Skip to content

Stabilize browser runtime and WebSocket sessions - #9

Merged
Artixcore merged 3 commits into
masterfrom
agent/security-hardening-phase-1
Jul 29, 2026
Merged

Stabilize browser runtime and WebSocket sessions#9
Artixcore merged 3 commits into
masterfrom
agent/security-hardening-phase-1

Conversation

@Artixcore

Copy link
Copy Markdown
Owner

What changed

  • disables Streamlit file watching and run-on-save in production
  • serializes reruns by disabling fastReruns
  • configures a 30-second WebSocket ping interval and a five-minute disconnected-session TTL
  • disables WebSocket compression to reduce proxy and extension edge cases
  • adds an Nginx Streamlit proxy template with explicit WebSocket upgrade headers, buffering disabled, long read timeouts, and no upstream retry
  • adds regression tests for runtime settings, proxy directives, and extension-neutral application code

Why

The reported console warnings originate from a browser wallet extension (contentscript.js, injected.js, ObjectMultiplex, and TronLink initiated), not from ContentPilot. The application must not hide the warning with setMaxListeners() or interfere with injected wallet providers.

These changes address the only safe application-side amplification factors: unnecessary Streamlit reruns, development file watching, and unstable reverse-proxy WebSocket sessions.

Security impact

  • no wallet-provider hooks are added
  • no browser extension APIs are patched
  • no listener limits are increased or warnings suppressed
  • CI fails if TronLink initialization, ObjectMultiplex markers, or setMaxListeners() enter production application files

Verification

Run the existing Product CI Final workflow. The warning may still appear when the TronLink extension itself repeatedly initializes; disabling or updating the extension remains the definitive browser-side test.

@Artixcore
Artixcore marked this pull request as ready for review July 29, 2026 19:37
@Artixcore
Artixcore merged commit 127cef7 into master Jul 29, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant