agent-comms 9.1.0 → 9.1.2

package/src/core/detached-work.ts

@@ -0,0 +1,55 @@
+/**
+ * Work started and not awaited, which must never end the process by rejecting: a peer decides what its messages contain, so an exception while handling one is reported, not left as an unhandled rejection.
+ */
+
+/**
+ * Attaches a rejection handler to `work`. A rejection goes to the error handler `getOnError` returns when it settles (read then, not now, so a handler assigned after the work started is the one used), and to stderr when there is none, so it is never silent.
+ */
+export function reportRejection(
+  work: Readonly<Promise<unknown>>,
+  getOnError: () => ((error: Error) => void) | undefined,
+): void {
+  work.catch((error: unknown) => {
+    const failure = error instanceof Error ? error : new Error(String(error));
+    const onError = getOnError();
+    if (onError !== undefined) {
+      onError(failure);
+      return;
+    }
+    process.stderr.write(`agent-comms: ${failure.message}\n`);
+  });
+}
+
+function report(
+  error: unknown,
+  getOnError: () => ((error: Error) => void) | undefined,
+): void {
+  reportRejection(
+    Promise.reject(error instanceof Error ? error : new Error(String(error))),
+    getOnError,
+  );
+}
+
+/** What a handler of consumeEach answers: read the next item, or end the loop here. */
+export type ConsumeStep = "continue" | "stop";
+
+/**
+ * Reads `items` until the stream ends, handing each to `handle` in arrival order, one at a time. A failure of `handle` is reported through `getOnError` (see reportRejection) and the loop carries on: one item a peer sent that cannot be handled must not stop every later one on the same session. A handler that returns "stop" ends the loop at once, as `break` would. A failure of the stream itself ends the loop and is reported the same way. Never rejects.
+ */
+export async function consumeEach<T>(
+  items: Readonly<AsyncIterable<T>>,
+  handle: (item: T) => Promise<ConsumeStep> | ConsumeStep,
+  getOnError: () => ((error: Error) => void) | undefined,
+): Promise<void> {
+  try {
+    for await (const item of items) {
+      try {
+        if ((await handle(item)) === "stop") return;
+      } catch (error) {
+        report(error, getOnError);
+      }
+    }
+  } catch (error) {
+    report(error, getOnError);
+  }
+}

package/src/core/election-sessions.ts

@@ -8,6 +8,7 @@
 
 import type { AcceptedMeshSession } from "wire-mesh-core/domain/mesh-session";
 import type { CoordinatorFrame } from "wire-mesh-core/generated/protocol";
+import { consumeEach } from "./detached-work.js";
 import type { ConnectionHandle, TransportEvents } from "./transport.js";
 
 /** Where a session's outbound claims stand: whether a send is unresolved, and the newest claim that arrived meanwhile. */
@@ -39,13 +40,16 @@ export class ElectionSessions {
     session: AcceptedMeshSession,
     handle: Readonly<ConnectionHandle>,
   ): void {
-    void (async () => {
-      for await (const frame of session.coordinatorFrames) {
+    void consumeEach(
+      session.coordinatorFrames,
+      (frame) => {
         if (this.enrolled.has(session)) {
           this.events.onCoordinatorClaim(handle, frame);
         }
-      }
-    })();
+        return "continue";
+      },
+      () => this.events.onError,
+    );
   }
 
   /** Enrols a trusted machine-local session, then fires onElectionSessionEnrolled so this side tells the peer which claim it accepts. Both ends of every machine-local session enrol it, so each tells the other. */

package/src/core/hub-session.ts

@@ -2,6 +2,7 @@
  * HubSession -- the relay-hub connection mode (agent-comms#151), split from wire-mesh-transport.ts under the max-lines cap the same way connection-approval.ts and its siblings were. A hub connection (wss://mesh.exadev.io/) is a RELAY, not a coordinator: no connect_request/introduce approval applies. The session's own self-advert is forwarded by the hub to every other connected agent and the hub answers with a catch-up of everyone already there, so peers discover each other purely through gossip. Messages ride relay-connect pairings -- sendManageRequest's own targetDevice routing, which the session layer wraps as relay-data to exactly that device.
  */
 
