fix: recover viewer startup asset failures

Author: kryptocodes

images/minimal-vnc-desktop/Dockerfile

@@ -271,20 +271,19 @@ RUN set -eux; \
         --minify-whitespace --minify-syntax \
         --outfile=/usr/share/novnc/viewer.bundle.js; \
     rm -rf /tmp/esbuild.tgz /tmp/esbuild-src /tmp/esbuild.lock; \
-    # Content-hash the bundle so novnc-proxy can serve it immutably (max-age=1y):
-    # a content change yields a NEW url, so a reconnect/reopen skips re-downloading
-    # it entirely — with zero staleness risk (the reason liveview.html itself stays
-    # no-store, pointing at whatever hash is current). Deterministic: the hash is of
-    # esbuild's deterministic output. Rewrite the <script src> to the hashed name.
+    # Immutable primary bundle plus a no-cache fallback; generate SRI from its bytes.
     bundle_hash="$(sha256sum /usr/share/novnc/viewer.bundle.js | cut -c1-12)"; \
+    bundle_sri="$(openssl dgst -sha384 -binary /usr/share/novnc/viewer.bundle.js | base64 | tr -d '\n')"; \
     mv /usr/share/novnc/viewer.bundle.js "/usr/share/novnc/viewer-${bundle_hash}.bundle.js"; \
-    sed -i "s#src=\"viewer\.bundle\.js\"#src=\"viewer-${bundle_hash}.bundle.js\"#" \
+    cp "/usr/share/novnc/viewer-${bundle_hash}.bundle.js" "/usr/share/novnc/viewer-fallback-${bundle_hash}.bundle.js"; \
+    sed -i "s#viewer\.bundle\.js#viewer-${bundle_hash}.bundle.js#g; s#viewer-fallback\.bundle\.js#viewer-fallback-${bundle_hash}.bundle.js#g; s#sha384-__VIEWER_BUNDLE_SRI__#sha384-${bundle_sri}#g" \
         /usr/share/novnc/liveview.html; \
     # Precompress the (hashed) bundle: it's the cold-start bottleneck over the
     # tunnel and novnc-proxy serves the .gz via Accept-Encoding negotiation. -n
     # drops the name/mtime from the gzip header so the output is deterministic;
     # -k keeps the raw file for clients without gzip.
-    gzip -9 -n -k -f "/usr/share/novnc/viewer-${bundle_hash}.bundle.js"
+    gzip -9 -n -k -f "/usr/share/novnc/viewer-${bundle_hash}.bundle.js" \
+        "/usr/share/novnc/viewer-fallback-${bundle_hash}.bundle.js"
 
 COPY third-party/fortress /usr/share/doc/popcorn/third-party/fortress
 COPY --chown=kernel:kernel extensions/proxy /home/kernel/extensions/proxy

images/minimal-vnc-desktop/liveview.html

@@ -186,62 +186,89 @@
         });
       }
 
-      // Reload a stalled viewer a bounded number of times; unsupported browsers skip it.
-      // 10s, not something tighter. Worst realistic cold boot is ~114KB gzip over a bad
-      // 3G link (~2.5s) plus parsing ~412KB of JS on a slow phone (~1-2s). A deadline
-      // near that budget would reload devices that were merely SLOW — and since each
-      // reload restarts the download, that makes those sessions strictly worse, not
-      // better. Three attempts at 10s still gives up ~22s before the ~52s stream
-      // timeout that this replaces.
+      // Retry the asset, not this document: the primary, a query-busted retry,
+      // then a distinct no-cache fallback. Ten seconds avoids restarting slow boots.
       var BOOT_DEADLINE_MS = 10000;
-      var BOOT_MAX_RETRIES = 2;
-      var pcnrMatch = /[?&]__pcnr=(\d+)/.exec(location.search);
-      var bootAttempt = pcnrMatch ? (parseInt(pcnrMatch[1], 10) || 0) : 0;
-
-      // Preserve viewer parameters while updating the retry counter.
-      function bootUrlForAttempt(n) {
-        var base = location.href.split('#')[0].split('?')[0];
-        var qs = location.search.replace(/^\?/, '');
-        var keep = [];
-        if (qs) {
-          var parts = qs.split('&');
-          for (var i = 0; i < parts.length; i++) {
-            if (parts[i] && parts[i].indexOf('__pcnr=') !== 0) keep.push(parts[i]);
-          }
-        }
-        if (n > 0) keep.push('__pcnr=' + n);
-        return base + (keep.length ? '?' + keep.join('&') : '') + location.hash;
+      var bootAttempt = 0;
+      var assetPaths = [
+        'viewer.bundle.js',
+        'viewer.bundle.js?__pcna=1',
+        'viewer-fallback.bundle.js'
+      ];
+      var assetScript;
+      var assetSettled = false;
+
+      // Rewritten by the Docker build with hashed paths and SRI.
+      var assetIntegrity = 'sha384-__VIEWER_BUNDLE_SRI__';
+
+      function reportStall(retrying) {
+        try {
+          parent.postMessage({
+            type: 'POPCORN_BOOT_STALL', stage: 'asset', attempt: bootAttempt, retrying: retrying,
+            path: assetPaths[bootAttempt]
+          }, '*');
+        } catch (e) { /* no parent, or a parent that refuses '*' */ }
       }
 
