viveworker 0.8.5 → 0.8.7

package/web/build-id.js

@@ -1 +1 @@
-export const APP_BUILD_ID = "20260514-lan-timeout-reply-ack";
+export const APP_BUILD_ID = "20260525-wallet-network-count";

package/web/i18n.js

@@ -619,25 +619,54 @@ const translations = {
     "settings.a2aShare.days": ({ count }) => `${count} ${count === 1 ? "day" : "days"}`,
     "settings.a2aShare.ratePerHour": ({ count }) => `${count} / hour`,
     "settings.a2aShare.passwordProtected": "Password protected",
-    "settings.a2aShare.paidShare": ({ price, network }) => `Paid — ${price} USDC on ${network}`,
+    "settings.a2aShare.paidShare": ({ price, asset, network }) => `Paid — ${price} ${asset || "USDC"} on ${network}`,
     "settings.a2aShare.showMore": "{count} more…",
     "settings.a2aShare.showLess": "Show less",
     "settings.a2aShare.expired": "Expired",
     "settings.a2aShare.status.unreachable": "Unreachable",
     "settings.a2aShare.error": "Upstream fetch failed: {reason}",
     "settings.wallet.title": "Wallet",
-    "settings.wallet.subtitle": "Sign-in, passkey, Base addresses",
-    "settings.wallet.copy": "Manage your wallet sign-in, passkey, and Base addresses.",
+    "settings.wallet.subtitle": "Paid-share receiving wallets",
+    "settings.wallet.copy": "Choose which issued wallets and payout addresses agents can use by default.",
     "settings.wallet.unavailable": "Wallet is not configured for this viveworker instance.",
     "settings.wallet.summary.title": "Current status",
     "settings.wallet.flow.title": "Recommended order",
+    "settings.wallet.agent.title": "Agent payment receiving wallets",
+    "settings.wallet.agent.copy": "Choose the wallets that receive payments for paid file shares. Mainnet is excluded until the formal release.",
+    "settings.wallet.agent.empty": "No wallet or payout address has been issued yet. Open Wallet Inventory to add receiving wallets.",
+    "settings.wallet.agent.emptyAvailable": "No testnet receiving wallet is available yet. Mainnet unlocks at the formal release.",
+    "settings.wallet.agent.save": "Save settings",
+    "settings.wallet.agent.useAllConfigured": "Enable all receiving wallets",
+    "settings.wallet.agent.currentDefaults": "Receiving wallets",
+    "settings.wallet.agent.unsaved": "You have unsaved changes. Receiving wallets will update after you save.",
+    "settings.wallet.agent.modalTitle": "Active receiving wallets",
+    "settings.wallet.agent.modalCopy": "These saved receiving wallets are available to paid file shares.",
+    "settings.wallet.inventory.title": "Wallet Inventory",
+    "settings.wallet.inventory.copy": "Issue or register optional wallets by environment. Testnet is available now; mainnet unlocks at the formal release.",
+    "settings.wallet.inventory.navGroup": "Wallet inventory",
+    "settings.wallet.inventory.navTitle": "Issue or register wallets",
+    "settings.wallet.inventory.navCopy": "Manage Base, Polygon, and Liquid payment capabilities.",
+    "settings.wallet.inventory.navValue": ({ count }) => `${count} configured`,
+    "settings.wallet.inventory.accountTitle": "Account access",
+    "settings.wallet.inventory.issueTitle": "Wallet issuance and registration",
+    "settings.wallet.inventory.testnetTitle": "Testnet",
+    "settings.wallet.inventory.mainnetTitle": "Mainnet",
+    "settings.wallet.inventory.environment.testnet": "Testnet",
+    "settings.wallet.inventory.environment.mainnet": "Mainnet",
+    "settings.wallet.chain.base.title": "Base",
+    "settings.wallet.chain.base.copy": "Issue Base smart wallets. Mainnet issuance is coming at the formal release.",