+import { consumeEach } from "./detached-work.js";
 import {
   acceptMeshSession,
   type AcceptedMeshSession,
@@ -205,59 +206,57 @@ export class HubSession {
     ownHex: string,
   ): Promise<void> {
     try {
-      for await (const event of session.events) {
-        if (this.deps.isShuttingDown()) break;
-        const remoteEntries = await this.deps.admitEntries(
-          event.directory.filter(
-            (entry) => deviceIdToHex(entry.device) !== ownHex,
-          ),
-        );
-        for (const entry of remoteEntries) {
-          this.hubPeersKnown.add(deviceIdToHex(entry.device));
-        }
-        if (remoteEntries.length > 0) this.deps.onDirectory(remoteEntries);
-        if (event.state.status === "closed") break;
-      }
+      // An event that cannot be handled (the directory filter rejecting, say) is reported and the next is still read: ending the loop here would clear a session that is still live.
+      await consumeEach(
+        session.events,
+        async (event) => {
+          if (this.deps.isShuttingDown()) return "stop";
+          const remoteEntries = await this.deps.admitEntries(
+            event.directory.filter(
+              (entry) => deviceIdToHex(entry.device) !== ownHex,
+            ),
+          );
+          for (const entry of remoteEntries) {
+            this.hubPeersKnown.add(deviceIdToHex(entry.device));
+          }
+          if (remoteEntries.length > 0) this.deps.onDirectory(remoteEntries);
+          return event.state.status === "closed" ? "stop" : "continue";
+        },
+        () => this.deps.events.onError,
+      );
     } finally {
       if (this.session === session) this.clearSession();
     }
   }
 
-  /** Consumes one hub session's inbound relayed manage-requests until it ends, dispatching each in arrival order to dispatchHubRequest -- see that function's own doc for the actual per-request trust decision. Split out purely so the decision itself is directly unit-testable against fake requests/deps (hub-session-dispatch.test.ts), the same reason hub-forwarding.ts's own routeRoomRequestViaHub is a standalone function rather than a private method. Passes this.url through as dispatchHubRequest's own hubAddress -- this side's own dialled address for the hub every request on this specific session arrived over (agent-comms#216), the answering-side equivalent of tracePath's own local.hubAddress above. */
+  /** Consumes one hub session's inbound relayed manage-requests until it ends, dispatching each in arrival order to dispatchHubRequest, and reporting a request whose dispatch fails without ending the loop, so one request cannot stop every later one on the session, see that function's own doc for the actual per-request trust decision. Split out purely so the decision itself is directly unit-testable against fake requests/deps (hub-session-dispatch.test.ts), the same reason hub-forwarding.ts's own routeRoomRequestViaHub is a standalone function rather than a private method. Passes this.url through as dispatchHubRequest's own hubAddress, this side's own dialled address for the hub every request on this specific session arrived over (agent-comms#216), the answering-side equivalent of tracePath's own local.hubAddress above. */
   private consume(session: AcceptedMeshSession): void {
-    void (async () => {
-      for await (const request of session.incomingManageRequests) {
-        if (this.deps.isShuttingDown()) break;
-        await dispatchHubRequest({
-          request,
-          deps: this.deps,
-          onKnownPeer: (hex) => {
-            this.hubPeersKnown.add(hex);
-          },
-          hubAddress: this.url,
-        });
-      }
-    })();
+    void drainHubRequests({
+      requests: session.incomingManageRequests,
+      deps: this.deps,
+      onKnownPeer: (hex) => {
+        this.hubPeersKnown.add(hex);
+      },
+      hubAddress: this.url,
+    });
   }
 
