@secure-exec/nodejs 0.2.0-rc.1 → 0.2.0-rc.2

package/dist/bridge-handlers.js

@@ -3,8 +3,11 @@
 // Each handler is a plain function that performs the host-side operation.
 // Handler names match HOST_BRIDGE_GLOBAL_KEYS from the bridge contract.
 import * as http from "node:http";
+import * as https from "node:https";
 import * as http2 from "node:http2";
 import * as tls from "node:tls";
+import * as hostUtil from "node:util";
+import * as zlib from "node:zlib";
 import { Duplex, PassThrough } from "node:stream";
 import { readFileSync, realpathSync, existsSync } from "node:fs";
 import { dirname as pathDirname, join as pathJoin, resolve as pathResolve } from "node:path";
@@ -15,9 +18,9 @@ import { HOST_BRIDGE_GLOBAL_KEYS, } from "./bridge-contract.js";
 import { AF_INET, AF_INET6, AF_UNIX, SOCK_DGRAM, SOCK_STREAM, mkdir, FDTableManager, O_RDONLY, O_WRONLY, O_RDWR, O_CREAT, O_TRUNC, O_APPEND, FILETYPE_REGULAR_FILE, } from "@secure-exec/core";
 import { normalizeBuiltinSpecifier } from "./builtin-modules.js";
 import { resolveModule, loadFile } from "./package-bundler.js";
-import { transformDynamicImport, isESM } from "@secure-exec/core/internal/shared/esm-utils";
 import { bundlePolyfill, hasPolyfill } from "./polyfills.js";
-import { createBuiltinESMWrapper, getStaticBuiltinWrapperSource, } from "./esm-compiler.js";
+import { createBuiltinESMWrapper, getBuiltinBindingExpression, getStaticBuiltinWrapperSource, } from "./esm-compiler.js";
+import { transformSourceForImport, transformSourceForImportSync, transformSourceForRequire, transformSourceForRequireSync, } from "./module-source.js";
 import { checkBridgeBudget, assertPayloadByteLength, assertTextPayloadSize, getBase64EncodedByteLength, getHostBuiltinNamedExports, parseJsonWithLimit, polyfillCodeCache, RESOURCE_BUDGET_ERROR_CODE, } from "./isolate-bootstrap.js";
 const SOL_SOCKET = 1;
 const IPPROTO_TCP = 6;
@@ -1965,89 +1968,41 @@ function buildKernelSocketBridgeHandlers(dispatch, socketTable, pid) {
     };
     return { handlers, dispose };
 }
-/**
- * Convert ESM source to CJS-compatible code for require() loading.
- * Handles import declarations, export declarations, and re-exports.
- */
-/** Strip // and /* comments from an export/import list string. */
-function stripComments(s) {
-    return s.replace(/\/\/[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
+function normalizeModuleResolveContext(referrer) {
+    if (!referrer || referrer.endsWith("/")) {
+        return referrer || "/";
+    }
+    return pathDirname(referrer) !== referrer && /\.[^/]+$/.test(referrer)
+        ? pathDirname(referrer)
+        : referrer;
 }
-function convertEsmToCjs(source, filePath) {
-    if (!isESM(source, filePath))
-        return source;
-    let code = source;
-    // Remove const __filename/dirname declarations (already provided by CJS wrapper)
-    code = code.replace(/^\s*(?:const|let|var)\s+__filename\s*=\s*[^;]+;?\s*$/gm, "// __filename provided by CJS wrapper");
-    code = code.replace(/^\s*(?:const|let|var)\s+__dirname\s*=\s*[^;]+;?\s*$/gm, "// __dirname provided by CJS wrapper");
-    // import X from 'Y' → const X = require('Y')
-    code = code.replace(/^\s*import\s+(\w+)\s+from\s+['"]([^'"]+)['"]\s*;?/gm, "const $1 = (function(m) { return m && m.__esModule ? m.default : m; })(require('$2'));");
-    // import { a, b as c } from 'Y' → const { a, b: c } = require('Y')
-    code = code.replace(/^\s*import\s+\{([^}]+)\}\s+from\s+['"]([^'"]+)['"]\s*;?/gm, (_match, imports, mod) => {
-        const mapped = stripComments(imports).split(",").map((s) => {
-            const t = s.trim();
-            if (!t)
-                return null;
-            const parts = t.split(/\s+as\s+/);
-            return parts.length === 2 ? `${parts[0].trim()}: ${parts[1].trim()}` : t;
-        }).filter(Boolean).join(", ");
-        return `const { ${mapped} } = require('${mod}');`;
-    });
-    // import * as X from 'Y' → const X = require('Y')
-    code = code.replace(/^\s*import\s+\*\s+as\s+(\w+)\s+from\s+['"]([^'"]+)['"]\s*;?/gm, "const $1 = require('$2');");
-    // Side-effect imports: import 'Y' → require('Y')
-    code = code.replace(/^\s*import\s+['"]([^'"]+)['"]\s*;?/gm, "require('$1');");
-    // export { a, b } from 'Y' → re-export
-    code = code.replace(/^\s*export\s+\{([^}]+)\}\s+from\s+['"]([^'"]+)['"]\s*;?/gm, (_match, exports, mod) => {
-        return stripComments(exports).split(",").map((s) => {
-            const t = s.trim();
-            if (!t)
-                return "";
-            const parts = t.split(/\s+as\s+/);
-            const local = parts[0].trim();
