@ai-ecoverse/slicc-kernel 1.37.1 → 1.39.1

package/dist/node.js

@@ -1190,7 +1190,153 @@ async function readWithin(reader, ms) {
   }
 }
 
+// src/kernel/net/ws-queue.ts
+var INBOUND_LIMIT = 16 * 1024 * 1024;
+var MESSAGE_LIMIT = 64 * 1024 * 1024;
+var TOO_BIG = 1009;
+function payloadSize(message2) {
+  return typeof message2 === "string" ? new TextEncoder().encode(message2).length : message2.length;
+}
+var MessageQueue = class {
+  items = [];
+  limit;
+  waiter;
+  size = 0;
+  ended = false;
+  overflow;
+  taken;
+  closed;
+  settle;
+  constructor(overflow, limit = INBOUND_LIMIT, taken) {
+    this.overflow = overflow;
+    this.limit = limit;
+    this.taken = taken;
+    this.closed = new Promise((resolve) => {
+      this.settle = resolve;
+    });
+  }
+  push(message2) {
+    if (this.ended) return;
+    const size = payloadSize(message2);
+    const huge = size > MESSAGE_LIMIT;
+    if (huge || this.items.length > 0 && this.size + size > this.limit) {
+      const reason = huge ? `a message is over ${MESSAGE_LIMIT} bytes` : `over ${this.limit} bytes of messages are waiting`;
+      this.end({ code: TOO_BIG, reason });
+      this.overflow();
+      return;
+    }
+    this.size += size;
+    this.items.push(message2);
+    this.wake();
+  }
+  end(close) {
+    if (this.ended) return;
+    this.ended = true;
+    this.settle(close);
+    this.wake();
+  }
+  wake() {
+    const waiter = this.waiter;
+    this.waiter = void 0;
+    waiter?.();
+  }
+  async *[Symbol.asyncIterator]() {
+    for (; ; ) {
+      const next = this.items.shift();
+      if (next !== void 0) {
+        const n = payloadSize(next);
+        this.size -= n;
+        this.taken?.(n);
+        yield next;
+        continue;
+      }
+      if (this.ended) return;
+      await new Promise((resolve) => {
+        this.waiter = resolve;
+      });
+    }
+  }
+};
+
+// src/websocket-transport.ts
+var SENT_HEADERS_DROP = /* @__PURE__ */ new Set([
+  "host",
+  "connection",
+  "upgrade",
+  "sec-websocket-key",
+  "sec-websocket-version",
+  "sec-websocket-extensions",
+  "sec-websocket-protocol"
+]);
+function headerRecord(headers) {
+  const out = {};
+  for (const [name2, value] of headers) {
+    if (!SENT_HEADERS_DROP.has(name2.toLowerCase())) out[name2] = value;
+  }
+  return out;
+}
+function sendableClose(code) {
+  return code === 1e3 || code !== void 0 && code >= 3e3 && code <= 4999 ? code : 1e3;
+}
+function blockedReason(url, e) {
+  const name2 = e?.name;
+  if (name2 === "SecurityError" && url.startsWith("ws:")) {
+    return `${url}: ws:// is blocked from an https page; use wss:// or slicc-node`;
+  }
+  return `${url}: ${e instanceof Error ? e.message : String(e)}`;
+}
+function openWebSocket(Socket, request, withHeaders) {
+  const { url, protocols, signal } = request;
+  signal.throwIfAborted();
+  let socket;
+  try {
+    socket = withHeaders ? new Socket(url, { protocols, headers: headerRecord(request.headers) }) : new Socket(url, protocols);
+  } catch (e) {
+    return Promise.reject(Object.assign(new Error(blockedReason(url, e)), { status: 502 }));
+  }
+  socket.binaryType = "arraybuffer";
+  const queue = new MessageQueue(() => socket.close(1e3, "too many waiting messages"));
+  return new Promise((resolve, reject) => {
+    let open = false;
+    const abort = () => {
+      socket.close(1e3, "aborted");
+      reject(signal.reason);
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    socket.addEventListener("open", () => {
+      open = true;
+      signal.removeEventListener("abort", abort);
+      resolve({
+        protocol: socket.protocol,
+        get buffered() {
+          return socket.bufferedAmount;
+        },
+        send: (data) => socket.send(data),
+        messages: queue,
+        close: (code, reason) => socket.close(sendableClose(code), reason),
+        closed: queue.closed
+      });
+    });
+    socket.addEventListener("message", (event) => {
+      queue.push(typeof event.data === "string" ? event.data : new Uint8Array(event.data));
+    });
+    socket.addEventListener("close", (event) => {
