiffManager, serviceProxy, scriptRuntimeStore, onBranchChanged, getDaemonTcpPort, getDaemonTcpHost, resolveScriptHealth, workspaceGitService, github, pushNotificationSender, providerSnapshotManager, daemonRuntimeConfig, workflowManager, serviceProxyPublicBaseUrl, browserToolsBroker) {
+        this.pendingConnections = new Map();
+        this.sessions = new Map();
+        this.socketIdentities = new Map();
+        this.externalSessionsByKey = new Map();
+        this.expoTokenBridge = null;
+        // COMPAT(extensions): set by the daemon (bootstrap) to the extension-service's
+        // executeCommand, so a client's extensions.command.execute.request routes to
+        // the right extension-host. Null when the plugin platform is disabled.
+        this.extensionExecuteCommand = null;
+        this.pushSubscriptionStore = null;
+        this.vapidPublicKey = null;
+        this.voiceSpeakHandlers = new Map();
+        this.voiceCallerContexts = new Map();
+        this.workspaceSetupSnapshots = new Map();
+        this.runtimeMetrics = new WebSocketRuntimeMetricsWindow();
+        this.lastRuntimeMetricsSnapshot = null;
+        this.runtimeMetricsInterval = null;
+        this.eventLoopDelayMonitor = null;
+        this.unsubscribeSpeechReadiness = null;
+        this.unsubscribeDaemonConfigChange = null;
+        this.unsubscribeTerminalActivity = null;
+        this.browserToolsRegistrations = new Map();
+        this.logger = logger.child({ module: "websocket-server" });
+        this.serverId = serverId;
+        if (typeof daemonVersion !== "string" || daemonVersion.trim().length === 0) {
+            throw new MissingDaemonVersionError();
+        }
+        this.daemonVersion = daemonVersion.trim();
+        this.daemonRuntimeConfig = daemonRuntimeConfig;
+        this.browserToolsBroker = browserToolsBroker ?? null;
+        this.agentManager = agentManager;
+        this.workflowManager = workflowManager;
+        this.agentStorage = agentStorage;
+        this.projectRegistry = projectRegistry ?? createNoopProjectRegistry();
+        this.workspaceRegistry = workspaceRegistry ?? createNoopWorkspaceRegistry();
+        const requiredServices = requireWebSocketServices({
+            chatService,
+            loopService,
+            scheduleService,
+            checkoutDiffManager,
+        });
+        this.chatService = requiredServices.chatService;
+        this.loopService = requiredServices.loopService;
+        this.scheduleService = requiredServices.scheduleService;
+        this.checkoutDiffManager = requiredServices.checkoutDiffManager;
+        this.github = github ?? createGitHubService();
+        this.workspaceGitService = workspaceGitService ?? createFallbackWorkspaceGitService();
+        this.workspaceAutoName = workspaceAutoName;
+        this.downloadTokenStore = downloadTokenStore;
+        this.paseoHome = paseoHome;
+        this.worktreesRoot = daemonRuntimeConfig?.worktreesRoot;
+        this.daemonConfigStore = daemonConfigStore;
+        this.mcpBaseUrl = mcpBaseUrl;
+        this.assignOptionalServices({
+            speech,
+            terminalManager,
+            dictation,
+            onLifecycleIntent,
+            serviceProxy,
+            scriptRuntimeStore,
+            onBranchChanged,
+            getDaemonTcpPort,
+            getDaemonTcpHost,
+            serviceProxyPublicBaseUrl,
+            resolveScriptHealth,
+        });
+        if (!providerSnapshotManager) {
+            throw new Error("providerSnapshotManager is required");
+        }
+        this.providerSnapshotManager = providerSnapshotManager;
+        this.serverCapabilities = buildServerCapabilities({
+            readiness: this.speech?.getReadiness() ?? null,
+        });
+        this.unsubscribeSpeechReadiness =
+            this.speech?.onReadinessChange((snapshot) => {
+                this.publishSpeechReadiness(snapshot);
+            }) ?? null;
+        this.unsubscribeDaemonConfigChange = this.daemonConfigStore.onChange((config) => {
+            const nextAgentManagerState = this.providerSnapshotManager.applyMutableProviderConfig(config.providers);
+            this.agentManager.updateProviderRegistry(nextAgentManagerState);
+            this.broadcastDaemonConfigChanged(config);
+        });
+        const pushLogger = this.logger.child({ module: "push" });
+        this.pushTokenStore = new PushTokenStore(pushLogger, join(paseoHome, "push-tokens.json"));
+        // pushNotificationSender accepts an override from bootstrap (used in tests
+        // to inject a mock); otherwise create the default one from the token store.
+        this.pushNotificationSender =
+            pushNotificationSender ?? createPushNotificationSender(pushLogger, this.pushTokenStore);
+        // Story 1.3 bridge: re-publish legacy WebSocket-registered Expo tokens into
+        // the Story 1.2 PushSubscriptionStore so the Expo Push worker sees them
+        // without requiring the mobile app to introduce a second registration path.
+        this.pushTokenStore.setSink({
+            onTokenAdded: (token) => {
+                try {
+                    this.expoTokenBridge?.(token);
+                }
+                catch (err) {
+                    pushLogger.warn({ err }, "expo-token bridge threw");
+                }
+            },
+        });
+        // Register the WebSocket broadcast as one of the agent-attention listeners.
+        // Upstream's refactor replaced the single `setAgentAttentionCallback` with a
+        // multi-subscriber `addAgentAttentionListener` registry (also consumed by
+        // push/triggers and bootstrap's session-digest hook, so the deprecated
+        // clear-then-set callback can no longer be used here). Guard on presence so
+        // an AgentManager surface that doesn't expose the listener API still
+        // constructs cleanly.
+        if ("addAgentAttentionListener" in this.agentManager) {
+            this.agentManager.addAgentAttentionListener((params) => {
+                void this.broadcastAgentAttention(params).catch((err) => {
+                    this.logger.warn({ err, agentId: params.agentId }, "Failed to broadcast agent attention");
+                });
+            });
+        }
+        this.providerUsageService = new ProviderUsageService({
+            logger: this.logger,
+        });
+        this.wss = this.createWebSocketServer(server, wsConfig, auth);
+        this.startRuntimeMetricsInterval();
+        this.logger.info("WebSocket server initialized on /ws");
+    }
+    /**
+     * Story 1.3 — register a bridge that re-publishes Expo tokens registered via
+     * the legacy `register_push_token` WebSocket message into the new
+     * PushSubscriptionStore. Called once from bootstrap after the push subsystem
+     * is wired. Replays existing tokens so already-registered devices land in
+     * the subscription store at startup, not only on the next registration.
+     */
+    setExtensionExecuteCommand(fn) {
+        this.extensionExecuteCommand = fn;
+    }
+    setExpoTokenBridge(bridge) {
+        this.expoTokenBridge = bridge;
+        if (!bridge)
+            return;
+        for (const token of this.pushTokenStore.getAllTokens()) {
+            try {
+                bridge(token);
+            }
+            catch (err) {
+                this.logger.warn({ err }, "expo-token bridge replay threw");
+            }
+        }
+    }
+    /**
+     * Wire the Story-1.2 push subscription store + VAPID public key into every
+     * future Session. Called once from bootstrap right after the websocket
+     * server is constructed. Required for the chat-actions
+     * `subscribe_push_request` / `get_vapid_public_key_request` WS bridges
+     * (relay-safe replacements for the HTTP /push/* routes).