-            const exported = parts.length === 2 ? parts[1].trim() : local;
-            return `Object.defineProperty(exports, '${exported}', { get: () => require('${mod}').${local}, enumerable: true });`;
-        }).filter(Boolean).join("\n");
-    });
-    // export * from 'Y'
-    code = code.replace(/^\s*export\s+\*\s+from\s+['"]([^'"]+)['"]\s*;?/gm, "Object.assign(exports, require('$1'));");
-    // export default X → module.exports.default = X
-    code = code.replace(/^\s*export\s+default\s+/gm, "module.exports.default = ");
-    // export const/let/var X = ... → const/let/var X = ...; exports.X = X;
-    code = code.replace(/^\s*export\s+(const|let|var)\s+(\w+)\s*=/gm, "$1 $2 =");
-    // Capture the names separately to add exports at the end
-    const exportedVars = [];
-    for (const m of source.matchAll(/^\s*export\s+(?:const|let|var)\s+(\w+)\s*=/gm)) {
-        exportedVars.push(m[1]);
+function selectPackageExportTarget(entry, mode) {
+    if (typeof entry === "string") {
+        return entry;
     }
-    // export function X(...) → function X(...); exports.X = X;
-    code = code.replace(/^\s*export\s+function\s+(\w+)/gm, "function $1");
-    for (const m of source.matchAll(/^\s*export\s+function\s+(\w+)/gm)) {
-        exportedVars.push(m[1]);
+    if (Array.isArray(entry)) {
+        for (const candidate of entry) {
+            const resolved = selectPackageExportTarget(candidate, mode);
+            if (resolved) {
+                return resolved;
+            }
+        }
+        return null;
     }
-    // export class X → class X; exports.X = X;
-    code = code.replace(/^\s*export\s+class\s+(\w+)/gm, "class $1");
-    for (const m of source.matchAll(/^\s*export\s+class\s+(\w+)/gm)) {
-        exportedVars.push(m[1]);
+    if (!entry || typeof entry !== "object") {
+        return null;
     }
-    // export { a, b } (local re-export without from)
-    code = code.replace(/^\s*export\s+\{([^}]+)\}\s*;?/gm, (_match, exports) => {
-        return stripComments(exports).split(",").map((s) => {
-            const t = s.trim();
-            if (!t)
-                return "";
-            const parts = t.split(/\s+as\s+/);
-            const local = parts[0].trim();
-            const exported = parts.length === 2 ? parts[1].trim() : local;
-            return `Object.defineProperty(exports, '${exported}', { get: () => ${local}, enumerable: true });`;
-        }).filter(Boolean).join("\n");
-    });
-    // Append named exports for exported vars/functions/classes
-    if (exportedVars.length > 0) {
-        const lines = exportedVars.map((name) => `Object.defineProperty(exports, '${name}', { get: () => ${name}, enumerable: true });`);
-        code += "\n" + lines.join("\n");
+    const conditionalEntry = entry;
+    const candidates = mode === "import"
+        ? [conditionalEntry.import, conditionalEntry.default, conditionalEntry.require]
+        : [conditionalEntry.require, conditionalEntry.default, conditionalEntry.import];
+    for (const candidate of candidates) {
+        const resolved = selectPackageExportTarget(candidate, mode);
+        if (resolved) {
+            return resolved;
+        }
     }
-    return code;
+    return null;
 }
 /**
  * Resolve a package specifier by walking up directories and reading package.json exports.
@@ -2067,16 +2022,16 @@ function resolvePackageExport(req, startDir, mode = "require") {
             const pkg = JSON.parse(readFileSync(pkgJsonPath, "utf-8"));
             let entry;
             if (pkg.exports) {
-                const exportEntry = pkg.exports[subpath];
-                if (typeof exportEntry === "string")
-                    entry = exportEntry;
-                else if (exportEntry) {
-                    const conditionalEntry = exportEntry;
-                    entry =
-                        mode === "import"
-                            ? conditionalEntry.import ?? conditionalEntry.default ?? conditionalEntry.require
-                            : conditionalEntry.require ?? conditionalEntry.default ?? conditionalEntry.import;
-                }
+                const exportEntry = subpath === "." &&
+                    typeof pkg.exports === "object" &&
+                    pkg.exports !== null &&
+                    !Array.isArray(pkg.exports) &&
+                    !("." in pkg.exports)
+                    ? pkg.exports
+                    : pkg.exports[subpath];
+                const resolvedEntry = selectPackageExportTarget(exportEntry, mode);
+                if (resolvedEntry)
+                    entry = resolvedEntry;
             }
             if (!entry && subpath === ".")
