@ai-ecoverse/slicc-kernel 1.37.1 → 1.39.1

package/dist/kernel-worker.js

@@ -2032,9 +2032,80 @@ var SIGNAL_BY_NAME = {
 // src/body-idle.ts
 var BODY_IDLE_MS = 5 * 60 * 1e3;
 
+// src/kernel/net/ws-queue.ts
+var INBOUND_LIMIT = 16 * 1024 * 1024;
+var MESSAGE_LIMIT = 64 * 1024 * 1024;
+var TOO_BIG = 1009;
+function payloadSize(message2) {
+  return typeof message2 === "string" ? new TextEncoder().encode(message2).length : message2.length;
+}
+var MessageQueue = class {
+  items = [];
+  limit;
+  waiter;
+  size = 0;
+  ended = false;
+  overflow;
+  taken;
+  closed;
+  settle;
+  constructor(overflow, limit = INBOUND_LIMIT, taken) {
+    this.overflow = overflow;
+    this.limit = limit;
+    this.taken = taken;
+    this.closed = new Promise((resolve) => {
+      this.settle = resolve;
+    });
+  }
+  push(message2) {
+    if (this.ended) return;
+    const size = payloadSize(message2);
+    const huge = size > MESSAGE_LIMIT;
+    if (huge || this.items.length > 0 && this.size + size > this.limit) {
+      const reason = huge ? `a message is over ${MESSAGE_LIMIT} bytes` : `over ${this.limit} bytes of messages are waiting`;
+      this.end({ code: TOO_BIG, reason });
+      this.overflow();
+      return;
+    }
+    this.size += size;
+    this.items.push(message2);
+    this.wake();
+  }
+  end(close) {
+    if (this.ended) return;
+    this.ended = true;
+    this.settle(close);
+    this.wake();
+  }
+  wake() {
+    const waiter = this.waiter;
+    this.waiter = void 0;
+    waiter?.();
+  }
+  async *[Symbol.asyncIterator]() {
+    for (; ; ) {
+      const next = this.items.shift();
+      if (next !== void 0) {
+        const n = payloadSize(next);
+        this.size -= n;
+        this.taken?.(n);
+        yield next;
+        continue;
+      }
+      if (this.ended) return;
+      await new Promise((resolve) => {
+        this.waiter = resolve;
+      });
+    }
+  }
+};
+
 // src/transport.ts
+var SEND_BUFFER = 1024 * 1024;
+var CLOSE_WAIT_MS = 5e3;
+var NO_WEBSOCKET = "WebSocket not supported by this transport (fetchTransport needs { webSocket: true })";
 var MAX_REQUEST_BODY = 64 * 1024 * 1024;
-function serveTransport(peer, transport) {
+function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
   const open = /* @__PURE__ */ new Map();
   const fail = (nid, e) => {
     open.delete(nid);
@@ -2075,6 +2146,96 @@ function serveTransport(peer, transport) {
       fail(call.nid, e);
     }
   };
+  const sockets = /* @__PURE__ */ new Map();
+  const credit = /* @__PURE__ */ new Map();
+  const refill = (nid, n, closing = false) => {
+    const flow = credit.get(nid);
+    if (!flow) return;
+    flow.inflight -= n;
+    if (closing && !flow.closing) {
+      flow.closing = true;
+      flow.deadline();
+    }
+    flow.wake?.();
+  };
+  const openSocket = async (call) => {
+    const abort = new AbortController();
+    open.set(call.nid, { abort });
+    try {
+      if (!transport.websocket) throw new Error(NO_WEBSOCKET);
+      const socket = await transport.websocket({
+        url: call.url,
+        protocols: call.protocols,
+        headers: call.headers,
+        signal: abort.signal
+      });
+      if (!open.delete(call.nid)) {
+        socket.close(1e3, "cancelled");
+        return;
+      }
+      sockets.set(call.nid, socket);
+      peer.postMessage({ net: "ws-opened", nid: call.nid, protocol: socket.protocol });
+      void relay(call.nid, socket);
+    } catch (e) {
+      fail(call.nid, e);
+    }
+  };
+  const relay = async (nid, socket) => {
+    let ending;
+    let late;
+    const unanswered = new Promise((resolve) => {
+      late = () => resolve("late");
+    });
+    const flow = {
+      inflight: 0,
+      closing: false,
+      deadline: () => AbortSignal.timeout(closeWaitMs).addEventListener("abort", late, { once: true })
+    };
+    credit.set(nid, flow);
+    const timedOut = { code: 1006, reason: "the far end did not answer the close" };
+    let oversize = false;
+    try {
+      const messages = socket.messages[Symbol.asyncIterator]();
+      for (; ; ) {
+        const next = await Promise.race([messages.next(), unanswered]);
+        if (next === "late" || next.done) break;
+        const data = next.value;
+        if (flow.closing) continue;
+        if (payloadSize(data) > MESSAGE_LIMIT) {
+          oversize = true;
+          break;
+        }
+        if (typeof data === "string") peer.postMessage({ net: "ws-message", nid, data });
+        else {
+          const bytes = data.slice();
+          peer.postMessage({ net: "ws-message", nid, data: bytes }, [bytes.buffer]);
+        }
+        flow.inflight += payloadSize(data);
