@myagentroam/node 0.13.11 → 0.13.13

package/dist/remote-desktop/tigervnc-backend-pool.js

@@ -0,0 +1,88 @@
+import { RemoteDesktopError } from './desktop-error.js';
+/** Owns one Remote-only backend and its references, not attachments or desktop control leases. */
+export class TigerVncBackendPool {
+    start;
+    onFailure;
+    #tail = Promise.resolve();
+    #backend;
+    #generation = 0;
+    #unavailable = false;
+    #retiring = false;
+    #references = new Set();
+    #disposed = false;
+    constructor(start, onFailure) {
+        this.start = start;
+        this.onFailure = onFailure;
+    }
+    /** Used alongside the native-session and topology checks when admitting input. */
+    isAvailable() {
+        return !this.#disposed && !this.#unavailable && !this.#retiring;
+    }
+    acquire(signal) {
+        return this.#serialize(async () => {
+            if (signal.aborted)
+                throw new RemoteDesktopError('DESKTOP_SETUP_CANCELLED');
+            if (this.#disposed || this.#unavailable || this.#retiring)
+                throw new RemoteDesktopError('DESKTOP_BACKEND_CLOSED');
+            if (!this.#backend) {
+                const generation = ++this.#generation;
+                const backend = await this.start(signal, () => {
+                    if (generation !== this.#generation || this.#unavailable)
+                        return;
+                    this.#unavailable = true;
+                    try {
+                        this.onFailure();
+                    }
+                    catch {
+                        // The unusable backend remains fenced even if its observer fails.
+                    }
+                });
+                this.#backend = backend;
+                if (signal.aborted || this.#unavailable || this.#disposed) {
+                    await this.#stopEmpty();
+                    throw new RemoteDesktopError('DESKTOP_SETUP_CANCELLED');
+                }
+            }
+            const backend = this.#backend;
+            const token = Symbol();
+            this.#references.add(token);
+            return {
+                backend,
+                release: () => this.#serialize(() => this.#release(token))
+            };
+        });
+    }
+    /** Disallow new references; existing owners still close their own connections. */
+    dispose() {
+        this.#disposed = true;
+        return this.#serialize(async () => {
+            if (this.#references.size)
+                throw new RemoteDesktopError('DESKTOP_NATIVE_ATTACHMENTS_ACTIVE');
+            await this.#stopEmpty();
+        });
+    }
+    async #release(token) {
+        if (!this.#references.has(token))
+            return;
+        if (this.#references.size === 1) {
+            // Keep the token and backend if stopping fails: only this owner can retry.
+            await this.#stopEmpty();
+        }
+        this.#references.delete(token);
+    }
+    async #stopEmpty() {
+        if (!this.#backend)
+            return;
+        this.#retiring = true;
+        await this.#backend.stop();
+        this.#backend = undefined;
+        this.#unavailable = false;
+        this.#retiring = false;
+        ++this.#generation;
+    }
+    #serialize(operation) {
+        const result = this.#tail.then(operation);
+        this.#tail = result.then(() => { }, () => { });
+        return result;
+    }
+}

package/dist/remote-desktop/tigervnc-cleanup-channel.js

@@ -0,0 +1,129 @@
+import { RemoteDesktopError } from './desktop-error.js';
+import { randomBytes } from 'node:crypto';
+const marker = 0x4d415231;
+const maxReceiptBytes = 64;
+/** Owns the private native receipt stream, but neither the RFB stream nor control leases. */
+export class TigerVncCleanupChannel {
+    stream;
+    onFailure;
+    #pending = new Map();
+    #line = '';
+    #failed = false;
+    constructor(stream, onFailure = () => { }) {
+        this.stream = stream;
+        this.onFailure = onFailure;
+        stream.on('data', this.#onData);
+        stream.on('error', this.#onFailure);
+        stream.on('end', this.#onFailure);
+        stream.on('close', this.#onClose);
+    }
+    get outstanding() {
+        return this.#pending.size;
+    }
+    issue() {
+        if (this.#failed || this.stream.destroyed || this.stream.readableEnded)
+            throw new RemoteDesktopError('DESKTOP_NATIVE_CHANNEL_CLOSED');
+        let token = '';
+        for (let attempt = 0; attempt < 4; attempt++) {