+      queue.end({ code: event.code, reason: event.reason });
+      if (open) return;
+      signal.removeEventListener("abort", abort);
+      reject(
+        Object.assign(new Error(`${url}: the WebSocket closed (${event.code}) before it opened`), {
+          status: 502
+        })
+      );
+    });
+  });
+}
+
 // src/transport.ts
+var SEND_BUFFER = 1024 * 1024;
+var CLOSE_WAIT_MS = 5e3;
+var NO_WEBSOCKET = "WebSocket not supported by this transport (fetchTransport needs { webSocket: true })";
 var MAX_REQUEST_BODY = 64 * 1024 * 1024;
 function joinHeaders(headers) {
   const out = new Headers();
@@ -1215,13 +1361,17 @@ async function* chunks(body, idleMs) {
 }
 function fetchTransport(options = {}) {
   const send = options.fetch ?? globalThis.fetch.bind(globalThis);
+  const Socket = options.webSocket === true ? globalThis.WebSocket : options.webSocket || void 0;
+  const headers = options.webSocketHeaders === true;
   return {
     traits: {
       manualRedirects: false,
       encodedBodies: false,
       maxRequestBody: options.maxRequestBody ?? MAX_REQUEST_BODY,
-      crossOrigin: "cors"
+      crossOrigin: "cors",
+      ...Socket ? { websocket: true } : {}
     },
+    ...Socket ? { websocket: (request) => openWebSocket(Socket, request, headers) } : {},
     async fetch(request) {
       let response;
       try {
@@ -1243,15 +1393,15 @@ function fetchTransport(options = {}) {
           { status: 502 }
         );
       }
-      const headers = [];
+      const headers2 = [];
       response.headers.forEach((value, name2) => {
-        headers.push([name2, value]);
+        headers2.push([name2, value]);
       });
       const body = chunks(response.body, options.bodyIdleMs ?? BODY_IDLE_MS);
       return {
         status: response.status,
         statusText: response.statusText,
-        headers,
+        headers: headers2,
         body,
         cancel: async () => {
           await body.return(void 0);
@@ -1261,7 +1411,7 @@ function fetchTransport(options = {}) {
     }
   };
 }
-function serveTransport(peer, transport) {
+function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS } = {}) {
   const open = /* @__PURE__ */ new Map();
   const fail2 = (nid, e) => {
     open.delete(nid);
@@ -1302,6 +1452,96 @@ function serveTransport(peer, transport) {
       fail2(call.nid, e);
     }
   };
+  const sockets = /* @__PURE__ */ new Map();
+  const credit = /* @__PURE__ */ new Map();
+  const refill = (nid, n, closing = false) => {
+    const flow = credit.get(nid);
+    if (!flow) return;
+    flow.inflight -= n;
+    if (closing && !flow.closing) {
+      flow.closing = true;
+      flow.deadline();
+    }
+    flow.wake?.();
+  };
+  const openSocket = async (call) => {
+    const abort = new AbortController();
+    open.set(call.nid, { abort });
+    try {
+      if (!transport.websocket) throw new Error(NO_WEBSOCKET);
+      const socket = await transport.websocket({
+        url: call.url,
+        protocols: call.protocols,
+        headers: call.headers,
+        signal: abort.signal
+      });
+      if (!open.delete(call.nid)) {
+        socket.close(1e3, "cancelled");
+        return;
+      }
+      sockets.set(call.nid, socket);
+      peer.postMessage({ net: "ws-opened", nid: call.nid, protocol: socket.protocol });
+      void relay(call.nid, socket);
+    } catch (e) {
+      fail2(call.nid, e);
+    }
+  };
+  const relay = async (nid, socket) => {
+    let ending;
+    let late;
+    const unanswered = new Promise((resolve) => {
+      late = () => resolve("late");
+    });
+    const flow = {
+      inflight: 0,
+      closing: false,
+      deadline: () => AbortSignal.timeout(closeWaitMs).addEventListener("abort", late, { once: true })
+    };
+    credit.set(nid, flow);
+    const timedOut = { code: 1006, reason: "the far end did not answer the close" };
+    let oversize = false;
+    try {
+      const messages = socket.messages[Symbol.asyncIterator]();
+      for (; ; ) {
+        const next = await Promise.race([messages.next(), unanswered]);
+        if (next === "late" || next.done) break;