+        while (flow.inflight > INBOUND_LIMIT && !flow.closing) {
+          await new Promise((resolve) => {
+            flow.wake = resolve;
+          });
+        }
+      }
+      if (oversize) socket.close(1e3, "a message is too big");
+      ending = oversize ? { code: 1009, reason: `a message is over ${MESSAGE_LIMIT} bytes` } : await Promise.race([socket.closed, unanswered.then(() => timedOut)]);
+    } catch (e) {
+      socket.close(1e3, "the relay failed");
+      ending = { code: 1011, reason: e instanceof Error ? e.message : String(e) };
+    }
+    sockets.delete(nid);
+    credit.delete(nid);
+    peer.postMessage({ net: "ws-closed", nid, ...ending });
+  };
+  const sendOn = async (call) => {
+    const socket = sockets.get(call.nid);
+    if (!socket) return;
+    socket.send(call.data);
+    while (socket.buffered > SEND_BUFFER && sockets.has(call.nid)) {
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+    peer.postMessage({ net: "ws-acked", nid: call.nid, n: payloadSize(call.data) });
+  };
   const read = async (nid) => {
     const body = open.get(nid)?.body;
     if (!body) return;
@@ -2092,6 +2253,8 @@ function serveTransport(peer, transport) {
     }
   };
   const drop = (nid) => {
+    sockets.get(nid)?.close(1e3, "cancelled");
+    refill(nid, 0, true);
     const entry = open.get(nid);
     open.delete(nid);
     entry?.abort.abort();
@@ -2101,10 +2264,16 @@ function serveTransport(peer, transport) {
     answer(call) {
       if (call.net === "fetch") void start(call);
       else if (call.net === "read") void read(call.nid);
+      else if (call.net === "ws-open") void openSocket(call);
+      else if (call.net === "ws-send") void sendOn(call);
+      else if (call.net === "ws-close") {
+        sockets.get(call.nid)?.close(call.code, call.reason);
+        refill(call.nid, 0, true);
+      } else if (call.net === "ws-consumed") refill(call.nid, call.n);
       else drop(call.nid);
     },
     close() {
-      for (const nid of [...open.keys()]) drop(nid);
+      for (const nid of [...open.keys(), ...sockets.keys()]) drop(nid);
     }
   };
 }
@@ -2494,6 +2663,10 @@ var Incoming = class {
     this.buf = this.buf.subarray(n);
     return out;
   }
+  async peek(signal) {
+    if (this.buf.length === 0) await this.fill(signal);
+    return this.buf[0];
+  }
   async some(max, signal) {
     if (this.buf.length > 0) return this.take(Math.min(max, this.buf.length));
     if (this.eof) return new Uint8Array(0);
@@ -2675,13 +2848,219 @@ function chunk(bytes) {
 }
 var LAST_CHUNK = latin1Bytes("0\r\n\r\n");
 
+// src/cdp/websocket.ts
+var GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+var MAX_MESSAGE = 256 * 1024 * 1024;
+var CLOSE = {
+  normal: 1e3,
+  protocol: 1002,
+  unsupported: 1003,
+  invalid: 1007,
+  tooBig: 1009,
+  error: 1011
+};
+var OP_TEXT = 1;
+var OP_BINARY = 2;
+var OP = {
+  continuation: 0,
+  text: OP_TEXT,
+  binary: OP_BINARY,
+  close: 8,
+  ping: 9,
+  pong: 10
+};
+var WsError = class extends Error {
+  code;
+  constructor(code, message2) {
+    super(message2);
+    this.code = code;
+  }
+};
+function sendableCode(code) {
+  if (code >= 3e3 && code <= 4999) return true;
+  return code >= 1e3 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006;
+}
+function field(headers, name2) {
+  return headers.find(([n]) => n.toLowerCase() === name2)?.[1];
+}
+async function acceptKey(headers) {
+  const tokens = (name2) => (field(headers, name2) ?? "").split(",").map((t) => t.trim().toLowerCase());
+  if (!tokens("upgrade").includes("websocket") || !tokens("connection").includes("upgrade")) {
+    throw new HttpError(400, "expected a WebSocket upgrade");
+  }
+  if (field(headers, "sec-websocket-version") !== "13") {
+    throw new HttpError(400, "Sec-WebSocket-Version must be 13");
+  }
+  const key = field(headers, "sec-websocket-key") ?? "";
+  if (!/^[A-Za-z0-9+/]{22}==$/.test(key)) throw new HttpError(400, "bad Sec-WebSocket-Key");
+  const digest = await crypto.subtle.digest("SHA-1", new TextEncoder().encode(key + GUID));
+  return btoa(String.fromCharCode(...new Uint8Array(digest)));
+}
+function isUpgrade(headers) {
+  return (field(headers, "upgrade") ?? "").toLowerCase().includes("websocket");
+}
+function frame(opcode, payload) {
+  const n = payload.length;
+  const size = n < 126 ? 2 : n < 65536 ? 4 : 10;
+  const out = new Uint8Array(size + n);
+  const view = new DataView(out.buffer);
+  out[0] = 128 | opcode;
+  if (n < 126) out[1] = n;
+  else if (n < 65536) {
+    out[1] = 126;
+    view.setUint16(2, n);
+  } else {
+    out[1] = 127;
+    view.setBigUint64(2, BigInt(n));
+  }
+  out.set(payload, size);