+     */
+    setPushSubscriptionBridge(store, vapidPublicKey) {
+        this.pushSubscriptionStore = store;
+        this.vapidPublicKey = typeof vapidPublicKey === "string" ? vapidPublicKey : null;
+    }
+    assignOptionalServices(params) {
+        this.speech = params.speech ?? null;
+        this.terminalManager = params.terminalManager ?? null;
+        if (this.terminalManager) {
+            this.unsubscribeTerminalActivity = this.terminalManager.subscribeTerminalActivity((event) => {
+                const reason = resolveTerminalAttentionReason({
+                    attentionReason: event.activity?.attentionReason,
+                    previousState: event.previous?.state ?? null,
+                    state: event.activity?.state ?? null,
+                });
+                if (!reason) {
+                    return;
+                }
+                void this.broadcastTerminalAttention({
+                    terminalId: event.terminalId,
+                    cwd: event.cwd,
+                    ...(event.workspaceId ? { workspaceId: event.workspaceId } : {}),
+                    terminalName: event.name,
+                    reason,
+                }).catch((err) => {
+                    this.logger.warn({ err, terminalId: event.terminalId }, "Failed to broadcast terminal attention");
+                });
+            });
+        }
+        this.dictation = params.dictation ?? null;
+        this.onLifecycleIntent = params.onLifecycleIntent ?? null;
+        this.serviceProxy = params.serviceProxy ?? null;
+        this.scriptRuntimeStore = params.scriptRuntimeStore ?? null;
+        this.onBranchChanged = params.onBranchChanged ?? null;
+        this.getDaemonTcpPort = params.getDaemonTcpPort ?? null;
+        this.getDaemonTcpHost = params.getDaemonTcpHost ?? null;
+        this.serviceProxyPublicBaseUrl = params.serviceProxyPublicBaseUrl ?? null;
+        this.resolveScriptHealth = params.resolveScriptHealth ?? null;
+    }
+    createWebSocketServer(server, wsConfig, auth) {
+        const { allowedOrigins, hostnames } = wsConfig;
+        const password = auth?.password;
+        const wss = new WebSocketServer({
+            server,
+            path: "/ws",
+            handleProtocols: (protocols) => selectWebSocketProtocol(protocols, password),
+            verifyClient: ({ req }, callback) => {
+                this.verifyWsUpgrade(req, allowedOrigins, hostnames, callback);
+            },
+        });
+        wss.on("connection", (ws, request) => {
+            void this.attachAuthenticatedSocket(ws, request, password);
+        });
+        return wss;
+    }
+    startRuntimeMetricsInterval() {
+        this.eventLoopDelayMonitor = monitorEventLoopDelay({ resolution: 10 });
+        this.eventLoopDelayMonitor.enable();
+        const runtimeMetricsInterval = setInterval(() => {
+            this.flushRuntimeMetrics();
+        }, WS_RUNTIME_METRICS_FLUSH_MS);
+        this.runtimeMetricsInterval = runtimeMetricsInterval;
+        runtimeMetricsInterval.unref?.();
+    }
+    // Main-loop stall visibility: terminal frames and agent traffic share one event
+    // loop, so delay percentiles here are the ground truth for "the daemon is busy".
+    snapshotEventLoopDelay() {
+        const monitor = this.eventLoopDelayMonitor;
+        if (!monitor) {
+            return null;
+        }
+        const toMs = (nanoseconds) => Math.round(nanoseconds / 1e5) / 10;
+        const snapshot = {
+            p50Ms: toMs(monitor.percentile(50)),
+            p99Ms: toMs(monitor.percentile(99)),
+            maxMs: toMs(monitor.max),
+        };
+        monitor.reset();
+        return snapshot;
+    }
+    verifyWsUpgrade(req, allowedOrigins, hostnames, callback) {
+        const requestMetadata = extractSocketRequestMetadata(req);
+        const origin = requestMetadata.origin;
+        const requestHost = requestMetadata.host ?? null;
+        if (requestHost && !isHostnameAllowed(requestHost, hostnames)) {
+            this.incrementRuntimeCounter("hostRejected");
+            this.logger.warn({ ...requestMetadata, host: requestHost }, "Rejected connection from disallowed host");
+            callback(false, 403, "Host not allowed");
+            return;
+        }
+        const sameOrigin = isWebSocketSameOrigin(origin, requestHost);
+        if (!origin || allowedOrigins.has("*") || allowedOrigins.has(origin) || sameOrigin) {
+            callback(true);
+        }
+        else {
+            this.incrementRuntimeCounter("originRejected");
+            this.logger.warn({ ...requestMetadata, origin }, "Rejected connection from origin");
+            callback(false, 403, "Origin not allowed");
+        }
+    }
+    async attachAuthenticatedSocket(ws, request, password) {
+        if (password) {
+            const requestMetadata = extractSocketRequestMetadata(request);
+            const protocol = extractWsBearerProtocol(request.headers["sec-websocket-protocol"]);
+            const token = extractWsBearerToken(protocol);
+            const isAuthorized = isBearerTokenValid({ password, token });
+            if (!isAuthorized) {
+                const reason = token === null ? "Password required" : "Incorrect password";
+                this.logger.warn({ ...requestMetadata, hasToken: token !== null }, "Rejected WebSocket connection with invalid daemon password");
+                ws.close(WS_CLOSE_DAEMON_AUTH_FAILED, reason);
+                return;
+            }
+        }
+        await this.attachSocket(ws, request);
+    }
+    broadcast(message) {
+        const payload = JSON.stringify(message);
+        for (const ws of this.sessions.keys()) {
+            // WebSocket.OPEN = 1
+            if (ws.readyState === 1) {
+                ws.send(payload);
+                this.runtimeMetrics.recordOutboundMessage(message, ws.bufferedAmount);
+            }
+        }
+    }
+    listActiveSessions() {
+        return Array.from(new Set([...this.sessions.values(), ...this.externalSessionsByKey.values()].map((connection) => connection.session)));
+    }
+    publishSpeechReadiness(readiness) {
+        this.updateServerCapabilities(buildServerCapabilities({ readiness }));
+    }
+    updateServerCapabilities(capabilities) {
+        const next = capabilities ?? undefined;
+        if (areServerCapabilitiesEqual(this.serverCapabilities, next)) {
+            return;
+        }
+        this.serverCapabilities = next;
+        this.broadcastCapabilitiesUpdate();
+    }
+    async attachExternalSocket(ws, metadata) {
+        if (metadata?.transport === "relay") {
+            this.incrementRuntimeCounter("relayExternalSocketAttached");
+        }
+        await this.attachSocket(ws, undefined, metadata);
+    }
+    async close() {
+        this.unsubscribeSpeechReadiness?.();
+        this.unsubscribeSpeechReadiness = null;
+        this.unsubscribeDaemonConfigChange?.();
+        this.unsubscribeDaemonConfigChange = null;
+        this.unsubscribeTerminalActivity?.();
+        this.unsubscribeTerminalActivity = null;
+        if (this.runtimeMetricsInterval) {
+            clearInterval(this.runtimeMetricsInterval);
+            this.runtimeMetricsInterval = null;
+        }
+        this.flushRuntimeMetrics({ final: true });
+        this.eventLoopDelayMonitor?.disable();
+        this.eventLoopDelayMonitor = null;
+        const uniqueConnections = new Set([
+            ...this.sessions.values(),
+            ...this.externalSessionsByKey.values(),
+        ]);
+        const pendingSockets = new Set(this.pendingConnections.keys());
+        for (const pending of this.pendingConnections.values()) {
+            if (pending.helloTimeout) {
+                clearTimeout(pending.helloTimeout);
+                pending.helloTimeout = null;
+            }
+        }
+        const cleanupPromises = [];
+        for (const connection of uniqueConnections) {
+            if (connection.externalDisconnectCleanupTimeout) {
+                clearTimeout(connection.externalDisconnectCleanupTimeout);
+                connection.externalDisconnectCleanupTimeout = null;
+            }
+            cleanupPromises.push(connection.session.cleanup());
+            for (const ws of connection.sockets) {
+                cleanupPromises.push(new Promise((resolve) => {
+                    // WebSocket.CLOSED = 3
+                    if (ws.readyState === 3) {
+                        resolve();
+                        return;
+                    }
+                    ws.once("close", () => resolve());
+                    ws.close();
+                }));
+            }
+        }
+        for (const ws of pendingSockets) {
+            cleanupPromises.push(new Promise((resolve) => {
+                if (ws.readyState === 3) {
+                    resolve();
+                    return;
+                }
+                ws.once("close", () => resolve());
+                ws.close();
+            }));
+        }
+        await Promise.all(cleanupPromises);
+        this.providerSnapshotManager.destroy();
+        this.checkoutDiffManager.dispose();
+        this.workspaceGitService.dispose();
+        this.pendingConnections.clear();
+        this.sessions.clear();
+        this.socketIdentities.clear();
+        this.externalSessionsByKey.clear();
+        for (const clientId of this.browserToolsRegistrations.keys()) {
+            this.unregisterBrowserToolsClient(clientId);
+        }
+        this.wss.close();
+    }
+    sendToClient(ws, message) {
+        // WebSocket.OPEN = 1. The check is a fast path; the socket can still
+        // transition to closed between here and ws.send(), so guard the send too —
+        // a synchronous throw here would propagate as an uncaughtException.
