@ekrooh/bare 0.5.0 → 0.6.0

package/dist/runtime.mjs

@@ -1,5 +1,5 @@
-import { c as createRequestId, d as createPluginRouter, g as ErrorCode, o as MessageProtocol, u as createPluginRegistry, v as MAX_HEADER_BYTES, y as MessageType } from "./messages-BbpF3wNH.mjs";
-import { t as createDefaultPlugins } from "./plugins-DZu_NWVp.mjs";
+import { _ as MAX_FRAME_BYTES, c as createRequestId, g as ErrorCode, n as createBareRuntimeContext, v as MAX_HEADER_BYTES, y as MessageType } from "./messages-CevD8qkV.mjs";
+import { t as createDefaultPlugins } from "./plugins-Ddp2AgOe.mjs";
 import { t as createLogRingBuffer } from "./store-DTg1jN5E.mjs";
 import { TextDecoder, TextEncoder } from "bare-encoding";
 import fs from "bare-fs";
@@ -9,15 +9,176 @@ import http from "bare-http1";
 import ws from "bare-ws";
 // core/lib/get-ipc.ts
 /**
-* Returns the active IPC channel.
-* In BareKit (Android), it uses BareKit.IPC.
+* Returns the active IPC channel, or null when there is no host.
+* In BareKit (Android, iOS), it uses BareKit.IPC.
 * In Bare (Sidecar), it uses Bare.IPC.
 */
 function getIPC() {
 	const IPC = typeof BareKit !== "undefined" ? BareKit.IPC : typeof Bare !== "undefined" ? Bare.IPC : void 0;
 	if (IPC && typeof IPC.resume === "function") IPC.resume();
-	return IPC;
+	return IPC ?? null;
 }
+// core/messages/bytes.ts
+/** Normalizes a binary stream chunk to a `Uint8Array` view without copying.
+* A `Buffer` is already a `Uint8Array`. Anything else (a text WebSocket
+* message, a stray object) is not a protocol frame and throws. */
+function toBytes(data) {
+	if (data instanceof Uint8Array) return data;
+	if (data instanceof ArrayBuffer) return new Uint8Array(data);
+	throw new TypeError(`expected binary data, got ${data === null ? "null" : typeof data}`);
+}
+/** The chunk form Bare's IPC stream writes: a `Buffer` view over the same
+* memory where `Buffer` exists (on Bare `encode` already returns one), the
+* bytes themselves elsewhere. */
+function toIpcChunk(bytes) {
+	if (typeof Buffer === "undefined" || Buffer.isBuffer(bytes)) return bytes;
+	return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+}
+// core/messages/backpressure.ts
+/** Honours `write() === false`: once the target signals pressure, frames queue
+* (bounded) until it drains instead of piling up inside the stream. */
+function createBoundedWriter(target, options) {
+	const hardMax = options.hardMaxQueuedBytes ?? options.maxQueuedBytes * 8;
+	let queue = [];
+	let head = 0;
+	let queued = 0;
+	let blocked = false;
+	let dead = false;
+	let dropped = 0;
+	function flush() {
+		while (!blocked && head < queue.length) {
+			const next = queue[head++];
+			queued -= next.byteLength;
+			if (!target.write(next)) blocked = true;
+		}
+		if (head === queue.length) {
+			queue = [];
+			head = 0;
+		} else if (head > 1024) {
+			queue = queue.slice(head);
+			head = 0;
+		}
+		if (!blocked && dropped > 0) {
+			console.warn(`[loopback] dropped ${dropped} push frame(s) while the client was not reading`);
+			dropped = 0;
+		}
+	}
+	target.on("drain", () => {
+		blocked = false;
+		flush();
+	});
+	return {
+		write(frame, writeOptions) {
+			if (dead) return false;
+			if (!blocked && head === queue.length) {
+				if (!target.write(frame)) blocked = true;
+				return true;
+			}
+			const size = frame.byteLength;
+			if (writeOptions?.droppable) {
+				if (queued + size > options.maxQueuedBytes) {
+					if (dropped === 0) console.warn("[loopback] client is not reading; dropping push frames (newest first)");
+					dropped++;
+					return false;
+				}
+			} else if (queued > 0 && queued + size > hardMax) {
+				dead = true;
+				queue = [];
+				head = 0;
+				queued = 0;
+				options.onOverflow();
+				return false;
+			}
+			queue.push(frame);
+			queued += size;
+			return true;
+		},
+		clear() {
+			queue = [];
+			head = 0;
+			queued = 0;
+		},
+		get queuedBytes() {
+			return queued;
+		}
+	};
+}
+/** Pauses an inbound stream while too much routed work is pending, so a fast
+* sender cannot queue work faster than it completes. */
+function createInboundGate(options) {
+	let pending = 0;
+	let paused = false;
+	function done() {
+		pending--;
+		if (paused && pending <= options.low) {
+			paused = false;
+			options.resume();
+		}
+	}
+	return {
+		/** Counts `work` as pending until it settles. */
+		track(work) {
+			pending++;
+			if (!paused && pending >= options.high) {
+				paused = true;
+				options.pause();
+			}
+			work.then(done, done);
+		},
+		get pending() {
+			return pending;
+		}
+	};
+}
+// core/messages/channel-health.ts
+/**
+* Per-channel decode/framing health tracker for the host↔worklet IPC pipe.
+*
+* The IPC pipe is a raw byte stream with no reconnect seam. A single corrupted
+* byte permanently desyncs the frame boundaries, so every subsequent frame
+* fails to decode. Unconditionally clearing the decoder after each failure
+* keeps parsing garbage forever — the channel is silently dead for the rest of
+* the session, and all host-delegated invokes time out until a restart.
+*
+* Instead we count consecutive decode/framing failures and treat a sustained run
+* as a fatal, unrecoverable desync. The caller then stops parsing rather than
+* spinning on garbage. A single isolated bad chunk is tolerated (the counter
+* resets on any successful frame batch), so transient corruption does not kill a
+* healthy channel.
+*/
+var ChannelHealth = class {
+	maxConsecutiveFailures;
+	consecutiveFailures = 0;
+	fatal = false;
+	constructor(maxConsecutiveFailures = 5) {
+		this.maxConsecutiveFailures = maxConsecutiveFailures;
+	}
+	/** Record a successful frame batch; resets the consecutive-failure counter. */
+	noteSuccess() {
+		this.consecutiveFailures = 0;
+	}
+	/**
+	* Record a decode/framing failure. Returns `true` once the run of
+	* consecutive failures reaches {@link maxConsecutiveFailures}, signalling the
+	* caller that the channel is fatally desynced and parsing should stop.
+	*/
+	noteFailure() {
+		this.consecutiveFailures++;
+		if (this.consecutiveFailures >= this.maxConsecutiveFailures) {
+			this.fatal = true;
+			return true;
+		}
+		return false;
+	}
+	/** Whether a fatal, unrecoverable desync has been reached. */
+	get isFatal() {
+		return this.fatal;
+	}
+	/** Number of consecutive failures since the last successful frame batch. */
+	get failures() {
+		return this.consecutiveFailures;
+	}
+};
 // core/messages/encode-response.ts
 /** Encodes a routed response. A response that cannot be encoded (a result over
 * the 64 KB header limit, or one that does not serialize) is replaced by an
@@ -146,61 +307,76 @@ function createFrameDecoder(protocol) {
 		}
 	};
 }
-// core/messages/channel-health.ts
-/**
-* Per-channel decode/framing health tracker for the host↔worklet IPC pipe.
-*
-* The IPC pipe is a raw byte stream with no reconnect seam. A single corrupted
-* byte permanently desyncs the frame boundaries, so every subsequent frame
-* fails to decode. Unconditionally clearing the decoder after each failure
-* keeps parsing garbage forever — the channel is silently dead for the rest of
-* the session, and all host-delegated invokes time out until a restart.
-*
-* Instead we count consecutive decode/framing failures and treat a sustained run
-* as a fatal, unrecoverable desync. The caller then stops parsing rather than
-* spinning on garbage. A single isolated bad chunk is tolerated (the counter
-* resets on any successful frame batch), so transient corruption does not kill a
-* healthy channel.
-*/
-var ChannelHealth = class {
-	maxConsecutiveFailures;
-	consecutiveFailures = 0;
-	fatal = false;
-	constructor(maxConsecutiveFailures = 5) {
-		this.maxConsecutiveFailures = maxConsecutiveFailures;
-	}
-	/** Record a successful frame batch; resets the consecutive-failure counter. */
-	noteSuccess() {
-		this.consecutiveFailures = 0;
-	}
-	/**
-	* Record a decode/framing failure. Returns `true` once the run of
-	* consecutive failures reaches {@link maxConsecutiveFailures}, signalling the
-	* caller that the channel is fatally desynced and parsing should stop.
