fix(live): surface control WebSocket construction failure #56

Merged

Claude-Run merged 1 commit from fix/VAPP-45-surface-control-ws-error into main

2026-06-29 02:43:48 +02:00

Claude-Run commented

2026-06-29 02:42:45 +02:00

Member

The live control channel's Conn::open swallowed a failed WebSocket constructor with WebSocket::new(ws_url).ok()?, returning None silently. When VERVAIN_SERVER_PUBLIC_URL is http://, get_control_token mints a ws:// url, and an insecure ws:// socket on the https SPA page is mixed-content-blocked: the constructor throws SecurityError, the swallow hid it, and the statusbar read "disconnected" with no diagnostic. VAPP-42 fixed this for the relay paths (terminal/files/desktop) but missed the control channel in live.rs.

Conn::open now logs the offending url (single-use auth token redacted via the shared redact_auth helper) and the error to the console and calls out the ws://-on-https mixed-content cause, mirroring the relay-WS fix, instead of returning None silently. The README note on VERVAIN_SERVER_PUBLIC_URL now spells out that an http:// value yields insecure ws:// sockets a secure SPA cannot open.

#VAPP-45

The live control channel's Conn::open swallowed a failed WebSocket constructor with `WebSocket::new(ws_url).ok()?`, returning None silently. When VERVAIN_SERVER_PUBLIC_URL is http://, get_control_token mints a ws:// url, and an insecure ws:// socket on the https SPA page is mixed-content-blocked: the constructor throws SecurityError, the swallow hid it, and the statusbar read "disconnected" with no diagnostic. VAPP-42 fixed this for the relay paths (terminal/files/desktop) but missed the control channel in live.rs. Conn::open now logs the offending url (single-use auth token redacted via the shared redact_auth helper) and the error to the console and calls out the ws://-on-https mixed-content cause, mirroring the relay-WS fix, instead of returning None silently. The README note on VERVAIN_SERVER_PUBLIC_URL now spells out that an http:// value yields insecure ws:// sockets a secure SPA cannot open. #VAPP-45

Claude-Run added 1 commit

2026-06-29 02:42:45 +02:00

fix(live): surface control WebSocket construction failure

Check / fmt + clippy + build + tests (pull_request) Successful in 47s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

3e2a5e3d2c

The live control channel's Conn::open swallowed a failed WebSocket constructor with `WebSocket::new(ws_url).ok()?`, returning None silently. When VERVAIN_SERVER_PUBLIC_URL is http://, get_control_token mints a ws:// url, and an insecure ws:// socket on the https SPA page is mixed-content-blocked: the constructor throws SecurityError, the swallow hid it, and the statusbar read "disconnected" with no diagnostic. VAPP-42 fixed this for the relay paths (terminal/files/desktop) but missed the control channel in live.rs.

Conn::open now logs the offending url (single-use auth token redacted via the shared redact_auth helper) and the error to the console and calls out the ws://-on-https mixed-content cause, mirroring the relay-WS fix, instead of returning None silently. The README note on VERVAIN_SERVER_PUBLIC_URL now spells out that an http:// value yields insecure ws:// sockets a secure SPA cannot open.

#VAPP-45