                 entry = pkg.main;
@@ -2111,8 +2066,11 @@ export function buildModuleResolutionBridgeHandlers(deps) {
         if (builtin)
             return builtin;
         // Translate sandbox fromDir to host path for resolution context
-        const sandboxDir = String(fromDir);
-        const hostDir = deps.sandboxToHostPath(sandboxDir) ?? sandboxDir;
+        const referrer = String(fromDir);
+        const sandboxDir = normalizeModuleResolveContext(referrer);
+        const hostDir = normalizeModuleResolveContext(deps.sandboxToHostPath(referrer) ??
+            deps.sandboxToHostPath(sandboxDir) ??
+            sandboxDir);
         const resolveFromExports = (dir) => {
             const resolved = resolvePackageExport(req, dir, resolveMode);
             return resolved ? deps.hostToSandboxPath(resolved) : null;
@@ -2156,20 +2114,12 @@ export function buildModuleResolutionBridgeHandlers(deps) {
         catch { /* fallback failed */ }
         return null;
     };
-    // Sync file read — translates sandbox path and reads via readFileSync.
-    // Transforms dynamic import() to __dynamicImport() and converts ESM to CJS
-    // for npm packages so require() can load ESM-only dependencies.
+    // Sync file read — translates sandbox path and applies parser-backed
+    // CJS transforms when require() needs ESM or import() support.
     handlers[K.loadFileSync] = (filePath) => {
         const sandboxPath = String(filePath);
         const hostPath = deps.sandboxToHostPath(sandboxPath) ?? sandboxPath;
-        try {
-            let source = readFileSync(hostPath, "utf-8");
-            source = convertEsmToCjs(source, hostPath);
-            return transformDynamicImport(source);
-        }
-        catch {
-            return null;
-        }
+        return loadHostModuleSourceSync(hostPath, sandboxPath, "require");
     };
     return handlers;
 }
@@ -2228,6 +2178,53 @@ export function buildConsoleBridgeHandlers(deps) {
     };
     return handlers;
 }
+function getStaticBuiltinRequireSource(moduleName) {
+    switch (moduleName) {
+        case "fs":
+            return "module.exports = globalThis.bridge?.fs || globalThis.bridge?.default || {};";
+        case "fs/promises":
+            return "module.exports = (globalThis.bridge?.fs || globalThis.bridge?.default || {}).promises || {};";
+        case "module":
+            return `module.exports = ${"globalThis.bridge?.module || {" +
+                "createRequire: globalThis._createRequire || function(f) {" +
+                "const dir = f.replace(/\\\\[^\\\\]*$/, '') || '/';" +
+                "return function(m) { return globalThis._requireFrom(m, dir); };" +
+                "}," +
+                "Module: { builtinModules: [] }," +
+                "isBuiltin: () => false," +
+                "builtinModules: []" +
+                "}"};`;
+        case "os":
+            return "module.exports = globalThis._osModule || {};";
+        case "http":
+            return "module.exports = globalThis._httpModule || globalThis.bridge?.network?.http || {};";
+        case "https":
+            return "module.exports = globalThis._httpsModule || globalThis.bridge?.network?.https || {};";
+        case "http2":
+            return "module.exports = globalThis._http2Module || {};";
+        case "dns":
+            return "module.exports = globalThis._dnsModule || globalThis.bridge?.network?.dns || {};";
+        case "child_process":
+            return "module.exports = globalThis._childProcessModule || globalThis.bridge?.childProcess || {};";
+        case "process":
+            return "module.exports = globalThis.process || {};";
+        case "v8":
+            return "module.exports = globalThis._moduleCache?.v8 || {};";
+        default:
+            return null;
+    }
+}
+function loadHostModuleSourceSync(readPath, logicalPath, loadMode) {
+    try {
+        const source = readFileSync(readPath, "utf-8");
+        return loadMode === "require"
+            ? transformSourceForRequireSync(source, logicalPath)
+            : transformSourceForImportSync(source, logicalPath, readPath);
+    }
+    catch {
+        return null;
+    }
+}
 /** Build module loading bridge handlers (loadPolyfill, resolveModule, loadFile). */
 export function buildModuleLoadingBridgeHandlers(deps, 
 /** Extra handlers to dispatch through _loadPolyfill for V8 runtime compatibility. */
@@ -2325,16 +2322,25 @@ dispatchHandlers) {
     // V8 ESM module mode handles static imports natively via module_resolve_callback;
     // this handler covers the __dynamicImport() path used in exec mode.
     handlers[K.dynamicImport] = async () => null;
-    // Async file read + dynamic import transform.
+    // Async file read for CommonJS and ESM loader paths.
     // Also serves ESM wrappers for built-in modules (fs, path, etc.) when
     // used from V8's ES module system which calls _loadFile after _resolveModule.