   /** Consumes one hub session's inbound core/data frames until it ends, handing each one that came through a relay pairing to onRelayedDataFrame in arrival order. A failure in the handler is reported and the loop carries on, since one bad frame must not stop every later one. */
   private consumeDataFrames(session: AcceptedMeshSession): void {
-    void (async () => {
-      for await (const incoming of session.incomingDataFrames) {
-        if (this.deps.isShuttingDown()) break;
-        if (incoming.fromDevice === undefined) continue;
-        await this.deps
-          .onRelayedDataFrame(
+    void consumeEach(
+      session.incomingDataFrames,
+      async (incoming) => {
+        if (this.deps.isShuttingDown()) return "stop";
+        if (incoming.fromDevice !== undefined) {
+          await this.deps.onRelayedDataFrame(
             deviceIdToHex(incoming.fromDevice),
             incoming.frame,
-          )
-          .catch((error: unknown) => {
-            this.deps.events.onError?.(
-              error instanceof Error ? error : new Error(String(error)),
-            );
-          });
-      }
-    })();
+          );
+        }
+        return "continue";
+      },
+      () => this.deps.events.onError,
+    );
   }
 
   /** Sends one core/data frame to a specific hub-reachable device through a relay pairing, sealed end to end with that device. Rejects when no hub session is live. */
@@ -325,6 +324,29 @@ function hexToBytes(hex: string): Uint8Array<ArrayBuffer> {
   return bytes;
 }
 
+/**
+ * Dispatches each inbound relayed manage-request in arrival order until the stream ends. A request whose dispatch throws is reported through the transport's error handler and the next is still read, and a transport that is shutting down makes the loop skip the rest. Never rejects. Exported so the loop is tested without a live hub session.
+ */
+export async function drainHubRequests(options: {
+  requests: AsyncIterable<IncomingManageRequest>;
+  deps: Readonly<
+    HubRequestDispatchDeps & Pick<HubSessionDeps, "events" | "isShuttingDown">
+  >;
+  onKnownPeer: (deviceHex: string) => void;
+  hubAddress?: string | undefined;
+}): Promise<void> {
+  const { requests, deps, onKnownPeer, hubAddress } = options;
+  await consumeEach(
+    requests,
+    async (request) => {
+      if (deps.isShuttingDown()) return "stop";
+      await dispatchHubRequest({ request, deps, onKnownPeer, hubAddress });
+      return "continue";
+    },
+    () => deps.events.onError,
+  );
+}
+
 /** The slice of HubSessionDeps dispatchHubRequest actually needs. Named so its own tests, and consume()'s call site, don't repeat the same Pick inline. */
 export type HubRequestDispatchDeps = Pick<
   HubSessionDeps,

package/src/core/message-limits.ts

@@ -0,0 +1,29 @@
+/**
+ * The size limit shared by every path that takes message text from outside this process: the web bridge's HTTP bodies and WebSocket messages, and the `content` of a message sent through the MCP tool.
+ */
+
+import { CommsError } from "./store.js";
+
+const BYTES_PER_KIB = 1024;
+const KIB_PER_MIB = 1024;
+
+/**
+ * The most bytes the bridge reads from one HTTP request body, accepts in one dashboard WebSocket message, and accepts as the content of one message sent through the tool.
+ *
+ * The largest legitimate input is a chat message a person typed or pasted. One mebibyte holds a pasted document of several hundred thousand characters, even with every character escaped in a JSON action, which is well beyond anything a conversation carries, while keeping what one request can make the bridge hold in memory small. Every other request the dashboard sends (room, agent and read calls) is a few hundred bytes.
+ */
+export const MAX_MESSAGE_BYTES = KIB_PER_MIB * BYTES_PER_KIB;
+
+/** The `code` of the error raised for message content over MAX_MESSAGE_BYTES. */
+export const MESSAGE_TOO_LARGE = "MESSAGE_TOO_LARGE";
+
+/** Throws a CommsError, before anything is sent, when `content` is longer than MAX_MESSAGE_BYTES in UTF-8. The text of the error states the limit and the size, never the content. */
+export function requireMessageWithinLimit(content: string): void {
+  const bytes = Buffer.byteLength(content, "utf-8");
+  if (bytes > MAX_MESSAGE_BYTES) {
+    throw new CommsError(
+      `The message is ${String(bytes)} bytes and the limit is ${String(MAX_MESSAGE_BYTES)} bytes; nothing was sent. Send it in shorter parts.`,
+      MESSAGE_TOO_LARGE,
+    );
+  }
+}