-	*/
-	noteFailure() {
-		this.consecutiveFailures++;
-		if (this.consecutiveFailures >= this.maxConsecutiveFailures) {
-			this.fatal = true;
-			return true;
+// core/messages/frame-channel.ts
+function createFrameChannel(options) {
+	const { name, protocol, router, onMalformed } = options;
+	const decoder = createFrameDecoder(protocol);
+	const health = onMalformed.kind === "tolerate" ? new ChannelHealth(onMalformed.maxConsecutiveFailures) : null;
+	const gate = options.inbound ? createInboundGate({
+		high: options.inbound.maxPending,
+		low: Math.floor(options.inbound.maxPending / 2),
+		pause: options.inbound.pause,
+		resume: options.inbound.resume
+	}) : null;
+	let stopped = false;
+	/** Handles a malformed chunk per the channel's policy. */
+	function malformed(reason) {
+		console.error(`${name} malformed frame dropped: ${reason}`);
+		if (health === null) {
+			stopped = true;
+			decoder.clear();
+			if (onMalformed.kind === "close") onMalformed.close();
+			return;
 		}
-		return false;
-	}
-	/** Whether a fatal, unrecoverable desync has been reached. */
-	get isFatal() {
-		return this.fatal;
+		if (health.noteFailure()) {
+			stopped = true;
+			console.error(`${name} channel permanently desynced after repeated malformed frames; no longer parsing it`);
+		}
+		decoder.clear();
 	}
-	/** Number of consecutive failures since the last successful frame batch. */
-	get failures() {
-		return this.consecutiveFailures;
+	function route(message) {
+		const work = router.route(message.header, message.payload).then((response) => {
+			if (response) options.write(encodeResponse(protocol, response));
+		}).catch((err) => {
+			const reason = err instanceof Error ? err.message : String(err);
+			console.error(`${name} routing failed: ${reason}`);
+		});
+		gate?.track(work);
 	}
-};
-// core/messages/host-ipc.ts
-function toUint8Array$2(data) {
-	if (data instanceof Uint8Array) return data;
-	if (typeof Buffer !== "undefined" && Buffer.isBuffer(data)) return new Uint8Array(data);
-	return new Uint8Array(data);
+	return {
+		push(chunk) {
+			if (stopped) return;
+			let bytes;
+			try {
+				bytes = toBytes(chunk);
+			} catch (err) {
+				const reason = err instanceof Error ? err.message : String(err);
+				if (health === null) {
+					malformed(reason);
+					return;
+				}
+				console.error(`${name} non-binary chunk dropped: ${reason}`);
+				return;
+			}
+			if (bytes.byteLength === 0) return;
+			const messages = decoder.push(bytes);
+			if (decoder.error) {
+				malformed(decoder.error.message);
+				return;
+			}
+			health?.noteSuccess();
+			for (const message of messages) {
+				if (options.intercept?.(message)) continue;
+				route(message);
+			}
+		},
+		close() {
+			stopped = true;
+			decoder.clear();
+		}
+	};
 }
+// core/messages/host-ipc.ts
 /** Hard ceiling on concurrently pending host calls. Above this, the oldest call
 * is dropped (its timer cleared and promise rejected) so a flood of invokes
 * cannot grow the pending map without bound. */
@@ -208,10 +384,6 @@ const MAX_CONCURRENT_HOST_CALLS = 1024;
 /** Sane default for a host invoke: five-minute waits let a single stalled host
 * call pin a slot indefinitely, so we default to 30s instead. */
 const DEFAULT_HOST_INVOKE_TIMEOUT_MS = 3e4;
-function writeEncoded(ipc, bytes) {
-	if (typeof Buffer !== "undefined" && typeof Buffer.from === "function") ipc.write(Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes));
-	else ipc.write(bytes);
-}
 function createHostIpcBridge(config) {
 	const { ipc, protocol } = config;
 	const pending = /* @__PURE__ */ new Map();
@@ -277,7 +449,7 @@ function createHostIpcBridge(config) {
 		tryConsumeDownstreamFromHost(raw) {
 			let msg;
 			try {
-				msg = protocol.decode(toUint8Array$2(raw));
+				msg = protocol.decode(toBytes(raw));
 			} catch (err) {
 				const message = err instanceof Error ? err.message : String(err);
 				console.debug(`[ipc] dropped undecodable host frame: ${message}`);
@@ -292,12 +464,12 @@ function createHostIpcBridge(config) {
 				type: "HOST_CAPABILITIES_QUERY",
 				requestId
 			};
-			writeEncoded(ipc, protocol.encode(MessageType.ENVELOPE, header, null));
+			ipc.write(toIpcChunk(protocol.encode(MessageType.ENVELOPE, header, null)));
 			return (await promise).capabilities ?? [];
 		},
 		async invokeOnHost(header, payload, timeoutMs = DEFAULT_HOST_INVOKE_TIMEOUT_MS) {
-			const requestId = header.requestId;
-			if (!requestId) return null;
+			if (!header.requestId) return null;
+			const requestId = createRequestId();
 			const promise = waitFor(requestId, "HOST_INVOKE_RESPONSE", timeoutMs);
 			const hostHeader = {
 				type: "HOST_INVOKE_REQUEST",
@@ -306,13 +478,13 @@ function createHostIpcBridge(config) {
 				event: header.event,
 				args: header.args
 			};
-			writeEncoded(ipc, protocol.encode(MessageType.ENVELOPE, hostHeader, payload));
+			ipc.write(toIpcChunk(protocol.encode(MessageType.ENVELOPE, hostHeader, payload)));
 			const hostResp = await promise;
 			return {
 				type: "INVOKE_RESPONSE",
 				pluginId: hostResp.pluginId,
 				event: hostResp.event,
-				requestId: hostResp.requestId,
+				requestId: header.requestId,
 				result: hostResp.result,
 				error: hostResp.error
 			};
@@ -387,99 +559,267 @@ function installConsoleCapture(store, source = "backend", options = {}) {
 		}
 	};
 }
-// core/messages/backpressure.ts
-/** Honours `write() === false`: once the target signals pressure, frames queue
-* (bounded) until it drains instead of piling up inside the stream. */
-function createBoundedWriter(target, options) {
-	const hardMax = options.hardMaxQueuedBytes ?? options.maxQueuedBytes * 8;
-	let queue = [];
-	let head = 0;
-	let queued = 0;
-	let blocked = false;
-	let dead = false;
-	let dropped = 0;
-	function flush() {
-		while (!blocked && head < queue.length) {
-			const next = queue[head++];
-			queued -= next.byteLength;
-			if (!target.write(next)) blocked = true;
-		}
-		if (head === queue.length) {
-			queue = [];
-			head = 0;
-		} else if (head > 1024) {
-			queue = queue.slice(head);
-			head = 0;
-		}
-		if (!blocked && dropped > 0) {
-			console.warn(`[loopback] dropped ${dropped} push frame(s) while the client was not reading`);
-			dropped = 0;
-		}
+// core/server/loopback-gate.ts
+const COOKIE_PREFIX = "bare_session";
+const ORIGIN_PATTERN = /^https?:\/\/[^/?#\s]+$/;
+/** Reads the token from the `X-Bare-Token` request header (parser-lowercased).
+* `fetch`-based non-browser clients that cannot carry cookies use this. It
+* travels the cleartext loopback like the cookie, and is only trusted from an
+* allowed origin. */
+function tokenFromHeaders(headers) {
+	const value = headers["x-bare-token"];
+	return typeof value === "string" ? value : null;
+}
+/** The session cookie name for a server bound on `port`. Cookies are scoped to
+* the host, not the port, so two loopback servers sharing a browser cookie
+* store (two apps' WebViews, or two desktop backends) would overwrite each
+* other's session under one fixed name. */
+function sessionCookieName(port) {
+	return `${COOKIE_PREFIX}_${port}`;
+}
+/** Reads the `name` cookie's value from the `Cookie` request header. */
+function cookieSession(headers, name) {
+	const cookie = headers["cookie"];
+	if (typeof cookie !== "string") return null;
+	for (const part of cookie.split(";")) {
+		const eq = part.indexOf("=");
+		if (eq === -1) continue;
+		if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();
+	}
+	return null;
+}
+/** Derives the cookie value from the session token so the token itself is not
+* echoed into a request header a local attacker could read back. */
+function sessionNonce(token) {
+	return crypto.createHash("blake2b-256").update(token).digest("hex");
+}
+/** Constant-time string comparison. bare-crypto's `timingSafeEqual` requires
+* equal-length inputs (it throws otherwise), so guard on byte length first. */
+function secretEquals(a, b) {
+	const ab = Buffer.from(a);
+	const bb = Buffer.from(b);
+	if (ab.length !== bb.length) return false;
+	return crypto.timingSafeEqual(ab, bb);
+}
+/** URL-safe random secret for the session token / bootstrap nonce. */
+function randomSecret() {
+	return crypto.randomBytes(32).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+/** `host:port` forms that name the loopback interface on `port`. `localhost`
+* cannot be pointed elsewhere by a remote DNS answer, so accepting it does not
+* reopen DNS rebinding. */
+function loopbackHosts(port) {
+	return [
+		`127.0.0.1:${port}`,
+		`localhost:${port}`,
+		`[::1]:${port}`
+	];
+}
+function createLoopbackGate(options) {
+	const { auth } = options;
+	for (const origin of options.allowedOrigins ?? []) if (!ORIGIN_PATTERN.test(origin)) throw new Error(`allowedOrigins entry is not a bare origin (scheme://host[:port]): '${origin}'`);
+	const token = options.token ?? randomSecret();
+	const cookieValue = sessionNonce(token);
+	let bootstrapNonce = randomSecret();
+	/** The most recently spent bootstrap nonce, kept only to answer replays of
+	* it with 409 (valid once but consumed) instead of 401 (bad credential). */
+	let spentBootstrapNonce = null;
+	let allowedHosts = /* @__PURE__ */ new Set();
+	let allowedOrigins = /* @__PURE__ */ new Set();
+	let cookieName = COOKIE_PREFIX;
+	function hasCredential(headers) {
+		if (!auth) return true;
+		if (secretEquals(tokenFromHeaders(headers) ?? "", token)) return true;
+		return secretEquals(cookieSession(headers, cookieName) ?? "", cookieValue);
+	}
+	/** The DNS-rebinding and cross-origin rule. `Host` must name the bound
+	* server (a rebinding page sends its own hostname). An `Origin`, when sent,
+	* must be the bound origin, a loopback alias of it, or an allowed origin.