+            const candidate = randomBytes(16).toString('hex');
+            if (!this.#pending.has(candidate)) {
+                token = candidate;
+                break;
+            }
+        }
+        if (!token)
+            throw new RemoteDesktopError('DESKTOP_NATIVE_ID_UNAVAILABLE');
+        const pending = { result: null };
+        this.#pending.set(token, pending);
+        const registration = Buffer.alloc(24);
+        registration[0] = 2;
+        registration.writeUInt16BE(5, 2);
+        registration.writeUInt32BE(marker, 4);
+        Buffer.from(token, 'hex').copy(registration, 8);
+        return {
+            registration,
+            wait: (signal) => new Promise((accept, fail) => {
+                if (pending.result) {
+                    if (pending.result === 'OK')
+                        accept();
+                    else
+                        fail(pending.result);
+                    return;
+                }
+                if (pending.waiter) {
+                    fail(new RemoteDesktopError('DESKTOP_NATIVE_WAIT_IN_PROGRESS'));
+                    return;
+                }
+                if (signal.aborted) {
+                    fail(new RemoteDesktopError('DESKTOP_NATIVE_CLEANUP_TIMEOUT'));
+                    return;
+                }
+                const abort = () => {
+                    delete pending.waiter;
+                    fail(new RemoteDesktopError('DESKTOP_NATIVE_CLEANUP_TIMEOUT'));
+                };
+                pending.waiter = { signal, abort, resolve: accept, reject: fail };
+                signal.addEventListener('abort', abort, { once: true });
+            })
+        };
+    }
+    dispose() {
+        this.#fail(false);
+        this.stream.destroy();
+    }
+    #onData = (chunk) => {
+        if (this.#failed)
+            return;
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        for (const byte of bytes) {
+            if (byte > 0x7f || this.#line.length >= maxReceiptBytes) {
+                this.#fail();
+                return;
+            }
+            this.#line += String.fromCharCode(byte);
+            if (byte !== 10)
+                continue;
+            const match = /^MAR1 ([0-9a-f]{32}) (OK|FAILED)\n$/.exec(this.#line);
+            this.#line = '';
+            const pending = match && this.#pending.get(match[1]);
+            if (!pending || !match) {
+                this.#fail();
+                return;
+            }
+            this.#pending.delete(match[1]);
+            this.#settle(pending, match[2] === 'OK' ? 'OK' : new RemoteDesktopError('DESKTOP_NATIVE_CLEANUP_FAILED'));
+        }
+    };
+    #onFailure = () => this.#fail();
+    #onClose = () => {
+        this.#fail();
+        this.stream.off('error', this.#onFailure);
+        this.stream.off('close', this.#onClose);
+    };
+    #fail(notify = true) {
+        if (this.#failed)
+            return;
+        this.#failed = true;
+        this.stream.off('data', this.#onData);
+        this.stream.off('end', this.#onFailure);
+        for (const pending of this.#pending.values())
+            this.#settle(pending, new RemoteDesktopError('DESKTOP_NATIVE_CHANNEL_CLOSED'));
+        this.#pending.clear();
+        if (notify) {
+            this.stream.destroy();
+            this.onFailure();
+        }
+    }
+    #settle(pending, result) {
+        pending.result = result;
+        const waiter = pending.waiter;
+        delete pending.waiter;
+        if (!waiter)
+            return;
+        waiter.signal.removeEventListener('abort', waiter.abort);
+        if (result === 'OK')
+            waiter.resolve();
+        else
+            waiter.reject(result);
+    }
+}

package/dist/remote-desktop/tigervnc-managed-process.js

@@ -0,0 +1,274 @@
+import { RemoteDesktopError } from './desktop-error.js';
+import { spawn } from 'node:child_process';
+import { createCipheriv, randomBytes } from 'node:crypto';
+import { mkdtemp, open, rm, stat, unlink } from 'node:fs/promises';
+import { connect } from 'node:net';
+import { tmpdir } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+import { Duplex } from 'node:stream';
+import { setTimeout as delay } from 'node:timers/promises';
+import { handshakeRfbBackend } from './rfb-backend-handshake.js';
+import { TigerVncCleanupChannel } from './tigervnc-cleanup-channel.js';
+function obfuscatePassword(secret) {
+    // TigerVNC's password file is an obfuscation, not a security boundary.