+        const data = next.value;
+        if (flow.closing) continue;
+        if (payloadSize(data) > MESSAGE_LIMIT) {
+          oversize = true;
+          break;
+        }
+        if (typeof data === "string") peer.postMessage({ net: "ws-message", nid, data });
+        else {
+          const bytes = data.slice();
+          peer.postMessage({ net: "ws-message", nid, data: bytes }, [bytes.buffer]);
+        }
+        flow.inflight += payloadSize(data);
+        while (flow.inflight > INBOUND_LIMIT && !flow.closing) {
+          await new Promise((resolve) => {
+            flow.wake = resolve;
+          });
+        }
+      }
+      if (oversize) socket.close(1e3, "a message is too big");
+      ending = oversize ? { code: 1009, reason: `a message is over ${MESSAGE_LIMIT} bytes` } : await Promise.race([socket.closed, unanswered.then(() => timedOut)]);
+    } catch (e) {
+      socket.close(1e3, "the relay failed");
+      ending = { code: 1011, reason: e instanceof Error ? e.message : String(e) };
+    }
+    sockets.delete(nid);
+    credit.delete(nid);
+    peer.postMessage({ net: "ws-closed", nid, ...ending });
+  };
+  const sendOn = async (call) => {
+    const socket = sockets.get(call.nid);
+    if (!socket) return;
+    socket.send(call.data);
+    while (socket.buffered > SEND_BUFFER && sockets.has(call.nid)) {
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+    peer.postMessage({ net: "ws-acked", nid: call.nid, n: payloadSize(call.data) });
+  };
   const read = async (nid) => {
     const body = open.get(nid)?.body;
     if (!body) return;
@@ -1319,6 +1559,8 @@ function serveTransport(peer, transport) {
     }
   };
   const drop = (nid) => {
+    sockets.get(nid)?.close(1e3, "cancelled");
+    refill(nid, 0, true);
     const entry = open.get(nid);
     open.delete(nid);
     entry?.abort.abort();
@@ -1328,10 +1570,16 @@ function serveTransport(peer, transport) {
     answer(call) {
       if (call.net === "fetch") void start(call);
       else if (call.net === "read") void read(call.nid);
+      else if (call.net === "ws-open") void openSocket(call);
+      else if (call.net === "ws-send") void sendOn(call);
+      else if (call.net === "ws-close") {
+        sockets.get(call.nid)?.close(call.code, call.reason);
+        refill(call.nid, 0, true);
+      } else if (call.net === "ws-consumed") refill(call.nid, call.n);
       else drop(call.nid);
     },
     close() {
-      for (const nid of [...open.keys()]) drop(nid);
+      for (const nid of [...open.keys(), ...sockets.keys()]) drop(nid);
     }
   };
 }
@@ -2417,6 +2665,10 @@ var Incoming = class {
     this.buf = this.buf.subarray(n);
     return out;
   }
+  async peek(signal) {
+    if (this.buf.length === 0) await this.fill(signal);
+    return this.buf[0];
+  }
   async some(max, signal) {
     if (this.buf.length > 0) return this.take(Math.min(max, this.buf.length));
     if (this.eof) return new Uint8Array(0);
@@ -2614,7 +2866,15 @@ var CLOSE = {
   error: 1011
 };
 var OP_TEXT = 1;
-var OP = { continuation: 0, text: OP_TEXT, binary: 2, close: 8, ping: 9, pong: 10 };
+var OP_BINARY = 2;
+var OP = {
+  continuation: 0,
+  text: OP_TEXT,
+  binary: OP_BINARY,
+  close: 8,
+  ping: 9,
+  pong: 10
+};
 var WsError = class extends Error {
   code;
   constructor(code, message2) {
@@ -2622,6 +2882,10 @@ var WsError = class extends Error {
     this.code = code;
   }
 };
+function sendableCode(code) {
+  if (code >= 3e3 && code <= 4999) return true;
+  return code >= 1e3 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006;
+}
 function field(headers, name2) {
   return headers.find(([n]) => n.toLowerCase() === name2)?.[1];
 }
@@ -2660,7 +2924,11 @@ function frame(opcode, payload) {
 }
 function closeFrame(code, reason = "") {
   let bytes = new TextEncoder().encode(reason);
-  if (bytes.length > 123) bytes = bytes.subarray(0, 123);
+  if (bytes.length > 123) {
+    let end = 123;
+    while ((bytes[end] & 192) === 128) end--;
+    bytes = bytes.subarray(0, end);
+  }
   const payload = new Uint8Array(2 + bytes.length);