+	* A top-level navigation (the first WebView load) sends no `Origin`. */
+	function checkOrigin(headers, requireOrigin) {
+		if (allowedHosts.size === 0) return {
+			ok: false,
+			status: 403,
+			reason: "server not bound yet"
+		};
+		const host = headers["host"];
+		if (typeof host !== "string" || !allowedHosts.has(host)) return {
+			ok: false,
+			status: 403,
+			reason: `host mismatch (got ${typeof host === "string" ? `'${host}'` : "no Host header"})`
+		};
+		const origin = headers["origin"];
+		if (typeof origin !== "string" || origin.length === 0) return requireOrigin ? {
+			ok: false,
+			status: 403,
+			reason: "no Origin header"
+		} : { ok: true };
+		if (!allowedOrigins.has(origin)) return {
+			ok: false,
+			status: 403,
+			reason: `origin mismatch (got '${origin}')`
+		};
+		return { ok: true };
 	}
-	target.on("drain", () => {
-		blocked = false;
-		flush();
-	});
 	return {
-		write(frame, writeOptions) {
-			if (dead) return false;
-			if (!blocked && head === queue.length) {
-				if (!target.write(frame)) blocked = true;
-				return true;
-			}
-			const size = frame.byteLength;
-			if (writeOptions?.droppable) {
-				if (queued + size > options.maxQueuedBytes) {
-					if (dropped === 0) console.warn("[loopback] client is not reading; dropping push frames (newest first)");
-					dropped++;
-					return false;
-				}
-			} else if (queued > 0 && queued + size > hardMax) {
-				dead = true;
-				queue = [];
-				head = 0;
-				queued = 0;
-				options.onOverflow();
-				return false;
-			}
-			queue.push(frame);
-			queued += size;
-			return true;
+		bind(origin) {
+			const hostPort = origin.slice(origin.indexOf("://") + 3);
+			const port = hostPort.slice(hostPort.lastIndexOf(":") + 1);
+			allowedHosts = /* @__PURE__ */ new Set([hostPort, ...loopbackHosts(port)]);
+			cookieName = sessionCookieName(port);
+			allowedOrigins = /* @__PURE__ */ new Set([
+				origin,
+				...loopbackHosts(port).map((h) => `http://${h}`),
+				...options.allowedOrigins ?? []
+			]);
 		},
-		clear() {
-			queue = [];
-			head = 0;
-			queued = 0;
+		token: () => token,
+		bootstrap: () => bootstrapNonce ?? "",
+		admitRequest(headers, resource) {
+			const origin = checkOrigin(headers, false);
+			if (!origin.ok) return origin;
+			if (resource === "gated" && !hasCredential(headers)) return {
+				ok: false,
+				status: 401,
+				reason: "unauthorized"
+			};
+			return { ok: true };
 		},
-		get queuedBytes() {
-			return queued;
+		admitUpgrade(headers) {
+			const origin = checkOrigin(headers, auth);
+			if (!origin.ok) return origin;
+			if (!hasCredential(headers)) return {
+				ok: false,
+				status: 401,
+				reason: `unauthorized (${headers["cookie"] ? "cookie present but invalid" : `no ${cookieName} cookie`})`
+			};
+			return { ok: true };
+		},
+		login(body, headers) {
+			if (!auth) return {
+				ok: true,
+				cookie: null
+			};
+			const credential = body.trim();
+			const byBootstrap = bootstrapNonce !== null && secretEquals(credential, bootstrapNonce);
+			const bySession = hasCredential(headers);
+			if (!byBootstrap && !bySession) return {
+				ok: false,
+				status: spentBootstrapNonce !== null && secretEquals(credential, spentBootstrapNonce) ? 409 : 401
+			};
+			if (byBootstrap) {
+				spentBootstrapNonce = bootstrapNonce;
+				bootstrapNonce = null;
+			}
+			return {
+				ok: true,
+				cookie: `${cookieName}=${cookieValue}; HttpOnly; SameSite=Strict; Path=/`
+			};
+		},
+		socketSource(headers) {
+			const host = headers["host"];
+			return `ws://${typeof host === "string" ? host : ""}`;
 		}
 	};
 }
-/** Pauses an inbound stream while too much routed work is pending, so a fast
-* sender cannot queue work faster than it completes. */
-function createInboundGate(options) {
-	let pending = 0;
-	let paused = false;
-	function done() {
-		pending--;
-		if (paused && pending <= options.low) {
-			paused = false;
-			options.resume();
+// core/server/protocol-socket.ts
+function createProtocolSocketSlot(options) {
+	const handlers = [];
+	let active = null;
+	let activeSince = 0;
+	/** The upgrade waiting out the replacement interval. At most one waits: a
+	* newer one supersedes it, since it would have evicted it on arrival. */
+	let waiting = null;
+	function accept(req, socket, head, reject) {
+		const wait = active ? activeSince + options.replaceMinIntervalMs - Date.now() : 0;
+		if (wait > 0) {
+			if (waiting) {
+				clearTimeout(waiting.timer);
+				waiting.reject("superseded by a newer upgrade", 429);
+			}
+			waiting = {
+				socket,
+				reject,
+				timer: setTimeout(() => {
+					waiting = null;
+					accept(req, socket, head, reject);
+				}, wait)
+			};
+			socket.on("close", () => {
+				if (waiting?.socket !== socket) return;
+				clearTimeout(waiting.timer);
+				waiting = null;
+			});
+			socket.on("error", () => socket.destroy());
+			return;
 		}
+		ws.Server.handshake(req, socket, head, (err) => {
+			if (err) {
+				reject(`handshake failed (${err.message})`);
+				return;
+			}
+			const raw = new ws.Socket({
+				socket,
+				isServer: true,
+				idleTimeout: options.deadPeerTimeoutMs,
+				maxPayload: MAX_FRAME_BYTES
+			});
+			const writer = createBoundedWriter(raw, {
+				maxQueuedBytes: options.maxQueuedBytes,
+				onOverflow: () => {
+					console.error("[loopback] client is not reading and responses are backing up; closing the protocol socket");
+					raw.destroy();
+				}
+			});
+			const client = {
+				on: (event, listener) => raw.on(event, listener),
+				write: (data) => writer.write(data),
+				destroy: () => raw.destroy(),
+				pause: () => raw.pause(),
+				resume: () => raw.resume()
+			};
+			const previous = active;
+			active = {
+				client,
+				writer
+			};
+			activeSince = Date.now();
+			if (previous) {
+				console.warn("[loopback] replaced the existing protocol socket");
+				previous.client.destroy();
+			}
+			raw.on("close", () => {
+				writer.clear();
+				if (active?.client === client) active = null;
+			});
+			raw.on("error", (err) => {
+				console.warn(`[loopback] protocol socket error: ${err.message}`);
+				raw.destroy();
+			});
+			socket.setTimeout(options.idleTimeoutMs, () => raw.destroy());
+			for (const handler of handlers) try {
+				handler(client, req);
+			} catch (e) {
+				const message = e instanceof Error ? e.message : String(e);
+				console.error("Error in loopback WS connection handler:", message);
+			}
+		});
 	}
 	return {
-		/** Counts `work` as pending until it settles. */
-		track(work) {
-			pending++;
-			if (!paused && pending >= options.high) {
-				paused = true;
-				options.pause();
-			}
-			work.then(done, done);
+		accept,
+		onConnection(handler) {
+			handlers.push(handler);
 		},
-		get pending() {
-			return pending;
+		push(frame) {
+			return active ? active.writer.write(frame, { droppable: true }) : false;
+		},
+		close() {
+			active?.client.destroy();
+			if (waiting) {
+				clearTimeout(waiting.timer);
+				waiting.socket.destroy();
+				waiting = null;
+			}
 		}
 	};
 }
@@ -527,40 +867,6 @@ function etagMatches(header, etag) {
 	if (typeof header !== "string") return false;
 	return header.split(",").some((candidate) => candidate.trim() === etag || candidate.trim() === "*");
 }
-/** Reads the token from the `X-Bare-Token` request header (parser-lowercased).
-* `fetch`-based non-browser clients that cannot carry cookies use this.