package/src/core/peer-lifecycle.ts

@@ -4,6 +4,7 @@
  * Two roles are kept apart here (agent-comms#341). The well-known port listener is only the compatibility first-contact address and introduction path, and is still passed on by graceful handover and recovered by the bind race. The coordinator duties (the stale-agent probe, single-authority departure announcements, the default cc-peer front) follow the elected CoordinatorRole instead, whose holder need not be the peer that bound the port.
  */
 
+import { reportRejection } from "./detached-work.js";
 import { normaliseWireState } from "./wire-protocol.js";
 import { parseIsoTimestampMs } from "./iso-timestamp.js";
 import type {
@@ -158,7 +159,7 @@ export class PeerLifecycle {
       this.deps.peerInfo.set(peer.id, peer);
       // The list always includes this store's own entry — dialling yourself is a wasted connection attempt (and, on some platforms, an immediate self-inflicted ECONNRESET) that never needs to happen.
       if (peer.id === peerId) continue;
-      void this.deps.requireTransport().connectToPeer(peer, peerId);
+      this.detach(this.deps.requireTransport().connectToPeer(peer, peerId));
     }
   }
 
@@ -166,7 +167,7 @@ export class PeerLifecycle {
     this.deps.peerInfo.set(peer.id, peer);
     const peerId = this.deps.getPeerId();
     if (peer.id === peerId) return;
-    void this.deps.requireTransport().connectToPeer(peer, peerId);
+    this.detach(this.deps.requireTransport().connectToPeer(peer, peerId));
   }
 
   async handleIntroduction(
@@ -242,13 +243,18 @@ export class PeerLifecycle {
     if (self !== undefined) this.deps.peerInfo.set(peerId, self);
     for (const peer of peerList) {
       this.deps.peerInfo.set(peer.id, peer);
-      void this.deps.requireTransport().connectToPeer(peer, peerId);
+      this.detach(this.deps.requireTransport().connectToPeer(peer, peerId));
     }
     await this.claimWhileAlone();
   }
 
+  /** Work started for a peer and not awaited: a failure is reported through onError (or stderr), never left as an unhandled rejection. */
+  private detach(work: Readonly<Promise<unknown>>): void {
+    reportRejection(work, () => this.deps.onError);
+  }
+
   handlePeerDisconnected(handle: Readonly<ConnectionHandle>): void {
-    void this.handlePeerDeparture(handle.id);
+    this.detach(this.handlePeerDeparture(handle.id));
   }
 
   /** The awaitable form of handlePeerDisconnected, which TransportEvents forces to be synchronous. A departing peer leaves the peer list. When it held the elected coordinator role, the role is recovered first (the lowest surviving device-id claims at a raised term), so the new holder is already in place by the time the departed peer's agent record is retired; when it held the well-known port this side dialled, the vacated port is contested too. */

package/src/core/pending-connection.ts

@@ -6,7 +6,11 @@ import type {
   AcceptedMeshSession,
   IncomingManageRequest,
 } from "wire-mesh-core/domain/mesh-session";
-import type { ListenerPolicy } from "./transport.js";
+import type {
+  ConnectionHandle,
+  ListenerPolicy,
+  TransportEvents,
+} from "./transport.js";
 
