@marimo-team/islands 0.23.14-dev55 → 0.23.14-dev58

package/src/core/websocket/useMarimoKernelConnection.tsx

@@ -1,6 +1,6 @@
 /* Copyright 2026 Marimo. All rights reserved. */
 
-import { useAtom, useSetAtom } from "jotai";
+import { useAtom, useAtomValue, useSetAtom } from "jotai";
 import { useRef } from "react";
 import { useErrorBoundary } from "react-error-boundary";
 import { toast } from "@/components/ui/use-toast";
@@ -38,7 +38,7 @@ import {
 } from "../codemirror/cells/debugger-state";
 import type { CellData } from "../cells/types";
 import { capabilitiesAtom } from "../config/capabilities";
-import { useSetAppConfig } from "../config/config";
+import { connectionTransportTypeAtom, useSetAppConfig } from "../config/config";
 import { useDataSourceActions } from "../datasets/data-source-connections";
 import type { ConnectionName } from "../datasets/engines";
 import {
@@ -84,13 +84,18 @@ const SUPPORTS_LAZY_KERNELS = true;
 
 // All MARIMO_* reasons except TRANSPORT_EXHAUSTED are emitted by the backend
 // (marimo/_server/api/endpoints/ws_endpoint.py and ws/*.py). Keep in sync with
-// the backend literals.
+// the backend literals. Over the SSE transport these arrive as in-band
+// `close` events rather than WebSocket close frames, so every terminal
+// reason must be classified here — an unclassified reason falls into the
+// retry path.
 export type CloseReason =
   | "MARIMO_NO_FILE_KEY"
   | "MARIMO_NO_SESSION_ID"
   | "MARIMO_NO_SESSION"
   | "MARIMO_SHUTDOWN"
   | "MARIMO_KERNEL_STARTUP_ERROR"
+  | "MARIMO_UNAUTHORIZED"
+  | "MARIMO_KIOSK_NOT_ALLOWED"
   | typeof TRANSPORT_EXHAUSTED_REASON;
 
 export type CloseDecision =
@@ -122,6 +127,26 @@ export function classifyCloseEvent(event: { reason?: string }): CloseDecision {
         },
         closeTransport: true,
       };
+    case "MARIMO_UNAUTHORIZED":
+      return {
+        kind: "terminal",
+        status: {
+          state: WebSocketState.CLOSED,
+          code: WebSocketClosedReason.KERNEL_DISCONNECTED,
+          reason: "not authorized",
+        },
+        closeTransport: true,
+      };
+    case "MARIMO_KIOSK_NOT_ALLOWED":
+      return {
+        kind: "terminal",
+        status: {
+          state: WebSocketState.CLOSED,
+          code: WebSocketClosedReason.KERNEL_DISCONNECTED,
+          reason: "kiosk mode is not available for this session",
+        },
+        closeTransport: true,
+      };
     case "MARIMO_KERNEL_STARTUP_ERROR":
       return {
         kind: "terminal",
@@ -198,6 +223,7 @@ export function useMarimoKernelConnection(opts: {
   const setKioskMode = useSetAtom(kioskModeAtom);
   const setCapabilities = useSetAtom(capabilitiesAtom);
   const runtimeManager = useRuntimeManager();
+  const transportType = useAtomValue(connectionTransportTypeAtom);
   const setCacheInfo = useSetAtom(cacheInfoAtom);
   const setKernelStartupError = useSetAtom(kernelStartupErrorAtom);
   const setDebuggerCurrentLine = useSetAtom(debuggerCurrentLineAtom);
@@ -456,10 +482,19 @@ export function useMarimoKernelConnection(opts: {
 
   const ws = useConnectionTransport({
     static: isStaticNotebook(),
+    transportType,
     /**
      * Unique URL for this session.
      */
-    url: () => runtimeManager.getWsURL(sessionId).toString(),
+    url: () =>
+      transportType === "sse"
+        ? runtimeManager.getSseURL(sessionId).toString()
+        : runtimeManager.getWsURL(sessionId).toString(),
+    /**
+     * Auth headers for the SSE transport. WebSockets cannot send headers
+     * and instead put the access token in the URL.
+     */
+    headers: () => runtimeManager.headers(),
 
     /**
      * Open callback. Set the connection status to open.

package/src/core/websocket/useWebSocket.tsx

@@ -5,12 +5,16 @@ import { Logger } from "@/utils/Logger";
 import { createPyodideConnection } from "../wasm/bridge";
 import { isWasm } from "../wasm/utils";
 import { BasicTransport } from "./transports/basic";
+import { SseTransport } from "./transports/sse";
 import { WsTransport } from "./transports/ws";
 import type { IConnectionTransport } from "./transports/transport";
 
 interface UseConnectionTransportOptions {
   url: () => string;
   static: boolean;
+  transportType: "websocket" | "sse";
+  /** Request headers for the SSE transport (auth); unused by WebSockets. */
+  headers: () => Record<string, string>;
   waitToConnect: () => Promise<void>;
   onOpen: (event: WebSocketEventMap["open"]) => void;
   onMessage: (event: WebSocketEventMap["message"]) => void;
@@ -18,8 +22,11 @@ interface UseConnectionTransportOptions {
   onError: (event: WebSocketEventMap["error"]) => void;
 }
 
-function createConnectionTransport(
-  options: Pick<UseConnectionTransportOptions, "url" | "static">,
+export function createConnectionTransport(
+  options: Pick<
+    UseConnectionTransportOptions,
+    "url" | "static" | "transportType" | "headers"
+  >,
 ): IConnectionTransport {
   if (options.static) {
     return BasicTransport.empty();
@@ -28,6 +35,9 @@ function createConnectionTransport(
     return createPyodideConnection();
   }
   // urlProvider is passed lazily; it may change after a runtime redirect.
+  if (options.transportType === "sse") {
+    return new SseTransport(options.url, options.headers);
+  }
   return new WsTransport(options.url);
 }
 

package/dist/assets/__vite-browser-external-DAm_YW43.js

@@ -1 +0,0 @@
-import{t as e}from"./worker-DEDLIQQV.js";var t=e(((e,t)=>{t.exports={}}));export default t();