+    "settings.wallet.chain.liquid.title": "Liquid",
+    "settings.wallet.chain.liquid.copy": "Register Liquid payout addresses. Mainnet registration is coming at the formal release.",
+    "settings.wallet.chain.polygon.title": "Polygon",
+    "settings.wallet.chain.polygon.copy": "Issue Polygon smart wallets. Mainnet issuance is coming at the formal release.",
+    "settings.wallet.chain.configuredValue": ({ count, total }) => `${count}/${total} configured`,
     "settings.wallet.flow.banner.title": "Let's set up your wallet",
     "settings.wallet.flow.copy": "You need to activate your wallet to exchange task rewards over A2A.",
-    "settings.wallet.betaNotice": "Wallet is in beta. During this test period, wallet payments and payouts are available on testnets only.",
+    "settings.wallet.betaNotice": "Wallet is in beta. Testnets are the safe default; mainnet will be available at the formal release.",
     "settings.wallet.sessionExpired.title": "Refresh your wallet session",
     "settings.wallet.sessionExpired.copy": "Your wallet session expired. Sign in again with a one-time password; your passkey and Base Sepolia address stay linked.",
     "settings.wallet.ready.title": "Ready to use",
-    "settings.wallet.ready.copy": "Your email sign-in, passkey, and Base Sepolia wallet are all set.",
+    "settings.wallet.ready.copy": "Your email sign-in, passkey, and testnet wallet setup are ready.",
     "settings.wallet.ready.payoutIntro": "Agents will use this address for payouts:",
     "settings.wallet.ready.copyAddress": "Tap to copy address",
     "settings.wallet.advanced.title": "Account actions",
@@ -657,8 +686,17 @@ const translations = {
     "settings.wallet.step.baseSepolia.title": "Issue a Base Sepolia wallet",
     "settings.wallet.step.baseSepolia.copy": "Create a testing wallet for the current beta flow. This is the main wallet we recommend issuing first.",
     "settings.wallet.step.base.title": "Issue a Base wallet",
-    "settings.wallet.step.base.copy": "Base mainnet wallet issuance is planned for production payouts. It is not active yet.",
+    "settings.wallet.step.base.copy": "Base mainnet wallet issuance is disabled during beta and will unlock at the formal release.",
     "settings.wallet.step.base.comingSoonDetail": "Coming soon",
+    "settings.wallet.step.polygonAmoy.title": "Issue a Polygon Amoy wallet",
+    "settings.wallet.step.polygonAmoy.copy": "Create a Polygon Amoy testing wallet so paid shares can accept USDC and JPYC over Polygon x402.",
+    "settings.wallet.step.polygon.title": "Issue a Polygon wallet",
+    "settings.wallet.step.polygon.copy": "Polygon mainnet wallet issuance is disabled during beta and will unlock at the formal release.",
+    "settings.wallet.step.liquidTestnet.title": "Register a Liquid Testnet payout",
+    "settings.wallet.step.liquidTestnet.copy": "Add a Liquid Testnet address so paid shares can accept USDt over Liquid x402.",
+    "settings.wallet.step.liquid.title": "Register a Liquid payout",
+    "settings.wallet.step.liquid.copy": "Liquid mainnet payout registration is disabled during beta and will unlock at the formal release.",
+    "settings.wallet.mainnet.comingSoonDetail": "Mainnet will be available at the formal release.",
     "settings.wallet.mainnet.optIn": "Also set up Base mainnet",
     "settings.wallet.mainnet.optInHint": "Optional — required only for production payouts.",
     "settings.hazbase.title": "Wallet",
@@ -666,7 +704,7 @@ const translations = {
     "settings.hazbase.status.signedIn": "Signed in",