+        if (ws.readyState !== 1) {
+            return;
+        }
+        try {
+            ws.send(JSON.stringify(message));
+            this.runtimeMetrics.recordOutboundMessage(message, ws.bufferedAmount);
+        }
+        catch (err) {
+            this.logger.warn({ err }, "ws_send_failed");
+        }
+    }
+    sendBinaryToClient(ws, frame) {
+        if (ws.readyState !== 1) {
+            return;
+        }
+        try {
+            ws.send(frame);
+            this.runtimeMetrics.recordOutboundBinaryFrame(ws.bufferedAmount);
+        }
+        catch (err) {
+            this.logger.warn({ err }, "ws_send_binary_failed");
+        }
+    }
+    sendToConnection(connection, message) {
+        for (const ws of connection.sockets) {
+            this.sendToClient(ws, message);
+        }
+    }
+    sendBinaryToConnection(connection, frame) {
+        for (const ws of connection.sockets) {
+            this.sendBinaryToClient(ws, frame);
+        }
+    }
+    async attachSocket(ws, request, metadata) {
+        const requestMetadata = extractSocketRequestMetadata(request);
+        const identity = createWebSocketConnectionIdentity(requestMetadata, metadata);
+        this.socketIdentities.set(ws, identity);
+        const connectionLogger = this.logger.child(toConnectionLogFields(identity));
+        const pending = {
+            connectionLogger,
+            helloTimeout: null,
+            identity,
+        };
+        const timeout = setTimeout(() => {
+            if (this.pendingConnections.get(ws) !== pending) {
+                return;
+            }
+            pending.helloTimeout = null;
+            this.pendingConnections.delete(ws);
+            pending.connectionLogger.warn({ ...toConnectionLogFields(identity), timeoutMs: HELLO_TIMEOUT_MS }, "Closing connection due to missing hello");
+            try {
+                ws.close(WS_CLOSE_HELLO_TIMEOUT, "Hello timeout");
+            }
+            catch {
+                // ignore close errors
+            }
+        }, HELLO_TIMEOUT_MS);
+        pending.helloTimeout = timeout;
+        timeout.unref?.();
+        this.pendingConnections.set(ws, pending);
+        this.incrementRuntimeCounter("connectedAwaitingHello");
+        this.bindSocketHandlers(ws);
+        pending.connectionLogger.info({
+            ...toConnectionLogFields(identity),
+            totalPendingConnections: this.pendingConnections.size,
+        }, "Client connected; awaiting hello");
+    }
+    createSessionConnection(params) {
+        const { ws, clientId, appVersion, clientCapabilities, connectionLogger } = params;
+        let connection = null;
+        const session = new Session({
+            clientId,
+            appVersion,
+            clientCapabilities,
+            onMessage: (msg) => {
+                if (!connection) {
+                    return;
+                }
+                this.sendToConnection(connection, wrapSessionMessage(msg));
+            },
+            onBinaryMessage: (frame) => {
+                if (!connection) {
+                    return;
+                }
+                this.sendBinaryToConnection(connection, frame);
+            },
+            getTransportBufferedAmount: () => {
+                if (!connection) {
+                    return null;
+                }
+                // Relay-attached sockets are a WebSocketLike that doesn't expose
+                // bufferedAmount. Return null when no socket gives a signal so the
+                // terminal fallback can't mistake "no signal" for "client keeping up";
+                // a direct ws reports its real buffered bytes (0 when drained).
+                let maxBuffered = null;
+                for (const socket of connection.sockets) {
+                    if (typeof socket.bufferedAmount === "number") {
+                        maxBuffered = Math.max(maxBuffered ?? 0, socket.bufferedAmount);
+                    }
+                }
+                return maxBuffered;
+            },
+            onLifecycleIntent: (intent) => {
+                this.onLifecycleIntent?.(intent);
+            },
+            logger: connectionLogger.child({ module: "session" }),
+            downloadTokenStore: this.downloadTokenStore,
+            pushTokenStore: this.pushTokenStore,
+            paseoHome: this.paseoHome,
+            worktreesRoot: this.worktreesRoot,
+            agentManager: this.agentManager,
+            workflowManager: this.workflowManager,
+            agentStorage: this.agentStorage,
+            projectRegistry: this.projectRegistry,
+            workspaceRegistry: this.workspaceRegistry,
+            chatService: this.chatService,
+            loopService: this.loopService,
+            scheduleService: this.scheduleService,
+            checkoutDiffManager: this.checkoutDiffManager,
+            executeExtensionCommand: this.extensionExecuteCommand ?? undefined,
+            github: this.github,
+            workspaceGitService: this.workspaceGitService,
+            workspaceAutoName: this.workspaceAutoName,
+            daemonConfigStore: this.daemonConfigStore,
+            mcpBaseUrl: this.mcpBaseUrl,
+            stt: () => this.speech?.resolveStt() ?? null,
+            sttLanguage: this.speech?.resolveSttLanguage() ?? "en",
+            tts: () => this.speech?.resolveTts() ?? null,
+            terminalManager: this.terminalManager,
+            providerSnapshotManager: this.providerSnapshotManager,
+            providerUsageService: this.providerUsageService,
+            serviceProxy: this.serviceProxy ?? undefined,
+            scriptRuntimeStore: this.scriptRuntimeStore ?? undefined,
+            workspaceSetupSnapshots: this.workspaceSetupSnapshots,
+            onBranchChanged: this.onBranchChanged ?? undefined,
+            getDaemonTcpPort: this.getDaemonTcpPort ?? undefined,
+            getDaemonTcpHost: this.getDaemonTcpHost ?? undefined,
+            serviceProxyPublicBaseUrl: this.serviceProxyPublicBaseUrl,
+            resolveScriptHealth: this.resolveScriptHealth ?? undefined,
+            voice: {
+                turnDetection: () => this.speech?.resolveTurnDetection() ?? null,
+            },
+            voiceBridge: {
+                registerVoiceSpeakHandler: (agentId, handler) => {
+                    this.voiceSpeakHandlers.set(agentId, handler);
+                },
+                unregisterVoiceSpeakHandler: (agentId) => {
+                    this.voiceSpeakHandlers.delete(agentId);
+                },
+                registerVoiceCallerContext: (agentId, context) => {
+                    this.voiceCallerContexts.set(agentId, context);
+                },
+                unregisterVoiceCallerContext: (agentId) => {
+                    this.voiceCallerContexts.delete(agentId);
+                },
+            },
+            dictation: this.dictation || this.speech
+                ? {
+                    finalTimeoutMs: this.dictation?.finalTimeoutMs,
+                    stt: () => this.speech?.resolveDictationStt() ?? null,
+                    sttLanguage: this.speech?.resolveDictationSttLanguage() ?? "en",
+                    getSpeechReadiness: () => this.speech.getReadiness(),
+                }
+                : undefined,
+            daemonRuntimeConfig: this.daemonRuntimeConfig,
+            pushSubscriptionStore: this.pushSubscriptionStore ?? undefined,
+            vapidPublicKey: this.vapidPublicKey,
+            getWebSocketRuntimeMetrics: () => this.lastRuntimeMetricsSnapshot,
+        });
+        connection = {
+            session,
+            clientId,
+            appVersion,
+            clientCapabilities,
+            connectionLogger,