-    handlers[K.loadFile] = async (path, requestedMode) => {
+    handlers[K.loadFile] = (path, requestedMode) => {
         const p = String(path);
         const loadMode = requestedMode === "require" || requestedMode === "import"
             ? requestedMode
             : (deps.resolveMode ?? "require");
         // Built-in module ESM wrappers (V8 module system resolves 'fs' then loads it)
         const bare = p.replace(/^node:/, "");
+        if (loadMode === "require") {
+            const builtinRequireSource = getStaticBuiltinRequireSource(bare);
+            if (builtinRequireSource)
+                return builtinRequireSource;
+        }
+        const builtinBindingExpression = getBuiltinBindingExpression(bare);
+        if (builtinBindingExpression) {
+            return createBuiltinESMWrapper(builtinBindingExpression, getHostBuiltinNamedExports(bare));
+        }
         const builtin = getStaticBuiltinWrapperSource(bare);
         if (builtin)
             return builtin;
@@ -2342,14 +2348,21 @@ dispatchHandlers) {
         if (hasPolyfill(bare)) {
             return createBuiltinESMWrapper(`globalThis._requireFrom(${JSON.stringify(bare)}, "/")`, getHostBuiltinNamedExports(bare));
         }
-        // Regular files load differently for CommonJS require() vs V8's ESM loader.
-        let source = await loadFile(p, deps.filesystem);
-        if (source === null)
-            return null;
-        if (loadMode === "require") {
-            source = convertEsmToCjs(source, p);
+        const hostPath = deps.sandboxToHostPath?.(p) ?? p;
+        const syncSource = loadHostModuleSourceSync(hostPath, p, loadMode);
+        if (syncSource !== null) {
+            return syncSource;
         }
-        return transformDynamicImport(source);
+        // Regular files load differently for CommonJS require() vs V8's ESM loader.
+        return (async () => {
+            const source = await loadFile(p, deps.filesystem);
+            if (source === null)
+                return null;
+            if (loadMode === "require") {
+                return transformSourceForRequire(source, p);
+            }
+            return transformSourceForImport(source, p);
+        })();
     };
     return handlers;
 }
@@ -2369,6 +2382,40 @@ export function buildTimerBridgeHandlers(deps) {
     };
     return handlers;
 }
+function serializeMimeTypeState(value) {
+    return {
+        value: String(value),
+        essence: value.essence,
+        type: value.type,
+        subtype: value.subtype,
+        params: Array.from(value.params.entries()),
+    };
+}
+export function buildMimeBridgeHandlers() {
+    return {
+        mimeBridge: (operation, input, ...args) => {
+            const mime = new hostUtil.MIMEType(String(input));
+            switch (String(operation)) {
+                case "parse":
+                    return serializeMimeTypeState(mime);
+                case "setType":
+                    mime.type = String(args[0]);
+                    return serializeMimeTypeState(mime);
+                case "setSubtype":
+                    mime.subtype = String(args[0]);
+                    return serializeMimeTypeState(mime);
+                case "setParam":
+                    mime.params.set(String(args[0]), String(args[1]));
+                    return serializeMimeTypeState(mime);
+                case "deleteParam":
+                    mime.params.delete(String(args[0]));
+                    return serializeMimeTypeState(mime);
+                default:
+                    throw new Error(`Unsupported MIME bridge operation: ${String(operation)}`);
+            }
+        },
+    };
+}
 export function buildKernelTimerDispatchHandlers(deps) {
     const handlers = {};
     handlers.kernelTimerCreate = (delayMs, repeat) => {
@@ -2420,6 +2467,25 @@ export function buildKernelTimerDispatchHandlers(deps) {
     };
     return handlers;
 }
+export function buildKernelStdinDispatchHandlers(deps) {
+    const handlers = {};
+    const K = HOST_BRIDGE_GLOBAL_KEYS;
+    handlers[K.kernelStdinRead] = async () => {
+        checkBridgeBudget(deps);
+        if (!deps.liveStdinSource) {
+            return { done: true };
+        }
+        const chunk = await deps.liveStdinSource.read();
+        if (chunk === null || chunk.length === 0) {
+            return { done: true };
+        }
+        return {
+            done: false,
+            dataBase64: Buffer.from(chunk).toString("base64"),
+        };
+    };
+    return handlers;
+}
 export function buildKernelHandleDispatchHandlers(deps) {
     const handlers = {};
     handlers.kernelHandleRegister = (id, description) => {
@@ -2598,8 +2664,23 @@ export function buildChildProcessBridgeHandlers(deps) {
     // Serialize a child process event and push it into the V8 isolate
     const dispatchEvent = (sessionId, type, data) => {
         try {
-            const payload = JSON.stringify({ sessionId, type, data: data instanceof Uint8Array ? Buffer.from(data).toString("base64") : data });
-            deps.sendStreamEvent("childProcess", Buffer.from(payload));
+            let eventType;
+            let payload;
+            if (type === "stdout" || type === "stderr") {
+                eventType = type === "stdout" ? "child_stdout" : "child_stderr";
+                payload = {
+                    sessionId,
+                    dataBase64: Buffer.from(data).toString("base64"),
+                };
+            }
+            else {
+                eventType = "child_exit";
+                payload = {
+                    sessionId,
+                    code: Number(data ?? 1),
+                };
+            }
+            deps.sendStreamEvent(eventType, Buffer.from(JSON.stringify(payload)));
         }
         catch {
             // Context may be disposed
@@ -2741,10 +2822,15 @@ export function buildChildProcessBridgeHandlers(deps) {
 function normalizeLoopbackHostname(hostname) {
     if (!hostname || hostname === "localhost")
         return "127.0.0.1";
-    if (hostname === "127.0.0.1" || hostname === "::1")
+    // Preserve wildcard binds so kernel listener lookup and server.address()
+    // reflect the caller's requested address while loopback connects still
+    // resolve through SocketTable wildcard matching.