     "settings.hazbase.status.sessionExpired": "Session expired",
     "settings.hazbase.status.otpAwaitingVerify": "Sent. Check your inbox, then enter the code below.",
-    "settings.hazbase.passkey.ready": "Registered on this device",
+    "settings.hazbase.passkey.ready": "Registered for this account",
     "settings.hazbase.passkey.missing": "Not registered yet",
     "settings.hazbase.passkey.localHostRequired": "Open viveworker on its .local hostname to register a passkey.",
     "settings.hazbase.wallet.missing": "Not issued yet",
@@ -674,6 +712,7 @@ const translations = {
     "settings.hazbase.field.emailPlaceholder": "you@example.com",
     "settings.hazbase.field.otpLabel": "One-time password",
     "settings.hazbase.field.otpPlaceholder": "e.g. 123456",
+    "settings.hazbase.field.liquidAddressLabel": "Liquid payout address",
     "settings.hazbase.action.requestOtp": "Send one-time password",
     "settings.hazbase.action.refreshSession": "Refresh session",
     "settings.hazbase.action.resendOtp": "Resend",
@@ -682,6 +721,9 @@ const translations = {
     "settings.hazbase.action.registerPasskey": "Register passkey",
     "settings.hazbase.action.bootstrapBaseSepolia": "Issue Base Sepolia",
     "settings.hazbase.action.bootstrapBase": "Issue Base",
+    "settings.hazbase.action.bootstrapPolygonAmoy": "Issue Polygon Amoy",
+    "settings.hazbase.action.bootstrapPolygon": "Issue Polygon",
+    "settings.hazbase.action.saveLiquidCapability": "Save payout address",
     "settings.hazbase.action.signOut": "Sign out of wallet",
     "settings.hazbase.logout.confirm.title": "Sign out of wallet?",
     "settings.hazbase.logout.confirm.copy": "You'll need to sign back in with a one-time password to access this wallet again. Your wallet address and passkey stay linked to this account.",
@@ -690,6 +732,8 @@ const translations = {
     "settings.hazbase.notice.otpVerified": "Signed in to wallet.",
     "settings.hazbase.notice.passkeyRegistered": "Passkey registered.",
     "settings.hazbase.notice.walletBootstrapped": "Wallet issued on chain {chainId}.",
+    "settings.hazbase.notice.paymentCapabilitySaved": "Payment capability saved for {network}.",
+    "settings.hazbase.notice.agentDefaultsSaved": "Receiving wallet settings saved.",
     "settings.hazbase.notice.signedOut": "Signed out of wallet.",
     "settings.hazbase.notice.sessionRefreshStarted": "Session refresh started. Send a one-time password to sign in again.",
     "settings.hazbase.prompt.email": "Wallet email address",
@@ -758,7 +802,7 @@ const translations = {
     "error.completionReplyImageLimit": "Attach up to {count} images at a time.",
     "error.completionReplyImageInvalidUpload": "That image could not be uploaded.",
     "error.codexIpcNotConnected": "Codex desktop is not connected right now.",
-    "error.codexClientNotFound": "Codex changed its active client. Reopen the thread on your PC and try again.",
+    "error.codexClientNotFound": "Codex couldn't find the target thread. Reopen that thread on your PC and try again.",
     "error.approvalNotFound": "This approval is no longer available.",
     "error.approvalAlreadyHandled": "This approval was already handled.",
     "error.planRequestNotFound": "This plan request is no longer available.",
@@ -772,8 +816,12 @@ const translations = {
     "error.hazbaseEmailRequired": "Enter your email address first.",
     "error.hazbaseOtpRequired": "Enter the one-time password.",
     "error.hazbasePasskeyLocalHostRequired": "Open viveworker on its .local hostname to use hazBase passkeys.",
