@specific.dev/spectest 0.101.0 → 0.102.0

package/dist/daemon.js

@@ -57,9 +57,10 @@ import { bindInstrumentationScope, createInstrumentationScope, runInstrumented,
 import { encodeRegistry } from "./harness/names-registry.js";
 import { InterceptRegistry, parseTarget, runChain, } from "./harness/intercept.js";
 import { HOP_BY_HOP_HEADERS, withIngressCors, upstreamRequestHeaders, } from "./harness/http-proxy.js";
-import { WS_BRIDGE_HANDLERS, openUpstreamWebSocket, parseSubprotocols, upstreamHandshakeHeaders, } from "./harness/ws-bridge.js";
+import { openUpstreamWebSocket, parseSubprotocols, upstreamHandshakeHeaders, } from "./harness/ws-bridge.js";
 import { certCovers as hostmatchCertCovers, hostWithoutPort, matchRoute, selectCertName, wildcardSuffix, } from "./harness/hostmatch.js";
 import { INGRESS_HTTPS_PORT, INGRESS_HTTP_PORT, bindRoute, clearTables, emptyTables, planBind, registryTarget, routesFor, unbindRoute, } from "./harness/ingress-table.js";
+import { startIngressServer } from "./harness/ingress-server.js";
 import { startHttp2Proxy } from "./harness/http2-proxy.js";
 import { startTlsTerminator } from "./harness/tls-terminator.js";
 import { runContainerArgs } from "./harness/container-run.js";
@@ -1495,11 +1496,10 @@ let LOWERED = {
     aliasesByService: {},
     wildcards: [],
 };
-/** Running HTTP servers per port (Bun.Server). Rebuilt on /load. */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
+/** Running HTTP servers per port. Rebuilt on /load. */
 const INGRESS_HTTP_SERVERS = new Map();
+const INGRESS_HTTP_STARTING = new Map();
 /** Running HTTPS servers per port (currently always {INGRESS_HTTPS_PORT}). */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 const INGRESS_HTTPS_SERVERS = new Map();
 /**
  * The :443 TLS terminator, once per harness process.
@@ -1564,6 +1564,7 @@ function stopIngressServers() {
         }
     }
     INGRESS_HTTP_SERVERS.clear();
+    INGRESS_HTTP_STARTING.clear();
     for (const [port, srv] of INGRESS_HTTPS_SERVERS) {
         try {
             srv.stop?.(true);
@@ -1691,7 +1692,7 @@ async function startIngress() {
         // eslint-disable-next-line no-console
         console.warn(`[ingress] root CA missing at ${CA_PATH}; skipping HTTPS bind (fakes/proxies will be HTTP-only)`);
     }
-    const Bun = requireBun();
+    requireBun();
     // Resolve every ingress hostname to its handler into the live per-port
     // route tables (module scope, so runtime `tls` can extend them later).
     // Fakes run an in-daemon handler on their declared port; proxies
@@ -1732,13 +1733,13 @@ async function startIngress() {
     for (const [port, byHost] of INGRESS.routesByPort) {
         if (port === INGRESS_HTTPS_PORT)
             continue;
-        INGRESS_HTTP_SERVERS.set(port, bindIngressServer(Bun, port, byHost, `port ${port}`));
+        await ensureHttpIngress(port, byHost);
         // eslint-disable-next-line no-console
         console.log(`[ingress] http :${port} for ${[...byHost.keys()].join(", ")}`);
     }
     // ── HTTPS listener on INGRESS_HTTPS_PORT: SNI per certificated hostname.
     if (INGRESS.certByHost.size > 0)
-        await ensureHttpsIngress(Bun);
+        await ensureHttpsIngress();
     // Seed the resolver's names registry: ingress hostnames (fakes, TLS
     // proxies, dnsName(→ingress)) → bridge gateway, plus ingress-targeted
     // wildcards. Service-targeted wildcards wait for the post-container pass
@@ -1750,17 +1751,17 @@ function requireBun() {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const Bun = globalThis.Bun;
     if (!Bun?.serve) {
-        throw new Error("ingress requires Bun.serve; the daemon must run under Bun (it does in-VM)");
+        throw new Error("ingress requires Bun; the daemon must run under Bun (it does in-VM)");
     }
     return Bun;
 }
 /**
  * Bring :443 up, once.
  *
- * Two pieces: a plaintext `Bun.serve` on an ephemeral loopback port that
+ * Two pieces: a plaintext HTTP server on an ephemeral loopback port that
  * carries the HTTPS route table (and therefore all the routing, fake
- * dispatch, interception, reverse-proxying and `server.upgrade()`
- * WebSocket bridging that :80 already gets, unchanged), and the TLS
+ * dispatch, interception, reverse-proxying and WebSocket
+ * bridging that :80 already gets, unchanged), and the TLS
  * terminator in front of it on :443.