-      if (!window.__viewerUnsupported && window.setTimeout) {
-        setTimeout(function () {
-          if (window.__viewerBooted) return;
-          var willRetry = bootAttempt < BOOT_MAX_RETRIES;
+      function terminalAssetFailure() {
+        reportStall(false);
+        window.__viewerOverlay(
+          'Live view couldn\u2019t start',
+          'The viewer didn\u2019t finish loading. Check your connection and try again.',
+          function () { location.reload(); }
+        );
+      }
+
+      function loadViewerAsset() {
+        if (window.__viewerBooted || assetSettled) return;
+        if (bootAttempt >= assetPaths.length) {
+          assetSettled = true;
+          terminalAssetFailure();
+          return;
+        }
+        if (assetScript && assetScript.parentNode) assetScript.parentNode.removeChild(assetScript);
+        assetScript = document.createElement('script');
+        assetScript.type = 'module';
+        assetScript.src = assetPaths[bootAttempt];
+        assetScript.integrity = assetIntegrity;
+        assetScript.onerror = function () {
+          if (window.__viewerBooted || assetSettled) return;
           try {
             parent.postMessage({
-              type: 'POPCORN_BOOT_STALL', stage: 'module', attempt: bootAttempt, retrying: willRetry
+              type: 'POPCORN_BOOT_ERROR', msg: 'Viewer bundle request failed',
+              src: assetPaths[bootAttempt], line: 0
             }, '*');
-          } catch (e) { /* no parent, or a parent that refuses '*' */ }
-          if (!willRetry) {
-            window.__viewerOverlay(
-              'Live view couldn\u2019t start',
-              'The viewer didn\u2019t finish loading. Check your connection and try again.',
-              function () { location.replace(bootUrlForAttempt(0)); }
-            );
+          } catch (e) { /* see above */ }
+          if (bootAttempt + 1 >= assetPaths.length) {
+            assetSettled = true;
+            terminalAssetFailure();
+            return;
+          }
+          reportStall(true);
+          bootAttempt++;
+          loadViewerAsset();
+        };
+        document.head.appendChild(assetScript);
+      }
+
+      if (!window.__viewerUnsupported && window.setTimeout) {
+        loadViewerAsset();
+        setTimeout(function watchdog() {
+          if (window.__viewerBooted || assetSettled) return;
+          if (bootAttempt + 1 >= assetPaths.length) {
+            assetSettled = true;
+            terminalAssetFailure();
             return;
           }
-          // replace(), not assign(): a failed attempt must not become a history entry.
-          location.replace(bootUrlForAttempt(bootAttempt + 1));
+          reportStall(true);
+          bootAttempt++;
+          loadViewerAsset();
+          setTimeout(watchdog, BOOT_DEADLINE_MS);
         }, BOOT_DEADLINE_MS);
       }
     })();
   </script>
 