+    "error.hazbasePasskeyAlreadyRegistered": "A passkey is already registered for this account. Use the existing passkey to continue.",
     "error.hazbaseWalletAccountMissing": "Issue a wallet on this chain first.",
-    "error.unsupportedChain": "That chain is not supported here.",
+    "error.hazbaseLiquidAddressRequired": "Enter a Liquid payout address first.",
+    "error.hazbaseLiquidAddressInvalid": "Enter a valid Liquid payout address for this network.",
+    "error.paymentNetworkComingSoon": "Mainnet payments will be available at the formal release.",
+    "error.unsupportedChain": "This network is not supported for wallet issuance yet. Choose a supported network and try again.",
     "server.fallback.codexTask": "{provider} task",
     "server.title.approval": "Approval",
     "server.title.complete": "Completed",
@@ -1698,25 +1746,54 @@ const translations = {
     "settings.a2aShare.days": ({ count }) => `${count} 日`,
     "settings.a2aShare.ratePerHour": ({ count }) => `${count} 件 / 1 時間`,
     "settings.a2aShare.passwordProtected": "パスワード保護",
-    "settings.a2aShare.paidShare": ({ price, network }) => `有料 — ${price} USDC (${network})`,
+    "settings.a2aShare.paidShare": ({ price, asset, network }) => `有料 — ${price} ${asset || "USDC"} (${network})`,
     "settings.a2aShare.showMore": "さらに {count} 件…",
     "settings.a2aShare.showLess": "閉じる",
     "settings.a2aShare.expired": "期限切れ",
     "settings.a2aShare.status.unreachable": "到達不可",
     "settings.a2aShare.error": "上流への問い合わせに失敗しました: {reason}",
     "settings.wallet.title": "ウォレット",
-    "settings.wallet.subtitle": "サインイン / パスキー / Base アドレス",
-    "settings.wallet.copy": "ウォレットへのサインイン、パスキー、Base 系アドレスの管理を行います。",
+    "settings.wallet.subtitle": "エージェント支払いの受け取り先",
+    "settings.wallet.copy": "発行済みウォレットや payout アドレスのうち、エージェントが既定で使えるものを選びます。",
     "settings.wallet.unavailable": "この viveworker では Wallet が設定されていません。",
     "settings.wallet.summary.title": "現在の状態",
     "settings.wallet.flow.title": "おすすめの順番",
+    "settings.wallet.agent.title": "エージェント支払いの受け取り先",
+    "settings.wallet.agent.copy": "有料ファイル共有で支払いを受け取るウォレットを選びます。mainnet は正式リリースまで除外されます。",
+    "settings.wallet.agent.empty": "まだウォレットまたは payout アドレスがありません。ウォレット管理で、受け取り先を追加してください。",
+    "settings.wallet.agent.emptyAvailable": "Testnet の受け取り先がまだありません。mainnet は正式リリース時に利用できます。",
+    "settings.wallet.agent.save": "設定を保存",
+    "settings.wallet.agent.useAllConfigured": "すべての受け取り先を有効にする",
+    "settings.wallet.agent.currentDefaults": "受け取り先",
+    "settings.wallet.agent.unsaved": "未保存の変更があります。保存すると受け取り先に反映されます。",
+    "settings.wallet.agent.modalTitle": "有効な受け取り先",
+    "settings.wallet.agent.modalCopy": "保存済みの受け取り先が、有料ファイル共有で利用されます。",
+    "settings.wallet.inventory.title": "ウォレット管理",
+    "settings.wallet.inventory.copy": "環境ごとに必要なウォレットを任意で発行・登録します。現在は Testnet が利用可能で、mainnet は正式リリース時に利用できます。",
+    "settings.wallet.inventory.navGroup": "ウォレット管理",
+    "settings.wallet.inventory.navTitle": "ウォレットを発行・登録",
+    "settings.wallet.inventory.navCopy": "Base、Polygon、Liquid の payment capability を管理します。",
+    "settings.wallet.inventory.navValue": ({ count }) => `${count} 件設定済み`,
+    "settings.wallet.inventory.accountTitle": "アカウント認証",
+    "settings.wallet.inventory.issueTitle": "ウォレット発行・登録",
+    "settings.wallet.inventory.testnetTitle": "Testnet",
+    "settings.wallet.inventory.mainnetTitle": "Mainnet",
+    "settings.wallet.inventory.environment.testnet": "Testnet",
+    "settings.wallet.inventory.environment.mainnet": "Mainnet",
+    "settings.wallet.chain.base.title": "Base",
+    "settings.wallet.chain.base.copy": "Base の smart wallet を発行します。Mainnet 発行は正式リリース時に利用できます。",