+            sockets: new Set([ws]),
+            externalDisconnectCleanupTimeout: null,
+        };
+        return connection;
+    }
+    clearPendingConnection(ws) {
+        const pending = this.pendingConnections.get(ws);
+        if (!pending) {
+            return null;
+        }
+        if (pending.helloTimeout) {
+            clearTimeout(pending.helloTimeout);
+            pending.helloTimeout = null;
+        }
+        this.pendingConnections.delete(ws);
+        return pending;
+    }
+    handleHello(params) {
+        const { ws, message, pending } = params;
+        if (message.protocolVersion !== WS_PROTOCOL_VERSION) {
+            this.clearPendingConnection(ws);
+            pending.connectionLogger.warn({
+                receivedProtocolVersion: message.protocolVersion,
+                expectedProtocolVersion: WS_PROTOCOL_VERSION,
+            }, "Rejected hello due to protocol version mismatch");
+            try {
+                ws.close(WS_CLOSE_INCOMPATIBLE_PROTOCOL, "Incompatible protocol version");
+            }
+            catch {
+                // ignore close errors
+            }
+            return;
+        }
+        const clientId = message.clientId.trim();
+        if (clientId.length === 0) {
+            this.clearPendingConnection(ws);
+            pending.connectionLogger.warn("Rejected hello with empty clientId");
+            try {
+                ws.close(WS_CLOSE_INVALID_HELLO, "Invalid hello");
+            }
+            catch {
+                // ignore close errors
+            }
+            return;
+        }
+        this.clearPendingConnection(ws);
+        pending.identity.clientId = clientId;
+        if (message.appVersion) {
+            pending.identity.appVersion = message.appVersion;
+        }
+        const existing = this.externalSessionsByKey.get(clientId);
+        if (existing) {
+            this.incrementRuntimeCounter("helloResumed");
+            if (existing.externalDisconnectCleanupTimeout) {
+                clearTimeout(existing.externalDisconnectCleanupTimeout);
+                existing.externalDisconnectCleanupTimeout = null;
+            }
+            const newAppVersion = message.appVersion ?? null;
+            if (newAppVersion && newAppVersion !== existing.appVersion) {
+                existing.appVersion = newAppVersion;
+                existing.session.updateAppVersion(newAppVersion);
+            }
+            const newClientCapabilities = message.capabilities ?? null;
+            if (JSON.stringify(existing.clientCapabilities ?? null) !==
+                JSON.stringify(newClientCapabilities ?? null)) {
+                existing.clientCapabilities = newClientCapabilities;
+                existing.session.updateClientCapabilities(newClientCapabilities);
+                this.syncBrowserToolsClientRegistration(existing);
+            }
+            existing.sockets.add(ws);
+            this.sessions.set(ws, existing);
+            pending.identity.sessionId = existing.session.getSessionId();
+            this.syncBrowserToolsClientRegistration(existing);
+            this.sendToClient(ws, this.createServerInfoMessage());
+            pending.connectionLogger.info({
+                ...toConnectionLogFields(pending.identity),
+                resumed: true,
+                totalSessions: this.sessions.size,
+            }, "Client connected via hello");
+            return;
+        }
+        const connectionLogger = pending.connectionLogger.child({ clientId });
+        this.incrementRuntimeCounter("helloNew");
+        const connection = this.createSessionConnection({
+            ws,
+            clientId,
+            appVersion: message.appVersion ?? null,
+            clientCapabilities: message.capabilities ?? null,
+            connectionLogger,
+        });
+        this.sessions.set(ws, connection);
+        this.externalSessionsByKey.set(clientId, connection);
+        pending.identity.sessionId = connection.session.getSessionId();
+        this.syncBrowserToolsClientRegistration(connection);
+        this.sendToClient(ws, this.createServerInfoMessage());
+        connection.connectionLogger.info({
+            ...toConnectionLogFields(pending.identity),
+            resumed: false,
+            totalSessions: this.sessions.size,
+        }, "Client connected via hello");
+    }
+    buildServerInfoStatusPayload() {
+        return {
+            status: "server_info",
+            serverId: this.serverId,
+            hostname: getHostname(),
+            version: this.daemonVersion,
+            ...(this.serverCapabilities ? { capabilities: this.serverCapabilities } : {}),
+            features: {
+                // COMPAT(providersSnapshot): keep optional until all clients rely on snapshot flow.
+                providersSnapshot: true,
+                // COMPAT(checkoutGithubSetAutoMerge): added in v0.1.75, remove gate after 2026-11-13.
+                checkoutGithubSetAutoMerge: true,
+                githubCheckDetails: true,
+                // COMPAT(daemonStatusRpc): added in v0.1.76, remove gate after 2026-11-18.
+                daemonStatusRpc: true,
+                // COMPAT(terminalRestoreModes): added in v0.1.81, remove gate after 2026-11-23.
+                "terminal-restore-modes": true,
+                // COMPAT(rewind): added in v0.1.X, drop the gate when floor >= v0.1.X.
+                rewind: true,
+                // COMPAT(checkoutRefresh): added in v0.1.86, remove gate after 2026-11-29.
+                checkoutRefresh: true,
+                // COMPAT(recallSearch): added in v0.1.X, remove gate after 2026-12-03.
+                recallSearch: true,
+                // COMPAT(fileUploads): added for client→daemon chunked uploads; drop the gate when client floor advertises support.
+                fileUploads: true,
+                // COMPAT(sessionsListRpc): added in v0.1.X, remove gate after 2026-12-13.
+                sessionsListRpc: true,
+                // COMPAT(workflows): added in v0.1.X, remove gate after 2026-12-17.
+                // Same constant the HTTP route gate reads — one source of truth.
+                workflows: WORKFLOWS_FEATURE_ENABLED,
+                // COMPAT(extensions): added in v0.1.X, remove gate after 2026-12-17.
+                extensions: true,
+                // COMPAT(sessionDigest): added in v0.1.X, remove gate after 2026-12-27.
+                // Daemon writes/serves per-session digests + refreshes summary/keyFiles
+                // on idle; absent on older daemons → client hides the digest UI.
+                sessionDigest: true,
+                // COMPAT(workspaceMultiplicity): added in v0.1.97, drop the gate when floor >= v0.1.97
+                workspaceMultiplicity: true,
+                // COMPAT(projectRemove): added in v0.1.97, drop the gate when floor >= v0.1.97.
+                projectRemove: true,
+                // COMPAT(projectAdd): added in v0.1.97, drop the gate when floor >= v0.1.97.
+                projectAdd: true,
+                // COMPAT(worktreeRestore): added in v0.1.97, drop the gate when floor >= v0.1.97
+                worktreeRestore: true,
+                // COMPAT(providerUsageList): added in v0.1.98, drop the gate when daemon floor >= v0.1.98.
+                providerUsageList: true,
+                // COMPAT(agentDetach): added in v0.1.98, remove gate after 2026-12-19 once daemon floor >= v0.1.98.
+                agentDetach: true,
+                // COMPAT(daemonDiagnostics): added in v0.1.100, remove gate after 2026-12-25 once daemon floor >= v0.1.100.
+                daemonDiagnostics: true,
+                // COMPAT(daemonSelfUpdate): added in v0.1.93, remove gate after 2026-12-13.