  *
  * **This is idempotent, and that is the feature.** Adding a certificate
@@ -1781,27 +1782,25 @@ function requireBun() {
  * container can reach (containers arrive at the bridge gateway), so the
  * only way in is through the terminator.
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-async function ensureHttpsIngress(Bun) {
+async function ensureHttpsIngress() {
     if (INGRESS_HTTPS_SERVERS.has(INGRESS_HTTPS_PORT))
         return;
     if (!HTTPS_INGRESS_STARTING) {
         // Cleared on both outcomes: once bound, the check above short-circuits
         // every later caller, and a failed bind must be retryable rather than
         // remembered as a rejection for the life of the project.
-        HTTPS_INGRESS_STARTING = startHttpsIngress(Bun).finally(() => {
+        HTTPS_INGRESS_STARTING = startHttpsIngress().finally(() => {
             HTTPS_INGRESS_STARTING = undefined;
         });
     }
     return HTTPS_INGRESS_STARTING;
 }
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-async function startHttpsIngress(Bun) {
+async function startHttpsIngress() {
     const routes = routesFor(INGRESS, INGRESS_HTTPS_PORT);
     // `proto` is passed rather than inferred: this listener speaks plain
     // HTTP, but everything reaching it arrived over TLS, so X-Forwarded-Proto
     // must say https.
-    const plain = bindIngressServer(Bun, 0, routes, `https :${INGRESS_HTTPS_PORT}`, {
+    const plain = await bindIngressServer(0, routes, `https :${INGRESS_HTTPS_PORT}`, {
         proto: "https",
         hostname: "127.0.0.1",
     });
@@ -1884,7 +1883,7 @@ async function bindRuntimeTls(hostname, service, port, http2, cors) {
     if (!existsSync(CA_PATH) || !existsSync(CA_KEY_PATH)) {
         throw new Error(`runtime tls for ${JSON.stringify(host)} requires the in-VM root CA at ${CA_PATH}`);
     }
-    const Bun = requireBun();
+    requireBun();
     const route = { kind: "proxy", service, port, http2, cors };
     // Decide the cost before mutating anything: an already-covered hostname
     // (an exact duplicate, or one under a boot wildcard) needs only a route.
@@ -1899,9 +1898,7 @@ async function bindRuntimeTls(hostname, service, port, http2, cors) {
     // the route is only reachable once the hostname resolves, which is the
     // registry write at the end.
     bindRoute(INGRESS, host, route);
-    if (!INGRESS_HTTP_SERVERS.has(INGRESS_HTTP_PORT)) {
-        INGRESS_HTTP_SERVERS.set(INGRESS_HTTP_PORT, bindIngressServer(Bun, INGRESS_HTTP_PORT, routesFor(INGRESS, INGRESS_HTTP_PORT), `port ${INGRESS_HTTP_PORT}`));
-    }
+    await ensureHttpIngress(INGRESS_HTTP_PORT, routesFor(INGRESS, INGRESS_HTTP_PORT));
     if (plan.needsCert) {
         // The terminator reads this table on every handshake, so the leaf is
         // live the moment it lands — no listener is touched, and no connection
@@ -1909,7 +1906,7 @@ async function bindRuntimeTls(hostname, service, port, http2, cors) {
         INGRESS.certByHost.set(host, await generateHostCert(host, [host]));
     }
     if (plan.needsHttpsListener)
-        await ensureHttpsIngress(Bun);
+        await ensureHttpsIngress();
     // Resolve the hostname to the daemon gateway (where :443/:80 listen).
     // A wildcard can only live in the resolver's suffix table.
     const gw = await bridgeGatewayIp();
@@ -1946,57 +1943,27 @@ async function unbindRuntimeTls(hostname) {
         await writeRegistry();
     }
 }
-/**
- * Spin up one Bun.serve listener bound to (port, optional TLS) that
- * dispatches every request to the matching Route by Host header.
- *
- * Shared by the HTTP and HTTPS branches. Also carries the `websocket`
- * handler set so reverse-proxy targets can transparently bridge WS
- * upgrades through to their upstream service.
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function bindIngressServer(
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-Bun, port, byHost, listenerLabel, 
-// Every ingress listener speaks plain HTTP now — the one behind :443
-// sits under the TLS terminator. So the scheme a client actually used
-// can no longer be inferred from the socket and is declared instead; it
-// stamps X-Forwarded-Proto, which upstreams that build absolute URLs or
-// redirect depend on.