+    "settings.wallet.chain.liquid.title": "Liquid",
+    "settings.wallet.chain.liquid.copy": "Liquid の payout アドレスを登録します。Mainnet 登録は正式リリース時に利用できます。",
+    "settings.wallet.chain.polygon.title": "Polygon",
+    "settings.wallet.chain.polygon.copy": "Polygon の smart wallet を発行します。Mainnet 発行は正式リリース時に利用できます。",
+    "settings.wallet.chain.configuredValue": ({ count, total }) => `${count}/${total} 設定済み`,
     "settings.wallet.flow.banner.title": "まずは、セットアップしましょう",
     "settings.wallet.flow.copy": "A2A でタスクの報酬をやりとりするには、ウォレットを有効化する必要があります。",
-    "settings.wallet.betaNotice": "ウォレット機能はベータテスト中です。この期間はテストネットでのみ支払い・受け取りを利用できます。",
+    "settings.wallet.betaNotice": "ウォレット機能はベータテスト中です。Testnet を安全な既定値にし、mainnet は正式リリース時にご利用いただけます。",
     "settings.wallet.sessionExpired.title": "ウォレットセッションを更新しましょう",
     "settings.wallet.sessionExpired.copy": "ウォレットのセッションが切れています。ワンタイムパスワードで再サインインすれば、パスキーと Base Sepolia アドレスはそのまま使えます。",
     "settings.wallet.ready.title": "利用準備ができました",
-    "settings.wallet.ready.copy": "メールサインイン、パスキー、Base Sepolia ウォレットの準備ができています。",
+    "settings.wallet.ready.copy": "メールサインイン、パスキー、Testnet ウォレット設定の準備ができています。",
     "settings.wallet.ready.payoutIntro": "エージェントは下記アドレスを利用します:",
     "settings.wallet.ready.copyAddress": "タップでアドレスをコピー",
     "settings.wallet.advanced.title": "アカウント操作",
@@ -1736,8 +1813,17 @@ const translations = {
     "settings.wallet.step.baseSepolia.title": "Base Sepolia ウォレットを発行",
     "settings.wallet.step.baseSepolia.copy": "現在の beta フローで使うテスト用ウォレットを発行します。まずはこれを用意するのがおすすめです。",
     "settings.wallet.step.base.title": "Base ウォレットを発行",
-    "settings.wallet.step.base.copy": "本番 payout 向けの Base mainnet ウォレット発行は準備中です。まだ有効化されていません。",
+    "settings.wallet.step.base.copy": "Base mainnet ウォレット発行は beta 中は無効です。正式リリース時に利用できます。",
     "settings.wallet.step.base.comingSoonDetail": "Coming soon",
+    "settings.wallet.step.polygonAmoy.title": "Polygon Amoy ウォレットを発行",
+    "settings.wallet.step.polygonAmoy.copy": "Polygon x402 で USDC / JPYC を受け取れるよう、Polygon Amoy のテスト用ウォレットを発行します。",
+    "settings.wallet.step.polygon.title": "Polygon ウォレットを発行",
+    "settings.wallet.step.polygon.copy": "Polygon mainnet ウォレット発行は beta 中は無効です。正式リリース時に利用できます。",
+    "settings.wallet.step.liquidTestnet.title": "Liquid Testnet payout を登録",
+    "settings.wallet.step.liquidTestnet.copy": "Liquid x402 で USDt を受け取れるよう、Liquid Testnet アドレスを追加します。",
+    "settings.wallet.step.liquid.title": "Liquid payout を登録",
+    "settings.wallet.step.liquid.copy": "Liquid mainnet payout 登録は beta 中は無効です。正式リリース時に利用できます。",
+    "settings.wallet.mainnet.comingSoonDetail": "mainnet は正式リリース時に利用できます。",
     "settings.wallet.mainnet.optIn": "Base mainnet も設定する",
     "settings.wallet.mainnet.optInHint": "任意 — 本番 payout が必要な場合だけ。",
     "settings.hazbase.title": "ウォレット",
@@ -1745,7 +1831,7 @@ const translations = {
     "settings.hazbase.status.signedIn": "サインイン済み",
     "settings.hazbase.status.sessionExpired": "セッション切れ",
     "settings.hazbase.status.otpAwaitingVerify": "送信しました。メールを確認して、下のフィールドに入力してください。",
-    "settings.hazbase.passkey.ready": "この端末で登録済み",
+    "settings.hazbase.passkey.ready": "このアカウントで登録済み",
     "settings.hazbase.passkey.missing": "まだ登録されていません",
     "settings.hazbase.passkey.localHostRequired": ".local ホスト名で viveworker を開くとパスキーを登録できます。",
     "settings.hazbase.wallet.missing": "未発行",
@@ -1753,6 +1839,7 @@ const translations = {
     "settings.hazbase.field.emailPlaceholder": "you@example.com",
     "settings.hazbase.field.otpLabel": "ワンタイムパスワード",
     "settings.hazbase.field.otpPlaceholder": "例: 123456",
+    "settings.hazbase.field.liquidAddressLabel": "Liquid payout アドレス",