   new DataView(payload.buffer).setUint16(0, code);
   payload.set(bytes, 2);
@@ -2691,9 +2959,12 @@ var WsReader = class {
   parts = [];
   size = 0;
   continuing = false;
-  constructor(incoming, max = MAX_MESSAGE) {
+  binaryMessage = false;
+  binary;
+  constructor(incoming, max = MAX_MESSAGE, binary) {
     this.incoming = incoming;
     this.max = max;
+    this.binary = binary;
   }
   async next(signal) {
     for (; ; ) {
@@ -2723,6 +2994,20 @@ var WsReader = class {
       if (event) return event;
     }
   }
+  data(opcode, fin, payload) {
+    if (opcode === OP.continuation !== this.continuing) {
+      throw new WsError(CLOSE.protocol, "unexpected continuation frame");
+    }
+    if (opcode !== OP.continuation) this.binaryMessage = opcode === OP.binary;
+    this.parts.push(payload);
+    this.size += payload.length;
+    this.continuing = !fin;
+    if (!fin) return void 0;
+    const whole = this.parts.length === 1 ? payload : concat(this.parts, this.size);
+    this.parts = [];
+    this.size = 0;
+    return this.binaryMessage ? { kind: "binary", bytes: whole } : { kind: "text", text: decode(whole) };
+  }
   async length(short, signal) {
     if (short < 126) return short;
     const ext = new Uint8Array(short === 126 ? 2 : 8);
@@ -2741,36 +3026,31 @@ var WsReader = class {
       case OP.close: {
         if (payload.length === 1) throw new WsError(CLOSE.protocol, "a close frame is malformed");
         const code = payload.length >= 2 ? new DataView(payload.buffer).getUint16(0) : 1005;
-        return { kind: "close", code, reason: decode(payload.subarray(2)) };
-      }
-      case OP.text:
-      case OP.continuation: {
-        if (opcode === OP.continuation !== this.continuing) {
-          throw new WsError(CLOSE.protocol, "unexpected continuation frame");
+        if (payload.length >= 2 && !sendableCode(code)) {
+          throw new WsError(CLOSE.protocol, `close code ${code} may not be sent`);
         }
-        this.parts.push(payload);
-        this.size += payload.length;
-        this.continuing = !fin;
-        if (!fin) return void 0;
-        const whole = this.parts.length === 1 ? payload : concat(this.parts, this.size);
-        this.parts = [];
-        this.size = 0;
-        return { kind: "text", text: decode(whole) };
+        return { kind: "close", code, reason: decode(payload.subarray(2)) };
       }
       case OP.binary:
-        throw new WsError(CLOSE.unsupported, "CDP messages are text");
+        if (!this.binary) throw new WsError(CLOSE.unsupported, "CDP messages are text");
+        return this.data(opcode, fin, payload);
+      case OP.text:
+      case OP.continuation:
+        return this.data(opcode, fin, payload);
       default:
         throw new WsError(CLOSE.protocol, `unknown opcode ${opcode}`);
     }
   }
 };
-function switchingHead(accept2) {
+function switchingHead(accept2, protocol = "") {
+  const chosen = protocol ? `Sec-WebSocket-Protocol: ${protocol}\r
+` : "";
   return latin1Bytes(
     `HTTP/1.1 101 Switching Protocols\r
 Upgrade: websocket\r
 Connection: Upgrade\r
 Sec-WebSocket-Accept: ${accept2}\r
-\r
+${chosen}\r
 `
   );
 }
@@ -2778,7 +3058,7 @@ Sec-WebSocket-Accept: ${accept2}\r
 // src/cdp/facade.ts
 var MAX_HEAD = 64 * 1024;
 var LIST_TIMEOUT = 1e4;
-var CLOSE_WAIT_MS = 1e3;
+var CLOSE_WAIT_MS2 = 1e3;
 function respond(status, body, type = "text/plain; charset=utf-8") {
   const bytes = new TextEncoder().encode(body);
   const head = latin1Bytes(
@@ -2926,7 +3206,7 @@ var CdpFacade = class {
     const host = await this.host(runtime);
     const limits = {
       max: this.options.maxMessage ?? MAX_MESSAGE,
-      closeWaitMs: this.options.closeWaitMs ?? CLOSE_WAIT_MS
+      closeWaitMs: this.options.closeWaitMs ?? CLOSE_WAIT_MS2
     };
     await new Relay(conn, incoming, host, limits, this.stop.signal).start(switchingHead(accept2)).finally(() => host.close());
   }
@@ -5276,12 +5556,17 @@ function ownNames(hostname) {
 }
 
 // src/kernel/net/proxy-service.ts
+var SEND_BUFFER2 = 1024 * 1024;
+var TLS_HANDSHAKE = 22;
