skydive-cli 0.5.0-beta.4 → 0.5.0-beta.44

package/dist/js/chunk-BbwQpWto.mjs

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") {
+		for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+			key = keys[i];
+			if (!__hasOwnProp.call(to, key) && key !== except) {
+				__defProp(to, key, {
+					get: ((k) => from[k]).bind(null, key),
+					enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+				});
+			}
+		}
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+//#endregion
+export { __require as n, __toESM as r, __commonJSMin as t };

package/dist/js/{client-Dd5sMXPv.mjs → client-BnpgrtCC.mjs}

@@ -1,11 +1,15 @@
 #!/usr/bin/env node
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
+import { a as mintPortalDeviceToken, c as unifyLegacyCliGrants, i as grantPortalAccess, l as startTlsForward, n as fetchPortalDevices, r as findThisDevice } from "./api-TwLD7ibI.mjs";
 import os from "node:os";
 import { z } from "zod";
-import { execFile, spawn } from "node:child_process";
-import { WebSocket } from "ws";
+import * as childProcess from "node:child_process";
+import { spawn } from "node:child_process";
+import net from "node:net";
+import { WebSocket, createWebSocketStream } from "ws";
 
 //#region ../portal-daemon/src/machine.ts
+const SCUTIL_TIMEOUT_MS = 2e3;
+const SCUTIL_ATTEMPTS = 3;
 /**
 * Identity this machine registers under on the portal.
 *
@@ -14,38 +18,74 @@ import { WebSocket } from "ws";
 * row, so a grant applies to the machine no matter which surface the user
 * shared from. The name must therefore match what the desktop app registers —
 * on macOS that is `scutil --get LocalHostName` (the Rust client's own
-* derivation, stabler than the network-assigned hostname), with the plain
-* hostname as the fallback for other platforms or a failed read.
+* derivation, stabler than the network-assigned hostname).
+*
+* The machine name is a durable IDENTITY, not a fresh network reading: every
+* grant hangs off the device row keyed by this name, so if it changes the
+* device flips to a brand-new row with ZERO grants and every agent re-prompts
+* across every open CLI. `os.hostname()` is NOT durable — macOS rewrites it
+* from DHCP/DNS per network — so it must never be allowed to silently replace
+* a name we already registered under. Resolution order:
+*
+*   1. `scutil --get LocalHostName` (retried) — the stable, correct source.
+*   2. `previous` — the name we last successfully registered under, persisted
+*      by the daemon. Preferred over the volatile hostname so a transient
+*      `scutil` failure keeps our existing identity (and grants) intact.
+*   3. `os.hostname()` — last resort for a machine that has NEVER resolved a
+*      name (first run, non-macOS, scutil permanently unavailable).
 *
 * Historically the CLI suffixed `-cli` to keep a device distinct from the
 * desktop's; `unifyLegacyCliGrants` migrates grants off those rows.
 */
-async function resolveMachineIdentity() {
-	const fallback = fallbackHost();
-	if (process.platform !== "darwin") return {
-		machineName: fallback,
-		friendlyName: fallback
+async function resolveMachineIdentity(previous) {
+	const persisted = previous?.trim() || null;
+	if (process.platform !== "darwin") {
+		const machineName = persisted ?? fallbackHost();
+		return {
+			machineName,
+			friendlyName: machineName,
+			machineNameSource: persisted ? "persisted" : "hostname-fallback"