+                daemonSelfUpdate: true,
+                // COMPAT(agentForkContext): added in v0.1.102, remove gate after 2026-12-28.
+                agentForkContext: true,
+                // COMPAT(meetingsLiveCapture): added in v0.2.1, drop the gate when floor >= v0.2.1.
+                meetingsLiveCapture: true,
+            },
+        };
+    }
+    createServerInfoMessage() {
+        return {
+            type: "session",
+            message: {
+                type: "status",
+                payload: this.buildServerInfoStatusPayload(),
+            },
+        };
+    }
+    createDaemonConfigChangedMessage(config) {
+        return wrapSessionMessage({
+            type: "status",
+            payload: {
+                status: "daemon_config_changed",
+                config,
+            },
+        });
+    }
+    broadcastCapabilitiesUpdate() {
+        this.broadcast(this.createServerInfoMessage());
+    }
+    broadcastDaemonConfigChanged(config) {
+        this.broadcast(this.createDaemonConfigChangedMessage(config));
+    }
+    bindSocketHandlers(ws) {
+        ws.on("message", (...args) => {
+            const data = args[0];
+            this.handleRawMessage(ws, data);
+        });
+        ws.on("close", async (...args) => {
+            const code = args[0];
+            const reason = args[1];
+            await this.detachSocket(ws, {
+                code: typeof code === "number" ? code : undefined,
+                reason,
+            });
+        });
+        ws.on("error", async (...args) => {
+            const error = args[0];
+            const err = error instanceof Error ? error : new Error(String(error));
+            const active = this.sessions.get(ws);
+            const pending = this.pendingConnections.get(ws);
+            const log = active?.connectionLogger ?? pending?.connectionLogger ?? this.logger;
+            log.error({ err }, "Client error");
+            await this.detachSocket(ws, { error: err });
+        });
+    }
+    resolveVoiceSpeakHandler(callerAgentId) {
+        return this.voiceSpeakHandlers.get(callerAgentId) ?? null;
+    }
+    resolveVoiceCallerContext(callerAgentId) {
+        return this.voiceCallerContexts.get(callerAgentId) ?? null;
+    }
+    async detachSocket(ws, details) {
+        const identity = this.socketIdentities.get(ws);
+        const identityFields = identity ? toConnectionLogFields(identity) : {};
+        const pending = this.clearPendingConnection(ws);
+        if (pending) {
+            this.incrementRuntimeCounter("pendingDisconnected");
+            pending.connectionLogger.info({
+                ...identityFields,
+                code: details.code,
+                reason: stringifyCloseReason(details.reason),
+            }, "Pending client disconnected");
+            this.socketIdentities.delete(ws);
+            return;
+        }
+        const connection = this.sessions.get(ws);
+        if (!connection) {
+            if (identity) {
+                this.logger.info({
+                    ...identityFields,
+                    code: details.code,
+                    reason: stringifyCloseReason(details.reason),
+                }, "Client socket closed without active session");
+                this.socketIdentities.delete(ws);
+            }
+            return;
+        }
+        this.sessions.delete(ws);
+        connection.sockets.delete(ws);
+        this.socketIdentities.delete(ws);
+        if (connection.sockets.size === 0) {
+            this.unregisterBrowserToolsClient(connection.clientId);
+            this.incrementRuntimeCounter("sessionDisconnectedWaitingReconnect");
+            if (connection.externalDisconnectCleanupTimeout) {
+                clearTimeout(connection.externalDisconnectCleanupTimeout);
+            }
+            const timeout = setTimeout(() => {
+                if (connection.externalDisconnectCleanupTimeout !== timeout) {
+                    return;
+                }
+                connection.externalDisconnectCleanupTimeout = null;
+                void this.cleanupConnection(connection, "Client disconnected (grace timeout)");
+            }, EXTERNAL_SESSION_DISCONNECT_GRACE_MS);
+            connection.externalDisconnectCleanupTimeout = timeout;
+            connection.connectionLogger.info({
+                ...identityFields,
+                code: details.code,
+                reason: stringifyCloseReason(details.reason),
+                reconnectGraceMs: EXTERNAL_SESSION_DISCONNECT_GRACE_MS,
+            }, "Client disconnected; waiting for reconnect");
+            return;
+        }
+        if (connection.sockets.size > 0) {
+            this.incrementRuntimeCounter("sessionSocketDisconnectedAttached");
+            connection.connectionLogger.info({
+                ...identityFields,
+                remainingSockets: connection.sockets.size,
+                code: details.code,
+                reason: stringifyCloseReason(details.reason),
+            }, "Client socket disconnected; session remains attached");
+            return;
+        }
+        await this.cleanupConnection(connection, "Client disconnected");
+    }
+    async cleanupConnection(connection, logMessage) {
+        this.incrementRuntimeCounter("sessionCleanup");
+        if (connection.externalDisconnectCleanupTimeout) {
+            clearTimeout(connection.externalDisconnectCleanupTimeout);
+            connection.externalDisconnectCleanupTimeout = null;
+        }
+        for (const socket of connection.sockets) {
+            this.sessions.delete(socket);
+            this.socketIdentities.delete(socket);
+        }
+        connection.sockets.clear();
+        const existing = this.externalSessionsByKey.get(connection.clientId);
+        if (existing === connection) {
+            this.externalSessionsByKey.delete(connection.clientId);
+        }
+        this.unregisterBrowserToolsClient(connection.clientId);
+        connection.connectionLogger.trace({ clientId: connection.clientId, totalSessions: this.sessions.size }, logMessage);
+        await connection.session.cleanup();
+    }
+    syncBrowserToolsClientRegistration(connection) {
+        if (!this.browserToolsBroker) {
+            return;
+        }
+        const browserHostCapability = getBrowserHostCapability(connection.clientCapabilities);
+        if (!browserHostCapability) {
+            this.unregisterBrowserToolsClient(connection.clientId);
+            return;
+        }
+        const capabilitySignature = JSON.stringify(browserHostCapability);
+        const existing = this.browserToolsRegistrations.get(connection.clientId);
+        if (existing?.capabilitySignature === capabilitySignature) {
+            return;
+        }
+        if (existing) {
+            this.browserToolsRegistrations.delete(connection.clientId);
+            existing.unregister();
+        }
+        const unregister = this.browserToolsBroker.registerClient({
+            id: connection.clientId,
+            hostKind: browserHostCapability.hostKind,
+            supportedCommands: browserHostCapability.supportedCommands,
+            sendBrowserAutomationRequest: (request) => {
+                this.sendToConnection(connection, wrapSessionMessage(request));
+            },
+        });
+        this.browserToolsRegistrations.set(connection.clientId, {
+            capabilitySignature,
+            unregister,
+        });
+    }
+    unregisterBrowserToolsClient(clientId) {
+        const registration = this.browserToolsRegistrations.get(clientId);
+        if (!registration) {
+            return;
+        }
+        this.browserToolsRegistrations.delete(clientId);
+        registration.unregister();
+    }
+    handleInvalidInboundMessage(args) {
+        const { ws, parsed, parsedMessage, pendingConnection, activeConnection, log } = args;
+        this.incrementRuntimeCounter("validationFailed");
+        if (pendingConnection) {
+            pendingConnection.connectionLogger.warn({ error: parsedMessage.error.message }, "Rejected pending message before hello");
+            this.clearPendingConnection(ws);
+            try {
+                ws.close(WS_CLOSE_INVALID_HELLO, "Invalid hello");
+            }
+            catch {
+                // ignore close errors
+            }
+            return;
+        }
+        const requestInfo = extractRequestInfoFromUnknownWsInbound(parsed);
+        const isUnknownSchema = requestInfo?.requestId != null &&
+            typeof parsed === "object" &&
+            parsed != null &&
+            "type" in parsed &&
+            parsed.type === "session";
+        log.warn({
+            clientId: activeConnection?.clientId,
+            requestId: requestInfo?.requestId,
+            requestType: requestInfo?.requestType,
+            error: parsedMessage.error.message,
+        }, "WS inbound message validation failed");
+        if (requestInfo) {
+            this.sendToClient(ws, wrapSessionMessage({
+                type: "rpc_error",
+                payload: {
+                    requestId: requestInfo.requestId,
+                    requestType: requestInfo.requestType,
+                    error: isUnknownSchema
+                        ? `Unknown request, try upgrading the daemon (currently v${this.daemonVersion})`
+                        : "Invalid message",
+                    code: isUnknownSchema ? "unknown_schema" : "invalid_message",
+                },
+            }));
+            return;
+        }
+        const errorMessage = `Invalid message: ${parsedMessage.error.message}`;
+        this.sendToClient(ws, wrapSessionMessage({
+            type: "status",
+            payload: {
+                status: "error",
+                message: errorMessage,
+            },
+        }));
+    }
+    maybeHandleBinaryFrame(params) {
+        const { ws, buffer, activeConnection, log } = params;
+        const asBytes = asUint8Array(buffer);
+        if (!asBytes) {
+            return false;
+        }
+        // Unified binary-frame decoder handles both terminal stream frames and
+        // file-transfer (client→daemon upload) frames — the two opcode spaces are
+        // disjoint, and session.handleBinaryFrame routes each kind accordingly.