 /** How long a connect_request may sit awaiting a human decision before this side gives up and rejects it automatically. Generous on purpose -- this bounds a human approval window, not a network timeout: 5 minutes covers a person genuinely being away from the terminal for a few minutes, while still guaranteeing every unanswered request eventually resolves instead of accumulating in pendingConnections indefinitely. */
 const PENDING_CONNECTION_TIMEOUT_MINUTES = 5;
@@ -51,3 +55,46 @@ export function expirePendingConnection(
     .catch(() => undefined);
   pending.resolve("reject");
 }
+
+/** What holdConnectRequest needs: where pending requests are kept, how long one may wait, and where the request is announced. */
+export interface HoldConnectRequestOptions {
+  pendingConnections: Map<string, PendingConnection>;
+  timeoutMs: number;
+  events: Pick<TransportEvents, "onConnectionRequest">;
+}
+
+/**
+ * Holds a connect_request open until a human decides, and settles with that decision. The request is announced through `onConnectionRequest` and answered later by acceptConnection or rejectConnection, or by expirePendingConnection if neither happens within the timeout. The timer is unref()'d so a stray pending connection, whose timer failed to be cleared through some path, can never by itself keep the process alive for up to the timeout after everything else is done.
+ */
+export async function holdConnectRequest(
+  options: Readonly<HoldConnectRequestOptions>,
+  held: Readonly<{
+    request: IncomingManageRequest;
+    message: { dataPort: number; name: string; fingerprint: string };
+    handle: Readonly<ConnectionHandle>;
+    session: AcceptedMeshSession;
+  }>,
+): Promise<ConnectionDecision> {
+  const { pendingConnections, timeoutMs, events } = options;
+  const { request, message, handle, session } = held;
+  return new Promise<ConnectionDecision>((resolve) => {
+    pendingConnections.set(handle.id, {
+      respond: request.respond,
+      dataPort: message.dataPort,
+      name: message.name,
+      fingerprint: message.fingerprint,
+      policy: handle.policy,
+      session,
+      resolve,
+      timeoutHandle: setTimeout(() => {
+        expirePendingConnection(pendingConnections, handle.id);
+      }, timeoutMs).unref(),
+    });
+    events.onConnectionRequest(handle, {
+      peerId: handle.id,
+      dataPort: message.dataPort,
+      name: message.name,
+      fingerprint: message.fingerprint,
+    });
+  });
+}

package/src/core/relay-server.ts

@@ -4,6 +4,11 @@
  * Admission is deny-by-default, like every other cross-machine decision here: a connection is registered with the hub only once it gossips an advert for a device isAdmitted accepts, and every gossiped advert naming a device it does not accept is dropped before the hub sees it. A connection that never gossips an admitted device can neither be named by a relay-connect nor relay anything, and learns nothing, since the hub's catch-up is sent only in answer to a registered connection's gossip.
  */
 
+import {
+  consumeEach,
+  reportRejection,
+  type ConsumeStep,
+} from "./detached-work.js";
 import { createServer, type Server } from "node:http";
 import * as os from "node:os";
 import { WebSocketServer } from "ws";
@@ -21,6 +26,25 @@ import { createUplink, type UplinkFeed } from "./relay-uplink.js";
 /** The wildcard IPv4 address: listening on it serves every interface, loopback and the local network alike. */
 export const ALL_INTERFACES_HOST = "0.0.0.0";
 
