Summary

• Guard ws.send() and ws.close() in WebSocketManager.checkClients() with readyState checks and try-catch to prevent unhandled EPIPE exceptions when the underlying socket pipe is broken
• Fall back to ws.terminate() when graceful close fails
• Apply the same defensive pattern to the heartbeat-timeout path and message-handler error response

Sentry Issue

• ELECTRON-78 — Error: write EPIPE in WebSocketManager.checkClients (816 occurrences, ongoing)
• Culprit: ws.send() called on a broken socket during token expiry handling without readyState guard or error handling

Root Cause

checkClients() sends an auth-expired message via ws.send() and then calls ws.close() without checking ws.readyState or wrapping in try-catch. When the client's socket pipe is already broken (common on low-resource Linux machines), this throws an unhandled EPIPE. Other methods like sendHeartbeat() and validateConnection() already had similar guards.

Test Plan

• Unit test: EPIPE on ws.send() during auth-expired → falls back to ws.terminate()
• Unit test: EPIPE on ws.close() during heartbeat timeout → falls back to ws.terminate()
• Unit test: skip ws.send() when readyState !== OPEN for expired token
• bun run test passes
• bunx tsc --noEmit passes
• bun run lint:fix clean
• bun run format clean