     "settings.hazbase.action.requestOtp": "ワンタイムパスワードを送信",
     "settings.hazbase.action.refreshSession": "セッションを更新",
     "settings.hazbase.action.resendOtp": "再送信",
@@ -1761,6 +1848,9 @@ const translations = {
     "settings.hazbase.action.registerPasskey": "パスキーを登録",
     "settings.hazbase.action.bootstrapBaseSepolia": "Base Sepolia発行",
     "settings.hazbase.action.bootstrapBase": "Base発行",
+    "settings.hazbase.action.bootstrapPolygonAmoy": "Polygon Amoy発行",
+    "settings.hazbase.action.bootstrapPolygon": "Polygon発行",
+    "settings.hazbase.action.saveLiquidCapability": "payout アドレスを保存",
     "settings.hazbase.action.signOut": "ウォレットからログアウト",
     "settings.hazbase.logout.confirm.title": "ウォレットからログアウトしますか?",
     "settings.hazbase.logout.confirm.copy": "再度アクセスするには、ワンタイムパスワードでのサインインが必要になります。ウォレットアドレスとパスキーは同じアカウントに紐付いたまま残ります。",
@@ -1769,6 +1859,8 @@ const translations = {
     "settings.hazbase.notice.otpVerified": "ウォレットにサインインしました。",
     "settings.hazbase.notice.passkeyRegistered": "パスキーを登録しました。",
     "settings.hazbase.notice.walletBootstrapped": "chain {chainId} にウォレットを発行しました。",
+    "settings.hazbase.notice.paymentCapabilitySaved": "{network} の payment capability を保存しました。",
+    "settings.hazbase.notice.agentDefaultsSaved": "受け取り先の設定を保存しました。",
     "settings.hazbase.notice.signedOut": "ウォレットからログアウトしました。",
     "settings.hazbase.notice.sessionRefreshStarted": "セッション更新を開始しました。ワンタイムパスワードを送信して再サインインしてください。",
     "settings.hazbase.prompt.email": "ウォレットのメールアドレス",
@@ -1837,7 +1929,7 @@ const translations = {
     "error.completionReplyImageLimit": "画像は最大 {count} 枚まで添付できます。",
     "error.completionReplyImageInvalidUpload": "この画像はアップロードできませんでした。",
     "error.codexIpcNotConnected": "いまは Codex desktop に接続できていません。",
-    "error.codexClientNotFound": "Codex 側の接続先が切り替わりました。PC で対象スレッドを開き直して、もう一度送信してください。",
+    "error.codexClientNotFound": "Codex 側で対象スレッドが見つかりませんでした。PC でそのスレッドを開き直して、もう一度送信してください。",
     "error.approvalNotFound": "この承認はもう利用できません。",
     "error.approvalAlreadyHandled": "この承認はすでに処理済みです。",
     "error.planRequestNotFound": "このプラン確認はもう利用できません。",
@@ -1851,8 +1943,12 @@ const translations = {
     "error.hazbaseEmailRequired": "先にメールアドレスを入力してください。",
     "error.hazbaseOtpRequired": "ワンタイムパスワードを入力してください。",
     "error.hazbasePasskeyLocalHostRequired": ".local ホスト名で viveworker を開くと hazBase パスキーを使えます。",
+    "error.hazbasePasskeyAlreadyRegistered": "このアカウントには既にパスキーが登録されています。既存のパスキーで続行してください。",
     "error.hazbaseWalletAccountMissing": "先にこのチェーンのウォレットを発行してください。",
-    "error.unsupportedChain": "このチェーンはここではサポートされていません。",
+    "error.hazbaseLiquidAddressRequired": "先に Liquid payout アドレスを入力してください。",
+    "error.hazbaseLiquidAddressInvalid": "このネットワーク用の有効な Liquid payout アドレスを入力してください。",
+    "error.paymentNetworkComingSoon": "mainnet の支払いは正式リリース時に利用できます。",
+    "error.unsupportedChain": "このネットワークのウォレット発行はまだサポートされていません。対応済みのネットワークを選んでください。",
     "server.fallback.codexTask": "{provider} task",
     "server.title.approval": "要承認",
     "server.title.complete": "完了",

package/web/remote-pairing/transport.js

@@ -91,6 +91,14 @@ const DEFAULT_MAX_CIRCUIT_BREAKER_MS = 10 * 60_000;
 const DEFAULT_STABLE_CONNECTION_MS = 15_000;
 const DEFAULT_PROLOGUE = new TextEncoder().encode("viveworker/remote-pairing/v1");
 
+// The relay token is carried in the Sec-WebSocket-Protocol handshake header,
+// not a `?token=` query param, so it stays out of URLs and access logs. We
+// offer the fixed RELAY_SUBPROTOCOL (which the relay echoes on the 101 so the
+// handshake completes) plus the token as `${TOKEN_SUBPROTOCOL_PREFIX}<token>`.
