@ai-ecoverse/slicc-kernel 1.149.1 → 1.150.1

package/README.md

@@ -511,7 +511,8 @@ The module's default export (or its `main` export) is called with a context and
       - `requestCert` needs `ca` (the roots a client certificate must reach; else `EINVAL`). With it the handshake fails without a client certificate that verifies, unless `rejectUnauthorized: false`, which only asks for one and reports the verdict.
       - A connection's `tls` is `{ path: 'kernel', protocol, alpnProtocol, servername (the SNI the client sent, or ''), authorized (whether a client certificate verified), authorizationError?, peerCertificates (the client's chain) }`.
       - On a `listen({ tls })` listener, the kernel handshakes accepted connections concurrently, from the first `accept` on, and `accept` (and `for await`) yields each as its handshake finishes, so a client that connects and stays silent doesn't hold up the next. It holds at most `backlog` (up to 64) connections in a handshake or handshaken but not yet taken; beyond that it stops accepting, leaving the rest in the kernel's backlog, until one finishes or is taken. A connection whose handshake fails is closed and never yielded. `secure()` rejects instead.
-      - `handshakeTimeout` (milliseconds, 120000 by default, as Node's) ends a handshake that hasn't finished: the connection is closed with `ERR_TLS_HANDSHAKE_TIMEOUT`. A handshake, server or loopback client, waits without holding the program's other calls, and an aborted `accept({ signal })` or `connect({ signal })` ends it. A signal delivered to the program doesn't interrupt a handshake, as with `SA_RESTART`.
+      - `handshakeTimeout` (milliseconds, 120000 by default, as Node's) ends a handshake that hasn't finished with `ERR_TLS_HANDSHAKE_TIMEOUT`. A listener closes that connection. After `secure()` rejects, the connection stays open and is the program's to answer or close, as with Node's `tlsClientError` ([#1504](https://github.com/ai-ecoverse/slicc-kernel/issues/1504)).
+      - A client that sends a plain HTTP request instead of a ClientHello fails the handshake with `ERR_SSL_HTTP_REQUEST`, as in Node. A handshake, server or loopback client, waits without holding the program's other calls, and an aborted `accept({ signal })` or `connect({ signal })` ends it. A signal delivered to the program doesn't interrupt a handshake, as with `SA_RESTART`.
       - **The key:** the kernel hands it to the engine once per listener (once per `secure()` call) and wipes its own copies; the engine keeps its copy until the listener is closed, and not in errors, logs, `ps`, `/proc` or the page. A forked child that inherits the listener shares that one copy, and it's freed when the last process closes it. **The program's own `key` string or `Buffer` stays in its realm**: JavaScript strings can't be wiped, so the kernel can't erase what the program holds.
     - **Sealed values in an A2 session** ([#1090](https://github.com/ai-ecoverse/slicc-kernel/issues/1090)) are substituted only at a credential position, only in a session the kernel verified itself (by its bundled roots, or by a vault anchor), and only as the vault allows. `substitutes` means the session **may** substitute: a placeholder at a recognized position will be offered to the vault, and whether a value comes back is the vault's and the anchor check's decision. It's true when all of these hold:
       - `verified` is true, or the engine can verify a chain on its own (wasm-tls-engine 4.2.0-5's `tls_chain_verify`) and the server name isn't an IP literal, so a vault anchor may verify the session (below);
@@ -555,7 +556,7 @@ The module's default export (or its `main` export) is called with a context and
         - a head with placeholders in two header lines;
         - later requests on the same connection;
         - anything once the head passes 16 KiB, or once the program pauses for 2 s in the middle of it;
-      - **What's read back:** once a process has had a value substituted for a host, everything its whole process tree reads from any A2 session to that host is scrubbed: the process itself, its ancestors and every descendant (forked, spawned or exec'd, before or after the substitution; a forked child's own new session included) with [slicc-scrub](https://github.com/ai-ecoverse/slicc-scrub), as S2 does: the value comes back as its placeholder, and a fragment or an encoded form (JSON, percent, HTML, base64, hex) as `[redacted:sealed]`. The scrub stays until the whole tree has ended. A process outside the tree isn't covered. A value shorter than 8 bytes is never substituted, as it couldn't be scrubbed.
+      - **What's read back:** once a process has had a value substituted for a host, everything its whole process tree reads from any A2 session to that host is scrubbed: the process itself, its ancestors and every descendant (forked, spawned or exec'd, before or after the substitution; a forked child's own new session included) with [slicc-scrub](https://github.com/ai-ecoverse/slicc-scrub), in every form S2 matches (the value, a fragment, JSON, percent, HTML, base64, hex, wrapped). Unlike S2, each match comes back as filler of exactly its own length: every byte `*`, CR and LF kept ([#1509](https://github.com/ai-ecoverse/slicc-kernel/issues/1509), slicc-scrub's `sameLength`). So the session's framing still holds where a server reflects a value (an HTTP `Content-Length` or chunk size, a pg message length, a WebSocket frame), and the filler shows only the match's length, which the framing shows anyway, and where a value with line breaks has them. The scrub stays until the whole tree has ended. A process outside the tree isn't covered. A value shorter than 8 bytes is never substituted, as it couldn't be scrubbed.
       - **The bound:** the server the value goes to is the one the vault rule names, verified against the kernel's own roots. Substitution trusts that server not to reflect the value back in a form the scrub doesn't know (encrypted under a key the program chose, say). That's the same residual as A1's.
       - **Elsewhere:** a placeholder written into any other A2 session reaches the server as written. It isn't the secret, so nothing leaks.
     - **Limits:** no revocation checking (neither OCSP nor CRLs, as with Node's default), no session resumption, and the clock is the page's `Date.now()`.
@@ -1098,7 +1099,7 @@ The kernel then asks the hook `{ v: 1, op: 'materializeConsume', ticket, stamp,
 - `interpreters` is the chain of `#!` and `binfmt` interpreters the kernel will really run, outermost first, each absolute with its symlinks resolved, and empty for a program of the catalog (Emscripten, WASI or JS) and the `/usr/bin/<name>` entries for one. A plain `#!/usr/bin/env X` (or `env -S X …`) is reported as `X`: a command of the catalog as `/usr/bin/X`, a script command by its file. `env` with any other option or a `NAME=value` assignment is run and reported as `/usr/bin/env` itself;
 - `trusted` is true when the program and every interpreter are regular files owned by root and not writable by group or others, under directories that are all the same, up to `/` (for a command of the catalog, its package files). It's false unless `users` is `'enforce'`: under `'off'` files have no owners, and under `'report'` owners don't stop a write. The reply must be `{ values, placeholders }` (string maps) within 10 s; anything else is `EACCES`. Each variable of the child's environment whose value is exactly `placeholders[NAME]` gets `values[NAME]`; nothing else changes. The kernel keeps no copy and logs nothing of either. Like any environment, the values are inherited by whatever the child itself spawns or execs, as on Linux. A ticket isn't carried across `sudo`, which builds its own environment: a `sudo` run with `SLICC_SEALED_TICKET` set fails with `EACCES`, and burns the ticket.
 
-**The child's output is scrubbed (S2).** The kernel compiles a [slicc-scrub](https://github.com/ai-ecoverse/slicc-scrub) scrubber (1.0.0, bundled; the published package has no runtime dependency) over exactly the values it swapped in, and gives the child new open file descriptions for fd 1 and fd 2, for every other descriptor it holds on the same descriptions (a `dup` of them), and for every descriptor on a terminal (fd 0 of a terminal session is one), that pass every write through it into the originals (one wrapper per original description, so `2>&1` keeps its order). A value appears as its placeholder, and a fragment or encoded form of it (JSON, percent, HTML, base64, hex, wrapped) as `[redacted:NAME]`. Bytes go through at once unless they may still be the start of a match; such a tail is let out after 50 ms without a write when it's shorter than 16 bytes, and otherwise at the next write or at close. The child's descendants inherit the scrubbed descriptions through fork, spawn, exec and `dup`, and a descendant that opens its controlling terminal (`/dev/tty`, or a terminal by name) gets one scrubbed too, as does a pseudo-terminal slave (`/dev/pts/N`) or [`/dev/clipboard`](#devclipboard) it opens, and a `/dev/clipboard` descriptor it inherited is wrapped at the redeem like fd 1 and 2, so the page's clipboard gets placeholders, never the values. Files, sockets and pipes the child or a descendant opens itself are not scrubbed, so `printf %s "$T" > f` writes the value. A scrubbed fd 1 or 2 is a stream: it doesn't seek. Under `O_NONBLOCK` it gives `EAGAIN` when the pipe or terminal under it would. A write that finds room returns at once, taking at most 64 KiB, and the scrubbed bytes the file couldn't take yet go out before anything written later. Until they have, `poll` reports it unwritable and a nonblocking write gets `EAGAIN`, taking nothing. A blocking write that waits for them, or for room, ends with `EINTR` at a signal, taking nothing; one interrupted after it began writing returns its whole count, and the rest follows. A descendant that redeems a ticket of its own adds its values: its output is scrubbed for both sets. A value under 8 bytes is swapped but can't be scrubbed. The scrubber goes when the last process and description holding it do.
+**The child's output is scrubbed (S2).** The kernel compiles a [slicc-scrub](https://github.com/ai-ecoverse/slicc-scrub) scrubber (1.1.0, bundled; the published package has no runtime dependency) over exactly the values it swapped in, and gives the child new open file descriptions for fd 1 and fd 2, for every other descriptor it holds on the same descriptions (a `dup` of them), and for every descriptor on a terminal (fd 0 of a terminal session is one), that pass every write through it into the originals (one wrapper per original description, so `2>&1` keeps its order). A value appears as its placeholder, and a fragment or encoded form of it (JSON, percent, HTML, base64, hex, wrapped) as `[redacted:NAME]`. Bytes go through at once unless they may still be the start of a match; such a tail is let out after 50 ms without a write when it's shorter than 16 bytes, and otherwise at the next write or at close. The child's descendants inherit the scrubbed descriptions through fork, spawn, exec and `dup`, and a descendant that opens its controlling terminal (`/dev/tty`, or a terminal by name) gets one scrubbed too, as does a pseudo-terminal slave (`/dev/pts/N`) or [`/dev/clipboard`](#devclipboard) it opens, and a `/dev/clipboard` descriptor it inherited is wrapped at the redeem like fd 1 and 2, so the page's clipboard gets placeholders, never the values. Files, sockets and pipes the child or a descendant opens itself are not scrubbed, so `printf %s "$T" > f` writes the value. A scrubbed fd 1 or 2 is a stream: it doesn't seek. Under `O_NONBLOCK` it gives `EAGAIN` when the pipe or terminal under it would. A write that finds room returns at once, taking at most 64 KiB, and the scrubbed bytes the file couldn't take yet go out before anything written later. Until they have, `poll` reports it unwritable and a nonblocking write gets `EAGAIN`, taking nothing. A blocking write that waits for them, or for room, ends with `EINTR` at a signal, taking nothing; one interrupted after it began writing returns its whole count, and the rest follows. A descendant that redeems a ticket of its own adds its values: its output is scrubbed for both sets. A value under 8 bytes is swapped but can't be scrubbed. The scrubber goes when the last process and description holding it do.
 
 **A2 sessions (`sessionMaterialize`, [#1090](https://github.com/ai-ecoverse/slicc-kernel/issues/1090)).** For a kernel-terminated TLS session (see **Sealed values in an A2 session** under JS programs' `ctx.net`), the kernel asks the hook `{ v: 1, op: 'sessionMaterialize', caller, stamp, session, host, port, protocol, position, verified, handshakeAt, exit, placeholders, head? }` (slicc-vault 1.10.0, Sessions), once per session:
 - `stamp` (also `caller`) is the stamp of the process that owns the socket; `session` the kernel's id for it (16 to 128 of `A-Za-z0-9_-`); `host` the name the leaf was verified against, lower-cased without a trailing dot; `handshakeAt` when the handshake finished (epoch ms); `exit` the exit the session leaves by, as the uplink reported it (`tailscale` or `device:<id>`, the id of `[A-Za-z0-9._:-]`);

package/dist/kernel-worker.js

@@ -5100,12 +5100,12 @@ var KernelPipe = class {
       await this.changed(signal);
     }
     const out = new Uint8Array(Math.min(max, this.size));
-    let filled = 0;
+    let filled2 = 0;
     for (const chunk2 of this.chunks) {
-      if (filled === out.length) break;
-      const count2 = Math.min(chunk2.length, out.length - filled);
-      out.set(chunk2.subarray(0, count2), filled);
-      filled += count2;
+      if (filled2 === out.length) break;
+      const count2 = Math.min(chunk2.length, out.length - filled2);
+      out.set(chunk2.subarray(0, count2), filled2);
+      filled2 += count2;
     }
     return out;
   }
@@ -5133,12 +5133,12 @@ var KernelPipe = class {
   }
   take(n) {
     const out = new Uint8Array(n);
-    let filled = 0;
-    while (filled < n) {
+    let filled2 = 0;
+    while (filled2 < n) {
       const head = this.chunks[0];
-      const count2 = Math.min(head.length, n - filled);
-      out.set(head.subarray(0, count2), filled);
-      filled += count2;
+      const count2 = Math.min(head.length, n - filled2);
+      out.set(head.subarray(0, count2), filled2);
+      filled2 += count2;
       if (count2 === head.length) this.chunks.shift();
       else this.chunks[0] = head.subarray(count2);
     }
@@ -5903,8 +5903,8 @@ var DIAL_ERRORS = [
   "ETIMEDOUT",
   "ECONNRESET"
 ];
-function dialError(e, timedOut, closed) {
-  if (timedOut) return new KernelError("ETIMEDOUT");
+function dialError(e, timedOut2, closed) {
+  if (timedOut2) return new KernelError("ETIMEDOUT");
   if (closed) return new KernelError("ECONNABORTED");
   const code = e?.code;
   const known = DIAL_ERRORS.find((errno3) => errno3 === code);
@@ -6159,7 +6159,7 @@ var KernelSocket = class _KernelSocket {
   get loopbackLinked() {
     return this.state === "connected" && !this.switch;
   }
-  async secureLink(make, signal = NEVER_ABORTED) {
+  async secureLink(make, signal = NEVER_ABORTED, keeps = () => false) {
     const raw2 = this.connection();
     if (this.switch || this.served || this.writeShut || this.readShut)
       throw new KernelError("EINVAL");
@@ -6181,14 +6181,18 @@ var KernelSocket = class _KernelSocket {
       }
     };
     let made2;
-    const abandon = () => view2.close();
+    const abandon = () => {
+      if (!keeps(signal.reason)) view2.close();
+    };
     signal.addEventListener("abort", abandon, { once: true });
     try {
       made2 = await make(view2);
     } catch (err) {
-      view2.close();
-      this.readShut = true;
-      this.writeShut = true;
+      if (!(signal.aborted && keeps(signal.reason))) {
+        view2.close();
+        this.readShut = true;
+        this.writeShut = true;
+      }
       this.changes.wake();
       throw signal.aborted ? signal.reason : err;
     } finally {
@@ -6212,9 +6216,9 @@ var KernelSocket = class _KernelSocket {
     this.state = "connecting";
     const abort = new AbortController();
     this.dialing = abort;
-    let timedOut = false;
+    let timedOut2 = false;
     const timer = setTimeout(() => {
-      timedOut = true;
+      timedOut2 = true;
       abort.abort(new KernelError("ETIMEDOUT"));
     }, route2.timeoutMs ?? DIAL_TIMEOUT_MS);
     const abandoned = new Promise((_, reject) => {
@@ -6230,7 +6234,7 @@ var KernelSocket = class _KernelSocket {
     );
     return Promise.race([dialled, abandoned]).then(
       async (raw2) => {
-        if (abort.signal.aborted) throw dialError(abort.signal.reason, timedOut, true);
+        if (abort.signal.aborted) throw dialError(abort.signal.reason, timedOut2, true);
         const conn = new SwitchConn(raw2);
         if (secure2) {
           clearTimeout(timer);
@@ -6256,7 +6260,7 @@ var KernelSocket = class _KernelSocket {
         );
       },
       (e) => {
-        throw this.dialFailed(abort, dialError(e, timedOut, abort.signal.aborted));
+        throw this.dialFailed(abort, dialError(e, timedOut2, abort.signal.aborted));
       }
     ).finally(() => clearTimeout(timer));
   }
@@ -6841,7 +6845,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
       deadline: () => AbortSignal.timeout(closeWaitMs).addEventListener("abort", late, { once: true })
     };
     credit.set(nid, flow);
-    const timedOut = { code: 1006, reason: "the far end did not answer the close" };
+    const timedOut2 = { code: 1006, reason: "the far end did not answer the close" };
     let oversize = false;
     try {
       const messages = socket.messages[Symbol.asyncIterator]();
@@ -6867,7 +6871,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
         }
       }
       if (oversize) socket.close(1e3, "a message is too big");
-      ending = oversize ? { code: 1009, reason: `a message is over ${MESSAGE_LIMIT} bytes` } : await Promise.race([socket.closed, unanswered.then(() => timedOut)]);
+      ending = oversize ? { code: 1009, reason: `a message is over ${MESSAGE_LIMIT} bytes` } : await Promise.race([socket.closed, unanswered.then(() => timedOut2)]);
     } catch (e) {
       socket.close(1e3, "the relay failed");
       ending = { code: 1011, reason: e instanceof Error ? e.message : String(e) };
@@ -7911,7 +7915,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.149.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.150.1" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -17711,8 +17715,8 @@ var HttpHandles = class {
         else entry.left = next3.value;
       } catch (e) {
         entry.done = true;
-        const timedOut = e?.code === "ETIMEDOUT";
-        return { ok: false, errno: timedOut ? "ETIMEDOUT" : "EIO", message: message2(e) };
+        const timedOut2 = e?.code === "ETIMEDOUT";
+        return { ok: false, errno: timedOut2 ? "ETIMEDOUT" : "EIO", message: message2(e) };
       }
     }
     const bytes = entry.left.subarray(0, Math.max(0, max));
@@ -18878,15 +18882,22 @@ async function tlsClient(conn, o, taken = new Uint8Array(0)) {
     throw err;
   }
 }
-async function serverHandshake(conn, session, inbox) {
+var HTTP_REQUEST = /^[A-Z]{3,10} [!-~]/;
+function serverRefusal(err, session, first) {
+  const opening2 = first ? new TextDecoder("latin1").decode(first.subarray(0, 16)) : "";
+  if (HTTP_REQUEST.test(opening2))
+    return new KernelError("EPROTO", "ERR_SSL_HTTP_REQUEST: http request");
+  const text = err instanceof TlsError ? err.message : String(err);
+  return new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
+}
+async function serverHandshake(conn, session, inbox, first) {
   for (; ; ) {
     let done5;
     try {
       done5 = session.handshake();
     } catch (err) {
       await send(conn, session).catch(() => void 0);
-      const text = err instanceof TlsError ? err.message : String(err);
-      throw new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
+      throw serverRefusal(err, session, first());
     }
     await send(conn, session);
     if (done5) return;
@@ -18899,9 +18910,18 @@ async function serverHandshake(conn, session, inbox) {
   }
 }
 async function tlsServer(conn, session, clientCerts) {
-  const inbox = new Ciphertext(conn, session);
+  let first;
+  const watched = {
+    ...conn,
+    read: async () => {
+      const bytes = await conn.read();
+      first ??= bytes ?? void 0;
+      return bytes;
+    }
+  };
+  const inbox = new Ciphertext(watched, session);
   try {
-    await serverHandshake(conn, session, inbox);
+    await serverHandshake(conn, session, inbox, () => first);
     const chain2 = session.peerChain();