+var TOKEN2 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var NO_WEBSOCKET2 = "WebSocket not supported by this transport (fetchTransport needs { webSocket: true })";
 var REALM_PROXY_PORT = 3128;
 var DEFAULT_LIMITS = {
   maxConnections: 64,
   maxHead: 64 * 1024,
   idleMs: 12e4,
-  bodyBudget: 128 * 1024 * 1024
+  bodyBudget: 128 * 1024 * 1024,
+  closeWaitMs: 5e3
 };
 var HOP_BY_HOP = /* @__PURE__ */ new Set([
   "connection",
@@ -5472,11 +5757,27 @@ function plainResponse(status, message2) {
     cancel: async () => void 0
   };
 }
-function timedSource(conn, idleMs, stop) {
+function timedSource(conn, idle, stop) {
   return {
-    read: (max) => conn.read(max, AbortSignal.any([stop, AbortSignal.timeout(idleMs)]))
+    read: (max, signal) => {
+      const own = signal ? [stop, signal] : [stop];
+      if (Number.isFinite(idle.ms)) own.push(AbortSignal.timeout(idle.ms));
+      return conn.read(max, AbortSignal.any(own));
+    }
   };
 }
+function webSocketTarget(req) {
+  return { ...req, target: req.target.replace(/^ws(s?):/i, (_, s) => `http${s.toLowerCase()}:`) };
+}
+function wireCode(code) {
+  if (code === 1005) return 1e3;
+  return sendableCode(code) ? code : 1011;
+}
+function quietly(ms) {
+  return new Promise((resolve) => {
+    AbortSignal.timeout(ms).addEventListener("abort", () => resolve(), { once: true });
+  });
+}
 var RealmProxy = class {
   options;
   listener;
@@ -5485,6 +5786,7 @@ var RealmProxy = class {
   slots;
   bodies;
   connections = /* @__PURE__ */ new Set();
+  warnedWebSocket = false;
   closed;
   port;
   constructor(options) {
@@ -5533,9 +5835,10 @@ var RealmProxy = class {
   }
   async serve(conn) {
     this.connections.add(conn);
-    const incoming = new Incoming(timedSource(conn, this.limits.idleMs, this.stop.signal));
+    const idle = { ms: this.limits.idleMs };
+    const incoming = new Incoming(timedSource(conn, idle, this.stop.signal));
     try {
-      await this.requests({ sink: conn, incoming, conn, socket: conn });
+      await this.requests({ sink: conn, incoming, conn, socket: conn, idle });
     } finally {
       this.connections.delete(conn);
       conn.close();
@@ -5562,7 +5865,11 @@ var RealmProxy = class {
     const req = parseRequestHead(head);
     if (req.method === "CONNECT") {
       if (!ctx.conn) throw new HttpError(400, "CONNECT inside a tunnel");
-      await this.connect(ctx.conn, incoming, req);
+      await this.connect(ctx.conn, incoming, req, ctx.idle);
+      return false;
+    }
+    if (req.method === "GET" && isUpgrade(req.headers)) {
+      await this.websocket(ctx, req);
       return false;
     }
     const url = ctx.origin ? tunnelRequestUrl(req, ctx.origin) : requestUrl(req);
@@ -5657,33 +5964,149 @@ var RealmProxy = class {
     if (chunked2) await conn.write(LAST_CHUNK, signal);
     return keep;
   }
-  async connect(conn, incoming, req) {
+  async connect(conn, incoming, req, idle) {
     const target = tunnelTarget(req);
-    const tunnel = this.options.tunnel;
-    if (!tunnel) {
-      throw new HttpError(
-        501,
-        `CONNECT ${target.host}:${target.port}: no tunnels through this proxy`
-      );
-    }
-    await this.options.tunnelReady?.().catch((e) => {
-      throw new HttpError(
-        501,
-        `CONNECT ${target.host}:${target.port}: ${e instanceof Error ? e.message : String(e)}`
-      );
-    });
+    const refused = target.port === 443 ? await this.tunnelReady(target) : void 0;
+    if (refused) throw refused;
     await conn.write(latin1Bytes("HTTP/1.1 200 Connection Established\r\n\r\n"), this.stop.signal);
     try {
+      const first = await incoming.peek(this.stop.signal);
+      if (first === void 0) return;
+      if (first !== TLS_HANDSHAKE) {
+        const origin = `http://${target.port === 80 ? target.host : `${target.host}:${target.port}`}`;
+        await this.requests({ sink: conn, incoming, origin, socket: conn, idle });
+        return;
+      }
+      const tunnel = this.options.tunnel;
+      if (!tunnel || target.port !== 443 && await this.tunnelReady(target)) return;
       await tunnel(