+		};
+	}
+	const local = await scutilRead("LocalHostName");
+	if (local) return {
+		machineName: local,
+		friendlyName: await scutilRead("ComputerName") ?? local,
+		machineNameSource: "scutil"
+	};
+	if (persisted) return {
+		machineName: persisted,
+		friendlyName: persisted,
+		machineNameSource: "persisted"
 	};
-	const local = await scutilRead("LocalHostName") ?? fallback;
+	const fallback = fallbackHost();
 	return {
-		machineName: local,
-		friendlyName: await scutilRead("ComputerName") ?? local
+		machineName: fallback,
+		friendlyName: fallback,
+		machineNameSource: "hostname-fallback"
 	};
 }
 function fallbackHost() {
 	return (os.hostname() || "machine").trim().replace(/\.local$/i, "") || "machine";
 }
 function scutilRead(key) {
-	return new Promise((resolve) => {
-		execFile("/usr/sbin/scutil", ["--get", key], { timeout: 2e3 }, (error, stdout) => {
-			if (error) {
-				resolve(null);
-				return;
-			}
-			const value = stdout.trim();
-			resolve(value.length > 0 ? value : null);
+	return attempt(0);
+	function attempt(n) {
+		return new Promise((resolve) => {
+			childProcess.execFile("/usr/sbin/scutil", ["--get", key], { timeout: SCUTIL_TIMEOUT_MS }, (error, stdout) => {
+				if (error) {
+					if (n + 1 < SCUTIL_ATTEMPTS) {
+						resolve(attempt(n + 1));
+						return;
+					}
+					resolve(null);
+					return;
+				}
+				const value = stdout.trim();
+				resolve(value.length > 0 ? value : null);
+			});
 		});
-	});
+	}
 }
 const INHERITED_ENV = [
 	"HOME",
@@ -134,6 +174,18 @@ const ctrlMessageSchema = z.discriminatedUnion("t", [
 		conversationId: z.string().nullable().optional()
 	}),
 	z.object({ t: z.literal("stdin_eof") }),
+	z.object({
+		t: z.literal("reverse_listen"),
+		listenPort: z.number().int().positive(),
+		targetPort: z.number().int().positive(),
+		dialOrigin: z.string().min(1),
+		token: z.string().min(1)
+	}),
+	z.object({ t: z.literal("reverse_listening") }),
+	z.object({
+		t: z.literal("reverse_token"),
+		token: z.string().min(1)
+	}),
 	z.object({ t: z.literal("pause") }),
 	z.object({ t: z.literal("resume") }),
 	z.object({ t: z.literal("cancel") }),
@@ -169,6 +221,128 @@ function decodeFrame(frame) {
 	};
 }
 
+//#endregion
+//#region ../portal-daemon/src/reverse-listener.ts
+/**
+* The desktop half of an agent-initiated expose tunnel (`platform portal
+* expose`): listen on the local loopback and pipe each accepted TCP
+* connection to the agent sandbox's daemon (`/portal/tcp`) through the
+* agent-webserver edge Worker — the same per-connection dial-and-pipe as the
+* user-initiated `skydive portal forward`, just started from a directive
+* instead of a terminal. Tunnel bytes never touch the directive stream that
+* created this listener; it only anchors the lifetime and carries the token.
+*
+* `target()` is read per connection so a token refresh (or any future
+* retarget) applies to the next dial without touching established pipes.
+*/
+var ReverseListener = class {
+	server = null;
+	tls = null;
+	conns = /* @__PURE__ */ new Set();
+	constructor(opts) {
+		this.opts = opts;
+	}
+	/**
+	* One tunnel to the sandbox target — the same per-connection edge dial the
+	* plain accept path inlines, shaped for the TLS listener's acquireTunnel
+	* seam. Resolves once the upgrade completes, with the duplex PAUSED so no
+	* early bytes drop before adoption.