-* Security note: like the `bare_session` cookie, this credential travels the
-* cleartext 127.0.0.1 loopback — it is only trusted from the bound origin
-* (enforced by `originAllowed`), and is an escape hatch for same-loopback
-* non-browser clients; it is accepted over TLS-agnostic plain HTTP by design. */
-function tokenFromHeaders(headers) {
-	const value = headers["x-bare-token"];
-	return typeof value === "string" ? value : null;
-}
-/** Reads the `bare_session` value from the `Cookie` request header. */
-function cookieSession(headers) {
-	const cookie = headers["cookie"];
-	if (typeof cookie !== "string") return null;
-	for (const part of cookie.split(";")) {
-		const eq = part.indexOf("=");
-		if (eq === -1) continue;
-		if (part.slice(0, eq).trim() === "bare_session") return part.slice(eq + 1).trim();
-	}
-	return null;
-}
-/** Derives the cookie value from the session token so the token itself is not
-* echoed into a request header a local attacker could read back. */
-function sessionNonce(token) {
-	return crypto.createHash("blake2b-256").update(token).digest("hex");
-}
-/** Constant-time string comparison. bare-crypto's `timingSafeEqual` requires
-* equal-length inputs (it throws otherwise), so guard on byte length first. */
-function secretEquals(a, b) {
-	const ab = Buffer.from(a);
-	const bb = Buffer.from(b);
-	if (ab.length !== bb.length) return false;
-	return crypto.timingSafeEqual(ab, bb);
-}
 /** Parses a `Range: bytes=<start>-<end>` header. Returns `null` when absent or
 * unsatisfiable (caller falls back to a 200 full response). */
 function parseRange(value, size) {
@@ -614,195 +920,208 @@ function collectRequestBody(req, maxBytes = Infinity) {
 		});
 	});
 }
+/** Splits a request target into its decoded path segments, or null when the
+* path cannot name a file inside a mount: a malformed escape, or a segment
+* that is `.`/`..` or carries a separator or NUL once decoded (`%2e%2e`,
+* `%2f`, `\`). Empty segments (`//`, a trailing `/`) are dropped. */
+function pathSegments(target) {
+	const rawPath = target.split(/[?#]/, 1)[0];
+	const segments = [];
+	for (const raw of rawPath.split("/")) {
+		if (raw === "") continue;
+		let segment;
+		try {
+			segment = decodeURIComponent(raw);
+		} catch {
+			return null;
+		}
+		if (segment === "." || segment === ".." || /[/\\\0]/.test(segment)) return null;
+		segments.push(segment);
+	}
+	return segments;
+}
+/** The key a mount path is stored under: the same decoded, normalized form a
+* request path is matched in, so `/media/a%20b` and `/media/a b/` name one
+* mount. A path no request could ever match is a programming error. */
+function mountKey(mountPath) {
+	const segments = pathSegments(mountPath);
+	if (segments === null) throw new Error(`invalid mount path: '${mountPath}'`);
+	return `/${segments.join("/")}`;
+}
+/** Whether a bind address names the loopback interface only. */
+function isLoopbackHost(host) {
+	return host === "localhost" || host === "::1" || host === "[::1]" || /^127(\.\d{1,3}){3}$/.test(host);
+}
+/** Whether `candidate` is `root` or lies below it. Both must be absolute,
+* normalized paths. */
+function isWithin(root, candidate) {
+	const rel = path.relative(root, candidate);
+	return rel === "" || rel !== ".." && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel);
+}
 /**
 * The single loopback HTTP+WS server for the worklet. One origin serves the
 * web app (`/`), the media files mounted by plugins, and the framed-protocol
 * WebSocket socket the page connects to. On device it binds `127.0.0.1` on an
-* ephemeral port. Only the explicit **bootstrap** directory mount (`/`, marked
-* `{ public: true }`) is world-readable before auth — a fresh WebView must load
-* the page before it can `POST /login`. Mounted session files (media) and the
-* WS upgrade are gated by a per-session token, accepted as a `bare_session`
-* cookie (set via `POST /login` with the one-time bootstrap nonce or the token)
-* or the `X-Bare-Token` header (non-browser clients). The URL `?token=` query
-* param is **not** accepted — a token must never appear in a URL an observer
-* could read. All responses send `Referrer-Policy: no-referrer`.
+* ephemeral port. Admission (origin rule, session credential, bootstrap login)
+* is decided by the loopback gate (`loopback-gate.ts`); the protocol socket's
+* lifecycle by the protocol socket slot (`protocol-socket.ts`). All responses
+* send `Referrer-Policy: no-referrer`.
 */
 function createLoopbackServer(options = {}) {
 	const host = options.host ?? "127.0.0.1";
 	const port = options.port ?? 0;
-	const authEnabled = options.auth ?? true;
-	const wsIdleTimeoutMs = options.wsIdleTimeoutMs ?? 6e4;
-	const wsDeadPeerTimeoutMs = options.wsDeadPeerTimeoutMs ?? 1e4;
-	const wsReplaceMinIntervalMs = options.wsReplaceMinIntervalMs ?? 1e3;
-	const wsMaxQueuedBytes = options.wsMaxQueuedBytes ?? 2097152;
-	/** URL-safe random secret for the session token / bootstrap nonce. */
-	const randomSecret = () => crypto.randomBytes(32).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+	const auth = options.auth ?? true;
+	if (!auth && !isLoopbackHost(host)) throw new Error(`refusing to bind '${host}' with auth off: only a loopback address may serve without a credential`);
+	const gate = createLoopbackGate({
+		auth,
+		token: options.token,
+		allowedOrigins: options.allowedOrigins
+	});
+	const slot = createProtocolSocketSlot({
+		idleTimeoutMs: options.wsIdleTimeoutMs ?? 6e4,
+		deadPeerTimeoutMs: options.wsDeadPeerTimeoutMs ?? 1e4,
+		replaceMinIntervalMs: options.wsReplaceMinIntervalMs ?? 1e3,
+		maxQueuedBytes: options.wsMaxQueuedBytes ?? 2097152
+	});
 	const fileMounts = /* @__PURE__ */ new Map();
 	const dirMounts = /* @__PURE__ */ new Map();
 	const publicDirMounts = /* @__PURE__ */ new Set();
 	const routeHandlers = /* @__PURE__ */ new Map();
-	const connectionHandlers = [];
-	let token = options.token ?? null;
-	let bootstrapNonce = null;
-	/** The most recently spent bootstrap nonce, kept only to answer replays of
-	* it with 409 (valid-once-but-consumed) instead of 401 (bad credential). */
-	let spentBootstrapNonce = null;
-	let boundOrigin = "";
 	let originPromise = null;
-	let activeSocket = null;
-	let activeWriter = null;
-	let activeSince = 0;
-	/** Non-fatal, never-throwing debug for skipped work (a missing file, a failed
-	* write) — observable in the `core.logs` ring buffer, never able to alter
-	* control flow. */
-	function debugSkip(message) {
-		try {
-			console.debug(message);
-		} catch {}
-	}
-	/** The session cookie value derived from `token`, hashed once per token
-	* instead of on every request (the token is fixed after bind). */
-	let nonceToken = null;
-	let nonceValue = "";
-	function sessionCookieValue(forToken) {
-		if (nonceToken !== forToken) {
-			nonceValue = sessionNonce(forToken);
-			nonceToken = forToken;
-		}
-		return nonceValue;
-	}
-	function isAuthorized(headers) {
-		if (!authEnabled) return true;
-		if (token === null) return false;
-		if (secretEquals(tokenFromHeaders(headers) ?? "", token)) return true;
-		return secretEquals(cookieSession(headers) ?? "", sessionCookieValue(token));
-	}
-	/** DNS-rebinding and cross-origin defense for plain HTTP. In auth (device)
-	* mode the server never advertises a stable hostname, so a browser request
-	* must either carry a same-origin `Origin` header (fetches/subresources) or,
-	* for top-level navigations that send no Origin (the initial WebView load),
-	* a `Host` header pointing back at the bound 127.0.0.1:port. A DNS-rebinding
-	* navigation resolves the loopback address under an attacker-controlled
-	* hostname and therefore sends a foreign `Host`. Dev (auth off) is open. */
-	function originAllowed(headers) {
-		if (!authEnabled) return true;
-		if (boundOrigin === "") return true;
-		const boundHostPort = boundOrigin.slice(7);
-		const host = headers["host"];
-		if (typeof host !== "string" || host !== boundHostPort) return false;
-		const origin = headers["origin"];
-		if (typeof origin === "string" && origin.length > 0 && origin !== boundOrigin) return false;
-		return true;
-	}
 	function writeError(res, status, message) {
+		if (res.headersSent) {
+			res.destroy();
+			return;
+		}
 		res.writeHead(status, {
 			"Content-Type": "text/plain",
 			"Referrer-Policy": "no-referrer"
 		});
 		res.end(message);
 	}
+	/** Logs the cause and answers a bare 500: an exception message can carry
+	* file paths or plugin internals, which never belong in a response body. */
+	function writeInternalError(res, context, err) {
+		const message = err instanceof Error ? err.message : String(err);
+		console.error(`[loopback] ${context} failed: ${message}`);
+		writeError(res, 500, "Internal Server Error");
+	}
 	function handleLogin(req, res) {