         conn,
         incoming,
         target,
         this.stop.signal,
-        (source, sink, origin) => this.requests({ sink, incoming: new Incoming(source), origin, socket: conn })
+        (source, sink, origin) => this.requests({ sink, incoming: new Incoming(source), origin, socket: conn, idle })
       );
     } catch {
     }
   }
+  async tunnelReady(target) {
+    const name2 = `CONNECT ${target.host}:${target.port}`;
+    if (!this.options.tunnel) return new HttpError(501, `${name2}: no tunnels through this proxy`);
+    try {
+      await this.options.tunnelReady?.();
+      return void 0;
+    } catch (e) {
+      return new HttpError(501, `${name2}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }
+  async websocket(ctx, req) {
+    const href = ctx.origin ? tunnelRequestUrl(req, ctx.origin) : requestUrl(webSocketTarget(req));
+    const { transport } = this.options;
+    if (!transport.traits.websocket || !transport.websocket) {
+      if (!this.warnedWebSocket) {
+        this.warnedWebSocket = true;
+        console.warn(`slicc-kernel: a program asked for a WebSocket: ${NO_WEBSOCKET2}`);
+      }
+      throw new HttpError(501, NO_WEBSOCKET2);
+    }
+    const accept2 = await acceptKey(req.headers);
+    const protocols = fieldValues(req.headers, "sec-websocket-protocol").flatMap((v) => v.split(",")).map((t) => t.trim()).filter((t) => t !== "");
+    const hangup = new AbortController();
+    const waiting = new AbortController();
+    void watchHangup(ctx.socket, hangup, waiting.signal);
+    let socket;
+    try {
+      socket = await transport.websocket({
+        url: toHostLoopback(href).replace(/^http/, "ws"),
+        protocols,
+        headers: forwardRequestHeaders(req.headers),
+        signal: AbortSignal.any([this.stop.signal, hangup.signal])
+      });
+    } catch (e) {
+      waiting.abort();
+      throw new HttpError(502, e instanceof Error ? e.message : String(e));
+    }
+    ctx.idle.ms = Number.POSITIVE_INFINITY;
+    try {
+      if (hangup.signal.aborted) throw hangup.signal.reason;
+      if (socket.protocol && !(protocols.includes(socket.protocol) && TOKEN2.test(socket.protocol))) {
+        throw new HttpError(502, "the far end chose a subprotocol the client did not offer");
+      }
+      await ctx.sink.write(switchingHead(accept2, socket.protocol), this.stop.signal);
+      await this.bridge(ctx, socket, hangup.signal);
+    } catch (e) {
+      socket.close(1001, "the client went away");
+      throw e;
+    } finally {
+      waiting.abort();
+    }
+  }
+  async bridge(ctx, socket, hangup) {
+    const stop = this.stop.signal;
+    let chain = Promise.resolve();
+    const toGuest = (bytes) => {
+      chain = chain.then(() => ctx.sink.write(bytes, stop));
+      return chain;
+    };
+    const done4 = new AbortController();
+    const reading = AbortSignal.any([stop, done4.signal, hangup]);
+    const stopping = () => socket.close(1001, "the proxy is stopping");
+    stop.addEventListener("abort", stopping, { once: true });
+    let guestDone = false;
+    let closeSent = false;
+    const outbound2 = (async () => {
+      for await (const data of socket.messages) {
+        if (guestDone) continue;
+        const text = typeof data === "string";
+        await toGuest(
+          frame(text ? OP_TEXT : OP_BINARY, text ? new TextEncoder().encode(data) : data)
+        );
+      }
+      const closed = await socket.closed;
+      if (guestDone) return;
+      closeSent = true;
+      await toGuest(closeFrame(wireCode(closed.code), closed.reason));
+      AbortSignal.timeout(this.limits.closeWaitMs).addEventListener("abort", () => done4.abort(), {
+        once: true
+      });
+    })().catch(() => done4.abort());
+    const reader = new WsReader(ctx.incoming, MESSAGE_LIMIT, true);
+    try {
+      for (; ; ) {
+        const event = await reader.next(reading);
+        if (!event) break;
+        if (event.kind === "ping") {
+          await toGuest(pongFrame(event.payload));
+          continue;
+        }
+        if (event.kind === "close") {