+	*/
+	dialTunnel() {
+		const { dialOrigin, targetPort, token } = this.opts.target();
+		const ws = new WebSocket(`${dialOrigin.replace(/^http/, "ws")}/portal/tcp?port=${targetPort}`, { headers: { authorization: `Bearer ${token}` } });
+		return new Promise((resolve, reject) => {
+			ws.once("error", reject);
+			ws.once("unexpected-response", (_req, res) => {
+				res.destroy();
+				reject(/* @__PURE__ */ new Error(`tunnel rejected (HTTP ${res.statusCode ?? "?"})`));
+			});
+			ws.once("open", () => {
+				const stream = createWebSocketStream(ws);
+				stream.pause();
+				resolve({
+					stream,
+					close: () => stream.destroy()
+				});
+			});
+		});
+	}
+	start() {
+		const server = net.createServer((sock) => {
+			this.conns.add(sock);
+			sock.once("close", () => this.conns.delete(sock));
+			sock.pause();
+			const { dialOrigin, targetPort, token } = this.opts.target();
+			const ws = new WebSocket(`${dialOrigin.replace(/^http/, "ws")}/portal/tcp?port=${targetPort}`, { headers: { authorization: `Bearer ${token}` } });
+			ws.on("open", () => {
+				const stream = createWebSocketStream(ws);
+				stream.on("error", () => sock.destroy());
+				sock.on("error", () => stream.destroy());
+				sock.pipe(stream).pipe(sock);
+				sock.resume();
+			});
+			ws.on("error", (err) => {
+				this.opts.log(`expose: tunnel connect failed: ${err.message}`);
+				sock.destroy();
+			});
+			ws.on("unexpected-response", (_req, res) => {
+				this.opts.log(`expose: tunnel rejected (HTTP ${res.statusCode ?? "?"})`);
+				res.destroy();
+				sock.destroy();
+			});
+		});
+		server.once("error", (err) => this.opts.onListening(err));
+		server.listen(this.opts.listenPort, "127.0.0.1", () => {
+			this.opts.onListening(null);
+			this.startTls();
+		});
+		this.server = server;
+	}
+	/**
+	* The additive TLS+h2 twin (fire-and-forget from start): browsers negotiate
+	* h2 there, lifting the 6-connection cap that serializes module-heavy dev
+	* servers. Every failure logs once and leaves the plain listener — the
+	* product's default behavior — untouched. The ack (`reverse_listening`)
+	* deliberately stays keyed to the plain bind: TLS is an enhancement, never
+	* a condition of "the tunnel is up".
+	*/
+	startTls() {
+		const source = this.opts.tlsCertSource;
+		if (!source) return;
+		(async () => {
+			try {
+				const cert = await source();
+				if (!cert || this.server === null) return;
+				this.tls = await startTlsForward({
+					cert,
+					localPort: this.opts.listenPort,
+					targetPort: this.opts.target().targetPort,
+					acquireTunnel: () => this.dialTunnel(),
+					log: this.opts.log
+				});
+				if (this.server === null) {
+					const straggler = this.tls;
+					this.tls = null;
+					await straggler.close();
+					return;
+				}
+				this.opts.log(`expose: TLS origin up: https://${this.tls.hostname}:${this.tls.port} (HTTP/2)`);
+			} catch (error) {
+				this.opts.log(`expose: TLS origin unavailable (${error instanceof Error ? error.message : String(error)}); http listener unaffected`);
+			}
+		})();
+	}
+	stop() {
+		this.server?.close();
+		this.server = null;
+		const tls = this.tls;
+		this.tls = null;
+		if (tls) tls.close();
+		for (const sock of this.conns) sock.destroy();
+		this.conns.clear();
+	}
+};
+
 //#endregion
 //#region ../portal-daemon/src/exec.ts
 /**
@@ -181,6 +355,7 @@ function decodeFrame(frame) {
 */
 var JobManager = class {
 	jobs = /* @__PURE__ */ new Map();
+	reverse = /* @__PURE__ */ new Map();
 	constructor(opts) {
 		this.opts = opts;
 	}
@@ -200,12 +375,35 @@ var JobManager = class {
 			job.child.kill("SIGKILL");
 		}
 		this.jobs.clear();
+		for (const rev of this.reverse.values()) {
+			rev.settled = true;
+			rev.listener.stop();
+		}
+		this.reverse.clear();
 	}
 	handleCtrl(id, msg) {
 		switch (msg.t) {
 			case "open":
 				this.startJob(id, msg.argv, msg.env, msg.conversationId ?? null);
 				return;
+			case "reverse_listen":
+				this.startReverse(id, {
+					listenPort: msg.listenPort,
+					target: {
+						dialOrigin: msg.dialOrigin,
+						targetPort: msg.targetPort,
+						token: msg.token
+					}
+				});
+				return;
+			case "reverse_token": {
+				const rev = this.reverse.get(id);
+				if (rev) rev.target = {
+					...rev.target,
+					token: msg.token
+				};