+    if (hostname === "127.0.0.1" ||
+        hostname === "::1" ||
+        hostname === "0.0.0.0" ||
+        hostname === "::") {
         return hostname;
-    if (hostname === "0.0.0.0" || hostname === "::")
-        return "127.0.0.1";
+    }
     throw new Error(`Sandbox HTTP servers are restricted to loopback interfaces. Received hostname: ${hostname}`);
 }
 function debugHttpBridge(...args) {
@@ -2752,6 +2838,50 @@ function debugHttpBridge(...args) {
         console.error("[secure-exec http bridge]", ...args);
     }
 }
+const MAX_REDIRECTS = 20;
+function shouldUseKernelHttpClientPath(adapter, urlString) {
+    const loopbackAwareAdapter = adapter;
+    if (typeof loopbackAwareAdapter.__setLoopbackPortChecker !== "function") {
+        return false;
+    }
+    try {
+        const parsed = new URL(urlString);
+        return parsed.protocol === "http:" || parsed.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+async function maybeDecompressHttpBody(buffer, contentEncoding) {
+    const encoding = Array.isArray(contentEncoding)
+        ? contentEncoding[0]
+        : contentEncoding;
+    if (encoding !== "gzip" && encoding !== "deflate") {
+        return buffer;
+    }
+    try {
+        return await new Promise((resolve, reject) => {
+            const decompress = encoding === "gzip" ? zlib.gunzip : zlib.inflate;
+            decompress(buffer, (err, result) => {
+                if (err)
+                    reject(err);
+                else
+                    resolve(result);
+            });
+        });
+    }
+    catch {
+        // Preserve the original bytes when decompression fails.
+        return buffer;
+    }
+}
+function shouldEncodeHttpBodyAsBinary(urlString, headers) {
+    const contentType = headers["content-type"] || "";
+    const headerValue = Array.isArray(contentType) ? contentType.join(", ") : contentType;
+    return (headerValue.includes("octet-stream") ||
+        headerValue.includes("gzip") ||
+        urlString.endsWith(".tgz"));
+}
 /**
  * Create a Duplex stream backed by a kernel socket.
  * Readable side reads from kernel socket readBuffer; writable side writes via send().
@@ -2885,6 +3015,7 @@ export function buildNetworkBridgeHandlers(deps) {
     const kernelHttp2ClientSessions = new Map();
     const http2Sessions = new Map();
     const http2Streams = new Map();
+    const pendingHttp2PushStreams = new Map();
     const http2ServerSessionIds = new WeakMap();
     let nextHttp2SessionId = 1;
     let nextHttp2StreamId = 1;
@@ -3017,6 +3148,173 @@ export function buildNetworkBridgeHandlers(deps) {
         }
         return false;
     });
+    const performKernelHttpRequest = async (urlString, requestOptions) => {
+        const url = new URL(urlString);
+        const isHttps = url.protocol === "https:";
+        const host = url.hostname;
+        const port = Number(url.port || (isHttps ? 443 : 80));
+        const socketId = socketTable.create(host.includes(":") ? AF_INET6 : AF_INET, SOCK_STREAM, 0, pid);
+        await socketTable.connect(socketId, { host, port });
+        const baseTransport = createKernelSocketDuplex(socketId, socketTable, pid);
+        const requestTransport = isHttps
+            ? tls.connect({
+                socket: baseTransport,
+                servername: host,
+                ...(requestOptions.rejectUnauthorized !== undefined
+                    ? { rejectUnauthorized: requestOptions.rejectUnauthorized }
+                    : {}),
+            })
+            : baseTransport;
+        const transport = isHttps ? https : http;
+        return await new Promise((resolve, reject) => {
+            let settled = false;
+            const settleResolve = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                resolve(value);
+            };
+            const settleReject = (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                reject(error);
+            };
+            const req = transport.request({
+                hostname: host,
+                port,
+                path: `${url.pathname}${url.search}`,
+                method: requestOptions.method || "GET",
+                headers: requestOptions.headers || {},
+                agent: false,
+                createConnection: () => requestTransport,
+            }, (res) => {
+                const chunks = [];
+                res.on("data", (chunk) => {
+                    chunks.push(chunk);
+                });
+                res.on("error", (error) => {
+                    requestTransport.destroy();
+                    settleReject(error);
+                });
+                res.on("end", async () => {
+                    const decodedBuffer = await maybeDecompressHttpBody(Buffer.concat(chunks), res.headers["content-encoding"]);
+                    const buffer = Buffer.from(decodedBuffer);
+                    const headers = {};
+                    const rawHeaders = [...res.rawHeaders];
+                    Object.entries(res.headers).forEach(([key, value]) => {
+                        if (typeof value === "string")
+                            headers[key] = value;
+                        else if (Array.isArray(value))
+                            headers[key] = value.join(", ");
+                    });
+                    delete headers["content-encoding"];
+                    const trailers = {};
+                    Object.entries(res.trailers || {}).forEach(([key, value]) => {
+                        if (typeof value === "string")