+          guestDone = true;
+          if (closeSent) break;
+          const code = wireCode(event.code);
+          socket.close(code, event.reason);
+          const reply = await Promise.race([
+            socket.closed,
+            quietly(this.limits.closeWaitMs).then(() => ({ code, reason: event.reason }))
+          ]);
+          await toGuest(closeFrame(wireCode(reply.code), reply.reason));
+          break;
+        }
+        while (socket.buffered > SEND_BUFFER2 && !reading.aborted) await quietly(10);
+        socket.send(event.kind === "text" ? event.text : event.bytes);
+      }
+    } catch (e) {
+      if (e instanceof WsError) {
+        guestDone = true;
+        socket.close(e.code, e.message);
+        await toGuest(closeFrame(e.code, e.message)).catch(() => void 0);
+      }
+    } finally {
+      guestDone = true;
+      socket.close(1e3, "the client went away");
+      stop.removeEventListener("abort", stopping);
+      await Promise.race([outbound2, quietly(this.limits.closeWaitMs)]);
+    }
+  }
 };
 
 // src/kernel/net/x509.ts
@@ -8778,7 +9201,42 @@ var Dying = class {
     return [typeof reported === "number" ? reported : CRASHED, void 0];
   }
 };
-function processInit(opts, sab, umask) {
+function notifiers(header3) {
+  return {
+    onPending(sig) {
+      Atomics.or(header3, SAB_I_SIGNALS, sigbit(sig));
+      Atomics.notify(header3, SAB_I_SIGNALS);
+    },
+    onAsync() {
+      Atomics.add(header3, SAB_I_ASYNC, 1);
+      Atomics.notify(header3, SAB_I_ASYNC);
+    }
+  };
+}
+function publishStops(process, header3) {
+  process.onState((state) => {
+    Atomics.store(header3, SAB_I_STOP, state === "stopped" ? 1 : 0);
+    Atomics.notify(header3, SAB_I_STOP);
+  });
+}
+function transferOf(opts, lane) {
+  const transfer = opts.fork ? [opts.fork.memory.buffer] : [];
+  return lane ? [...transfer, lane.port] : transfer;
+}
+function openLane(token, dispatch2) {
+  const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
+  const { port1, port2 } = new MessageChannel();
+  const responder = attachSyncSabResponder(port1, sab, token, { dispatch: dispatch2 });
+  port1.start();
+  return {
+    lane: { sab, port: port2 },
+    dispose() {
+      responder.dispose();
+      port1.close();
+    }
+  };
+}
+function processInit(opts, sab, umask, lane) {
   const base = {
     type: WASM_PROCESS_INIT,
     pid: opts.shownPid ?? opts.pid,
@@ -8791,7 +9249,12 @@ function processInit(opts, sab, umask) {
     ...opts.ppid !== void 0 ? { ppid: opts.ppid } : {}
   };
   if (opts.program.abi === "js") {
-    return { ...base, program: opts.program, fds: inheritedFds(opts.fds) };
+    return {
+      ...base,
+      program: opts.program,
+      fds: inheritedFds(opts.fds),
+      lane
+    };
   }
   return {
     ...base,
@@ -8843,23 +9306,13 @@ function spawnWasmProcess(opts) {
     locks: opts.locks,
     onReap: opts.onReap,
     resolver: opts.resolver,
-    onPending: (sig) => {
-      Atomics.or(header3, SAB_I_SIGNALS, sigbit(sig));
-      Atomics.notify(header3, SAB_I_SIGNALS);
-    },
-    onAsync: () => {
-      Atomics.add(header3, SAB_I_ASYNC, 1);
-      Atomics.notify(header3, SAB_I_ASYNC);
-    },
+    ...notifiers(header3),
     onTimer: (which) => void Atomics.or(header3, SAB_I_TIMERS, 1 << which),
     hasPending: () => Atomics.load(header3, SAB_I_SIGNALS) !== 0 || Atomics.load(header3, SAB_I_TIMERS) !== 0,
     raise: (sig) => signal(sig),
     ...opts.program.abi === "wasi" || opts.program.abi === "js" ? { pendingBits: () => Atomics.load(header3, SAB_I_SIGNALS) } : {}
   });
-  process.onState((state) => {
-    Atomics.store(header3, SAB_I_STOP, state === "stopped" ? 1 : 0);
-    Atomics.notify(header3, SAB_I_STOP);
-  });
+  publishStops(process, header3);
   const holds = new HeldPaths();
   opts.held?.add(holds);
   const token = holdingToken(opts, holds);
@@ -8868,6 +9321,7 @@ function spawnWasmProcess(opts) {
   const dying = new Dying();
   const dispatch2 = (req) => dying.serving(() => isWasmSyscall(req) ? process.syscall(req) : dispatchSyncFs(req));