 		collectRequestBody(req, 4096).then((body) => {
-			const trimmed = body.trim();
-			const byToken = token !== null && secretEquals(trimmed, token);
-			const byBootstrap = bootstrapNonce !== null && secretEquals(trimmed, bootstrapNonce);
-			const bySession = authEnabled && isAuthorized(req.headers);
-			const accepted = !authEnabled || byToken || byBootstrap || bySession;
-			const bySpentBootstrap = bootstrapNonce === null && spentBootstrapNonce !== null && secretEquals(trimmed, spentBootstrapNonce);
-			if (!accepted) {
-				writeError(res, bySpentBootstrap ? 409 : 401, "Unauthorized");
+			const verdict = gate.login(body, req.headers);
+			if (!verdict.ok) {
+				writeError(res, verdict.status, "Unauthorized");
 				return;
 			}
-			if (byBootstrap && bootstrapNonce !== null) {
-				spentBootstrapNonce = bootstrapNonce;
-				bootstrapNonce = null;
-			}
 			const headers = {
 				"Content-Type": "text/plain",
 				"Cache-Control": "no-store",
 				"Referrer-Policy": "no-referrer"
 			};
-			if (authEnabled && token !== null) headers["Set-Cookie"] = `bare_session=${sessionCookieValue(token)}; HttpOnly; SameSite=Lax; Path=/`;
+			if (verdict.cookie !== null) headers["Set-Cookie"] = verdict.cookie;
 			res.writeHead(200, headers);
 			res.end("ok");
-		}).catch(() => writeError(res, 413, "Request Entity Too Large"));
+		}, () => writeError(res, 413, "Request Entity Too Large")).catch((err) => writeInternalError(res, "POST /login", err));
 	}
-	/** Resolves a request path to a file mount, or a directory mount + relative
-	* path. Directory mounts win on longest-prefix match. */
-	function resolveMount(cleanPath) {
+	/** Resolves a request path to a file mount, or a directory mount + the path
+	* segments below it. Directory mounts win on longest-prefix match. */
+	function resolveMount(cleanPath, segments) {
 		const fileMount = fileMounts.get(cleanPath);
 		if (fileMount) return {
 			kind: "file",
 			filePath: fileMount
 		};
 		let best = null;
-		let bestPrefix = -1;
+		let bestDepth = -1;
 		for (const [prefix, dirPath] of dirMounts) {
-			let rel;
-			if (cleanPath === prefix) rel = "";
-			else if (prefix === "/") rel = cleanPath.replace(/^\/+/, "");
-			else if (cleanPath.startsWith(`${prefix}/`)) rel = cleanPath.slice(prefix.length + 1);
-			else continue;
-			if (prefix.length > bestPrefix) {
-				best = {
-					dirPath,
-					rel,
-					public: publicDirMounts.has(prefix)
-				};
-				bestPrefix = prefix.length;
-			}
+			const prefixSegments = prefix.split("/").filter((s) => s !== "");
+			const depth = prefixSegments.length;
+			if (depth <= bestDepth) continue;
+			if (!prefixSegments.every((s, i) => segments[i] === s)) continue;
+			best = {
+				dirPath,
+				rel: segments.slice(depth),
+				public: publicDirMounts.has(prefix)
+			};
+			bestDepth = depth;
 		}
 		return best ? {
 			...best,
 			kind: "dir"
 		} : null;
 	}
-	/** Resolves a directory-mount request to a concrete file. Only a `public`
-	* (bootstrap) mount applies the SPA fallback (unknown navigation GET →
-	* `index.html`); a non-public directory mount 404s unknown paths so
+	/** Resolves a directory-mount request to a concrete file inside the mount
+	* root (its real path, so a symlink cannot lead outside it). Only a
+	* `public` (bootstrap) mount applies the SPA fallback (unknown navigation
+	* GET → `index.html`); a non-public directory mount 404s unknown paths so
 	* unauthenticated clients never receive bootstrap HTML. Subresource requests
-	* (`Accept` without `text/html`) never fall back — a missing asset is a 404. */
+	* (`Accept` without `text/html`) never fall back — a missing asset is a
+	* 404. */
 	function resolveDirFile(mount, headers) {
-		const candidate = mount.rel === "" ? mount.dirPath : path.join(mount.dirPath, mount.rel);
+		let root;
 		try {
-			const stat = fs.statSync(candidate);
-			if (stat.isFile()) return {
-				filePath: candidate,
-				stat
-			};
-		} catch {}
-		if (mount.rel === "") return indexHtmlIfPresent(mount.dirPath);
-		if (!mount.public) return null;
-		const accept = headers["accept"];
-		if (typeof accept !== "string" || !accept.includes("text/html")) return null;
-		return indexHtmlIfPresent(mount.dirPath);
+			root = fs.realpathSync(mount.dirPath);
+		} catch {
+			console.debug(`[static-server] mount root ${mount.dirPath} is missing — 404`);
+			return null;
+		}
+		const served = (file) => file && {
+			...file,
+			rel: path.relative(root, file.filePath).split(path.sep).join("/")
+		};
+		if (mount.rel.length > 0) {
+			const found = fileWithin(root, path.join(root, ...mount.rel));
+			if (found) return served(found);
+			if (!mount.public) return null;
+			const accept = headers["accept"];
+			if (typeof accept !== "string" || !accept.includes("text/html")) return null;
+		}
+		return served(fileWithin(root, path.join(root, "index.html")));
 	}
-	function indexHtmlIfPresent(dirPath) {
+	/** `candidate` as a served file when it exists, is a regular file, and its
+	* real path stays inside `root`. A missing file is routine (every SPA route,
+	* every missing asset), so it is not logged. */
+	function fileWithin(root, candidate) {
+		let real;
+		try {
+			real = fs.realpathSync(candidate);
+		} catch {
+			return null;
+		}
+		if (!isWithin(root, real)) {
+			console.warn(`[static-server] refused a path that resolves outside its mount: ${candidate}`);
+			return null;
+		}
 		try {
-			const index = path.join(dirPath, "index.html");
-			const stat = fs.statSync(index);
-			if (stat.isFile()) return {
-				filePath: index,
+			const stat = fs.statSync(real);
+			return stat.isFile() ? {
+				filePath: real,
 				stat
-			};
+			} : null;
 		} catch {
-			debugSkip(`[static-server] indexHtmlIfPresent: no index.html under ${dirPath} — 404`);
+			return null;
 		}
-		return null;
 	}
 	/** Strict Content-Security-Policy for HTML documents served by the loopback
-	* server; subresources must stay same-origin (the page talks to the worklet
-	* over the loopback socket). `style-src` needs `'unsafe-inline'` for the
-	* bundled web app's inline styles and `connect-src` allows the same-origin
-	* protocol socket. */
-	const CSP_HEADER = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' ws:";
-	function serveFile(req, res, filePath, knownStat, cache = "no-store") {
+	* server. Subresources stay same-origin; `connect-src` names the one
+	* protocol socket the page may open (`ws:` alone would allow any host).
+	* `style-src` needs `'unsafe-inline'` for the bundled web app's inline
+	* styles. */
+	function cspFor(socketSource) {
+		return `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' ${socketSource}; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'`;
+	}
+	/** Policy for mounted session files (media). They are loaded by `<img>` and
+	* `<video>`, where a response CSP has no effect; it only bites when one is
+	* opened as a document, so a hostile file (an SVG with script) runs in an
+	* opaque, script-less sandbox instead of the app origin. */
+	const MOUNTED_FILE_CSP = "default-src 'none'; style-src 'unsafe-inline'; sandbox";
+	function serveFile(req, res, filePath, knownStat, cache = "no-store", sandboxed = false) {
 		let stat;
 		if (knownStat) stat = knownStat;
 		else try {
 			stat = fs.statSync(filePath);
 		} catch {
-			debugSkip(`[static-server] serveFile: stat failed for ${filePath} — 404`);
+			console.debug(`[static-server] serveFile: stat failed for ${filePath} — 404`);
 			writeError(res, 404, "Not found");
 			return;
 		}
@@ -811,7 +1130,10 @@ function createLoopbackServer(options = {}) {
 			return;
 		}
 		const contentType = mimeTypeFor(filePath);
-		const cspHeader = contentType === "text/html" ? { "Content-Security-Policy": CSP_HEADER } : {};
+		const cspHeader = {
+			"X-Content-Type-Options": "nosniff",
+			...sandboxed ? { "Content-Security-Policy": MOUNTED_FILE_CSP } : contentType === "text/html" ? { "Content-Security-Policy": cspFor(gate.socketSource(req.headers)) } : {}
+		};
 		const range = parseRange(req.headers["range"], stat.size);
 		if (range) {
 			res.writeHead(206, {
@@ -870,146 +1192,98 @@ function createLoopbackServer(options = {}) {
 		});
 		stream.pipe(res);
 	}
-	const server = http.createServer((req, res) => {
-		try {
-			const [rawPath] = (req.url ?? "/").split("?");
-			const cleanPath = rawPath.split("#")[0].replace(/\/+$/, "") || "/";
-			const headers = req.headers;
-			if (!originAllowed(headers)) {
-				writeError(res, 403, "Forbidden");
-				return;
-			}
-			if (req.method === "POST" && cleanPath === "/login") {
-				handleLogin(req, res);
-				return;
-			}
-			if (cleanPath.split("/").includes("..")) {
-				writeError(res, 400, "Bad request");
-				return;
-			}
-			const route = routeHandlers.get(`${req.method} ${cleanPath}`);
