Function proxyThroughTarget

services/kiloclaw/src/index.ts:180–312

* Forward an HTTP or WebSocket request through to a provider-routed target. * * Shared by all four catch-all proxy branches (`/i/:instanceId/*`, host-based, * cookie-routed, and default personal). `logTag` is prepended to console logs * so failing requests can be traced back to their originating

(opts: {
  request: Request;
  targetUrl: string;
  forwardHeaders: Headers;
  logTag: string;
  unreachableHint?: string;
  startingUpHint?: string;
})

  targetUrl: string;
  forwardHeaders: Headers;
  logTag: string;
  unreachableHint?: string;
  startingUpHint?: string;
}): Promise<Response> {
  const { request, targetUrl, forwardHeaders, logTag, unreachableHint, startingUpHint } = opts;
  const isWebSocketRequest = request.headers.get('Upgrade')?.toLowerCase() === 'websocket';

  const unreachableBody: Record<string, string> = { error: 'Instance not reachable' };
  if (unreachableHint) unreachableBody.hint = unreachableHint;
  const startingUpBody: Record<string, string> = { error: 'Instance is starting up' };
  if (startingUpHint) startingUpBody.hint = startingUpHint;

  if (isWebSocketRequest) {
    let containerResponse: Response;
    try {
      containerResponse = await fetch(targetUrl, { headers: forwardHeaders });
    } catch (err) {
      console.error(`${logTag} WS fetch failed:`, err);
      return Response.json(unreachableBody, {
        status: 503,
        headers: { 'Retry-After': '5' },
      });
    }

    if (containerResponse.status === 502) {
      return Response.json(startingUpBody, {
        status: 503,
        headers: { 'Retry-After': '5' },
      });
    }

    const containerWs = containerResponse.webSocket;
    if (!containerWs) {
      // Upstream returned a non-upgrade response to a WebSocket request.
      // Normalize to 502 JSON rather than leaking the raw upstream body —
      // this path is only hit when the container is in a bad state
      // (gateway crash, proxy misconfig) and the raw response may contain
      // provider/controller error details we don't want to surface to
      // the Control UI.
      console.warn(`${logTag} upstream did not upgrade (status ${containerResponse.status})`);
      return Response.json({ error: 'WebSocket upgrade failed' }, { status: 502 });
    }

    const [clientWs, serverWs] = Object.values(new WebSocketPair());
    serverWs.accept();
    containerWs.accept();

    let droppedToContainer = 0;
    let droppedToClient = 0;

    serverWs.addEventListener('message', event => {
      if (containerWs.readyState === WebSocket.OPEN) {
        containerWs.send(event.data as string | ArrayBuffer);
      } else {
        droppedToContainer++;
        if (droppedToContainer === 1) {
          console.warn(
            `${logTag} First dropped client->container message (readyState:`,