+        const decodedFrame = decodeBinaryFrame(asBytes);
+        if (!decodedFrame) {
+            return false;
+        }
+        // Reject any pre-hello binary frame regardless of which decoder matched.
+        if (!activeConnection) {
+            this.incrementRuntimeCounter("binaryBeforeHelloRejected");
+            log.warn("Rejected binary frame before hello");
+            this.clearPendingConnection(ws);
+            try {
+                ws.close(WS_CLOSE_INVALID_HELLO, "Session message before hello");
+            }
+            catch {
+                // ignore close errors
+            }
+            return true;
+        }
+        void Promise.resolve(activeConnection.session.handleBinaryFrame(decodedFrame)).catch((error) => {
+            this.handleRawMessageError({
+                ws,
+                data: buffer,
+                error,
+                log: activeConnection.connectionLogger,
+            });
+        });
+        return true;
+    }
+    handlePendingConnectionMessage(params) {
+        const { ws, message, pendingConnection } = params;
+        if (message.type === "hello") {
+            this.handleHello({
+                ws,
+                message,
+                pending: pendingConnection,
+            });
+            return;
+        }
+        pendingConnection.connectionLogger.warn({
+            messageType: message.type,
+        }, "Rejected pending message before hello");
+        this.incrementRuntimeCounter("pendingMessageRejectedBeforeHello");
+        this.clearPendingConnection(ws);
+        try {
+            ws.close(WS_CLOSE_INVALID_HELLO, "Session message before hello");
+        }
+        catch {
+            // ignore close errors
+        }
+    }
+    handleRawMessage(ws, data) {
+        const activeConnection = this.sessions.get(ws);
+        const pendingConnection = this.pendingConnections.get(ws);
+        const log = activeConnection?.connectionLogger ?? pendingConnection?.connectionLogger ?? this.logger;
+        try {
+            const buffer = bufferFromWsData(data);
+            const binaryHandled = this.maybeHandleBinaryFrame({
+                ws,
+                buffer,
+                activeConnection,
+                log,
+            });
+            if (binaryHandled) {
+                return;
+            }
+            const parsed = JSON.parse(buffer.toString());
+            const parsedMessage = WSInboundMessageSchema.safeParse(parsed);
+            if (!parsedMessage.success) {
+                this.handleInvalidInboundMessage({
+                    ws,
+                    parsed,
+                    parsedMessage,
+                    pendingConnection,
+                    activeConnection,
+                    log,
+                });
+                return;
+            }
+            const message = parsedMessage.data;
+            this.recordInboundMessageType(message.type);
+            if (message.type === "ping") {
+                this.sendToClient(ws, { type: "pong" });
+                return;
+            }
+            if (message.type === "recording_state") {
+                return;
+            }
+            if (pendingConnection) {
+                this.handlePendingConnectionMessage({
+                    ws,
+                    message,
+                    pendingConnection,
+                });
+                return;
+            }
+            if (!activeConnection) {
+                this.incrementRuntimeCounter("missingConnectionForMessage");
+                this.logger.error("No connection found for websocket");
+                return;
+            }
+            if (message.type === "hello") {
+                this.incrementRuntimeCounter("unexpectedHelloOnActiveConnection");
+                activeConnection.connectionLogger.warn("Received hello on active connection");
+                try {
+                    ws.close(WS_CLOSE_INVALID_HELLO, "Unexpected hello");
+                }
+                catch {
+                    // ignore close errors
+                }
+                return;
+            }
+            if (message.type === "session") {
+                void this.dispatchSessionMessage(ws, activeConnection, message).catch((error) => {
+                    this.handleRawMessageError({ ws, data, error, log: activeConnection.connectionLogger });
+                });
+            }
+        }
+        catch (error) {
+            this.handleRawMessageError({ ws, data, error, log });
+        }
+    }
+    async dispatchSessionMessage(ws, activeConnection, message) {
+        this.recordInboundSessionRequestType(message.message.type);
+        const controlRpc = getControlRpcLogInfo(message.message);
+        if (controlRpc) {
+            const identity = this.socketIdentities.get(ws);
+            activeConnection.connectionLogger.warn({
+                ...(identity ? toConnectionLogFields(identity) : { clientId: activeConnection.clientId }),
+                ...controlRpc,
+            }, "ws_control_rpc_received");
+        }
+        if (message.message.type === "browser.automation.execute.response") {
+            this.browserToolsBroker?.receiveResponse(message.message);
+            return;
+        }
+        const startMs = performance.now();
+        await activeConnection.session.handleMessage(message.message);
+        const durationMs = performance.now() - startMs;
+        this.recordRequestLatency(message.message.type, durationMs);
+        if (durationMs >= SLOW_REQUEST_THRESHOLD_MS) {
+            activeConnection.connectionLogger.warn({
+                requestType: message.message.type,
+                durationMs: Math.round(durationMs),
+                inflightRequests: activeConnection.session.getRuntimeMetrics().inflightRequests,
+            }, "ws_slow_request");
+        }
+    }
+    handleRawMessageError(params) {
+        const { ws, data, error, log } = params;
+        const err = error instanceof Error ? error : new Error(String(error));
+        const { rawPayload, parsedPayload } = this.decodeRawMessagePayloadForError(data);
+        const trimmedRawPayload = typeof rawPayload === "string" && rawPayload.length > 2000
+            ? `${rawPayload.slice(0, 2000)}... (truncated)`
+            : rawPayload;
+        log.error({
+            err,
+            rawPayload: trimmedRawPayload,
+            parsedPayload,
+        }, "Failed to parse/handle message");
+        if (this.pendingConnections.has(ws)) {
+            this.clearPendingConnection(ws);
+            try {
+                ws.close(WS_CLOSE_INVALID_HELLO, "Invalid hello");
+            }
+            catch {
+                // ignore close errors
+            }
+            return;
+        }
+        const requestInfo = extractRequestInfoFromUnknownWsInbound(parsedPayload);
+        if (requestInfo) {
+            this.sendToClient(ws, wrapSessionMessage({
+                type: "rpc_error",
+                payload: {
+                    requestId: requestInfo.requestId,
+                    requestType: requestInfo.requestType,
+                    error: "Invalid message",
+                    code: "invalid_message",
+                },
+            }));
+            return;
+        }
+        this.sendToClient(ws, wrapSessionMessage({
+            type: "status",
+            payload: {
+                status: "error",
+                message: `Invalid message: ${err.message}`,
+            },
+        }));
+    }
+    decodeRawMessagePayloadForError(data) {
+        let rawPayload = null;
+        let parsedPayload = null;
+        try {
+            const buffer = bufferFromWsData(data);
+            rawPayload = buffer.toString();
+            parsedPayload = JSON.parse(rawPayload);
+        }
+        catch (payloadError) {
+            rawPayload = rawPayload ?? "<unreadable>";
+            parsedPayload = parsedPayload ?? rawPayload;
+            const payloadErr = payloadError instanceof Error ? payloadError : new Error(String(payloadError));