+const BYTES_PER_KIB = 1024;
+const KIB_PER_MIB = 1024;
+const RELAY_FRAME_MIB = 16;
+
+/**
+ * The most bytes one WebSocket message may carry to the relay: 16 MiB. It is above the largest frame a legitimate client sends (a full reply of account ledger entries, about 12.6 MiB), equal to the receive cap of the Rust stream transport, and below the 32 MiB the hosted hub accepts, so no frame a conforming peer sends is refused and the relay holds no more of one connection's message than the hub would. The WebSocket server enforces it on the length a frame declares, before its payload is read: a message over it closes that connection with 1009 and nothing else.
+ */
+export const MAX_RELAY_FRAME_BYTES =
+  RELAY_FRAME_MIB * KIB_PER_MIB * BYTES_PER_KIB;
+
+/** How long a client of the relay has to send its request headers and to complete a request: ample for any real client on a local network, and short because every such client is unauthenticated until it has gossiped an admitted device. */
+export const RELAY_REQUEST_TIMEOUT_MS = 10_000;
+
+/** How long a WebSocket client of the relay has, from connecting, to gossip an advert for an admitted device. A connection that has not is closed: it can neither be named by a relay-connect nor relay anything, so holding it open serves no one. */
+export const RELAY_ADMISSION_TIMEOUT_MS = 30_000;
+
+/** HTTP status for a request to the relay that is not a WebSocket upgrade: the relay speaks nothing else. */
+const HTTP_UPGRADE_REQUIRED = 426;
+
 /** The loopback address every relay also offers, so a peer on the same machine reaches it without leaving the host. */
 const LOOPBACK_HOST = "127.0.0.1";
 
@@ -31,6 +55,12 @@ export interface RelayServerOptions {
   isAdmitted: (deviceHex: string) => boolean;
   /** Reports a failure of the uplink, which is otherwise detached from any caller. */
   onError: (error: Error) => void;
+  /** Overrides RELAY_REQUEST_TIMEOUT_MS, the time a client has to send its headers and complete a request. A test sets it small. */
+  requestTimeoutMs?: number | undefined;
+  /** Overrides RELAY_ADMISSION_TIMEOUT_MS, the time a WebSocket client has to gossip an admitted device. A test sets it small. */
+  admissionTimeoutMs?: number | undefined;
+  /** Overrides how often Node checks connections against the request timeouts (its default is thirty seconds, which makes a timeout take effect up to that much late). A test sets it small. */
+  connectionsCheckingIntervalMs?: number | undefined;
 }
 
 export class RelayServer {
@@ -39,16 +69,58 @@ export class RelayServer {
   });
   /** The devices (hex) each connected client has registered, so an advert for one of them arriving from upstream never displaces the client's own registration. */
   private readonly clientDevices = new Map<Readonly<Connection>, Set<string>>();
-  private readonly http: Server = createServer();
-  private readonly wss = new WebSocketServer({ server: this.http });
+  private readonly http: Server;
+  private readonly wss: WebSocketServer;
   private port = 0;
   /** Settles once the previous uplink has been forgotten by the hub, which refuses a second while one is attached. */
   private uplinkDone: Promise<void> = Promise.resolve();
 
   constructor(private readonly options: Readonly<RelayServerOptions>) {
+    const requestTimeoutMs =
+      options.requestTimeoutMs ?? RELAY_REQUEST_TIMEOUT_MS;
+    // A request that is not a WebSocket upgrade is answered at once and its connection closed, and a client that sends headers or a request too slowly is cut off by the timeouts: nothing unauthenticated holds a connection open for ever.
+    this.http = createServer(
+      {
+        requestTimeout: requestTimeoutMs,
+        headersTimeout: requestTimeoutMs,
+        ...(options.connectionsCheckingIntervalMs !== undefined && {
+          connectionsCheckingInterval: options.connectionsCheckingIntervalMs,
+        }),
+      },
+      (_request, response) => {
+        response.writeHead(HTTP_UPGRADE_REQUIRED, {
+          "Content-Type": "text/plain; charset=utf-8",
+          Connection: "close",
+          Upgrade: "websocket",
+        });
+        response.end("Upgrade required");
+      },
+    );
+    this.wss = new WebSocketServer({
+      server: this.http,
+      maxPayload: MAX_RELAY_FRAME_BYTES,
+    });
+    // The WebSocket server re-emits an error of its listener; with no handler it would end the process.
+    this.wss.on("error", (error) => {
+      this.options.onError(error);
+    });
     this.wss.on("connection", (socket) => {
       socket.binaryType = "arraybuffer";
-      void this.serve(wrapWsSocket(socket));
+      // The error event a message over the size limit raises is this connection's alone: reported, never left to end the process.
+      socket.on("error", (error) => {
+        this.options.onError(error);
+      });
+      const admission = setTimeout(() => {
+        socket.terminate();
+      }, options.admissionTimeoutMs ?? RELAY_ADMISSION_TIMEOUT_MS);
+      reportRejection(
+        this.serve(wrapWsSocket(socket), () => {
+          clearTimeout(admission);
+        }).finally(() => {
+          clearTimeout(admission);
+        }),
+        () => this.options.onError,
+      );
     });
   }
 
