[Wikid82]

Summary

gorilla/websocket is no longer maintained. This moves both the server side (backend/) and the agent (agent/) to github.com/coder/websocket v1.8.15 in a single PR.

Backend

• New websocket_upgrade.go centralizes origin checking and the upgrade. The origin rule is unchanged: no Origin, or the origin host must equal Host/X-Forwarded-Host, otherwise 403 before upgrade. Orthrus still accepts any origin (bearer token is the boundary).
• New log_socket.go shares read-limit, keepalive and write helpers across the logs, cerberus and hecate streams.
• Stats hub and orthrus server/session ported; the hand-rolled wsNetConn is replaced by websocket.NetConn.
• Dead code removed (old pong/deadline handling, TCP buffer-shrinking helpers, unused AgentSession.conn).

Agent

• leash dials with websocket.Dial; wire behavior is preserved: no compression, no proxy, no HTTP/2 negotiation, binary-only NetConn, abrupt close, unchanged headers.

Behavior changes worth reviewing

• Non-upgrade GETs to the orthrus and cerberus WS endpoints now return 426 instead of 400.
• The hecate stream now has a ping/pong keepalive and a 10s write deadline; clients that stop answering pings are dropped after about 60s. Its client read limit is now coder's 32 KiB default (clients send nothing).
• JSON frames no longer end with the trailing newline that gorilla's WriteJSON added.
• The agent connection carries binary frames only; a text frame closes it (the orthrus server only sends binary).
• A write that times out now closes the connection (library behavior).

Other

• Removed the Renovate ignoreDeps entry for the old dependency so the new one is tracked; updated both ARCHITECTURE tables.
• //nolint:bodyclose on the three websocket.Dial call sites: the library documents that the response body is nil on success and closed on error.

Testing

• Ported all websocket tests in backend/internal/api/handlers, backend/internal/orthrus and agent/leash; added tests for the upgrade/origin helper, the agent NetConn close behavior, and the dial HTTP client.
• go build, go vet, and golangci-lint (fast) are clean for both modules.
• Backend and agent go test pass, and handlers, orthrus, services and the agent pass under -race.
• Full Playwright / cross-browser runs are left to CI.

Note: one test (the stalled-write test) relies on kernel socket buffers filling within a 10s budget, so it may be timing-sensitive on other hosts.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

✅ Supply Chain Verification Results

✅ PASSED

📦 SBOM Summary

• Components: 1873

🔍 Vulnerability Scan

Severity	Count
🔴 Critical	0
🟠 High	0
🟡 Medium	13
🟢 Low	2
Total	16

📎 Artifacts

• SBOM (CycloneDX JSON) and Grype results available in workflow artifacts

---

_{Generated by Supply Chain Verification workflow • View Details}

[codecov]

Codecov Report

❌ Patch coverage is 96.49123% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
agent/leash/leash.go	92.85%	1 Missing ⚠️
backend/internal/api/handlers/stats_handler.go	50.00%	1 Missing ⚠️
backend/internal/orthrus/server.go	66.66%	1 Missing ⚠️
backend/internal/orthrus/session.go	75.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!