+            this.logger.error({ err: payloadErr }, "Failed to decode raw payload");
+        }
+        return { rawPayload, parsedPayload };
+    }
+    incrementRuntimeCounter(counter) {
+        this.runtimeMetrics.incrementCounter(counter);
+    }
+    recordInboundMessageType(type) {
+        this.runtimeMetrics.recordInboundMessage(type);
+    }
+    recordInboundSessionRequestType(type) {
+        this.runtimeMetrics.recordInboundSessionRequest(type);
+    }
+    recordRequestLatency(type, durationMs) {
+        this.runtimeMetrics.recordRequestLatency(type, durationMs);
+    }
+    collectSessionRuntimeMetrics() {
+        const uniqueConnections = new Set(this.externalSessionsByKey.values());
+        let terminalDirectorySubscriptionCount = 0;
+        let terminalSubscriptionCount = 0;
+        let inflightRequests = 0;
+        let peakInflightRequests = 0;
+        for (const connection of uniqueConnections) {
+            const sessionMetrics = connection.session.getRuntimeMetrics();
+            terminalDirectorySubscriptionCount += sessionMetrics.terminalDirectorySubscriptionCount;
+            terminalSubscriptionCount += sessionMetrics.terminalSubscriptionCount;
+            inflightRequests += sessionMetrics.inflightRequests;
+            peakInflightRequests = Math.max(peakInflightRequests, sessionMetrics.peakInflightRequests);
+            connection.session.resetPeakInflight();
+        }
+        return {
+            ...this.checkoutDiffManager.getMetrics(),
+            terminalDirectorySubscriptionCount,
+            terminalSubscriptionCount,
+            inflightRequests,
+            peakInflightRequests,
+        };
+    }
+    flushRuntimeMetrics(options) {
+        const runtimeMetrics = this.runtimeMetrics.snapshotAndReset();
+        const activeConnections = new Set(this.sessions.values()).size;
+        const activeSockets = this.sessions.size;
+        const pendingConnections = this.pendingConnections.size;
+        const reconnectGraceSessions = [...this.externalSessionsByKey.values()].filter((connection) => connection.sockets.size === 0 && connection.externalDisconnectCleanupTimeout !== null).length;
+        const sessionMetrics = this.collectSessionRuntimeMetrics();
+        const agentSnapshot = this.agentManager.getMetricsSnapshot();
+        const loggedMetrics = {
+            windowMs: runtimeMetrics.windowMs,
+            final: Boolean(options?.final),
+            sessions: {
+                activeConnections,
+                externalSessionKeys: this.externalSessionsByKey.size,
+                reconnectGraceSessions,
+            },
+            sockets: {
+                activeSockets,
+                pendingConnections,
+            },
+            counters: runtimeMetrics.counters,
+            inboundMessageTypesTop: runtimeMetrics.inboundMessageTypesTop,
+            inboundSessionRequestTypesTop: runtimeMetrics.inboundSessionRequestTypesTop,
+            outboundMessageTypesTop: runtimeMetrics.outboundMessageTypesTop,
+            outboundSessionMessageTypesTop: runtimeMetrics.outboundSessionMessageTypesTop,
+            outboundAgentStreamTypesTop: runtimeMetrics.outboundAgentStreamTypesTop,
+            outboundAgentStreamAgentsTop: runtimeMetrics.outboundAgentStreamAgentsTop,
+            outboundBinaryFrameTypesTop: runtimeMetrics.outboundBinaryFrameTypesTop,
+            bufferedAmount: runtimeMetrics.bufferedAmount,
+            eventLoopDelay: this.snapshotEventLoopDelay(),
+            uptimeSeconds: getProcessUptimeSeconds(),
+            memory: getProcessMemoryDiagnostics(),
+            runtime: sessionMetrics,
+            latency: runtimeMetrics.latency,
+            agents: agentSnapshot,
+        };
+        this.lastRuntimeMetricsSnapshot = {
+            collectedAt: new Date().toISOString(),
+            ...loggedMetrics,
+        };
+        this.logger.info(loggedMetrics, "ws_runtime_metrics");
+    }
+    getClientActivityState(session) {
+        const activity = session.getClientActivity();
+        if (!activity) {
+            return {
+                appVisible: false,
+                focusedAgentId: null,
+                focusedTerminalId: null,
+                lastActivityAtMs: null,
+            };
+        }
+        return {
+            appVisible: activity.appVisible,
+            focusedAgentId: activity.focusedAgentId,
+            focusedTerminalId: activity.focusedTerminalId,
+            lastActivityAtMs: activity.lastActivityAt.getTime(),
+        };
+    }
+    async broadcastAgentAttention(params) {
+        const clientEntries = [];
+        for (const [ws, connection] of this.sessions) {
+            clientEntries.push({
+                ws,
+                state: this.getClientActivityState(connection.session),
+            });
+        }
+        const allStates = clientEntries.map((e) => e.state);
+        const nowMs = Date.now();
+        const agent = this.agentManager.getAgent(params.agentId);
+        const assistantMessage = await this.agentManager.getLastAssistantMessage(params.agentId);
+        const notification = buildAgentAttentionNotificationPayload({
+            reason: params.reason,
+            serverId: this.serverId,
+            agentId: params.agentId,
+            assistantMessage,
+            permissionRequest: agent ? findLatestPermissionRequest(agent.pendingPermissions) : null,
+        });
+        const plan = computeNotificationPlan({
+            allStates,
+            focusTarget: { kind: "agent", id: params.agentId },
+            pushEligible: isPushEligibleAttentionReason(params.reason),
+            nowMs,
+        });
+        if (plan.shouldPush) {
+            void this.pushNotificationSender.send(notification).catch((err) => {
+                this.logger.warn({ err, agentId: params.agentId }, "Failed to send push notification");
+            });
+        }
+        for (const [clientIndex, { ws }] of clientEntries.entries()) {
+            const shouldNotify = clientIndex === plan.inAppRecipientIndex;
+            const timestamp = new Date().toISOString();
+            const message = wrapSessionMessage({
+                type: "agent_stream",
+                payload: {
+                    agentId: params.agentId,
+                    event: {
+                        type: "attention_required",
+                        provider: params.provider,
+                        reason: params.reason,
+                        timestamp,
+                        shouldNotify,
+                        notification,
+                    },
+                    timestamp,
+                },
+            });
+            this.sendToClient(ws, message);
+        }
+    }
+    async broadcastTerminalAttention(params) {
+        const clientEntries = [];
+        for (const [ws, connection] of this.sessions) {
+            clientEntries.push({
+                ws,
+                state: this.getClientActivityState(connection.session),
+            });
+        }
+        const allStates = clientEntries.map((e) => e.state);
+        const nowMs = Date.now();
+        const workspaceId = params.workspaceId;
+        const plan = computeNotificationPlan({
+            allStates,
+            focusTarget: { kind: "terminal", id: params.terminalId },
+            pushEligible: true,
+            nowMs,
+        });
+        const title = terminalAttentionTitle(params.reason);
+        const body = params.terminalName;
+        if (plan.shouldPush) {
+            void this.pushNotificationSender
+                .send({
+                title,
+                body,
+                data: {
+                    serverId: this.serverId,
+                    terminalId: params.terminalId,
+                    cwd: params.cwd,
+                    ...(workspaceId ? { workspaceId } : {}),
+                },
+            })
+                .catch((err) => {
+                this.logger.warn({ err, terminalId: params.terminalId }, "Failed to send push notification");
