Hardening a Developer Platform for Beta

A single shared database client across the service instead of one per frame, a fixed startup race between the socket layer and the filesystem channel, agent reconnect with unbounded exponential backoff and hello re-send, no unhandled promise rejections on send, and clean crash recovery with reporting.

Beyond directory listing: inline file viewing and editing with save-back over the wire protocol, drag-and-drop upload and download inside defined size limits, a stated strategy for large files, and permission and error states users can actually act on.

A create-session dialog covering every runtime driver, with working directory, environment overrides, and extra-argument input, inline validation, sane defaults, and end-to-end launch coverage for each session kind.

Per-user relay filtering so a dashboard only receives frames for its own devices, enforced WebSocket auth in production, server-side rate limits on auth, pairing, and filesystem channels, secure environment defaults, fail-fast on missing or weak production secrets, and a dependency audit pass.

Structured logs across dashboard, hub, and agent with correlation IDs tying a request to its frames, user, device, and session; surfaced protocol-parse failures instead of silent frame drops; health and readiness endpoints; and a runbook for the top failure scenarios.

Reproducible dev and beta environment scripts, verified container images and compose config behind a TLS reverse proxy, dynamic proxy configuration as tunnels open and close, seeded test data, and one-command bootstrap.

Filesystem requests timing out

Home-directory paths resolved against the process working directory on one OS, and the agent's allowed-roots set was never persisted, so the dashboard kept requesting a path that could not exist. Fixed by expanding the path correctly agent-side and persisting allowed roots, merged with live registry data in API responses.

Silently dropped protocol frames

Schema validation errors in the multiplexer were caught into a no-op handler, so malformed or unrouted frames vanished without a trace. Parse failures and missing channel handlers now surface as real, traceable errors.

Unhandled rejections on disconnect

Sends issued while the socket was down threw into nothing, leaving the caller to time out. Every send now goes through a guarded path that fails loudly and fast.

Connection pool exhaustion

Each inbound event frame constructed and discarded its own database client. Replaced with a shared singleton reused across handlers.

Path resolution now happens agent-side, against a persisted, explicitly stated set of allowed roots, rather than the dashboard requesting whatever path it guessed. The interface no longer accepts a raw path from a client without first checking it against the agent's declared roots.

Frame dispatch gained an explicit error contract: a parse failure or an unrouted message returns a typed error frame to the caller instead of being consumed by a no-op handler. A message that cannot be handled is now a response, not a silence.

The send API was changed to always settle. Instead of throwing into the void when the socket is down, every send resolves or rejects through a guarded path, so the caller gets a definitive outcome and can react to it.

Handlers no longer construct their own database client. A single shared client is provided through the request context, so the interface exposes one way to reach the data layer and every handler uses it.