+				return;
+			}
 			case "stdin_eof":
 				this.jobs.get(id)?.child.stdin.end();
 				return;
@@ -217,12 +415,52 @@ var JobManager = class {
 				return;
 			case "cancel":
 				this.jobs.get(id)?.child.kill("SIGKILL");
+				this.stopReverse(id);
 				return;
 			case "close":
-			case "error": return;
+			case "error":
+			case "reverse_listening": return;
 			default: return msg;
 		}
 	}
+	startReverse(id, { listenPort, target }) {
+		const rev = {
+			settled: false,
+			target,
+			seq: 0,
+			listener: new ReverseListener({
+				listenPort,
+				target: () => rev.target,
+				tlsCertSource: this.opts.tlsCertSource,
+				log: (msg) => {
+					if (rev.settled) return;
+					this.opts.send(encodeData(id, STREAM.stderr, rev.seq, Buffer.from(msg)));
+					rev.seq = rev.seq + 1 >>> 0;
+				},
+				onListening: (err) => {
+					if (err) {
+						rev.settled = true;
+						this.reverse.delete(id);
+						this.opts.send(encodeCtrl(id, {
+							t: "error",
+							message: `reverse listen failed: ${err.message}`
+						}));
+						return;
+					}
+					this.opts.send(encodeCtrl(id, { t: "reverse_listening" }));
+				}
+			})
+		};
+		this.reverse.set(id, rev);
+		rev.listener.start();
+	}
+	stopReverse(id) {
+		const rev = this.reverse.get(id);
+		if (!rev) return;
+		rev.settled = true;
+		this.reverse.delete(id);
+		rev.listener.stop();
+	}
 	setPaused(id, paused) {
 		const job = this.jobs.get(id);
 		if (!job) return;
@@ -296,115 +534,16 @@ var JobManager = class {
 	}
 };
 
-//#endregion
-//#region ../portal-daemon/src/api.ts
-/**
-* The portal's session-authed REST surface, shared by `PortalClient` (the
-* TUI/`portal open` connection) and the `skydive portal` management
-* commands, so the endpoint contracts and response schemas live in exactly
-* one place.
-*/
-const deviceSchema = z.object({
-	id: z.string(),
-	machineName: z.string(),
-	friendlyName: z.string(),
-	connected: z.boolean(),
-	lastSeen: z.string().nullable(),
-	grantedAgentIds: z.array(z.string())
-});
-const devicesResponseSchema = z.object({
-	devices: z.array(deviceSchema),
-	agents: z.array(z.object({
-		id: z.string(),
-		name: z.string()
-	}))
-});
-const deviceTokenSchema = z.object({ token: z.string().min(1) });
-async function portalFetch(auth, path, init) {
-	const res = await fetch(`${auth.appUrl}${path}`, {
-		method: init.method,
-		headers: {
-			authorization: `Bearer ${auth.sessionToken}`,
-			accept: "application/json",
-			...init.body ? { "content-type": "application/json" } : {}
-		},
-		...init.body ? { body: init.body } : {}
-	});
-	if (!res.ok) {
-		const body = await res.text().catch(() => "");
-		throw new HttpError(res.status, body);
-	}
-	return res.json();
-}
-async function fetchPortalDevices(auth) {
-	const json = await portalFetch(auth, "/api/v1/portal/devices", { method: "GET" });
-	return devicesResponseSchema.parse(json);
-}
-const registerResponseSchema = z.object({ device: z.object({ id: z.string() }) });
-/**
-* Register this machine's device row without connecting. Connecting registers
-* as a side effect; this covers granting an agent on a machine that has never
-* shared yet (the grant references the device row).
-*/
-async function registerPortalDevice(auth, { machineName, friendlyName }) {
-	const json = await portalFetch(auth, "/api/v1/portal/devices", {
-		method: "POST",
-		body: JSON.stringify({
-			machineName,
-			friendlyName
-		})
-	});
-	return registerResponseSchema.parse(json).device;
-}
-/** Short-lived token the machine presents when dialing the portal WebSocket. */
-async function mintPortalDeviceToken(auth) {
-	const json = await portalFetch(auth, "/api/v1/portal/device-token", { method: "POST" });
-	return deviceTokenSchema.parse(json).token;
-}
-async function grantPortalAccess(auth, { deviceId, agentId }) {
-	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants`, {
-		method: "POST",
-		body: JSON.stringify({ agentId })
-	});
-}
-async function revokePortalAccess(auth, { deviceId, agentId }) {
-	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants/${encodeURIComponent(agentId)}`, { method: "DELETE" });
-}
-/**
-* The device row for a given machine identity. Matching is by `machineName`
-* equality — the stable handle the machine registers under, not the display
-* label.