+            });
+        }
+        for (const [clientIndex, { ws }] of clientEntries.entries()) {
+            const shouldNotify = clientIndex === plan.inAppRecipientIndex;
+            const message = wrapSessionMessage({
+                type: "terminal_attention_required",
+                payload: {
+                    serverId: this.serverId,
+                    terminalId: params.terminalId,
+                    cwd: params.cwd,
+                    ...(workspaceId ? { workspaceId } : {}),
+                    reason: params.reason,
+                    title,
+                    body,
+                    shouldNotify,
+                },
+            });
+            this.sendToClient(ws, message);
+        }
+    }
+}
+function createWebSocketConnectionIdentity(requestMetadata, metadata) {
+    return {
+        connectionId: `conn_${randomUUID().replaceAll("-", "")}`,
+        transport: metadata?.transport === "relay" ? "relay" : "direct",
+        ...(requestMetadata.host ? { host: requestMetadata.host } : {}),
+        ...(requestMetadata.origin ? { origin: requestMetadata.origin } : {}),
+        ...(requestMetadata.userAgent ? { userAgent: requestMetadata.userAgent } : {}),
+        ...(requestMetadata.remoteAddress ? { remoteAddress: requestMetadata.remoteAddress } : {}),
+        ...(metadata?.relayConnectionId ? { relayConnectionId: metadata.relayConnectionId } : {}),
+    };
+}
+function toConnectionLogFields(identity) {
+    return {
+        connectionId: identity.connectionId,
+        transport: identity.transport,
+        ...(identity.host ? { host: identity.host } : {}),
+        ...(identity.origin ? { origin: identity.origin } : {}),
+        ...(identity.userAgent ? { userAgent: identity.userAgent } : {}),
+        ...(identity.remoteAddress ? { remoteAddress: identity.remoteAddress } : {}),
+        ...(identity.relayConnectionId ? { relayConnectionId: identity.relayConnectionId } : {}),
+        ...(identity.clientId ? { clientId: identity.clientId } : {}),
+        ...(identity.sessionId ? { sessionId: identity.sessionId } : {}),
+        ...(identity.appVersion ? { appVersion: identity.appVersion } : {}),
+    };
+}
+function extractSocketRequestMetadata(request) {
+    if (!request || typeof request !== "object") {
+        return {};
+    }
+    const record = request;
+    const host = typeof record.headers?.host === "string" ? record.headers.host : undefined;
+    const origin = typeof record.headers?.origin === "string" ? record.headers.origin : undefined;
+    const userAgent = typeof record.headers?.["user-agent"] === "string" ? record.headers["user-agent"] : undefined;
+    const remoteAddress = typeof record.socket?.remoteAddress === "string" ? record.socket.remoteAddress : undefined;
+    return {
+        ...(host ? { host } : {}),
+        ...(origin ? { origin } : {}),
+        ...(userAgent ? { userAgent } : {}),
+        ...(remoteAddress ? { remoteAddress } : {}),
+    };
+}
+function stripIpv6Brackets(hostname) {
+    return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+function parseHostAuthority(host) {
+    const trimmed = host.trim();
+    if (!trimmed) {
+        return null;
+    }
+    if (trimmed.startsWith("[")) {
+        const end = trimmed.indexOf("]");
+        if (end === -1) {
+            return null;
+        }
+        const hostname = stripIpv6Brackets(trimmed.slice(0, end + 1)).toLowerCase();
+        const rest = trimmed.slice(end + 1);
+        if (!rest) {
+            return { hostname, port: null };
+        }
+        if (!rest.startsWith(":")) {
+            return null;
+        }
+        const port = rest.slice(1);
+        return port ? { hostname, port } : null;
+    }
+    const firstColon = trimmed.indexOf(":");
+    if (firstColon === -1) {
+        return { hostname: trimmed.toLowerCase(), port: null };
+    }
+    if (trimmed.indexOf(":", firstColon + 1) !== -1) {
+        return { hostname: trimmed.toLowerCase(), port: null };
+    }
+    const hostname = trimmed.slice(0, firstColon).toLowerCase();
+    const port = trimmed.slice(firstColon + 1);
+    return hostname && port ? { hostname, port } : null;
+}
+function defaultPortForOriginProtocol(protocol) {
+    if (protocol === "http:") {
+        return "80";
+    }
+    if (protocol === "https:") {
+        return "443";
+    }
+    return null;
+}
+function isLoopbackAlias(hostname) {
+    const normalized = stripIpv6Brackets(hostname).toLowerCase();
+    if (normalized === "localhost" || normalized.endsWith(".localhost")) {
+        return true;
+    }
+    if (normalized === "::1" || normalized === "0:0:0:0:0:0:0:1") {
+        return true;
+    }
+    return /^127(?:\.\d{1,3}){3}$/.test(normalized);
+}
+export function isWebSocketSameOrigin(origin, requestHost) {
+    if (!origin || !requestHost) {
+        return false;
+    }
+    if (origin === `http://${requestHost}` || origin === `https://${requestHost}`) {
+        return true;
+    }
+    let originUrl;
+    try {
+        originUrl = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    const originPort = originUrl.port || defaultPortForOriginProtocol(originUrl.protocol);
+    if (!originPort) {
+        return false;
+    }
+    const requestAuthority = parseHostAuthority(requestHost);
+    if (!requestAuthority) {
+        return false;
+    }
+    const requestPort = requestAuthority.port || defaultPortForOriginProtocol(originUrl.protocol);
+    if (originPort !== requestPort) {
+        return false;
+    }
+    return isLoopbackAlias(originUrl.hostname) && isLoopbackAlias(requestAuthority.hostname);
+}
+function selectWebSocketProtocol(protocols, password) {
+    if (!password) {
+        return protocols.values().next().value ?? false;
+    }
+    for (const protocol of protocols) {
+        const token = extractWsBearerToken(protocol);
+        if (token !== null) {
+            return protocol;
+        }
+    }
+    return false;
+}
+function stringifyCloseReason(reason) {
+    if (typeof reason === "string") {
+        return reason.length > 0 ? reason : null;
+    }
+    if (Buffer.isBuffer(reason)) {
+        const text = reason.toString();
+        return text.length > 0 ? text : null;
+    }
+    if (reason == null) {
+        return null;
+    }
+    const text = String(reason);
+    return text.length > 0 ? text : null;
+}
+function getControlRpcLogInfo(message) {
+    if (message.type === "shutdown_server_request") {
+        return {
+            requestType: message.type,
+            requestId: message.requestId,
+            reason: CLIENT_SHUTDOWN_RPC_REASON,
+        };
+    }
+    if (message.type === "restart_server_request") {
+        const reason = normalizeClientRestartRpcReason(message.reason);
+        return {
+            requestType: message.type,
+            requestId: message.requestId,
+            reason,
+        };
+    }
+    if (message.type === "daemon.update.request") {
+        return {
+            requestType: message.type,
+            requestId: message.requestId,
+            reason: "daemon_update",
+        };
+    }
+    return null;
+}
+function extractRequestInfoFromUnknownWsInbound(payload) {
+    if (!payload || typeof payload !== "object") {
+        return null;
+    }
+    const record = payload;
+    // Session-wrapped messages
+    if (record.type === "session" && record.message && typeof record.message === "object") {
+        const msg = record.message;
+        if (typeof msg.requestId === "string") {
+            return {
+                requestId: msg.requestId,
+                ...(typeof msg.type === "string" ? { requestType: msg.type } : {}),
+            };
+        }
+    }
+    // Non-session messages (future-proof)
+    if (typeof record.requestId === "string") {
+        return {
+            requestId: record.requestId,
+            ...(typeof record.type === "string" ? { requestType: record.type } : {}),
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=websocket-server.js.map