+                            trailers[key] = value;
+                    });
+                    const result = {
+                        status: res.statusCode || 200,
+                        statusText: res.statusMessage || "OK",
+                        headers,
+                        rawHeaders,
+                        url: urlString,
+                        body: shouldEncodeHttpBodyAsBinary(urlString, res.headers)
+                            ? (() => {
+                                headers["x-body-encoding"] = "base64";
+                                return buffer.toString("base64");
+                            })()
+                            : buffer.toString("utf8"),
+                    };
+                    if (Object.keys(trailers).length > 0) {
+                        result.trailers = trailers;
+                    }
+                    requestTransport.destroy();
+                    settleResolve(result);
+                });
+            });
+            req.on("upgrade", (res, upgradedSocket, head) => {
+                const headers = {};
+                const rawHeaders = [...res.rawHeaders];
+                Object.entries(res.headers).forEach(([key, value]) => {
+                    if (typeof value === "string")
+                        headers[key] = value;
+                    else if (Array.isArray(value))
+                        headers[key] = value.join(", ");
+                });
+                settleResolve({
+                    status: res.statusCode || 101,
+                    statusText: res.statusMessage || "Switching Protocols",
+                    headers,
+                    rawHeaders,
+                    body: head.toString("base64"),
+                    url: urlString,
+                    upgradeSocketId: registerKernelUpgradeSocket(upgradedSocket),
+                });
+            });
+            req.on("connect", (res, connectSocket, head) => {
+                const headers = {};
+                const rawHeaders = [...res.rawHeaders];
+                Object.entries(res.headers).forEach(([key, value]) => {
+                    if (typeof value === "string")
+                        headers[key] = value;
+                    else if (Array.isArray(value))
+                        headers[key] = value.join(", ");
+                });
+                settleResolve({
+                    status: res.statusCode || 200,
+                    statusText: res.statusMessage || "Connection established",
+                    headers,
+                    rawHeaders,
+                    body: head.toString("base64"),
+                    url: urlString,
+                    upgradeSocketId: registerKernelUpgradeSocket(connectSocket),
+                });
+            });
+            req.on("error", (error) => {
+                requestTransport.destroy();
+                settleReject(error);
+            });
+            if (requestOptions.body) {
+                req.write(requestOptions.body);
+            }
+            req.end();
+        });
+    };
+    const performKernelFetch = async (urlString, requestOptions) => {
+        let currentUrl = urlString;
+        let redirected = false;
+        let currentOptions = { ...requestOptions };
+        for (let redirectCount = 0; redirectCount <= MAX_REDIRECTS; redirectCount += 1) {
+            const response = await performKernelHttpRequest(currentUrl, currentOptions);
+            if ([301, 302, 303, 307, 308].includes(response.status)) {
+                const location = response.headers.location;
+                if (location) {
+                    currentUrl = new URL(location, currentUrl).href;
+                    redirected = true;
+                    if (response.status === 301 || response.status === 302 || response.status === 303) {
+                        currentOptions = {
+                            ...currentOptions,
+                            method: "GET",
+                            body: null,
+                        };
+                    }
+                    continue;
+                }
+            }
+            return {
+                ok: response.status >= 200 && response.status < 300,
+                status: response.status,
+                statusText: response.statusText,
+                headers: { ...response.headers },
+                body: response.body,
+                url: currentUrl,
+                redirected,
+            };
+        }
+        throw new Error("Too many redirects");
+    };
     const registerKernelUpgradeSocket = (socket) => {
         const socketId = nextKernelUpgradeSocketId++;
         kernelUpgradeSockets.set(socketId, socket);
@@ -3069,10 +3367,20 @@ export function buildNetworkBridgeHandlers(deps) {
     handlers[K.networkFetchRaw] = async (url, optionsJson) => {
         checkBridgeBudget(deps);
         const options = parseJsonWithLimit("network.fetch options", String(optionsJson), jsonLimit);
-        const result = await adapter.fetch(String(url), options);
-        const json = JSON.stringify(result);
-        assertTextPayloadSize("network.fetch response", json, jsonLimit);
-        return json;
+        deps.activeHttpClientRequests.count += 1;
+        try {
+            const urlString = String(url);
+            const result = shouldUseKernelHttpClientPath(adapter, urlString)
+                ? await performKernelFetch(urlString, options)
+                // Legacy fallback for custom adapters and explicit no-network stubs.