-			if (route) {
-				if (!isAuthorized(headers)) {
-					writeError(res, 401, "Unauthorized");
-					return;
-				}
-				try {
-					route(req, res);
-				} catch (err) {
-					writeError(res, 500, err instanceof Error ? err.message : String(err));
-				}
-				return;
-			}
-			const mount = resolveMount(cleanPath);
-			if (!(mount !== null && mount.kind === "dir" && mount.public) && !isAuthorized(headers)) {
-				writeError(res, 401, "Unauthorized");
-				return;
-			}
-			if (mount === null) {
-				writeError(res, 404, "Not found");
+	function handleRequest(req, res) {
+		const headers = req.headers;
+		const segments = pathSegments(req.url ?? "/");
+		if (segments === null) {
+			writeError(res, 400, "Bad request");
+			return;
+		}
+		const cleanPath = `/${segments.join("/")}`;
+		if (req.method === "POST" && cleanPath === "/login") {
+			const verdict = gate.admitRequest(headers, "public");
+			if (!verdict.ok) {
+				writeError(res, verdict.status, "Forbidden");
 				return;
 			}
-			if (mount.kind === "file") {
-				serveFile(req, res, mount.filePath);
+			handleLogin(req, res);
+			return;
+		}
+		const route = routeHandlers.get(`${req.method} ${cleanPath}`);
+		if (route) {
+			const verdict = gate.admitRequest(headers, "gated");
+			if (!verdict.ok) {
+				writeError(res, verdict.status, verdict.status === 401 ? "Unauthorized" : "Forbidden");
 				return;
 			}
-			const resolved = resolveDirFile(mount, headers);
-			if (resolved === null) {
-				writeError(res, 404, "Not found");
-				return;
+			try {
+				route(req, res);
+			} catch (err) {
+				writeInternalError(res, `route ${req.method} ${cleanPath}`, err);
 			}
-			const servedRel = resolved.filePath.slice(mount.dirPath.length).replace(/\\/g, "/").replace(/^\/+/, "");
-			serveFile(req, res, resolved.filePath, resolved.stat, cachePolicyFor(servedRel, mount.public));
+			return;
+		}
+		const mount = resolveMount(cleanPath, segments);
+		const verdict = gate.admitRequest(headers, mount !== null && mount.kind === "dir" && mount.public ? "public" : "gated");
+		if (!verdict.ok) {
+			writeError(res, verdict.status, verdict.status === 401 ? "Unauthorized" : "Forbidden");
+			return;
+		}
+		if (mount === null) {
+			writeError(res, 404, "Not found");
+			return;
+		}
+		if (mount.kind === "file") {
+			serveFile(req, res, mount.filePath, void 0, "no-store", true);
+			return;
+		}
+		const resolved = resolveDirFile(mount, headers);
+		if (resolved === null) {
+			writeError(res, 404, "Not found");
+			return;
+		}
+		serveFile(req, res, resolved.filePath, resolved.stat, cachePolicyFor(resolved.rel, mount.public), !mount.public);
+	}
+	const server = http.createServer((req, res) => {
+		try {
+			handleRequest(req, res);
 		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			res.writeHead(500, { "Content-Type": "text/plain" });
-			res.end(message);
+			writeInternalError(res, `${req.method} request`, err);
 		}
 	});
 	function origin() {
 		if (!originPromise) originPromise = new Promise((resolve, reject) => {
-			token ??= randomSecret();
-			bootstrapNonce ??= randomSecret();
 			server.on("error", reject);
 			server.listen(port, host, () => {
 				const address = server.address();
-				boundOrigin = `http://${host}:${address?.port}`;
-				resolve(boundOrigin);
+				const bound = `http://${host}:${address?.port}`;
+				gate.bind(bound);
+				resolve(bound);
 			});
 		});
 		return originPromise;
 	}
 	server.on("upgrade", (req, socket, head) => {
-		const headers = req.headers;
-		const reject = (reason) => {
+		const reject = (reason, status) => {
 			console.error(`[loopback] upgrade rejected: ${reason}`);
-			socket.destroy();
+			if (status === void 0) {
+				socket.destroy();
+				return;
+			}
+			socket.on("finish", () => socket.destroy());
+			socket.on("error", () => socket.destroy());
+			socket.end(`HTTP/1.1 ${status} ${http.STATUS_CODES[status]}\r\nConnection: close\r
+Content-Length: 0\r
+Referrer-Policy: no-referrer\r
+\r
+`);
 		};
-		const origin = headers["origin"];
-		const allowed = typeof origin === "string" && origin.length > 0 && origin === boundOrigin && boundOrigin !== "";
-		if (authEnabled && !allowed) {
-			reject(`origin mismatch (got ${typeof origin === "string" && origin ? `'${origin}'` : "no Origin header"}, bound '${boundOrigin}')`);
-			return;
-		}
-		if (!isAuthorized(headers)) {
-			reject(`unauthorized (${headers["cookie"] ? "cookie present but invalid" : "no bare_session cookie"})`);
-			return;
-		}
-		if (activeSocket && Date.now() - activeSince < wsReplaceMinIntervalMs) {
-			reject("replacement rate limit (a protocol socket was just accepted)");
+		const verdict = gate.admitUpgrade(req.headers);
+		if (!verdict.ok) {
+			reject(verdict.reason, verdict.status);
 			return;
 		}
-		ws.Server.handshake(req, socket, head, (err) => {
-			if (err) {
-				reject(`handshake failed (${err.message})`);
-				return;
-			}
-			const raw = new ws.Socket({
-				socket,
-				isServer: true,
-				idleTimeout: wsDeadPeerTimeoutMs
-			});
-			const writer = createBoundedWriter(raw, {
-				maxQueuedBytes: wsMaxQueuedBytes,
-				onOverflow: () => {
-					console.error("[loopback] client is not reading and responses are backing up; closing the protocol socket");
-					raw.destroy();
-				}
-			});
-			const client = {
-				on: (event, listener) => raw.on(event, listener),
-				write: (data) => writer.write(data),
-				destroy: () => raw.destroy(),
-				pause: () => raw.pause?.(),
-				resume: () => raw.resume?.()
-			};
-			const previous = activeSocket;
-			activeSocket = client;
-			activeWriter = writer;
-			activeSince = Date.now();
-			if (previous) {
-				console.warn("[loopback] replaced the existing protocol socket");
-				try {
-					previous.destroy();
-				} catch {
-					debugSkip("[static-server] replace: previous socket already closed");
-				}
-			}
-			raw.on("close", () => {
-				writer.clear();
-				if (activeSocket === client) {
-					activeSocket = null;
-					activeWriter = null;
-				}
-			});
-			socket.setTimeout(wsIdleTimeoutMs, () => raw.destroy());
-			for (const handler of connectionHandlers) try {
-				handler(client, req);
-			} catch (e) {
-				const message = e instanceof Error ? e.message : String(e);
-				console.error("Error in loopback WS connection handler:", message);
-			}
-		});
+		slot.accept(req, socket, head, reject);
 	});
 	async function url(path) {
 		return `${await origin()}${path}`;
@@ -1017,55 +1291,47 @@ function createLoopbackServer(options = {}) {
 	return {
 		origin,
 		url,
-		token() {
-			return token ?? "";
-		},
+		token: () => gate.token(),
 		async credentials() {
 			const originUrl = await origin();
 			return {
 				origin: originUrl,
 				port: Number(originUrl.slice(originUrl.lastIndexOf(":") + 1)),
-				token,
-				bootstrap: bootstrapNonce
+				token: gate.token(),
+				bootstrap: gate.bootstrap()
 			};
 		},
 		mount(path, filePath) {
-			fileMounts.set(path, filePath);
+			fileMounts.set(mountKey(path), filePath);
 		},
 		unmount(path) {
-			fileMounts.delete(path);
+			fileMounts.delete(mountKey(path));
 		},
 		mountDir(prefix, dirPath, opts) {
-			dirMounts.set(prefix, dirPath);
-			if (opts?.public) publicDirMounts.add(prefix);
-			else publicDirMounts.delete(prefix);
-		},
-		onConnection(handler) {
-			connectionHandlers.push(handler);
+			const key = mountKey(prefix);
+			dirMounts.set(key, dirPath);
+			if (opts?.public) publicDirMounts.add(key);
+			else publicDirMounts.delete(key);
 		},
+		onConnection: (handler) => slot.onConnection(handler),
 		registerRoute(method, path, handler) {
 			routeHandlers.set(`${method.toUpperCase()} ${path}`, handler);
 		},
-		push(frame) {
-			if (!activeWriter) return false;
-			try {
-				return activeWriter.write(frame, { droppable: true });
-			} catch {
-				debugSkip("[static-server] push: socket.write failed — frame dropped");
-				return false;
-			}
-		},
+		push: (frame) => slot.push(frame),
 		close(cb) {
-			if (activeSocket) try {
-				activeSocket.destroy();
-			} catch {
-				debugSkip("[static-server] close: socket.destroy failed — already closed");
-			}
+			slot.close();
 			server.close(cb);
 		}
 	};
 }
 // core/logs/routes.ts
+const LOG_LEVELS = [
+	"debug",
+	"info",
+	"warn",
+	"error"
+];
+/** Parses the query string, or returns null when an escape is malformed. */
 function queryParams(url) {
 	const out = {};
 	const query = (url ?? "").split("?")[1];
@@ -1073,14 +1339,32 @@ function queryParams(url) {
 	for (const pair of query.split("&")) {
 		const eq = pair.indexOf("=");
 		if (eq === -1) continue;
-		const key = decodeURIComponent(pair.slice(0, eq));
-		out[key] = decodeURIComponent(pair.slice(eq + 1));
+		try {
+			out[decodeURIComponent(pair.slice(0, eq))] = decodeURIComponent(pair.slice(eq + 1));