-  <!-- The entire viewer — noVNC core + the kbd/IME layer + this page's
-       controller — is bundled by esbuild at build time into one file (see
-       viewer.js + the Dockerfile bundler step), so it loads in a single request
-       instead of a ~70-module ES-graph waterfall. Served no-store; a module
-       script is deferred, so the classic preflight above runs first. -->
-  <script type="module" src="viewer.bundle.js"></script>
+  <!-- The asset loader above starts the content-addressed viewer module. -->
 </body>
 </html>

images/minimal-vnc-desktop/proxy/main.go

@@ -23,11 +23,14 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 )
 
 const websocketGUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"
 
+var websocketBridgeSequence atomic.Uint64
+
 func main() {
 	listen := flag.String("listen", envDefault("NOVNC_LISTEN", ":6080"), "HTTP listen address")
 	vnc := flag.String("vnc", envDefault("VNC_ADDR", "127.0.0.1:5900"), "upstream VNC address")
@@ -345,6 +348,9 @@ func staticHandler(root string, ready readyGate) http.HandlerFunc {
 		// carries the current bundle hash, so it has to be re-read every load.
 		base := path.Base(clean)
 		switch {
+		case strings.HasPrefix(base, "viewer-fallback-") && strings.HasSuffix(base, ".bundle.js"):
+			// The recovery path must not inherit the primary's immutable cache.
+			w.Header().Set("Cache-Control", "no-store, max-age=0, must-revalidate")
 		case strings.HasPrefix(base, "viewer-") && strings.HasSuffix(base, ".bundle.js"):
 			w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
 		case strings.HasSuffix(clean, "/liveview.html") || strings.HasSuffix(clean, "/kbd-autofocus.js") ||
@@ -987,32 +993,48 @@ func websocketKey() (string, error) {
 }
 
 func proxyWebsocket(w http.ResponseWriter, r *http.Request, upstream string) {
+	sid := websocketDiagSID(r)
 	if !isWebsocketRequest(r) {
+		if sid != "" {
+			log.Printf("[websockify sid=%s] rejected: websocket upgrade required", sid)
+		}
 		http.Error(w, "websocket upgrade required", http.StatusBadRequest)
 		return
 	}
 
 	key := strings.TrimSpace(r.Header.Get("Sec-WebSocket-Key"))
 	if key == "" {
+		if sid != "" {
+			log.Printf("[websockify sid=%s] rejected: missing Sec-WebSocket-Key", sid)
+		}
 		http.Error(w, "missing Sec-WebSocket-Key", http.StatusBadRequest)
 		return
 	}
 
 	vncConn, err := net.DialTimeout("tcp", upstream, 5*time.Second)
 	if err != nil {
+		if sid != "" {
+			log.Printf("[websockify sid=%s] VNC dial %s failed: %v", sid, upstream, err)
+		}
 		http.Error(w, fmt.Sprintf("failed to connect to VNC upstream: %v", err), http.StatusBadGateway)
 		return
 	}
 
 	hijacker, ok := w.(http.Hijacker)
 	if !ok {
+		if sid != "" {
+			log.Printf("[websockify sid=%s] rejected: hijacking unsupported", sid)
+		}
 		_ = vncConn.Close()
 		http.Error(w, "hijacking unsupported", http.StatusInternalServerError)
 		return
 	}
 
 	clientConn, rw, err := hijacker.Hijack()
 	if err != nil {
+		if sid != "" {
+			log.Printf("[websockify sid=%s] client hijack failed: %v", sid, err)
+		}
 		_ = vncConn.Close()
 		return
 	}
@@ -1039,7 +1061,22 @@ func proxyWebsocket(w http.ResponseWriter, r *http.Request, upstream string) {
 		reader: rw.Reader,
 		vnc:    vncConn,
 	}
-	bridge.run()
+	bridgeID := websocketBridgeSequence.Add(1)
+	if sid != "" {
+		log.Printf("[websockify sid=%s bridge=%d] upgraded upstream=%s", sid, bridgeID, upstream)
+	}
+	result := bridge.run()
+	if sid != "" {
+		if result.closeCode != 0 {
+			log.Printf("[websockify sid=%s bridge=%d] closed direction=%s code=%d reason=%q", sid, bridgeID, result.direction, result.closeCode, result.closeReason)
+		} else {
+			log.Printf("[websockify sid=%s bridge=%d] closed direction=%s err=%v", sid, bridgeID, result.direction, result.err)
+		}
+	}
+}
+
+func websocketDiagSID(r *http.Request) string {
+	return klogSanitize(r.URL.Query().Get("diag_sid"), 24)
 }
 
 func isWebsocketRequest(r *http.Request) bool {
@@ -1085,26 +1122,32 @@ type wsBridge struct {
 	mu     sync.Mutex
 }
 
