flowviant 0.74.1 → 0.74.2

package/bin/lib/authproxy.mjs

@@ -421,6 +421,13 @@ export function startAuthProxy({ targetPort, log, onAbuse, grantSecret, shareId,
   // WS upgrade (HMR). The browser resends the Basic-auth header on same-origin
   // upgrades, so we gate it too, then pipe the two sockets together.
   server.on('upgrade', (req, socket, head) => {
+    // OWN THE SOCKET FROM THE FIRST LINE. Between this handler firing and the
+    // origin's 101, the client socket had no 'error' listener — a browser
+    // that RSTs mid-handshake (tab closed during HMR reconnect) emitted
+    // 'error' with nobody listening, and an uncaughtException took the WHOLE
+    // daemon down (2026-08 audit HIGH, reproduced on Node 24; closed
+    // 2026-09-02). The post-101 block still swaps in the cross-destroy pair.
+    socket.on('error', () => socket.destroy());
     // Nothing under the reserved prefix is ever piped to the origin.
     if (safePathname(req.url).startsWith('/__fv/')) {
       socket.destroy();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flowviant",
-  "version": "0.74.1",
+  "version": "0.74.2",
   "description": "Run your own coding CLIs as build agents for Flowviant \u2014 Claude Code, Codex or Antigravity, on your own credentials. Holds your sessions, keeps a worktree per tab, and ships branches on your word.",
   "type": "module",
   "bin": {