@@ -130,32 +202,47 @@ export class RelayServer {
     });
   }
 
-  /** Drives one connection: filters its gossip to admitted devices, registers it with the hub on its first admitted advert, and hands the hub every frame from then on. */
-  private async serve(connection: Readonly<Connection>): Promise<void> {
-    let registered = false;
+  /** Drives one connection: filters its gossip to admitted devices, registers it with the hub on its first admitted advert and calls `onVerified` once the hub has accepted an advert of it, and hands the hub every frame from then on. A frame that cannot be handled is reported and the next is still read, so one bad frame never ends a connection's service; the loop ends when the connection's own stream does. */
+  private async serve(
+    connection: Readonly<Connection>,
+    onVerified: () => void,
+  ): Promise<void> {
+    const state = { registered: false, verified: false };
     const devices = new Set<string>();
     this.clientDevices.set(connection, devices);
     try {
-      for await (const frame of connection.receive()) {
-        const admitted = this.admit(frame);
-        if (admitted?.type === "gossip") {
-          for (const advert of admitted.peers) {
-            devices.add(deviceIdToHex(advert.device));
+      await consumeEach(
+        connection.receive(),
+        async (frame): Promise<ConsumeStep> => {
+          const admitted = this.admit(frame);
+          if (admitted?.type === "gossip") {
+            for (const advert of admitted.peers) {
+              devices.add(deviceIdToHex(advert.device));
+            }
           }
-        }
-        if (admitted === undefined) continue;
-        if (!registered) {
-          if (admitted.type !== "gossip") continue;
-          this.hub.registerConnection(connection);
-          registered = true;
-        }
-        await this.hub.onFrame(connection, admitted);
-      }
-    } catch {
-      // A connection that fails mid-stream is simply gone; its registration is cleaned up below.
+          if (admitted === undefined) return "continue";
+          if (!state.registered) {
+            if (admitted.type !== "gossip") return "continue";
+            this.hub.registerConnection(connection);
+            state.registered = true;
+          }
+          await this.hub.onFrame(connection, admitted);
+          // The hub verifies an advert after the connection is registered on the device id it names: the key must hash to that device and the signature must verify, or the advert is dropped. Only a connection the hub has accepted something from has proved anything, so only then is its admission deadline lifted.
+          if (
+            !state.verified &&
+            this.hub.exportConnection(connection) !== undefined
+          ) {
+            state.verified = true;
+            onVerified();
+          }
+          return "continue";
+        },
+        () => this.options.onError,
+      );
     } finally {
       this.clientDevices.delete(connection);
-      if (registered) this.hub.onDisconnect(connection);
+      if (state.registered) this.hub.onDisconnect(connection);
+      await connection.close().catch(() => undefined);
     }
   }
 