+                : await adapter.fetch(urlString, options);
+            const json = JSON.stringify(result);
+            assertTextPayloadSize("network.fetch response", json, jsonLimit);
+            return json;
+        }
+        finally {
+            deps.activeHttpClientRequests.count = Math.max(0, deps.activeHttpClientRequests.count - 1);
+        }
     };
     handlers[K.networkDnsLookupRaw] = async (hostname) => {
         checkBridgeBudget(deps);
@@ -3082,10 +3390,20 @@ export function buildNetworkBridgeHandlers(deps) {
     handlers[K.networkHttpRequestRaw] = async (url, optionsJson) => {
         checkBridgeBudget(deps);
         const options = parseJsonWithLimit("network.httpRequest options", String(optionsJson), jsonLimit);
-        const result = await adapter.httpRequest(String(url), options);
-        const json = JSON.stringify(result);
-        assertTextPayloadSize("network.httpRequest response", json, jsonLimit);
-        return json;
+        deps.activeHttpClientRequests.count += 1;
+        try {
+            const urlString = String(url);
+            const result = shouldUseKernelHttpClientPath(adapter, urlString)
+                ? await performKernelHttpRequest(urlString, options)
+                // Legacy fallback for custom adapters and explicit no-network stubs.
+                : await adapter.httpRequest(urlString, options);
+            const json = JSON.stringify(result);
+            assertTextPayloadSize("network.httpRequest response", json, jsonLimit);
+            return json;
+        }
+        finally {
+            deps.activeHttpClientRequests.count = Math.max(0, deps.activeHttpClientRequests.count - 1);
+        }
     };
     handlers[K.networkHttpServerRespondRaw] = (serverId, requestId, responseJson) => {
         const numericServerId = Number(serverId);
@@ -3374,6 +3692,28 @@ export function buildNetworkBridgeHandlers(deps) {
             code: err.code,
         }));
     };
+    const resolveHostHttp2FilePath = (filePath) => {
+        // The sandbox defaults process.execPath to /usr/bin/node, but the host-side
+        // http2 respondWithFile helper needs a real host path when serving the Node binary.
+        if (filePath === "/usr/bin/node" && process.execPath) {
+            return process.execPath;
+        }
+        return filePath;
+    };
+    const withHttp2ServerStream = (streamId, action, fallback) => {
+        const stream = http2Streams.get(streamId);
+        if (stream) {
+            return action(stream);
+        }
+        const pending = pendingHttp2PushStreams.get(streamId);
+        if (pending) {
+            pending.operations.push((resolvedStream) => {
+                action(resolvedStream);
+            });
+            return fallback();
+        }
+        throw new Error(`HTTP/2 stream ${String(streamId)} not found`);
+    };
     const attachHttp2ClientStreamListeners = (streamId, stream) => {
         stream.on("response", (headers) => {
             emitHttp2Event("clientResponseHeaders", streamId, JSON.stringify(normalizeHttp2EventHeaders(headers)));
@@ -3717,70 +4057,68 @@ export function buildNetworkBridgeHandlers(deps) {
         return state?.closedPromise ?? Promise.resolve();
     };
     handlers[K.networkHttp2StreamRespondRaw] = (streamId, headersJson) => {
-        const stream = http2Streams.get(Number(streamId));
-        if (!stream) {
-            throw new Error(`HTTP/2 stream ${String(streamId)} not found`);
-        }
         const headers = parseJsonWithLimit("network.http2Stream.respond headers", String(headersJson), jsonLimit);
-        stream.respond(headers);
+        withHttp2ServerStream(Number(streamId), (stream) => {
+            stream.respond(headers);
+        }, () => undefined);
     };
-    handlers[K.networkHttp2StreamPushStreamRaw] = async (streamId, headersJson, optionsJson) => {
+    handlers[K.networkHttp2StreamPushStreamRaw] = (streamId, headersJson, optionsJson) => {
         const stream = http2Streams.get(Number(streamId));
         if (!stream) {
             throw new Error(`HTTP/2 stream ${String(streamId)} not found`);
         }
         const headers = parseJsonWithLimit("network.http2Stream.pushStream headers", String(headersJson), jsonLimit);
         const options = parseJsonWithLimit("network.http2Stream.pushStream options", String(optionsJson), jsonLimit);
-        return await new Promise((resolve, reject) => {
-            try {
-                stream.pushStream(headers, options, (error, pushStream, pushHeaders) => {
-                    if (error) {
-                        resolve(JSON.stringify({
-                            error: JSON.stringify({
-                                message: error.message,
-                                name: error.name,
-                                code: error.code,
-                            }),
-                        }));