+  return out;
+}
+function closeFrame(code, reason = "") {
+  let bytes = new TextEncoder().encode(reason);
+  if (bytes.length > 123) {
+    let end = 123;
+    while ((bytes[end] & 192) === 128) end--;
+    bytes = bytes.subarray(0, end);
+  }
+  const payload = new Uint8Array(2 + bytes.length);
+  new DataView(payload.buffer).setUint16(0, code);
+  payload.set(bytes, 2);
+  return frame(OP.close, payload);
+}
+function pongFrame(payload) {
+  return frame(OP.pong, payload);
+}
+async function fill(incoming, out, signal) {
+  for (let at = 0; at < out.length; ) {
+    const piece = await incoming.some(out.length - at, signal);
+    if (piece.length === 0) throw new WsError(CLOSE.protocol, "the connection closed mid-frame");
+    out.set(piece, at);
+    at += piece.length;
+  }
+}
+var fatal = new TextDecoder("utf-8", { fatal: true });
+function decode(bytes) {
+  try {
+    return fatal.decode(bytes);
+  } catch {
+    throw new WsError(CLOSE.invalid, "a text message is not UTF-8");
+  }
+}
+var WsReader = class {
+  incoming;
+  max;
+  parts = [];
+  size = 0;
+  continuing = false;
+  binaryMessage = false;
+  binary;
+  constructor(incoming, max = MAX_MESSAGE, binary) {
+    this.incoming = incoming;
+    this.max = max;
+    this.binary = binary;
+  }
+  async next(signal) {
+    for (; ; ) {
+      const first = await this.incoming.some(1, signal);
+      if (first.length === 0) return null;
+      const head = new Uint8Array(2);
+      head[0] = first[0];
+      await fill(this.incoming, head.subarray(1), signal);
+      const fin = (head[0] & 128) !== 0;
+      const opcode = head[0] & 15;
+      if ((head[0] & 112) !== 0) throw new WsError(CLOSE.protocol, "reserved bits are set");
+      if ((head[1] & 128) === 0) throw new WsError(CLOSE.protocol, "client frames must be masked");
+      const length2 = await this.length(head[1] & 127, signal);
+      const control = opcode >= 8;
+      if (control && (length2 > 125 || !fin)) {
+        throw new WsError(CLOSE.protocol, "a control frame is too long or fragmented");
+      }
+      if (!control && this.size + length2 > this.max) {
+        throw new WsError(CLOSE.tooBig, `a message is over ${this.max} bytes`);
+      }
+      const mask = new Uint8Array(4);
+      await fill(this.incoming, mask, signal);
+      const payload = new Uint8Array(length2);
+      await fill(this.incoming, payload, signal);
+      for (let i = 0; i < length2; i++) payload[i] ^= mask[i & 3];
+      const event = this.take(opcode, fin, payload);
+      if (event) return event;
+    }
+  }
+  data(opcode, fin, payload) {
+    if (opcode === OP.continuation !== this.continuing) {
+      throw new WsError(CLOSE.protocol, "unexpected continuation frame");
+    }
+    if (opcode !== OP.continuation) this.binaryMessage = opcode === OP.binary;
+    this.parts.push(payload);
+    this.size += payload.length;
+    this.continuing = !fin;
+    if (!fin) return void 0;
+    const whole = this.parts.length === 1 ? payload : concat(this.parts, this.size);
+    this.parts = [];
+    this.size = 0;
+    return this.binaryMessage ? { kind: "binary", bytes: whole } : { kind: "text", text: decode(whole) };
+  }
+  async length(short, signal) {
+    if (short < 126) return short;
+    const ext = new Uint8Array(short === 126 ? 2 : 8);
+    await fill(this.incoming, ext, signal);
+    const view = new DataView(ext.buffer);
+    if (short === 126) return view.getUint16(0);
+    const long = view.getBigUint64(0);
+    return long > BigInt(this.max) ? this.max + 1 : Number(long);
+  }
+  take(opcode, fin, payload) {
+    switch (opcode) {
+      case OP.ping:
+        return { kind: "ping", payload };
+      case OP.pong:
+        return void 0;
+      case OP.close: {
+        if (payload.length === 1) throw new WsError(CLOSE.protocol, "a close frame is malformed");
+        const code = payload.length >= 2 ? new DataView(payload.buffer).getUint16(0) : 1005;
+        if (payload.length >= 2 && !sendableCode(code)) {
+          throw new WsError(CLOSE.protocol, `close code ${code} may not be sent`);
+        }
+        return { kind: "close", code, reason: decode(payload.subarray(2)) };
+      }
+      case OP.binary:
+        if (!this.binary) throw new WsError(CLOSE.unsupported, "CDP messages are text");
+        return this.data(opcode, fin, payload);
+      case OP.text:
+      case OP.continuation:
+        return this.data(opcode, fin, payload);
+      default:
+        throw new WsError(CLOSE.protocol, `unknown opcode ${opcode}`);
+    }
+  }
+};
+function switchingHead(accept2, protocol = "") {
+  const chosen = protocol ? `Sec-WebSocket-Protocol: ${protocol}\r
+` : "";
+  return latin1Bytes(
+    `HTTP/1.1 101 Switching Protocols\r
+Upgrade: websocket\r
+Connection: Upgrade\r
+Sec-WebSocket-Accept: ${accept2}\r
+${chosen}\r
+`
+  );
+}
+
 // src/kernel/net/proxy-service.ts
+var SEND_BUFFER2 = 1024 * 1024;
+var TLS_HANDSHAKE = 22;
+var TOKEN2 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var NO_WEBSOCKET2 = "WebSocket not supported by this transport (fetchTransport needs { webSocket: true })";
 var REALM_PROXY_PORT = 3128;
 var DEFAULT_LIMITS = {
   maxConnections: 64,
   maxHead: 64 * 1024,
   idleMs: 12e4,
-  bodyBudget: 128 * 1024 * 1024
+  bodyBudget: 128 * 1024 * 1024,
+  closeWaitMs: 5e3
 };
 var HOP_BY_HOP = /* @__PURE__ */ new Set([
   "connection",
@@ -2872,11 +3251,27 @@ function plainResponse(status, message2) {
     cancel: async () => void 0
   };
 }
-function timedSource(conn, idleMs, stop) {
+function timedSource(conn, idle, stop) {
   return {
-    read: (max) => conn.read(max, AbortSignal.any([stop, AbortSignal.timeout(idleMs)]))
+    read: (max, signal) => {
+      const own = signal ? [stop, signal] : [stop];
+      if (Number.isFinite(idle.ms)) own.push(AbortSignal.timeout(idle.ms));
+      return conn.read(max, AbortSignal.any(own));
+    }
   };
 }
+function webSocketTarget(req) {
+  return { ...req, target: req.target.replace(/^ws(s?):/i, (_, s) => `http${s.toLowerCase()}:`) };
+}
+function wireCode(code) {
+  if (code === 1005) return 1e3;
+  return sendableCode(code) ? code : 1011;
+}
+function quietly(ms) {
+  return new Promise((resolve) => {
+    AbortSignal.timeout(ms).addEventListener("abort", () => resolve(), { once: true });
+  });
+}
 var RealmProxy = class {
   options;
   listener;
@@ -2885,6 +3280,7 @@ var RealmProxy = class {
   slots;
   bodies;
   connections = /* @__PURE__ */ new Set();
+  warnedWebSocket = false;
   closed;
   port;
   constructor(options) {
@@ -2933,9 +3329,10 @@ var RealmProxy = class {
   }
   async serve(conn) {
     this.connections.add(conn);
-    const incoming = new Incoming(timedSource(conn, this.limits.idleMs, this.stop.signal));
+    const idle = { ms: this.limits.idleMs };
+    const incoming = new Incoming(timedSource(conn, idle, this.stop.signal));
     try {
-      await this.requests({ sink: conn, incoming, conn, socket: conn });
+      await this.requests({ sink: conn, incoming, conn, socket: conn, idle });
     } finally {
       this.connections.delete(conn);
       conn.close();
@@ -2962,7 +3359,11 @@ var RealmProxy = class {
     const req = parseRequestHead(head);
     if (req.method === "CONNECT") {
       if (!ctx.conn) throw new HttpError(400, "CONNECT inside a tunnel");
-      await this.connect(ctx.conn, incoming, req);
+      await this.connect(ctx.conn, incoming, req, ctx.idle);
+      return false;
+    }
+    if (req.method === "GET" && isUpgrade(req.headers)) {
+      await this.websocket(ctx, req);
       return false;
     }
     const url = ctx.origin ? tunnelRequestUrl(req, ctx.origin) : requestUrl(req);
@@ -3057,33 +3458,149 @@ var RealmProxy = class {
     if (chunked) await conn.write(LAST_CHUNK, signal);
     return keep;
   }
-  async connect(conn, incoming, req) {
+  async connect(conn, incoming, req, idle) {
     const target = tunnelTarget(req);
-    const tunnel = this.options.tunnel;
-    if (!tunnel) {
-      throw new HttpError(
-        501,
-        `CONNECT ${target.host}:${target.port}: no tunnels through this proxy`
-      );
-    }
-    await this.options.tunnelReady?.().catch((e) => {
-      throw new HttpError(
-        501,
-        `CONNECT ${target.host}:${target.port}: ${e instanceof Error ? e.message : String(e)}`
-      );
-    });
+    const refused = target.port === 443 ? await this.tunnelReady(target) : void 0;
+    if (refused) throw refused;
     await conn.write(latin1Bytes("HTTP/1.1 200 Connection Established\r\n\r\n"), this.stop.signal);
     try {
+      const first = await incoming.peek(this.stop.signal);
+      if (first === void 0) return;
+      if (first !== TLS_HANDSHAKE) {
+        const origin = `http://${target.port === 80 ? target.host : `${target.host}:${target.port}`}`;
+        await this.requests({ sink: conn, incoming, origin, socket: conn, idle });
+        return;
+      }
+      const tunnel = this.options.tunnel;
+      if (!tunnel || target.port !== 443 && await this.tunnelReady(target)) return;
       await tunnel(
         conn,
         incoming,
         target,
         this.stop.signal,
-        (source, sink, origin) => this.requests({ sink, incoming: new Incoming(source), origin, socket: conn })
+        (source, sink, origin) => this.requests({ sink, incoming: new Incoming(source), origin, socket: conn, idle })
       );
     } catch {
     }
   }
+  async tunnelReady(target) {
+    const name2 = `CONNECT ${target.host}:${target.port}`;
+    if (!this.options.tunnel) return new HttpError(501, `${name2}: no tunnels through this proxy`);
+    try {
+      await this.options.tunnelReady?.();
+      return void 0;
+    } catch (e) {
+      return new HttpError(501, `${name2}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+  async websocket(ctx, req) {
+    const href = ctx.origin ? tunnelRequestUrl(req, ctx.origin) : requestUrl(webSocketTarget(req));
+    const { transport } = this.options;
+    if (!transport.traits.websocket || !transport.websocket) {
+      if (!this.warnedWebSocket) {
+        this.warnedWebSocket = true;
+        console.warn(`slicc-kernel: a program asked for a WebSocket: ${NO_WEBSOCKET2}`);
+      }
+      throw new HttpError(501, NO_WEBSOCKET2);
+    }
+    const accept2 = await acceptKey(req.headers);
+    const protocols = fieldValues(req.headers, "sec-websocket-protocol").flatMap((v) => v.split(",")).map((t) => t.trim()).filter((t) => t !== "");
+    const hangup = new AbortController();
+    const waiting = new AbortController();
+    void watchHangup(ctx.socket, hangup, waiting.signal);
+    let socket;
+    try {
+      socket = await transport.websocket({
+        url: toHostLoopback(href).replace(/^http/, "ws"),
+        protocols,
+        headers: forwardRequestHeaders(req.headers),
+        signal: AbortSignal.any([this.stop.signal, hangup.signal])
+      });
+    } catch (e) {
+      waiting.abort();
+      throw new HttpError(502, e instanceof Error ? e.message : String(e));
+    }
+    ctx.idle.ms = Number.POSITIVE_INFINITY;
+    try {
+      if (hangup.signal.aborted) throw hangup.signal.reason;
+      if (socket.protocol && !(protocols.includes(socket.protocol) && TOKEN2.test(socket.protocol))) {
+        throw new HttpError(502, "the far end chose a subprotocol the client did not offer");
+      }
+      await ctx.sink.write(switchingHead(accept2, socket.protocol), this.stop.signal);
+      await this.bridge(ctx, socket, hangup.signal);
+    } catch (e) {
+      socket.close(1001, "the client went away");
+      throw e;
+    } finally {
+      waiting.abort();
+    }
+  }
+  async bridge(ctx, socket, hangup) {
+    const stop = this.stop.signal;
+    let chain = Promise.resolve();
+    const toGuest = (bytes) => {
+      chain = chain.then(() => ctx.sink.write(bytes, stop));
+      return chain;
+    };
+    const done4 = new AbortController();
+    const reading = AbortSignal.any([stop, done4.signal, hangup]);
+    const stopping = () => socket.close(1001, "the proxy is stopping");
+    stop.addEventListener("abort", stopping, { once: true });
+    let guestDone = false;
+    let closeSent = false;
+    const outbound2 = (async () => {
+      for await (const data of socket.messages) {
+        if (guestDone) continue;
+        const text = typeof data === "string";
+        await toGuest(
+          frame(text ? OP_TEXT : OP_BINARY, text ? new TextEncoder().encode(data) : data)
+        );
+      }
+      const closed = await socket.closed;
+      if (guestDone) return;
+      closeSent = true;
+      await toGuest(closeFrame(wireCode(closed.code), closed.reason));
+      AbortSignal.timeout(this.limits.closeWaitMs).addEventListener("abort", () => done4.abort(), {
+        once: true
+      });
+    })().catch(() => done4.abort());
+    const reader = new WsReader(ctx.incoming, MESSAGE_LIMIT, true);
+    try {
+      for (; ; ) {
+        const event = await reader.next(reading);
+        if (!event) break;
+        if (event.kind === "ping") {
+          await toGuest(pongFrame(event.payload));
+          continue;
+        }
+        if (event.kind === "close") {
+          guestDone = true;
+          if (closeSent) break;
+          const code = wireCode(event.code);
+          socket.close(code, event.reason);
+          const reply = await Promise.race([
+            socket.closed,
+            quietly(this.limits.closeWaitMs).then(() => ({ code, reason: event.reason }))
+          ]);
+          await toGuest(closeFrame(wireCode(reply.code), reply.reason));
+          break;
+        }
+        while (socket.buffered > SEND_BUFFER2 && !reading.aborted) await quietly(10);
+        socket.send(event.kind === "text" ? event.text : event.bytes);
+      }
+    } catch (e) {
+      if (e instanceof WsError) {
+        guestDone = true;
+        socket.close(e.code, e.message);
+        await toGuest(closeFrame(e.code, e.message)).catch(() => void 0);
+      }
+    } finally {
+      guestDone = true;
+      socket.close(1e3, "the client went away");
+      stop.removeEventListener("abort", stopping);
+      await Promise.race([outbound2, quietly(this.limits.closeWaitMs)]);
+    }
+  }
 };
 
 // src/kernel/net/x509.ts
@@ -3813,12 +4330,15 @@ var RemoteTransport = class {
   port;
   waiting = /* @__PURE__ */ new Map();
   nextId = 0;
+  sockets = /* @__PURE__ */ new Map();
   failure;
   constructor(port, traits) {
     this.port = port;
     this.traits = traits;
   }
   receive(reply) {
+    const socket = this.sockets.get(reply.nid);
+    if (socket && this.toSocket(reply, socket)) return;
     const waiter = this.waiting.get(reply.nid);
     if (!waiter) return;
     this.waiting.delete(reply.nid);
@@ -3826,10 +4346,22 @@ var RemoteTransport = class {
       waiter.reject(new TransportError(reply.message, reply.status, reply.code));
     } else waiter.resolve(reply);
   }
+  toSocket(reply, socket) {
+    if (reply.net === "ws-message") socket.queue.push(reply.data);
+    else if (reply.net === "ws-acked") socket.acked(reply.n);
+    else if (reply.net === "ws-closed") {
+      this.sockets.delete(reply.nid);
+      socket.queue.end({ code: reply.code, reason: reply.reason });
+    } else return false;
+    return true;
+  }
   fail(error) {
     this.failure = error;
     for (const waiter of this.waiting.values()) waiter.reject(error);
     this.waiting.clear();
+    for (const socket of this.sockets.values())
+      socket.queue.end({ code: 1011, reason: error.message });
+    this.sockets.clear();
   }
   ask(call) {
     if (this.failure) return Promise.reject(this.failure);
@@ -3908,6 +4440,46 @@ var RemoteTransport = class {
       }
     };
   }
+  async websocket(request2) {
+    const nid = ++this.nextId;
+    const { signal } = request2;
+    signal.throwIfAborted();
+    const abort = () => this.cancel(nid);
+    signal.addEventListener("abort", abort, { once: true });
+    let opened2;
+    try {
+      opened2 = await this.ask({
+        net: "ws-open",
+        nid,
+        url: request2.url,
+        protocols: request2.protocols,
+        headers: request2.headers
+      });
+    } finally {
+      signal.removeEventListener("abort", abort);
+    }
+    const close = (code, reason) => this.port.postMessage({ net: "ws-close", nid, code, reason });
+    const queue = new MessageQueue(
+      () => close(1e3, "a message is too big"),
+      Number.POSITIVE_INFINITY,
+      (n) => this.port.postMessage({ net: "ws-consumed", nid, n })
+    );
+    let unacked = 0;
+    this.sockets.set(nid, { queue, acked: (n) => void (unacked -= n) });
+    return {
+      protocol: opened2.protocol,
+      get buffered() {
+        return unacked;
+      },
+      send: (data) => {
+        unacked += payloadSize(data);
+        this.port.postMessage({ net: "ws-send", nid, data });
+      },
+      messages: queue,
+      close,
+      closed: queue.closed
+    };
+  }
 };
 
 // src/kernel/net/routes.ts
@@ -4086,183 +4658,10 @@ var RemoteUplink = class {
 var CDP_PORT = 9222;
 var NO_CDP_HOST = "slicc-kernel: no CDP host is attached (createKernel({ cdp }) or client.serveCdp)";
 
-// src/cdp/websocket.ts
-var GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
-var MAX_MESSAGE = 256 * 1024 * 1024;
-var CLOSE = {
-  normal: 1e3,
-  protocol: 1002,
-  unsupported: 1003,
-  invalid: 1007,
-  tooBig: 1009,
-  error: 1011
-};
-var OP_TEXT = 1;
-var OP = { continuation: 0, text: OP_TEXT, binary: 2, close: 8, ping: 9, pong: 10 };
-var WsError = class extends Error {
-  code;
-  constructor(code, message2) {
-    super(message2);
-    this.code = code;
-  }
-};
-function field(headers, name2) {
-  return headers.find(([n]) => n.toLowerCase() === name2)?.[1];
-}
-async function acceptKey(headers) {
-  const tokens = (name2) => (field(headers, name2) ?? "").split(",").map((t) => t.trim().toLowerCase());
-  if (!tokens("upgrade").includes("websocket") || !tokens("connection").includes("upgrade")) {
-    throw new HttpError(400, "expected a WebSocket upgrade");
-  }
-  if (field(headers, "sec-websocket-version") !== "13") {
-    throw new HttpError(400, "Sec-WebSocket-Version must be 13");
-  }
-  const key = field(headers, "sec-websocket-key") ?? "";
-  if (!/^[A-Za-z0-9+/]{22}==$/.test(key)) throw new HttpError(400, "bad Sec-WebSocket-Key");
-  const digest = await crypto.subtle.digest("SHA-1", new TextEncoder().encode(key + GUID));
-  return btoa(String.fromCharCode(...new Uint8Array(digest)));
-}
-function isUpgrade(headers) {
-  return (field(headers, "upgrade") ?? "").toLowerCase().includes("websocket");
-}
-function frame(opcode, payload) {
-  const n = payload.length;
-  const size = n < 126 ? 2 : n < 65536 ? 4 : 10;
-  const out = new Uint8Array(size + n);
-  const view = new DataView(out.buffer);
-  out[0] = 128 | opcode;
-  if (n < 126) out[1] = n;
-  else if (n < 65536) {
-    out[1] = 126;
-    view.setUint16(2, n);
-  } else {
-    out[1] = 127;
-    view.setBigUint64(2, BigInt(n));
-  }
-  out.set(payload, size);
-  return out;
-}
-function closeFrame(code, reason = "") {
-  let bytes = new TextEncoder().encode(reason);
-  if (bytes.length > 123) bytes = bytes.subarray(0, 123);
-  const payload = new Uint8Array(2 + bytes.length);
-  new DataView(payload.buffer).setUint16(0, code);
-  payload.set(bytes, 2);
-  return frame(OP.close, payload);
-}
-function pongFrame(payload) {
-  return frame(OP.pong, payload);
-}
-async function fill(incoming, out, signal) {
-  for (let at = 0; at < out.length; ) {
-    const piece = await incoming.some(out.length - at, signal);
-    if (piece.length === 0) throw new WsError(CLOSE.protocol, "the connection closed mid-frame");
-    out.set(piece, at);
-    at += piece.length;
-  }
-}
-var fatal = new TextDecoder("utf-8", { fatal: true });
-function decode(bytes) {
-  try {
-    return fatal.decode(bytes);
-  } catch {
-    throw new WsError(CLOSE.invalid, "a text message is not UTF-8");
-  }
-}
-var WsReader = class {
-  incoming;
-  max;
-  parts = [];
-  size = 0;
-  continuing = false;
-  constructor(incoming, max = MAX_MESSAGE) {
-    this.incoming = incoming;
-    this.max = max;
-  }
-  async next(signal) {
-    for (; ; ) {
-      const first = await this.incoming.some(1, signal);
-      if (first.length === 0) return null;
-      const head = new Uint8Array(2);
-      head[0] = first[0];
-      await fill(this.incoming, head.subarray(1), signal);
-      const fin = (head[0] & 128) !== 0;
-      const opcode = head[0] & 15;
-      if ((head[0] & 112) !== 0) throw new WsError(CLOSE.protocol, "reserved bits are set");
-      if ((head[1] & 128) === 0) throw new WsError(CLOSE.protocol, "client frames must be masked");
-      const length2 = await this.length(head[1] & 127, signal);
-      const control = opcode >= 8;
-      if (control && (length2 > 125 || !fin)) {
-        throw new WsError(CLOSE.protocol, "a control frame is too long or fragmented");
-      }
-      if (!control && this.size + length2 > this.max) {
-        throw new WsError(CLOSE.tooBig, `a message is over ${this.max} bytes`);
-      }
-      const mask = new Uint8Array(4);
-      await fill(this.incoming, mask, signal);
-      const payload = new Uint8Array(length2);
-      await fill(this.incoming, payload, signal);
-      for (let i = 0; i < length2; i++) payload[i] ^= mask[i & 3];
-      const event = this.take(opcode, fin, payload);
-      if (event) return event;
-    }
-  }
-  async length(short, signal) {
-    if (short < 126) return short;
-    const ext = new Uint8Array(short === 126 ? 2 : 8);
-    await fill(this.incoming, ext, signal);
-    const view = new DataView(ext.buffer);
-    if (short === 126) return view.getUint16(0);
-    const long = view.getBigUint64(0);
-    return long > BigInt(this.max) ? this.max + 1 : Number(long);
-  }
-  take(opcode, fin, payload) {
-    switch (opcode) {
-      case OP.ping:
-        return { kind: "ping", payload };
-      case OP.pong:
-        return void 0;
-      case OP.close: {
-        if (payload.length === 1) throw new WsError(CLOSE.protocol, "a close frame is malformed");
-        const code = payload.length >= 2 ? new DataView(payload.buffer).getUint16(0) : 1005;
-        return { kind: "close", code, reason: decode(payload.subarray(2)) };
-      }
-      case OP.text:
-      case OP.continuation: {
-        if (opcode === OP.continuation !== this.continuing) {
-          throw new WsError(CLOSE.protocol, "unexpected continuation frame");
-        }
-        this.parts.push(payload);
-        this.size += payload.length;
-        this.continuing = !fin;
-        if (!fin) return void 0;
-        const whole = this.parts.length === 1 ? payload : concat(this.parts, this.size);
-        this.parts = [];
-        this.size = 0;
-        return { kind: "text", text: decode(whole) };
-      }
-      case OP.binary:
-        throw new WsError(CLOSE.unsupported, "CDP messages are text");
-      default:
-        throw new WsError(CLOSE.protocol, `unknown opcode ${opcode}`);
-    }
-  }
-};
-function switchingHead(accept2) {
-  return latin1Bytes(
-    `HTTP/1.1 101 Switching Protocols\r
-Upgrade: websocket\r
-Connection: Upgrade\r
-Sec-WebSocket-Accept: ${accept2}\r
-\r
-`
-  );
-}
-
 // src/cdp/facade.ts
 var MAX_HEAD = 64 * 1024;
 var LIST_TIMEOUT = 1e4;
-var CLOSE_WAIT_MS = 1e3;
+var CLOSE_WAIT_MS2 = 1e3;
 function respond(status, body, type = "text/plain; charset=utf-8") {
   const bytes = new TextEncoder().encode(body);
   const head = latin1Bytes(
@@ -4410,7 +4809,7 @@ var CdpFacade = class {
     const host = await this.host(runtime);
     const limits = {
       max: this.options.maxMessage ?? MAX_MESSAGE,
-      closeWaitMs: this.options.closeWaitMs ?? CLOSE_WAIT_MS
+      closeWaitMs: this.options.closeWaitMs ?? CLOSE_WAIT_MS2
     };
     await new Relay(conn, incoming, host, limits, this.stop.signal).start(switchingHead(accept2)).finally(() => host.close());
   }
@@ -9060,7 +9459,42 @@ var Dying = class {
     return [typeof reported === "number" ? reported : CRASHED, void 0];
   }
 };
-function processInit(opts, sab, umask) {
+function notifiers(header2) {
+  return {
+    onPending(sig) {
+      Atomics.or(header2, SAB_I_SIGNALS, sigbit(sig));
+      Atomics.notify(header2, SAB_I_SIGNALS);
+    },
+    onAsync() {
+      Atomics.add(header2, SAB_I_ASYNC, 1);
+      Atomics.notify(header2, SAB_I_ASYNC);
+    }
+  };
+}
+function publishStops(process, header2) {
+  process.onState((state) => {
+    Atomics.store(header2, SAB_I_STOP, state === "stopped" ? 1 : 0);
+    Atomics.notify(header2, SAB_I_STOP);
+  });
+}
+function transferOf(opts, lane) {
+  const transfer = opts.fork ? [opts.fork.memory.buffer] : [];
+  return lane ? [...transfer, lane.port] : transfer;
+}
+function openLane(token, dispatch2) {
+  const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
+  const { port1, port2 } = new MessageChannel();
+  const responder = attachSyncSabResponder(port1, sab, token, { dispatch: dispatch2 });
+  port1.start();
+  return {
+    lane: { sab, port: port2 },
+    dispose() {
+      responder.dispose();
+      port1.close();
+    }
+  };
+}
+function processInit(opts, sab, umask, lane) {
   const base = {
     type: WASM_PROCESS_INIT,
     pid: opts.shownPid ?? opts.pid,
@@ -9073,7 +9507,12 @@ function processInit(opts, sab, umask) {
     ...opts.ppid !== void 0 ? { ppid: opts.ppid } : {}
   };
   if (opts.program.abi === "js") {
-    return { ...base, program: opts.program, fds: inheritedFds(opts.fds) };
+    return {
+      ...base,
+      program: opts.program,
+      fds: inheritedFds(opts.fds),
+      lane
+    };
   }
   return {
     ...base,
@@ -9125,23 +9564,13 @@ function spawnWasmProcess(opts) {
     locks: opts.locks,
     onReap: opts.onReap,
     resolver: opts.resolver,
-    onPending: (sig) => {
-      Atomics.or(header2, SAB_I_SIGNALS, sigbit(sig));
-      Atomics.notify(header2, SAB_I_SIGNALS);
-    },
-    onAsync: () => {
-      Atomics.add(header2, SAB_I_ASYNC, 1);
-      Atomics.notify(header2, SAB_I_ASYNC);
-    },
+    ...notifiers(header2),
     onTimer: (which) => void Atomics.or(header2, SAB_I_TIMERS, 1 << which),
     hasPending: () => Atomics.load(header2, SAB_I_SIGNALS) !== 0 || Atomics.load(header2, SAB_I_TIMERS) !== 0,
     raise: (sig) => signal(sig),
     ...opts.program.abi === "wasi" || opts.program.abi === "js" ? { pendingBits: () => Atomics.load(header2, SAB_I_SIGNALS) } : {}
   });
-  process.onState((state) => {
-    Atomics.store(header2, SAB_I_STOP, state === "stopped" ? 1 : 0);
-    Atomics.notify(header2, SAB_I_STOP);
-  });
+  publishStops(process, header2);
   const holds = new HeldPaths();
   opts.held?.add(holds);
   const token = holdingToken(opts, holds);
@@ -9150,6 +9579,7 @@ function spawnWasmProcess(opts) {
   const dying = new Dying();
   const dispatch2 = (req) => dying.serving(() => isWasmSyscall(req) ? process.syscall(req) : dispatchSyncFs(req));
   const responder = attachSyncSabResponder(worker, sab, token, { dispatch: dispatch2 });
+  const lane = opts.program.abi === "js" ? openLane(token, dispatch2) : void 0;
   const { promise: exited, resolve: settle3 } = Promise.withResolvers();
   let done4 = false;
   let endedBy;
@@ -9162,6 +9592,7 @@ function spawnWasmProcess(opts) {
     worker.removeEventListener("error", onError);
     for (const tid of [...threads.keys()]) endThread(tid);
     responder.dispose();
+    lane?.dispose();
     revokeSyncFsToken(token);
     opts.held?.delete(holds);
     worker.terminate();
@@ -9232,8 +9663,10 @@ function spawnWasmProcess(opts) {
     };
     tw.postMessage(tinit);
   };
-  const init = processInit(opts, sab, process.umask);
-  worker.postMessage(init, opts.fork ? [opts.fork.memory.buffer] : []);
+  worker.postMessage(
+    processInit(opts, sab, process.umask, lane?.lane),
+    transferOf(opts, lane?.lane)
+  );
   const signal = (sig) => {
     if (process.signal(sig) !== "terminate") return;
     const code = sig === SIG.KILL ? 137 : 128 + sig;