Skip to content

Disable WebSocket by default (opt-in via ENABLE_WEBSOCKET) #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nanehambardzumyan wants to merge 2 commits into
base: main
Choose a base branch
from
+16 −7
Open

Disable WebSocket by default (opt-in via ENABLE_WEBSOCKET) #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
058e6df
Disable WebSocket by default, gate behind ENABLE_WEBSOCKET flag
cursoragent Jun 26, 2026
40b3b95
Remove /ws Vite proxy to stop EPIPE errors when WebSocket is disabled
cursoragent Jun 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion client/app.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,11 @@
// app.js
import Modal from './design-system/components/modal/modal.js';

// WebSocket messaging is disabled by default. The API Simulator UI uses plain
// HTTP, so the optional alert/messaging channel is opt-in. Set this to true and
// run the server with ENABLE_WEBSOCKET=true to re-enable it.
const ENABLE_WEBSOCKET = false;
Comment on lines +4 to +7

@coderabbitai coderabbitai Bot Jun 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Don't hardcode the client gate to false.

With this literal, enabling ENABLE_WEBSOCKET=true on the server still never re-enables the browser connection, so the opt-in flow described in this PR cannot work end to end. Read the flag from shared runtime/build config instead of baking in false.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@client/app.js` around lines 4 - 7, The browser-side gate in client/app.js is
hardcoded off, so the optional messaging path can never be re-enabled even when
the server/runtime flag is set. Update the ENABLE_WEBSOCKET constant to read
from shared runtime/build configuration instead of using a literal false, and
keep the existing WebSocket connection setup in app.js driven by that shared
flag so the opt-in flow works end to end.


let websocket = null;
let helpModal = null;
let helpModalInitialized = false;
Expand Down Expand Up @@ -114,7 +119,9 @@ async function initializeHelpModal() {
// Initialize both help modal and WebSocket when DOM is ready
async function initialize() {
await initializeHelpModal();
initializeWebSocket();
if (ENABLE_WEBSOCKET) {
initializeWebSocket();
}
}

if (document.readyState === 'loading') {
Expand Down
9 changes: 8 additions & 1 deletion server.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,13 @@ const fs = require('fs');
const fsp = fs.promises;
const path = require('path');
const url = require('url');
// Try to load WebSocket module, fallback if not available
// WebSocket support is opt-in. Set ENABLE_WEBSOCKET=true to enable the optional
// /ws channel and POST /message broadcasting. It is disabled by default because
// the API Simulator UI communicates over plain HTTP and does not use WebSockets.
const WEBSOCKET_ENABLED = process.env.ENABLE_WEBSOCKET === 'true';
let WebSocket = null;
let isWebSocketAvailable = false;
if (WEBSOCKET_ENABLED) {
Comment on lines +26 to +29

@coderabbitai coderabbitai Bot Jun 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Separate “disabled by config” from “ws unavailable”.

This gate reuses isWebSocketAvailable for both states, so POST /message now tells clients to install ws even when WebSockets were only disabled via ENABLE_WEBSOCKET. Return a config-disabled 503 body separately from the missing-dependency case.

Also applies to: 38-40

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server.js` around lines 26 - 29, The WebSocket gating in server.js conflates
configuration-disabled and dependency-missing states via isWebSocketAvailable,
so split the logic around WEBSOCKET_ENABLED and the ws import in the startup
block and POST /message handler. Keep a separate flag or branch for “disabled by
config” versus “ws unavailable,” and return a distinct 503 response for each
case so clients only see the install-ws message when the dependency is actually
missing.

try {
WebSocket = require('ws');
isWebSocketAvailable = true;
Expand All @@ -31,6 +35,9 @@ console.log('WebSocket support enabled');
console.log('WebSocket support disabled (ws package not installed)');
console.log('Install with: npm install ws');
}
} else {
console.log('WebSocket support disabled (set ENABLE_WEBSOCKET=true to enable)');
}
const DIST_DIR = path.join(__dirname, 'dist');
const DATA_DIR = path.join(__dirname, '.api-sim-data');
const EVENTS_FILE = path.join(DATA_DIR, 'events.jsonl');
Expand Down
5 changes: 0 additions & 5 deletions vite.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,11 +25,6 @@ export default defineConfig({
'/message': {
target: 'http://localhost:3001',
changeOrigin: true
},
'/ws': {
target: 'ws://localhost:3001',
ws: true,
changeOrigin: true
}
}
},
Expand Down