   const responder = attachSyncSabResponder(worker, sab, token, { dispatch: dispatch2 });
+  const lane = opts.program.abi === "js" ? openLane(token, dispatch2) : void 0;
   const { promise: exited, resolve: settle } = Promise.withResolvers();
   let done4 = false;
   let endedBy;
@@ -8880,6 +9334,7 @@ function spawnWasmProcess(opts) {
     worker.removeEventListener("error", onError);
     for (const tid of [...threads.keys()]) endThread(tid);
     responder.dispose();
+    lane?.dispose();
     revokeSyncFsToken(token);
     opts.held?.delete(holds);
     worker.terminate();
@@ -8950,8 +9405,10 @@ function spawnWasmProcess(opts) {
     };
     tw.postMessage(tinit);
   };
-  const init = processInit(opts, sab, process.umask);
-  worker.postMessage(init, opts.fork ? [opts.fork.memory.buffer] : []);
+  worker.postMessage(
+    processInit(opts, sab, process.umask, lane?.lane),
+    transferOf(opts, lane?.lane)
+  );
   const signal = (sig) => {
     if (process.signal(sig) !== "terminate") return;
     const code = sig === SIG.KILL ? 137 : 128 + sig;
@@ -11429,12 +11886,15 @@ var RemoteTransport = class {
   port;
   waiting = /* @__PURE__ */ new Map();
   nextId = 0;
+  sockets = /* @__PURE__ */ new Map();
   failure;
   constructor(port, traits) {
     this.port = port;
     this.traits = traits;
   }
   receive(reply) {
+    const socket = this.sockets.get(reply.nid);
+    if (socket && this.toSocket(reply, socket)) return;
     const waiter = this.waiting.get(reply.nid);
     if (!waiter) return;
     this.waiting.delete(reply.nid);
@@ -11442,10 +11902,22 @@ var RemoteTransport = class {
       waiter.reject(new TransportError(reply.message, reply.status, reply.code));
     } else waiter.resolve(reply);
   }
+  toSocket(reply, socket) {
+    if (reply.net === "ws-message") socket.queue.push(reply.data);
+    else if (reply.net === "ws-acked") socket.acked(reply.n);
+    else if (reply.net === "ws-closed") {
+      this.sockets.delete(reply.nid);
+      socket.queue.end({ code: reply.code, reason: reply.reason });
+    } else return false;
+    return true;
+  }
   fail(error) {
     this.failure = error;
     for (const waiter of this.waiting.values()) waiter.reject(error);
     this.waiting.clear();
+    for (const socket of this.sockets.values())
+      socket.queue.end({ code: 1011, reason: error.message });
+    this.sockets.clear();
   }
   ask(call) {
     if (this.failure) return Promise.reject(this.failure);
@@ -11524,6 +11996,46 @@ var RemoteTransport = class {
       }
     };
   }
+  async websocket(request) {
+    const nid = ++this.nextId;
+    const { signal } = request;
+    signal.throwIfAborted();
+    const abort = () => this.cancel(nid);
+    signal.addEventListener("abort", abort, { once: true });
+    let opened2;
+    try {
+      opened2 = await this.ask({
+        net: "ws-open",
+        nid,
+        url: request.url,
+        protocols: request.protocols,
+        headers: request.headers
+      });
+    } finally {
+      signal.removeEventListener("abort", abort);
+    }
+    const close = (code, reason) => this.port.postMessage({ net: "ws-close", nid, code, reason });
+    const queue = new MessageQueue(
+      () => close(1e3, "a message is too big"),
+      Number.POSITIVE_INFINITY,
+      (n) => this.port.postMessage({ net: "ws-consumed", nid, n })
+    );
+    let unacked = 0;
+    this.sockets.set(nid, { queue, acked: (n) => void (unacked -= n) });
+    return {
+      protocol: opened2.protocol,
+      get buffered() {
+        return unacked;
+      },
+      send: (data) => {
+        unacked += payloadSize(data);
+        this.port.postMessage({ net: "ws-send", nid, data });
+      },
+      messages: queue,
+      close,
+      closed: queue.closed
+    };
+  }
 };
 
 // src/serve.ts
@@ -12145,7 +12657,7 @@ function hostfsFetchOf(options) {
   };
 }
 function nodeTransport() {
-  const transport = fetchTransport();
+  const transport = fetchTransport({ webSocket: true, webSocketHeaders: true });
   return { ...transport, traits: { ...transport.traits, crossOrigin: "any" } };
 }
 var TERMINATED = "the kernel is terminated";