+    const key = Buffer.from('e84ad660c4721ae0'.repeat(3), 'hex');
+    try {
+        const cipher = createCipheriv('des-ede3', key, null);
+        cipher.setAutoPadding(false);
+        return Buffer.concat([cipher.update(secret), cipher.final()]);
+    }
+    finally {
+        key.fill(0);
+    }
+}
+/** Owns one local TigerVNC process and private control stream, never a control lease. */
+export class TigerVncManagedProcess {
+    child;
+    directory;
+    socketPath;
+    secret;
+    cleanup;
+    onUnexpectedExit;
+    #connections = new Set();
+    #exited;
+    #stopping = false;
+    #ready = false;
+    #didExit = false;
+    #notified = false;
+    #stopPromise;
+    #directoryCleanup;
+    constructor(child, directory, socketPath, secret, cleanup, onUnexpectedExit) {
+        this.child = child;
+        this.directory = directory;
+        this.socketPath = socketPath;
+        this.secret = secret;
+        this.cleanup = cleanup;
+        this.onUnexpectedExit = onUnexpectedExit;
+        this.#exited = new Promise((resolve) => {
+            child.once('close', () => {
+                this.#didExit = true;
+                this.secret.fill(0);
+                this.#notifyFailure();
+                this.#directoryCleanup = rm(this.directory, { recursive: true, force: true });
+                void this.#directoryCleanup.catch(() => { });
+                resolve();
+            });
+        });
+        child.on('error', () => { });
+        child.stderr?.resume();
+    }
+    static async start(options, signal) {
+        if (process.platform !== 'linux' ||
+            !isAbsolute(options.binaryPath) ||
+            !options.display ||
+            !isAbsolute(options.xAuthority))
+            throw new RemoteDesktopError('DESKTOP_BACKEND_CONFIG_INVALID');
+        const deadline = AbortSignal.any([signal, AbortSignal.timeout(10_000)]);
+        if (deadline.aborted)
+            throw new RemoteDesktopError('DESKTOP_SETUP_TIMEOUT');
+        let directory;
+        try {
+            directory = await mkdtemp(join(tmpdir(), 'mar-rfb-'));
+        }
+        catch {
+            throw new RemoteDesktopError('DESKTOP_BACKEND_START_FAILED');
+        }
+        const socketPath = join(directory, 'rfb.sock');
+        const passwordPath = join(directory, 'password');
+        const alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+        const secret = randomBytes(8);
+        for (let i = 0; i < secret.length; i++)
+            secret[i] = alphabet.charCodeAt(secret[i] & 63);
+        let backend;
+        try {
+            const file = await open(passwordPath, 'wx', 0o600);
+            try {
+                const obfuscated = obfuscatePassword(secret);
+                try {
+                    await file.writeFile(obfuscated);
+                }
+                finally {
+                    obfuscated.fill(0);
+                }
+                // The inherited descriptor keeps the unlinked password available only
+                // to this backend; a crashed Node leaves no password file behind.
+                await unlink(passwordPath);
+                const child = spawn(options.binaryPath, [
+                    '-display',
+                    options.display,
+                    '-rfbport',
+                    '-1',
+                    '-rfbunixpath',
+                    socketPath,
+                    '-rfbunixmode',
+                    '0600',
+                    '-SecurityTypes',
+                    'VncAuth',
+                    '-PasswordFile',
+                    '/proc/self/fd/4',
+                    '-AlwaysShared',
+                    '-AcceptSetDesktopSize=0',
+                    '-MaxCutText=1048576'
+                ], {
+                    env: {
+                        PATH: '/usr/bin:/bin',
+                        HOME: directory,
+                        DISPLAY: options.display,
+                        XAUTHORITY: options.xAuthority,
+                        MAR_RFB_CONTROL_FD: '3'
+                    },
+                    stdio: ['ignore', 'ignore', 'pipe', 'pipe', file.fd]
+                });
+                const control = child.stdio[3];
+                if (!(control instanceof Duplex)) {
+                    child.on('error', () => { });
+                    child.kill();
+                    await new Promise((resolve) => child.once('close', () => resolve()));
+                    throw new RemoteDesktopError('DESKTOP_BACKEND_START_FAILED');
+                }
+                backend = new TigerVncManagedProcess(child, directory, socketPath, secret, new TigerVncCleanupChannel(control), options.onUnexpectedExit);