package/src/core/room-router.ts

@@ -11,6 +11,7 @@ import type {
   IncomingManageRequest,
   ManageOutcome,
 } from "wire-mesh-core/domain/mesh-session";
+import { consumeEach, type ConsumeStep } from "./detached-work.js";
 import { isMeshMessage } from "./wire-protocol.js";
 import type { MeshMessage } from "./wire-protocol.js";
 import type { ConnectionHandle, TransportEvents } from "./transport.js";
@@ -128,9 +129,13 @@ export function createRoomRouter(options: RoomRouterOptions): RoomRouter {
     origin: Readonly<RoomRequestOrigin>,
   ): Promise<void> {
     const verb = extractParamsVerb(request.command.params);
+    // The verb is what a peer sent: look it up among the handlers' own names only, never the members every object has (`constructor`, `toString`), which would be called as a handler.
     const handler =
-      request.command.verb !== FRAME_VERB && verb !== undefined
-        ? options.handlers?.[verb]
+      request.command.verb !== FRAME_VERB &&
+      verb !== undefined &&
+      options.handlers !== undefined &&
+      Object.hasOwn(options.handlers, verb)
+        ? options.handlers[verb]
         : undefined;
     if (handler === undefined) {
       await request
@@ -138,7 +143,16 @@ export function createRoomRouter(options: RoomRouterOptions): RoomRouter {
         .catch(() => undefined);
       return;
     }
-    const outcome = await handler(request, handle, origin);
+    // A handler that throws on what a peer sent answers that request with an error and is reported; it must not end the loop that reads this session's requests, or the process.
+    let outcome: ManageOutcome;
+    try {
+      outcome = await handler(request, handle, origin);
+    } catch (err) {
+      options.events.onError?.(
+        err instanceof Error ? err : new Error(String(err)),
+      );
+      outcome = { result: "error", code: "internal_error" };
+    }
     await request.respond(outcome).catch(() => undefined);
   }
 
@@ -149,8 +163,18 @@ export function createRoomRouter(options: RoomRouterOptions): RoomRouter {
   ): Promise<void> {
     if (request.command.verb === FRAME_VERB) {
       const message = extractMessage(request.command);
-      if (message !== undefined) {
-        routeLegacyMessage(handle, message, options.events);
+      try {
+        if (message !== undefined) {
+          routeLegacyMessage(handle, message, options.events);
+        }
+      } catch (err) {
+        options.events.onError?.(
+          err instanceof Error ? err : new Error(String(err)),
+        );
+        await request
+          .respond({ result: "error", code: "internal_error" })
+          .catch(() => undefined);
+        return;
       }
       await request.respond({ result: "ok" }).catch(() => undefined);
       return;
@@ -170,11 +194,14 @@ export function createRoomRouter(options: RoomRouterOptions): RoomRouter {
     handleLocalRequest,
     handleRelayedRequest,
     drainSession(session, handle) {
-      void (async () => {
-        for await (const request of session.incomingManageRequests) {
+      void consumeEach(
+        session.incomingManageRequests,
+        async (request): Promise<ConsumeStep> => {
           await handleLocalRequest(request, handle);
-        }
-      })();
+          return "continue";
+        },
+        () => options.events.onError,
+      );
     },
   };
 }

package/src/core/tool.ts

@@ -37,6 +37,7 @@ import type { CommsStore } from "./comms-store.js";
 import type { CapabilityToken } from "wire-mesh-core/generated/protocol";
 import type { DiscoveryManager } from "./discovery.js";
 import { CommsError } from "./store.js";
+import { requireMessageWithinLimit } from "./message-limits.js";
 import type { LedgerGaps } from "./account-ledger.js";
 import { getOwnPackageVersion } from "./package-version.js";
 import { describeDeliveryFor } from "./send-outcome.js";
@@ -614,6 +615,7 @@ export class CommsTool {
     ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "send" },
   ): Promise<CommsResult> {
+    requireMessageWithinLimit(action.content);
     const roomId = action.target;
     const { message, deliveries } = await this.store.sendRoomMessage(
       roomId,
@@ -650,6 +652,7 @@ export class CommsTool {
     ctx: Readonly<CommsContext>,
     action: CommsAction & { action: "dm" },
   ): Promise<CommsResult> {
+    requireMessageWithinLimit(action.content);
     const targetId = action.target;
     const { message, delivery } = await this.store.sendDm(
       ctx.agentId,