Improve singleton connection handling and prevent state recursion#69
Merged
MarcosBrendonDePaula merged 1 commit intomainfrom Feb 27, 2026
Merged
Conversation
…n safety - Add recursion guard for onStateChange to prevent infinite loops when hooks modify state (proxy and setState paths) - Replace public _setEmitOverride with Symbol-keyed EMIT_OVERRIDE_KEY to prevent accidental access from userland code - Fix silent catch in singleton broadcast — now logs and removes dead connections instead of swallowing errors - Make connectionId collision-safe with random suffix fallback - Notify client on onMount failure via ERROR emit instead of silent log - Cache favicon blob URLs by hue to avoid recreating blobs per navigation - Extract removeSingletonConnection() to deduplicate logic between unmountComponent and cleanupConnection - Add 2 new tests for recursion guard (proxy + setState paths) https://claude.ai/code/session_01898rxEV1yuwvJZCHnYjjUs
MarcosBrendonDePaula
pushed a commit
that referenced
this pull request
Feb 27, 2026
- onAction cancellation no longer emits ERROR to client (info leak)
- setState skips emit/hooks when values are unchanged (parity with proxy)
- Silent catch {} replaced with console.error in onStateChange, onRoomJoin, onRoomLeave
- Singleton broadcast now includes userId and room metadata
- Add onClientJoin/onClientLeave lifecycle hooks for singletons
- Singleton onDisconnect only fires when last client leaves
- New hooks added to BLOCKED_ACTIONS for security
- 19 regression tests covering all fixed bugs
https://claude.ai/code/session_01JEtihEZe9cThDAadXAp3Rp
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR improves the reliability and safety of LiveComponent singleton broadcasting and state management by fixing connection tracking, preventing infinite recursion in state change hooks, and enhancing error handling.
Key Changes
Singleton Connection Management
ws-${Date.now()}tows-${Date.now()}-${Math.random().toString(36).slice(2, 8)}to prevent collisions when multiple connections are created in rapid successionremoveSingletonConnection()helper method to centralize singleton lifecycle logic across unmount and disconnect handlers, reducing code duplicationEmit Override Mechanism
_setEmitOverride()to Symbol-keyed propertyEMIT_OVERRIDE_KEYto prevent accidental userland access while maintaining internal functionalityState Change Recursion Guard
_inStateChangeguard flag to prevent infinite recursion whenonStateChange()hook modifies state or callssetState()setState()methodsetState()callsError Handling
onMount()fails during both initial mount and rehydration, improving debugging visibilityClient-Side Optimization
faviconUrlCacheto prevent recreating blob URLs on every navigation, reducing memory churn from repeatedURL.createObjectURL()callsURL.revokeObjectURL()from effect cleanup since cached URLs are reused across navigationsSecurity
publicActionsblocklist to prevent client-side calls to_inStateChangeand other internal methodshttps://claude.ai/code/session_01898rxEV1yuwvJZCHnYjjUs