+            }
+            finally {
+                await file.close();
+            }
+            while (!deadline.aborted) {
+                if (backend.#didExit ||
+                    backend.child.exitCode !== null ||
+                    backend.child.signalCode !== null)
+                    throw new RemoteDesktopError('DESKTOP_BACKEND_START_FAILED');
+                try {
+                    const info = await stat(socketPath);
+                    if (!info.isSocket() || (info.mode & 0o777) !== 0o600 || info.uid !== process.getuid?.())
+                        throw new RemoteDesktopError('DESKTOP_BACKEND_SOCKET_INVALID');
+                    if (backend.#didExit)
+                        throw new RemoteDesktopError('DESKTOP_BACKEND_START_FAILED');
+                    backend.#ready = true;
+                    return backend;
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                }
+                await delay(25, undefined, { signal: deadline });
+            }
+            throw new RemoteDesktopError('DESKTOP_SETUP_TIMEOUT');
+        }
+        catch (error) {
+            try {
+                if (backend)
+                    await backend.forceStop();
+                else {
+                    secret.fill(0);
+                    await rm(directory, { recursive: true, force: true });
+                }
+            }
+            catch {
+                throw new RemoteDesktopError('DESKTOP_BACKEND_STOP_FAILED');
+            }
+            if (deadline.aborted)
+                throw new RemoteDesktopError('DESKTOP_SETUP_TIMEOUT');
+            if (error instanceof RemoteDesktopError)
+                throw error;
+            throw new RemoteDesktopError('DESKTOP_BACKEND_START_FAILED');
+        }
+    }
+    async connect(maxPixels, signal) {
+        if (this.#stopping || this.child.exitCode !== null || this.child.signalCode !== null)
+            throw new RemoteDesktopError('DESKTOP_BACKEND_CLOSED');
+        const deadline = AbortSignal.any([signal, AbortSignal.timeout(10_000)]);
+        if (deadline.aborted)
+            throw new RemoteDesktopError('DESKTOP_SETUP_TIMEOUT');
+        const socket = connect(this.socketPath);
+        this.#connections.add(socket);
+        socket.once('close', () => this.#connections.delete(socket));
+        try {
+            await new Promise((resolve, reject) => {
+                const cleanup = () => {
+                    socket.off('connect', connected);
+                    socket.off('error', failed);
+                    deadline.removeEventListener('abort', aborted);
+                };
+                const connected = () => {
+                    cleanup();
+                    resolve();
+                };
+                const failed = () => {
+                    cleanup();
+                    reject(new RemoteDesktopError('DESKTOP_BACKEND_CLOSED'));
+                };
+                const aborted = () => {
+                    cleanup();
+                    reject(new RemoteDesktopError('DESKTOP_SETUP_TIMEOUT'));
+                };
+                socket.once('connect', connected);
+                socket.once('error', failed);
+                if (deadline.aborted)
+                    aborted();
+                else
+                    deadline.addEventListener('abort', aborted, { once: true });
+            });
+            const init = await handshakeRfbBackend(socket, this.secret, maxPixels, deadline);
+            return { socket, init };
+        }
+        catch (error) {
+            const ignoreLateError = () => { };
+            socket.on('error', ignoreLateError);
+            socket.once('close', () => socket.off('error', ignoreLateError));
+            socket.destroy();
+            if (error instanceof RemoteDesktopError)
+                throw error;
+            throw new RemoteDesktopError('DESKTOP_TRANSPORT_ERROR');
+        }
+    }
+    stop() {
+        if (this.#connections.size || this.cleanup.outstanding)
+            return Promise.reject(new RemoteDesktopError('DESKTOP_NATIVE_ATTACHMENTS_ACTIVE'));
+        return this.#stop();
+    }
+    /** Terminates an unusable backend; this never confirms or releases any lease. */
+    forceStop() {
+        return this.#stop();
+    }
+    #stop() {
+        if (this.#stopPromise)
+            return this.#stopPromise;
+        this.#stopping = true;
+        this.#stopPromise = (async () => {
+            for (const socket of this.#connections)
+                socket.destroy();
+            this.cleanup.dispose();
+            const timeout = await Promise.race([
+                this.#exited.then(() => false),
