skills/websocket-realtime-expert/SKILL.md
WebSockets, SSE, and real-time communication with Socket.io and native APIs. Activate on: WebSocket, real-time, SSE, Socket.io, live updates, push notifications, bidirectional, presence. NOT for: message queue infrastructure (use event-driven-architecture-expert), API gateway routing (use api-gateway-reverse-proxy-expert).
npx skillsauth add curiositech/windags-skills websocket-realtime-expertInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Build reliable real-time communication systems using WebSockets, Server-Sent Events, and managed real-time services.
Activate on: "WebSocket", "real-time", "SSE", "Socket.io", "live updates", "push notifications", "bidirectional", "presence", "live cursors", "collaborative editing"
NOT for: Message queue setup → event-driven-architecture-expert | Gateway WebSocket routing → api-gateway-reverse-proxy-expert | Streaming data pipelines → streaming-pipeline-architect
type discriminator and monotonic sequence IDs| Domain | Technologies | |--------|-------------| | WebSocket | ws (Node), Socket.io 4.8+, uWebSockets.js | | SSE | Native EventSource, @microsoft/fetch-event-source | | Managed | Supabase Realtime, Ably, Pusher, PartyKit | | Scaling | Redis Pub/Sub, NATS, @socket.io/redis-adapter | | Protocols | WebSocket (RFC 6455), SSE, WebTransport (HTTP/3) |
Client A ──ws──→ Server 1 ←──redis pub/sub──→ Server 2 ←──ws── Client B
│ │
└─────── Redis Cluster ───────┘
Each server subscribes to channels. When Server 1 receives a message
for a room, it publishes to Redis. Server 2 picks it up and forwards
to its connected clients.
// Server: SSE endpoint with resume support
app.get('/events', (req, res) => {
res.writeHead(200, {
'Content-Type': 'text/event-stream',
'Cache-Control': 'no-cache',
'Connection': 'keep-alive',
});
const lastId = parseInt(req.headers['last-event-id'] || '0');
// Replay missed events from store
const missed = eventStore.since(lastId);
missed.forEach(evt => {
res.write(`id: ${evt.id}\nevent: ${evt.type}\ndata: ${JSON.stringify(evt.data)}\n\n`);
});
// Subscribe to new events
const unsub = eventBus.subscribe(evt => {
res.write(`id: ${evt.id}\nevent: ${evt.type}\ndata: ${JSON.stringify(evt.data)}\n\n`);
});
req.on('close', unsub);
});
// Client sends heartbeat every 15s
const HEARTBEAT_INTERVAL = 15_000;
const PRESENCE_TIMEOUT = 45_000; // 3 missed heartbeats = offline
// Server tracks presence
const presence = new Map<string, { userId: string; lastSeen: number }>();
ws.on('message', (msg) => {
const { type, userId } = JSON.parse(msg);
if (type === 'heartbeat') {
presence.set(userId, { userId, lastSeen: Date.now() });
}
});
// Sweep stale presence every 10s
setInterval(() => {
const cutoff = Date.now() - PRESENCE_TIMEOUT;
for (const [id, p] of presence) {
if (p.lastSeen < cutoff) {
presence.delete(id);
broadcast({ type: 'presence:leave', userId: id });
}
}
}, 10_000);
type discriminatortools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.