-*/
-function findThisDevice(devices, machineName) {
-	return devices.find((device) => device.machineName === machineName) ?? null;
-}
-/**
-* One-time grant migration onto the merged device. Earlier CLI builds
-* registered a separate `<machineName>-cli` device, so a user's existing
-* approvals hang off that row; the merged device would start with zero grants
-* and every already-authorized agent would ask again. Copy any grant the
-* merged device is missing (the grant endpoint upserts, so re-runs are
-* no-ops). The legacy row is left in place — an old CLI build may still
-* connect under it. Returns how many grants were copied.
-*/
-async function unifyLegacyCliGrants(auth, machineName) {
-	const { devices } = await fetchPortalDevices(auth);
-	const merged = findThisDevice(devices, machineName);
-	const legacy = findThisDevice(devices, `${machineName}-cli`);
-	if (!merged || !legacy) return 0;
-	const have = new Set(merged.grantedAgentIds);
-	const missing = legacy.grantedAgentIds.filter((id) => !have.has(id));
-	for (const agentId of missing) await grantPortalAccess(auth, {
-		deviceId: merged.id,
-		agentId
-	});
-	return missing.length;
-}
-
 //#endregion
 //#region ../portal-daemon/src/client.ts
-const INITIAL_BACKOFF_MS = 500;
-const MAX_BACKOFF_MS = 1e4;
+const DEFAULT_HEARTBEAT = {
+	intervalMs: 15e3,
+	maxMissed: 2,
+	wakeTickMs: 2e3,
+	wakeGapThresholdMs: 1e4,
+	initialBackoffMs: 500,
+	maxBackoffMs: 1e4
+};
 /**
 * Shares the local machine with agents over the portal: dials OUT to the api's
 * desktop-portal WebSocket (authenticating with a short-lived device token
@@ -427,8 +566,38 @@ var PortalClient = class {
 	machineName = "";
 	friendlyName = "";
 	legacyGrantsChecked = false;
+	wakeWatch = null;
+	lastTick = Date.now();
+	heartbeatConfig;
 	constructor(opts) {
 		this.opts = opts;
+		this.heartbeatConfig = {
+			...DEFAULT_HEARTBEAT,
+			...opts.heartbeat
+		};
+		this.startWakeWatch();
+	}
+	/**
+	* Detect wake-from-sleep without an Electron/`powerMonitor` dependency (the
+	* daemon also runs headless under the CLI). A repeating timer that should
+	* fire every WAKE_TICK_MS; when the actual gap since the last tick far
+	* exceeds that, the process was suspended (macOS sleep, laptop lid) and the
+	* current socket — if any — is a zombie against a server that has already
+	* reaped our presence. Terminate it now so `connectLoop` redials at once
+	* instead of waiting out the heartbeat deadline. Cheap: one no-op timer.
+	*/
+	startWakeWatch() {
+		this.lastTick = Date.now();
+		this.wakeWatch = setInterval(() => {
+			const now = Date.now();
+			const gap = now - this.lastTick;
+			this.lastTick = now;
+			if (gap > this.heartbeatConfig.wakeGapThresholdMs && this.ws) {
+				this.error = "woke from sleep; reconnecting portal";
+				this.ws.terminate();
+			}
+		}, this.heartbeatConfig.wakeTickMs);
+		this.wakeWatch.unref?.();
 	}
 	isEnabled() {
 		return this.enabled;
@@ -464,18 +633,28 @@ var PortalClient = class {
 	dispose() {
 		this.disposed = true;
 		this.enabled = false;
+		if (this.wakeWatch) {
+			clearInterval(this.wakeWatch);
+			this.wakeWatch = null;
+		}
 		this.jobs?.killAll();
 		this.jobs = null;
 		this.ws?.close();
 		this.ws = null;
 	}
-	/** Grant one agent access to this machine (default-deny; user-initiated). */
-	async grantAgent(agentId) {
+	/**
+	* Grant one agent access to this machine (default-deny; user-initiated).
+	* `conversationId` is the conversation whose run asked (null when the grant
+	* is not answering an in-chat request) — the server uses it to wake the
+	* waiting agent.