+                delay(5_000, undefined, { ref: false }).then(() => true)
+            ]);
+            if (timeout) {
+                this.child.kill('SIGKILL');
+                const stillRunning = await Promise.race([
+                    this.#exited.then(() => false),
+                    delay(5_000, undefined, { ref: false }).then(() => true)
+                ]);
+                if (stillRunning)
+                    throw new RemoteDesktopError('DESKTOP_BACKEND_STOP_FAILED');
+            }
+            try {
+                await (this.#directoryCleanup ??= rm(this.directory, { recursive: true, force: true }));
+            }
+            catch {
+                this.#directoryCleanup = undefined;
+                throw new RemoteDesktopError('DESKTOP_BACKEND_STOP_FAILED');
+            }
+        })();
+        const stopping = this.#stopPromise;
+        void stopping.catch(() => {
+            if (this.#stopPromise === stopping)
+                this.#stopPromise = undefined;
+        });
+        return this.#stopPromise;
+    }
+    #notifyFailure() {
+        if (!this.#ready || this.#stopping || this.#notified)
+            return;
+        this.#notified = true;
+        this.onUnexpectedExit();
+    }
+}

package/dist/remote-desktop/tigervnc-rfb-session.js

@@ -0,0 +1,190 @@
+import { RemoteDesktopError } from './desktop-error.js';
+import { handshakeRfbFrontend } from './rfb-frontend-handshake.js';
+import { RfbClientGate } from './rfb-client-gate.js';
+import { StandardRfbAttachment } from './standard-rfb-attachment.js';
+/** Keeps failed setup cleanup retryable without releasing the caller's lease. */
+export class TigerVncSetupCleanupError extends RemoteDesktopError {
+    attachment;
+    constructor(code, attachment) {
+        super(code);
+        this.attachment = attachment;
+        this.name = 'TigerVncSetupCleanupError';
+    }
+    retryCleanup(signal) {
+        return this.attachment.close(signal);
+    }
+}
+/** Owns one authorized RFB stream pair, never a desktop lease. */
+export class TigerVncRfbSession {
+    options;
+    socket;
+    gate;
+    attachment;
+    #closed = false;
+    #failed = false;
+    #detached = false;
+    #closing;
+    constructor(options, socket, gate, attachment) {
+        this.options = options;
+        this.socket = socket;
+        this.gate = gate;
+        this.attachment = attachment;
+    }
+    /** Called only after the surrounding Server authorization has accepted OPEN. */
+    static async open(options, signal) {
+        const setup = new AbortController();
+        const deadline = AbortSignal.any([signal, setup.signal, AbortSignal.timeout(10_000)]);
+        const frontendFailed = () => setup.abort();
+        options.frontend.pause();
+        options.frontend.on('error', frontendFailed);
+        options.frontend.once('close', frontendFailed);
+        options.frontend.once('end', frontendFailed);
+        let attachment;
+        let socket;
+        let gateFailure;
+        try {
+            const connected = await options.backend.connect(options.maxPixels, deadline);
+            socket = connected.socket;
+            if (!options.isCurrentTopology(connected.init.width, connected.init.height))
+                throw new RemoteDesktopError('DESKTOP_TOPOLOGY_UNAVAILABLE');
+            let session;
+            const gate = new RfbClientGate(socket, options.mode, () => options.isCurrentTopology(connected.init.width, connected.init.height) &&
+                options.isControlOwner(), (code) => {
+                if (session)
+                    session.#fail(code);
+                else {
+                    gateFailure = code;
+                    setup.abort();
+                }
+            });
+            attachment = new StandardRfbAttachment(socket, gate);
+            if (gateFailure)
+                throw new RemoteDesktopError(gateFailure);
+            if (deadline.aborted)
+                throw new RemoteDesktopError('DESKTOP_SETUP_CANCELLED');
+            if (!options.isCurrentTopology(connected.init.width, connected.init.height))
+                throw new RemoteDesktopError('DESKTOP_TOPOLOGY_UNAVAILABLE');
+            options.onAttached();
+            await handshakeRfbFrontend(options.frontend, connected.init.serverInit, deadline);
+            if (gateFailure)
+                throw new RemoteDesktopError(gateFailure);
+            if (deadline.aborted)
+                throw new RemoteDesktopError('DESKTOP_SETUP_CANCELLED');
+            if (!options.isCurrentTopology(connected.init.width, connected.init.height))
+                throw new RemoteDesktopError('DESKTOP_TOPOLOGY_UNAVAILABLE');