+		} catch {
+			return null;
+		}
 	}
 	return out;
 }
+function isLogLevel(value) {
+	return LOG_LEVELS.includes(value);
+}
+/** Longest ingested message and tag, in UTF-16 code units. The ring holds a
+* fixed number of entries, so this is what bounds its memory: without it a
+* page could pin capacity × 1 MiB in the worklet. */
+const MAX_INGEST_MESSAGE_CHARS = 8192;
+function truncate(value, max) {
+	return value.length > max ? `${value.slice(0, max)}…` : value;
+}
+/** One entry per line: a line break inside a message would let a page write a
+* line that reads as a backend diagnostic. */
+function oneLine(value) {
+	return value.replace(/\\/g, "\\\\").replace(/\r/g, "\\r").replace(/\n/g, "\\n");
+}
 function formatText(e) {
-	const tag = e.tag ? `[${e.tag}] ` : "";
-	return `[${new Date(e.ts).toISOString()}] ${e.level.toUpperCase()} ${e.source} ${tag}${e.message}`;
+	const tag = e.tag ? `[${oneLine(e.tag)}] ` : "";
+	return `[${new Date(e.ts).toISOString()}] ${e.level.toUpperCase()} ${e.source} ${tag}${oneLine(e.message)}`;
 }
 /** Registers the loopback log routes on the unified server. They inherit the
 * server's auth gate and single-server rule for free:
@@ -1093,9 +1377,17 @@ function formatText(e) {
 function registerLogRoutes(server, store) {
 	server.registerRoute("GET", "/logs", (req, res) => {
 		const params = queryParams(req.url);
+		if (params === null) {
+			res.writeHead(400, {
+				"Content-Type": "text/plain",
+				"Referrer-Policy": "no-referrer"
+			});
+			res.end("Bad request");
+			return;
+		}
 		const tail = params.tail === void 0 ? void 0 : Number(params.tail);
-		const level = params.level || void 0;
-		const source = params.source || void 0;
+		const level = isLogLevel(params.level) ? params.level : void 0;
+		const source = params.source === "web" || params.source === "backend" ? params.source : void 0;
 		const entries = store.view({
 			tail: tail !== void 0 && Number.isFinite(tail) ? tail : void 0,
 			level,
@@ -1121,6 +1413,9 @@ function registerLogRoutes(server, store) {
 			try {
 				parsed = JSON.parse(body);
 			} catch {
+				parsed = null;
+			}
+			if (typeof parsed !== "object" || parsed === null) {
 				res.writeHead(400, {
 					"Content-Type": "text/plain",
 					"Referrer-Policy": "no-referrer"
@@ -1128,17 +1423,20 @@ function registerLogRoutes(server, store) {
 				res.end("Bad request");
 				return;
 			}
-			const source = parsed.source === "backend" ? "backend" : "web";
-			const batch = Array.isArray(parsed.entries) ? parsed.entries : [];
+			const source = "web";
+			const entries = parsed.entries;
+			const batch = Array.isArray(entries) ? entries : [];
 			let accepted = 0;
-			for (const raw of batch) {
-				if (!raw || typeof raw.message !== "string") continue;
+			for (const item of batch) {
+				if (typeof item !== "object" || item === null) continue;
+				const raw = item;
+				if (typeof raw.message !== "string") continue;
 				store.append({
 					ts: Date.now(),
-					level: raw.level ?? "info",
+					level: isLogLevel(raw.level) ? raw.level : "info",
 					source,
-					tag: raw.tag,
-					message: raw.message
+					tag: typeof raw.tag === "string" ? truncate(raw.tag, 64) : void 0,
+					message: truncate(raw.message, MAX_INGEST_MESSAGE_CHARS)
 				});
 				accepted++;
 			}
@@ -1148,7 +1446,7 @@ function registerLogRoutes(server, store) {
 				"Cache-Control": "no-store"
 			});
 			res.end(JSON.stringify({ accepted }));
-		}).catch((err) => {
+		}, (err) => {
 			const message = err instanceof Error ? err.message : String(err);
 			console.error("Discarding oversized /logs batch:", message);
 			res.writeHead(413, {
@@ -1156,17 +1454,22 @@ function registerLogRoutes(server, store) {
 				"Referrer-Policy": "no-referrer"
 			});
 			res.end("Request Entity Too Large");
+		}).catch((err) => {
+			const message = err instanceof Error ? err.message : String(err);
+			console.error(`[loopback] POST /logs failed: ${message}`);
+			if (res.headersSent) {
+				res.destroy();
+				return;
+			}
+			res.writeHead(500, {
+				"Content-Type": "text/plain",
+				"Referrer-Policy": "no-referrer"
+			});
+			res.end("Internal Server Error");
 		});
 	});
 }
 // core/server/websocket-server.ts
-function toUint8Array$1(data) {
-	if (data instanceof Uint8Array) return data;
-	if (data instanceof ArrayBuffer) return new Uint8Array(data);
-	throw new Error("Expected Uint8Array or ArrayBuffer from socket data");
-}
-/** Envelope encoder bound to a loopback server's connected protocol socket —
-* the server-initiated (backend → web) push seam. */
 /** Routed calls pending on one socket before it stops being read. */
 const MAX_PENDING_ROUTES = 32;
 /** Builds the push seam for the server's connected protocol socket: encodes a
@@ -1181,49 +1484,34 @@ function createLoopbackPush(server, protocol) {
 /**
 * Attaches the framed-protocol socket to the unified loopback server. The
 * server owns the WebSocket upgrade (origin check, cookie/token auth, single
-* client, idle timeout); this layer only routes decoded envelopes through the
-* plugin router and writes responses back as raw frames.
+* client, idle timeout); this layer runs one frame channel per socket. A peer
+* that sends a malformed frame is not recoverable on that socket, so it is
+* torn down and the client reconnects.
 */
 function attachWebSocketProtocol(server, context) {
 	const { protocol, pluginRouter } = context;
-	server.onConnection((socket, _request) => {
-		const decoder = createFrameDecoder(protocol);
-		const gate = createInboundGate({
-			high: MAX_PENDING_ROUTES,
-			low: MAX_PENDING_ROUTES / 2,
-			pause: () => socket.pause?.(),
-			resume: () => socket.resume?.()
-		});
-		socket.on("data", (raw) => {
-			const data = toUint8Array$1(raw);
-			if (data.byteLength === 0) {
-				console.debug("[ws] received empty data chunk, ignoring");
-				return;
-			}
-			const messages = decoder.push(data);
-			if (decoder.error) {
-				console.error("Error handling WebSocket message: " + decoder.error.message);
-				socket.destroy();
-				return;
-			}
-			if (messages.length === 0) return;
-			for (const parsed of messages) {
-				const work = pluginRouter.route(parsed.header, parsed.payload).then((pluginResponse) => {
-					if (pluginResponse) socket.write(encodeResponse(protocol, pluginResponse));
-				}).catch((err) => {
-					const message = err instanceof Error ? err.message : String(err);
-					console.error("Error handling WebSocket message:", message);
-				});
-				gate.track(work);
+	server.onConnection((socket) => {
+		const channel = createFrameChannel({
+			name: "[ws]",
+			protocol,
+			router: pluginRouter,
+			write: (frame) => socket.write(frame),
+			onMalformed: {
+				kind: "close",
+				close: () => socket.destroy()
+			},
+			inbound: {
+				maxPending: MAX_PENDING_ROUTES,
+				pause: () => socket.pause?.(),
+				resume: () => socket.resume?.()
 			}
 		});
-		socket.on("close", () => {
-			decoder.clear();
-		});
+		socket.on("data", (chunk) => channel.push(chunk));
+		socket.on("close", () => channel.close());
 		socket.on("error", (err) => {
 			const message = err instanceof Error ? err.message : String(err);
-			console.error("WebSocket connection error:", message);
-			decoder.clear();
+			console.error("[ws] connection error:", message);
+			channel.close();
 			socket.destroy();
 		});
 	});
@@ -1234,12 +1522,11 @@ function readBareArgv() {
 }
 /** Resolves the host-provided worklet configuration from `start(...)`
 * arguments. On-device hosts pass `["<webAssets>", "<storage>", "<cache>"]`
-* (three existing directories, in that order), landing at `Bare.argv[0..2]`;
-* the Bare CLI (dev) passes the binary and the script path instead, so a
-* missing/absent config means dev mode (auth off, fixed port, no handoff
-* file). Falls back to the labeled CLI token syntax (see `resolveCliConfig`)
-* when the positional shape doesn't match, so the same entry works for both
-* device and dev runs. */
+* (three existing directories, in that order), landing at `Bare.argv[0..2]`.
+* Falls back to the labeled CLI token syntax (see `resolveCliConfig`) when the
+* positional shape doesn't match, so the same entry works for device and dev
+* runs. Nothing here turns auth off: the dev backend is selected only by an
+* explicit `mode=dev` token. */
 function resolveWorkletConfig() {
 	const argv = readBareArgv();
 	const webAssets = argv[0];
@@ -1262,19 +1549,22 @@ function resolveWorkletConfig() {
 	return resolveCliConfig(argv);
 }
 /**
-* Parses the dev/CLI labeled-token configuration from bare CLI arguments:
-* `webassets=<dir>`, `storage=<dir>`, `cache=<dir>`, `host=<addr>`,
-* `port=<n>`, `auth=<on|off|true|false|1|0>` — a single `key=value` separator.