-                        return;
-                    }
-                    if (!pushStream) {
-                        reject(new Error("HTTP/2 push stream callback returned no stream"));
-                        return;
-                    }
-                    const pushStreamId = nextHttp2StreamId++;
-                    http2Streams.set(pushStreamId, pushStream);
-                    pushStream.on("close", () => {
-                        http2Streams.delete(pushStreamId);
-                    });
-                    resolve(JSON.stringify({
-                        streamId: pushStreamId,
-                        headers: JSON.stringify(normalizeHttp2EventHeaders(pushHeaders ?? {})),
-                    }));
-                });
+        const pushStreamId = nextHttp2StreamId++;
+        pendingHttp2PushStreams.set(pushStreamId, {
+            operations: [],
+        });
+        stream.pushStream(headers, options, (error, pushStream, pushHeaders) => {
+            const pending = pendingHttp2PushStreams.get(pushStreamId);
+            if (error) {
+                pendingHttp2PushStreams.delete(pushStreamId);
+                emitHttp2SerializedError("serverStreamError", Number(streamId), error);
+                return;
             }
-            catch (error) {
-                reject(error);
+            if (!pushStream) {
+                pendingHttp2PushStreams.delete(pushStreamId);
+                return;
             }
+            http2Streams.set(pushStreamId, pushStream);
+            pushStream.on("close", () => {
+                http2Streams.delete(pushStreamId);
+                pendingHttp2PushStreams.delete(pushStreamId);
+            });
+            for (const operation of pending?.operations ?? []) {
+                operation(pushStream);
+            }
+            pendingHttp2PushStreams.delete(pushStreamId);
+            void pushHeaders;
+        });
+        return JSON.stringify({
+            streamId: pushStreamId,
+            headers: JSON.stringify(normalizeHttp2EventHeaders(headers)),
         });
     };
     handlers[K.networkHttp2StreamWriteRaw] = (streamId, dataBase64) => {
-        const stream = http2Streams.get(Number(streamId));
-        if (!stream) {
-            throw new Error(`HTTP/2 stream ${String(streamId)} not found`);
-        }
-        return stream.write(Buffer.from(String(dataBase64), "base64"));
+        return withHttp2ServerStream(Number(streamId), (stream) => stream.write(Buffer.from(String(dataBase64), "base64")), () => true);
     };
     handlers[K.networkHttp2StreamEndRaw] = (streamId, dataBase64) => {
-        const stream = http2Streams.get(Number(streamId));
-        if (!stream) {
-            throw new Error(`HTTP/2 stream ${String(streamId)} not found`);
-        }
-        if (typeof dataBase64 === "string" && dataBase64.length > 0) {
-            stream.end(Buffer.from(dataBase64, "base64"));
-            return;
-        }
-        stream.end();
+        withHttp2ServerStream(Number(streamId), (stream) => {
+            if (typeof dataBase64 === "string" && dataBase64.length > 0) {
+                stream.end(Buffer.from(dataBase64, "base64"));
+                return;
+            }
+            stream.end();
+        }, () => undefined);
+    };
+    handlers[K.networkHttp2StreamCloseRaw] = (streamId, rstCode) => {
+        withHttp2ServerStream(Number(streamId), (stream) => {
+            if (typeof stream.close !== "function") {
+                throw new Error(`HTTP/2 stream ${String(streamId)} not found`);
+            }
+            stream.close(typeof rstCode === "number" ? Number(rstCode) : undefined);
+        }, () => undefined);
     };
     handlers[K.networkHttp2StreamPauseRaw] = (streamId) => {
         http2Streams.get(Number(streamId))?.pause();
@@ -3789,13 +4127,11 @@ export function buildNetworkBridgeHandlers(deps) {
         http2Streams.get(Number(streamId))?.resume();
     };
     handlers[K.networkHttp2StreamRespondWithFileRaw] = (streamId, filePath, headersJson, optionsJson) => {
-        const stream = http2Streams.get(Number(streamId));
-        if (!stream) {
-            throw new Error(`HTTP/2 stream ${String(streamId)} not found`);
-        }
         const headers = parseJsonWithLimit("network.http2Stream.respondWithFile headers", String(headersJson), jsonLimit);
         const options = parseJsonWithLimit("network.http2Stream.respondWithFile options", String(optionsJson), jsonLimit);
-        stream.respondWithFile(String(filePath), headers, options);
+        withHttp2ServerStream(Number(streamId), (stream) => {
+            stream.respondWithFile(resolveHostHttp2FilePath(String(filePath)), headers, options);
+        }, () => undefined);
     };
     handlers[K.networkHttp2ServerRespondRaw] = (serverId, requestId, responseJson) => {
         resolveHttp2CompatResponse({