+            session = new TigerVncRfbSession(options, socket, gate, attachment);
+            session.#start();
+            return session;
+        }
+        catch (error) {
+            const ignore = () => { };
+            if (!options.frontend.closed) {
+                options.frontend.on('error', ignore);
+                options.frontend.once('close', () => options.frontend.off('error', ignore));
+            }
+            options.frontend.destroy();
+            if (attachment) {
+                try {
+                    await attachment.close(AbortSignal.timeout(5_000));
+                }
+                catch (cleanupError) {
+                    throw new TigerVncSetupCleanupError(cleanupError instanceof RemoteDesktopError
+                        ? cleanupError.code
+                        : 'DESKTOP_NATIVE_CLEANUP_FAILED', attachment);
+                }
+            }
+            else if (socket) {
+                if (!socket.closed) {
+                    socket.on('error', ignore);
+                    socket.once('close', () => socket?.off('error', ignore));
+                }
+                socket.destroy();
+            }
+            if (gateFailure)
+                throw new RemoteDesktopError(gateFailure);
+            if (error instanceof RemoteDesktopError)
+                throw error;
+            throw new RemoteDesktopError('DESKTOP_TRANSPORT_ERROR');
+        }
+        finally {
+            options.frontend.off('error', frontendFailed);
+            options.frontend.off('close', frontendFailed);
+            options.frontend.off('end', frontendFailed);
+        }
+    }
+    /** Synchronously stop frontend input and output before attachment cleanup. */
+    fence() {
+        if (this.#closed || this.#closing)
+            return;
+        void this.gate.fence().catch(() => { });
+        this.#detach();
+    }
+    /** Fence input and await this backend's attachment cleanup contract. */
+    close(signal) {
+        if (this.#closed)
+            return Promise.resolve();
+        if (this.#closing)
+            return this.#closing;
+        this.fence();
+        const pending = this.attachment.close(signal).then(() => {
+            this.#closed = true;
+        });
+        this.#closing = pending.finally(() => {
+            this.#closing = undefined;
+        });
+        return this.#closing;
+    }
+    #start() {
+        this.options.frontend.on('data', this.#input);
+        this.options.frontend.on('error', this.#transportFailed);
+        this.options.frontend.on('end', this.#transportFailed);
+        this.options.frontend.on('close', this.#transportFailed);
+        this.socket.on('end', this.#transportFailed);
+        this.socket.on('close', this.#transportFailed);
+        this.socket.pipe(this.options.frontend, { end: false });
+        // Handshake explicitly paused this stream; resume only after the gate owns reads.
+        this.options.frontend.resume();
+    }
+    #input = (data) => {
+        if (!(data instanceof Uint8Array))
+            this.#fail('DESKTOP_RFB_INVALID');
+        else
+            this.gate.receive(data);
+    };
+    #transportFailed = () => this.#fail('DESKTOP_TRANSPORT_ERROR');
+    #fail(code) {
+        if (this.#failed || this.#closed || this.#closing)
+            return;
+        this.#failed = true;
+        // fence() stops admission synchronously even while its writes are draining.
+        void this.gate.fence().catch(() => { });
+        this.#detach();
+        try {
+            this.options.onFailure(code);
+        }
+        catch {
+            // Resource cleanup cannot depend on a caller callback succeeding.
+        }
+        void this.close(AbortSignal.timeout(5_000)).catch(() => { });
+    }
+    #detach() {
+        if (this.#detached)
+            return;
+        this.#detached = true;
+        this.options.frontend.pause();
+        this.options.frontend.off('data', this.#input);
+        this.options.frontend.off('error', this.#transportFailed);
+        this.options.frontend.off('end', this.#transportFailed);
+        this.options.frontend.off('close', this.#transportFailed);
+        this.socket.off('end', this.#transportFailed);
+        this.socket.off('close', this.#transportFailed);
+        this.socket.unpipe(this.options.frontend);
+        // Absorb a late transport error until destroy completes.
+        const ignore = () => { };
+        if (!this.options.frontend.closed) {
+            this.options.frontend.on('error', ignore);
+            this.options.frontend.once('close', () => this.options.frontend.off('error', ignore));
+        }
+        this.options.frontend.destroy();
+    }
+}