-func (b *wsBridge) run() {
-	done := make(chan struct{}, 2)
+type wsBridgeResult struct {
+	direction   string
+	err         error
+	closeCode   int
+	closeReason string
+}
+
+func (b *wsBridge) run() wsBridgeResult {
+	done := make(chan wsBridgeResult, 2)
 	stopPing := make(chan struct{})
 
 	go func() {
-		b.copyWebsocketToVNC()
-		done <- struct{}{}
+		done <- b.copyWebsocketToVNC()
 	}()
 
 	go func() {
-		b.copyVNCToWebsocket()
-		done <- struct{}{}
+		done <- b.copyVNCToWebsocket()
 	}()
 
 	go b.pingLoop(stopPing)
 
-	<-done
+	result := <-done
 	close(stopPing)
 	_ = b.client.Close()
 	_ = b.vnc.Close()
+	return result
 }
 
 // pingLoop sends server->client WS pings so idle-but-alive connections stay warm
@@ -1124,7 +1167,7 @@ func (b *wsBridge) pingLoop(stop <-chan struct{}) {
 	}
 }
 
-func (b *wsBridge) copyWebsocketToVNC() {
+func (b *wsBridge) copyWebsocketToVNC() wsBridgeResult {
 	for {
 		// Refresh the read deadline on every frame (client keystrokes AND the
 		// auto-pongs to our pings count as liveness), so a silent half-open
@@ -1135,7 +1178,7 @@ func (b *wsBridge) copyWebsocketToVNC() {
 			continue // e.g. an enormous clipboard paste: drop the message, keep the session
 		}
 		if err != nil {
-			return
+			return wsBridgeResult{direction: "client-read", err: err}
 		}
 
 		switch opcode {
@@ -1144,39 +1187,48 @@ func (b *wsBridge) copyWebsocketToVNC() {
 				continue
 			}
 			if _, err := b.vnc.Write(payload); err != nil {
-				return
+				return wsBridgeResult{direction: "vnc-write", err: err}
 			}
 		case 0x8:
 			_ = b.writeFrame(0x8, payload)
-			return
+			code, reason := websocketCloseInfo(payload)
+			return wsBridgeResult{direction: "client-close", closeCode: code, closeReason: reason}
 		case 0x9:
 			_ = b.writeFrame(0xA, payload)
 		case 0xA:
 		default:
 			_ = b.writeFrame(0x8, []byte{0x03, 0xEA})
-			return
+			return wsBridgeResult{direction: "client-protocol", err: fmt.Errorf("unsupported opcode %d", opcode)}
 		}
 	}
 }
 
-func (b *wsBridge) copyVNCToWebsocket() {
+func (b *wsBridge) copyVNCToWebsocket() wsBridgeResult {
 	buf := make([]byte, 32*1024)
 	for {
 		n, err := b.vnc.Read(buf)
 		if n > 0 {
 			if writeErr := b.writeFrame(0x2, buf[:n]); writeErr != nil {
-				return
+				return wsBridgeResult{direction: "client-write", err: writeErr}
 			}
 		}
 		if err != nil {
 			if !errors.Is(err, io.EOF) {
 				_ = b.writeFrame(0x8, nil)
 			}
-			return
+			return wsBridgeResult{direction: "vnc-read", err: err}
 		}
 	}
 }
 
+func websocketCloseInfo(payload []byte) (int, string) {
+	if len(payload) < 2 {
+		return 0, ""
+	}
+	code := int(binary.BigEndian.Uint16(payload[:2]))
+	return code, klogSanitize(string(payload[2:]), 120)
+}
+
 func (b *wsBridge) writeFrame(opcode byte, payload []byte) error {
 	_ = b.client.SetWriteDeadline(time.Now().Add(wsWriteDeadline))
 	return writeFrameToConn(b.client, &b.mu, opcode, payload, false, true)