Fix WebSocket connections through exposed ports

[ghostwriternr]

WebSocket upgrade requests through exposed sandbox ports were failing during the connection handshake. The routing layer was not correctly handling the WebSocket protocol upgrade.

This fixes the routing to support WebSocket connections to services running in sandboxes.

[changeset-bot]

🦋 Changeset detected

Latest commit: 49ddec4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudflare/sandbox	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[claude]

Claude Code Review

Summary: This PR correctly implements WebSocket support for exposed sandbox ports. The implementation properly detects WebSocket upgrade headers and routes them through the Container's native fetch path instead of JSRPC, which cannot handle WebSocket upgrades.

Code Quality:

• Core implementation is solid: WebSocket detection in both request-handler.ts:74-79 and sandbox.ts:241-249 correctly uses case-insensitive header matching
• Proper routing through super.fetch() bypasses JSRPC serialization boundary
• Uses switchPort() helper to set the target port header in request-handler.ts:79
• Test coverage is comprehensive with unit tests and E2E validation
• Security maintained: Token validation occurs before routing decision

Minor observation: The await keywords in return statements (lines 79 and 108 of request-handler.ts) are technically unnecessary but don't cause issues.

Architecture Alignment: Follows the three-layer architecture correctly. Changeset properly documents the fix as a patch.

Verdict: LGTM - Ready to merge.

[riderx]

@whoiskatrin that mean the websocket is ready?

[whoiskatrin]

@whoiskatrin that mean the websocket is ready?

Half way there, there will be another PR in the next few days.

[riderx]

Lovely !