+	*/
+	async grantAgent(agentId, conversationId) {
 		const auth = this.sessionAuth();
 		if (!auth) throw new Error("granting needs a signed-in CLI session on this machine (the desktop connection alone cannot manage grants)");
 		await grantPortalAccess(auth, {
 			deviceId: await this.ensureDeviceId(),
-			agentId
+			agentId,
+			conversationId
 		});
 		this.granted.add(agentId);
 		this.emit();
@@ -517,28 +696,36 @@ var PortalClient = class {
 	}
 	async connectLoop() {
 		if (!this.machineName) {
-			const identity = await resolveMachineIdentity();
+			const identity = await resolveMachineIdentity(this.opts.persistedMachineName);
 			this.machineName = identity.machineName;
 			this.friendlyName = identity.friendlyName;
+			this.opts.onMachineName(identity.machineName, identity.machineNameSource);
 		}
-		let backoff = INITIAL_BACKOFF_MS;
+		let backoff = this.heartbeatConfig.initialBackoffMs;
 		while (this.enabled && !this.disposed) {
 			this.setStatus("connecting");
 			try {
 				const token = await this.wsToken();
-				await this.runConnection(token);
-				backoff = INITIAL_BACKOFF_MS;
+				if (await this.runConnection(token)) backoff = this.heartbeatConfig.initialBackoffMs;
+				else backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
 			} catch (err) {
 				if (!this.enabled || this.disposed) break;
 				this.setStatus("error", errorMessage(err));
+				backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
 			}
 			if (!this.enabled || this.disposed) break;
-			await sleep(backoff);
-			backoff = Math.min(backoff * 2, MAX_BACKOFF_MS);
+			await sleep(Math.random() * backoff);
 		}
 	}
 	runConnection(token) {
 		return new Promise((resolve) => {
+			let settled = false;
+			let healthy = false;
+			const settle = () => {
+				if (settled) return;
+				settled = true;
+				resolve(healthy);
+			};
 			const ws = new WebSocket(portalWsUrl(this.opts.appUrl, this.machineName, this.friendlyName), {
 				headers: { authorization: `Bearer ${token}` },
 				maxPayload: MAX_WS_FRAME_BYTES
@@ -546,26 +733,46 @@ var PortalClient = class {
 			this.ws = ws;
 			const jobs = new JobManager({
 				resolveCwd: this.opts.resolveCwd,
+				tlsCertSource: this.opts.tlsCertSource,
 				send: (frame) => {
 					if (ws.readyState === WebSocket.OPEN) ws.send(frame);
 				}
 			});
 			this.jobs = jobs;
+			let missed = 0;
+			const heartbeat = setInterval(() => {
+				if (ws.readyState !== WebSocket.OPEN) return;
+				if (missed >= this.heartbeatConfig.maxMissed) {
+					this.error = "portal connection went silent (no pong); reconnecting";
+					ws.terminate();
+					return;
+				}
+				missed += 1;
+				ws.ping();
+			}, this.heartbeatConfig.intervalMs);
+			const markAlive = () => {
+				missed = 0;
+				healthy = true;
+			};
 			ws.on("open", () => {
 				this.setStatus("connected");
 				this.syncDeviceState();
 			});
+			ws.on("pong", markAlive);
+			ws.on("ping", markAlive);
 			ws.on("message", (data, isBinary) => {
+				markAlive();
 				if (isBinary) jobs.handleFrame(toBuffer(data));
 			});
 			ws.on("error", (err) => {
 				this.error = errorMessage(err);
 			});
 			ws.on("close", () => {
+				clearInterval(heartbeat);
 				jobs.killAll();
 				if (this.jobs === jobs) this.jobs = null;
 				if (this.ws === ws) this.ws = null;
-				resolve();
+				settle();
 			});
 		});
 	}
@@ -617,4 +824,4 @@ function sleep(ms) {
 }
 
 //#endregion
-export { registerPortalDevice as a, resolveMachineIdentity as c, grantPortalAccess as i, fetchPortalDevices as n, revokePortalAccess as o, findThisDevice as r, isRecord as s, PortalClient as t };
+export { isRecord as n, resolveMachineIdentity as r, PortalClient as t };