+// Must match worker-pairing/worker.js and worker-pairing/pairing-do.js.
+const RELAY_SUBPROTOCOL = "viveworker.relay.v1";
+const TOKEN_SUBPROTOCOL_PREFIX = "vwtok.";
+
 // CloseEvent codes we emit. 1000 is normal; 4xxx is application-defined.
 const CLOSE_NORMAL = 1000;
 const CLOSE_HANDSHAKE_TIMEOUT = 4001;
@@ -354,12 +362,16 @@ export class RemotePairingTransport {
 
     const url =
       `${this._relayUrl}/v1/pairing/${encodeURIComponent(this._pairingId)}` +
-      `/ws?role=${encodeURIComponent(this._role)}` +
-      `&token=${encodeURIComponent(this._relayToken)}`;
+      `/ws?role=${encodeURIComponent(this._role)}`;
+
+    // Send the relay token via Sec-WebSocket-Protocol instead of the URL. Both
+    // the browser WebSocket and the Node `ws` package take a protocols list as
+    // the 2nd arg; the relay echoes only RELAY_SUBPROTOCOL back.
+    const subprotocols = [RELAY_SUBPROTOCOL, `${TOKEN_SUBPROTOCOL_PREFIX}${this._relayToken}`];
 
     let ws;
     try {
-      ws = new this._WebSocketImpl(url);
+      ws = new this._WebSocketImpl(url, subprotocols);
     } catch (err) {
       this._onError(err);
       this._setState(STATE.DISCONNECTED, { reason: "open-threw", error: err });

package/web/sw.js

@@ -2,6 +2,7 @@ const APP_BUILD_ID = "__VIVEWORKER_APP_BUILD_ID__";
 const CACHE_NAME = `viveworker-${APP_BUILD_ID}`;
 const APP_SCRIPT_URL = `/app.js?v=${APP_BUILD_ID}`;
 const APP_STYLE_URL = `/app.css?v=${APP_BUILD_ID}`;
+const I18N_SCRIPT_URL = `/i18n.js?v=${APP_BUILD_ID}`;
 const API_ROUTER_URL = `/remote-pairing/api-router.js?v=${APP_BUILD_ID}`;
 const NOTIFICATION_INTENT_CACHE = "viveworker-notification-intent-v1";
 const NOTIFICATION_INTENT_PATH = "/__viveworker_notification_intent__";
@@ -16,6 +17,7 @@ const APP_ASSETS = [
   "/app",
   APP_SCRIPT_URL,
   APP_STYLE_URL,
+  I18N_SCRIPT_URL,
   "/app.js",
   "/i18n.js",
   "/icons/viveworker-v-pulse.svg",
@@ -33,11 +35,13 @@ const CACHED_PATHS = new Set(APP_ASSETS.map((asset) => new URL(asset, self.locat
 const VERSIONED_CACHE_PATHS = new Set([
   "/app.js",
   "/app.css",
+  "/i18n.js",
   "/remote-pairing/api-router.js",
 ]);
 const NETWORK_FIRST_PATHS = new Set([
   "/app.js",
   "/app.css",
+  "/i18n.js",
   "/remote-pairing/api-router.js",
 ]);
 const APP_NAVIGATION_NETWORK_TIMEOUT_MS = 1800;