     const code = clientCerts ? verifyCode(session.verifyResult) : void 0;
     const info = {
@@ -19371,6 +19391,7 @@ var RANK = {
 var CR2 = 13;
 var LF2 = 10;
 var EMPTY4 = new Uint8Array(0);
+var FILLER = 42;
 function register(automaton, sources, ids, bytes, source) {
   const key = Array.from(bytes).join(",");
   let id2 = ids.get(key);
@@ -19381,7 +19402,7 @@ function register(automaton, sources, ids, bytes, source) {
   }
   sources[id2].push(source);
 }
-function prepare(secrets) {
+function prepare(secrets, sameLength) {
   const main = new Automaton();
   const wrap = new Automaton();
   const sources = [];
@@ -19405,7 +19426,19 @@ function prepare(secrets) {
     utf82(secret.placeholder),
     utf82(`[redacted:${secret.name}]`)
   ]);
-  return { secrets, values, main, wrap, sources, wrapSources, replacements };
+  return { secrets, values, main, wrap, sources, wrapSources, replacements, sameLength };
+}
+function filled(input, start2, end) {
+  const out = new Uint8Array(end - start2);
+  for (let i = start2; i < end; i++) {
+    const byte = input[i];
+    out[i - start2] = byte === CR2 || byte === LF2 ? byte : FILLER;
+  }
+  return out;
+}
+function replacement(c, input, candidate) {
+  if (c.sameLength) return filled(input, candidate.start, candidate.end);
+  return c.replacements[candidate.secret][candidate.form === "raw" ? 0 : 1];
 }
 function better(a, b) {
   if (!b) return true;
@@ -19514,10 +19547,7 @@ function pass(c, input, final) {
       break;
     }
     const candidate = best.get(next3);
-    parts2.push(
-      input.subarray(pos, next3),
-      c.replacements[candidate.secret][candidate.form === "raw" ? 0 : 1]
-    );
+    parts2.push(input.subarray(pos, next3), replacement(c, input, candidate));
     count(c, hits, candidate);
     pos = candidate.end;
   }
@@ -19532,7 +19562,10 @@ function merge(into, from) {
   }
 }
 function compile(secrets, options = {}) {
-  const c = prepare(secrets.map((secret) => ({ ...secret })));
+  const c = prepare(
+    secrets.map((secret) => ({ ...secret })),
+    options.sameLength === true
+  );
   const decoder4 = new TextDecoder();
   const idleMs = options.idleMs ?? 250;
   const scrubBytes = (input) => {
@@ -19586,9 +19619,9 @@ function compile(secrets, options = {}) {
 var SCRUB_IDLE_MS = 50;
 var SCRUB_NONBLOCK_MAX = 64 * 1024;
 var encoder6 = new TextEncoder();
-function scrubberOf(secrets) {
+function scrubberOf(secrets, sameLength = false) {
   const usable2 = secrets.filter((s) => encoder6.encode(s.value).length >= MIN_VALUE);
-  return usable2.length > 0 ? compile(usable2, { idleMs: SCRUB_IDLE_MS }) : void 0;
+  return usable2.length > 0 ? compile(usable2, { idleMs: SCRUB_IDLE_MS, sameLength }) : void 0;
 }
 async function writeAll3(file, bytes) {
   const write = file.write;
@@ -19776,7 +19809,7 @@ function addTo(tree2, host, secrets) {
 function scrubOf(tree2, host) {
   const entry = tree2?.get(host);
   if (!entry) return void 0;
-  entry.scrubber ??= scrubberOf(entry.secrets);
+  entry.scrubber ??= scrubberOf(entry.secrets, true);
   return entry.scrubber ? { version: entry.version, scrubber: entry.scrubber } : void 0;
 }
 var SessionScrubs = class {
@@ -22105,12 +22138,10 @@ function timeoutOf(req) {
     );
   return ms;
 }
+var timedOut = new KernelError("EPROTO", "ERR_TLS_HANDSHAKE_TIMEOUT: TLS handshake timeout");
 function handshakeSignal(proc, ms) {
   const timer = new AbortController();
-  const id2 = setTimeout(
-    () => timer.abort(new KernelError("EPROTO", "ERR_TLS_HANDSHAKE_TIMEOUT: TLS handshake timeout")),
-    ms
-  );
+  const id2 = setTimeout(() => timer.abort(timedOut), ms);
   return {
     signal: AbortSignal.any([handshakeAbort(proc), timer.signal]),
     done: () => clearTimeout(id2)
@@ -22168,7 +22199,8 @@ async function serveSecure(proc, socket, req) {
     const limit = handshakeSignal(proc, server.timeoutMs);
     const info = await socket.secureLink(
       (raw2) => tlsServer(raw2, engine.serverSession(leaf, alpn, store, flags2), flags2 !== 0),
-      limit.signal
+      limit.signal,
+      (reason) => !shared && reason === timedOut
     ).finally(limit.done);
     return {
       path: "kernel",