-* Unknown labels (e.g. `bootstrap=127.0.0.1:49737`) are ignored and stay
-* consumer-owned.
+* Parses labeled-token configuration from bare CLI arguments, one `key=value`
+* per token: `webassets=<dir>`, `storage=<dir>`, `cache=<dir>`,
+* `host=<addr>`, `port=<n>`, `auth=<on|off|true|false|1|0>`,
+* `mode=<device|dev>` and `origin=<scheme://host[:port]>` (repeatable; an
+* extra allowed page origin, e.g. the Vite dev server). Unknown labels (e.g.
+* `bootstrap=127.0.0.1:49737`) are ignored and stay consumer-owned.
 *
-* Returns the equivalent `WorkletRuntimeOptions` in **dev mode**: `deviceMode:
-* false` (so a `storage=` token does not flip auth on or make the port
-* ephemeral), `auth: false`, `port: 8080`, each overridable by a token. When
-* no labeled tokens are present it returns `{}` (plain dev defaults).
+* Without `mode=dev` the result keeps the secure device defaults (auth on, an
+* ephemeral port), and `auth=off` is ignored with a warning. `mode=dev` selects the dev backend: `deviceMode: false`,
+* `auth: false`, `port: 8080`, each overridable by a token. Returns `{}` when
+* no labeled tokens are present.
 */
 function resolveCliConfig(argv = readBareArgv()) {
 	const parsed = {};
+	const allowedOrigins = [];
+	let dev = false;
 	let matched = false;
 	for (const token of argv) {
 		const m = /^([A-Za-z][A-Za-z0-9]*)=(.*)$/.exec(token);
@@ -1296,29 +1586,33 @@ function resolveCliConfig(argv = readBareArgv()) {
 				break;
 			case "port": {
 				const n = Number(value);
-				if (Number.isInteger(n) && n >= 0 && n <= 65535) parsed.port = n;
+				if (value !== "" && Number.isInteger(n) && n >= 0 && n <= 65535) parsed.port = n;
 				else console.warn(`[bare] ignoring invalid port= token: "${value}"`);
 				break;
 			}
-			case "auth": parsed.auth = value !== "off" && value !== "false" && value !== "0";
+			case "auth":
+				parsed.auth = value !== "off" && value !== "false" && value !== "0";
+				break;
+			case "mode":
+				if (value === "dev") dev = true;
+				else if (value !== "device") console.warn(`[bare] ignoring unknown mode= token: "${value}" (expected device or dev)`);
+				break;
+			case "origin": allowedOrigins.push(value);
 		}
 	}
 	if (!matched) return {};
-	return {
+	if (allowedOrigins.length > 0) parsed.allowedOrigins = allowedOrigins;
+	if (dev) return {
 		deviceMode: false,
 		auth: false,
 		port: 8080,
 		...parsed
 	};
-}
-function toUint8Array(data) {
-	if (data instanceof Uint8Array) return data;
-	if (typeof Buffer !== "undefined" && Buffer.isBuffer(data)) return new Uint8Array(data);
-	return new Uint8Array(data);
-}
-function writeIpc(ipc, bytes) {
-	if (typeof Buffer !== "undefined" && typeof Buffer.from === "function") ipc.write(Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes));
-	else ipc.write(bytes);
+	if (parsed.auth === false) {
+		console.warn("[bare] ignoring auth=off without mode=dev");
+		delete parsed.auth;
+	}
+	return parsed;
 }
 /**
 * Creates one worklet runtime — a per-instance, stateless factory (no
@@ -1327,36 +1621,32 @@ function writeIpc(ipc, bytes) {
 * wire p2p". Mirrors the reference wiring in `core/main.core.ts`.
 */
 function createWorkletRuntime(options = {}) {
-	const deviceMode = options.deviceMode ?? options.storage !== void 0;
+	const deviceMode = options.deviceMode ?? true;
 	const auth = options.auth ?? deviceMode;
 	const port = options.port ?? (deviceMode ? 0 : 8080);
-	const textEncoder = new TextEncoder();
-	const textDecoder = new TextDecoder();
-	const protocol = new MessageProtocol({
-		encode: (str) => textEncoder.encode(str),
-		decode: (bytes) => textDecoder.decode(bytes)
-	});
-	let ipc;
-	try {
-		ipc = getIPC();
-	} catch (err) {
-		console.debug(`[runtime] no host IPC channel available, running without a host: ` + (err instanceof Error ? err.message : String(err)));
-		ipc = void 0;
-	}
-	const hostBridge = ipc ? createHostIpcBridge({
-		ipc,
-		protocol
-	}) : null;
-	const pluginRegistry = createPluginRegistry();
+	const ipc = getIPC();
+	if (!ipc) console.debug("[runtime] no host IPC channel available, running without a host");
 	const server = createLoopbackServer({
 		host: options.host,
 		port,
 		auth,
+		allowedOrigins: options.allowedOrigins,
 		wsIdleTimeoutMs: options.wsIdleTimeoutMs,
 		wsDeadPeerTimeoutMs: options.wsDeadPeerTimeoutMs,
 		wsReplaceMinIntervalMs: options.wsReplaceMinIntervalMs,
 		wsMaxQueuedBytes: options.wsMaxQueuedBytes
 	});
+	let hostBridge = null;
+	const { protocol, pluginRegistry, pluginRouter } = createBareRuntimeContext([], {
+		maxInflight: options.maxInflight,
+		serialPlugins: options.serialPlugins,
+		delegateToHost: (header, payload) => hostBridge?.invokeOnHost(header, payload) ?? Promise.resolve(null),
+		getHostCapabilities: () => hostBridge?.queryCapabilities() ?? Promise.resolve([])
+	});
+	hostBridge = ipc ? createHostIpcBridge({
+		ipc,
+		protocol
+	}) : null;
 	const logStore = createLogRingBuffer(options.logsCapacity ?? 500);
 	installConsoleCapture(logStore, "backend", { minLevel: options.logsMinLevel });
 	registerLogRoutes(server, logStore);
@@ -1368,39 +1658,17 @@ function createWorkletRuntime(options = {}) {
 		store: logStore
 	})) pluginRegistry.register(plugin);
 	for (const plugin of options.plugins ?? []) pluginRegistry.register(plugin);
-	const pluginRouter = createPluginRouter(pluginRegistry, "bare", {
-		maxInflight: options.maxInflight,
-		serialPlugins: options.serialPlugins,
-		delegateToHost: (header, payload) => hostBridge?.invokeOnHost(header, payload) ?? Promise.resolve(null),
-		getHostCapabilities: () => hostBridge?.queryCapabilities() ?? Promise.resolve([])
-	});
 	if (ipc) {
-		const ipcDecoder = createFrameDecoder(protocol);
-		const ipcHealth = new ChannelHealth();
-		ipc.on("data", (data) => {
-			if (ipcHealth.isFatal) return;
-			const messages = ipcDecoder.push(toUint8Array(data));
-			if (ipcDecoder.error) {
-				console.error(`Malformed IPC frame dropped: ${ipcDecoder.error.message}`);
-				if (ipcHealth.noteFailure()) {
-					console.error("IPC channel permanently desynced after repeated malformed frames; stopping host→worklet frame parsing");
-					return;
-				}
-				ipcDecoder.clear();
-				return;
-			}
-			ipcHealth.noteSuccess();
-			if (messages.length === 0) return;
-			for (const parsed of messages) {
-				if (hostBridge?.tryConsumeDownstream(parsed)) continue;
-				pluginRouter.route(parsed.header, parsed.payload).then((pluginResponse) => {
-					if (pluginResponse) writeIpc(ipc, encodeResponse(protocol, pluginResponse));
-				}).catch((err) => {
-					const message = err instanceof Error ? err.message : String(err);
-					console.error(`Malformed IPC frame dropped: ${message}`);
-				});
-			}
+		const bridge = hostBridge;
+		const channel = createFrameChannel({
+			name: "[ipc]",
+			protocol,
+			router: pluginRouter,
+			write: (frame) => ipc.write(toIpcChunk(frame)),
+			onMalformed: { kind: "tolerate" },
+			intercept: (message) => bridge?.tryConsumeDownstream(message) ?? false
 		});
+		ipc.on("data", (data) => channel.push(data));
 	}
 	async function start() {
 		if (options.storage) try {
@@ -1415,11 +1683,18 @@ function createWorkletRuntime(options = {}) {
 			pluginRouter
 		});
 		const credentials = await server.credentials();
-		if (auth && options.storage && options.handoffFile !== false) try {
-			fs.writeFileSync(path.join(options.storage, "handoff.json"), JSON.stringify(credentials));
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			console.error(`Failed to write handoff file: ${message}`);
+		if (auth && options.storage && options.handoffFile !== false) {
+			const { origin, port, bootstrap } = credentials;
+			try {
+				fs.writeFileSync(path.join(options.storage, "handoff.json"), JSON.stringify({
+					origin,
+					port,
+					bootstrap
+				}));
+			} catch (err) {
+				const message = err instanceof Error ? err.message : String(err);
+				console.error(`Failed to write handoff file: ${message}`);
+			}
 		}
 		return credentials;
 	}