-serve = { proto: "http" }) {
-    const proto = serve.proto;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const opts = {
+/** Concurrent runtime routes must share the asynchronous first bind. */
+async function ensureHttpIngress(port, byHost) {
+    if (INGRESS_HTTP_SERVERS.has(port))
+        return;
+    let starting = INGRESS_HTTP_STARTING.get(port);
+    if (!starting) {
+        starting = bindIngressServer(port, byHost, `port ${port}`).then(server => {
+            INGRESS_HTTP_SERVERS.set(port, server);
+        }).finally(() => INGRESS_HTTP_STARTING.delete(port));
+        INGRESS_HTTP_STARTING.set(port, starting);
+    }
+    await starting;
+}
+/** Bind the shared HTTP/1 ingress handler, including the listener behind TLS. */
+async function bindIngressServer(port, byHost, listenerLabel, serve = { proto: "http" }) {
+    return startIngressServer({
         port,
         hostname: serve.hostname ?? "0.0.0.0",
-        // SO_REUSEPORT on every ingress listener. It was introduced so a
-        // replacement :443 could overlap the original during a certificate
-        // swap; the terminator removed that swap, and this stays for the
-        // remaining case — the `/load` teardown force-closes and rebinds, and
-        // a socket the kernel has not finished releasing would otherwise fail
-        // the next bind with "Is port 443 in use?". Note the flip side, which
-        // {@link stopIngressServers} depends on: a half-alive listener shares
-        // the port silently instead of colliding loudly.
         reusePort: true,
-        // OCI layer uploads can exceed Bun's default 128 MiB request limit.
-        // Large proxy bodies stream through; this limit does not allocate a buffer.
-        maxRequestBodySize: 1024 ** 4,
-        // Bun.serve defaults to a 10s idleTimeout, which kills any proxied
-        // request whose upstream takes >10s to produce bytes — under parallel
-        // test load that surfaced as "fetch failed"/"other side closed" on
-        // deploy-archive uploads and ERR_EMPTY_RESPONSE in browser tests
-        // ([Bun.serve]: request timed out after 10 seconds). Ingress fronts
-        // arbitrarily slow app endpoints (deploys can legitimately take
-        // minutes), so disable the idle timeout entirely; forked test VMs are
-        // short-lived, leaked-connection risk is bounded by the fork.
-        idleTimeout: 0,
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        fetch: (req, server) => dispatchIngress(req, server, byHost, listenerLabel, proto),
-        // The frame relay for bridged WebSocket upgrades; `proxyToService`
-        // opens the upstream before it upgrades the client (harness/ws-bridge.ts).
-        websocket: WS_BRIDGE_HANDLERS,
-    };
-    return Bun.serve(opts);
+        fetch: (req, server) => dispatchIngress(req, server, byHost, listenerLabel, serve.proto),
+    });
 }
 /**
  * Resolve a Host header to a route: an exact entry first, then the longest
@@ -2128,7 +2095,7 @@ server, service, port, listenerLabel, proto) {
             headers: selected ? { "sec-websocket-protocol": selected } : undefined,
         });
         if (ok) {
-            // Bun has already taken over the response — return a stub.
+            // The WebSocket has already taken over the response — return a stub.
             return new Response(null, { status: 101 });
         }
         try {
@@ -2189,6 +2156,7 @@ server, service, port, listenerLabel, proto) {
                 headers: fwdHeaders,
                 body: hasBody ? (bufferedBody ?? req.body) : undefined,
                 redirect: "manual",
+                signal: req.signal,
             });
             // decompress:false → forward the encoded body untouched (see fn doc).
             // keepalive:false → fresh connection per request (see fwdHeaders above).
@@ -2198,7 +2166,7 @@ server, service, port, listenerLabel, proto) {
                 keepalive: false,
                 // eslint-disable-next-line @typescript-eslint/no-explicit-any
             });
-            // Strip hop-by-hop response headers; let Bun set content-length / TE.
+            // Strip connection framing while preserving the unchanged body's length.
             const respHeaders = new Headers();
             for (const [k, v] of upstreamRes.headers) {
                 if (HOP_BY_HOP_HEADERS.has(k.toLowerCase()))

package/dist/harness/ingress-server.d.ts

@@ -0,0 +1,26 @@
+import { type WsBridgeData } from "./ws-bridge.js";
+export interface IngressServer {
+    port: number;
+    stop(force?: boolean): void;
+    requestIP(req: Request): {
+        address: string;
+        port: number;
+    } | undefined;
+    upgrade(req: Request, options: {
+        data: WsBridgeData;
+        headers?: Record<string, string>;
+    }): boolean;
+}
+/**
+ * Serve the ingress's Fetch handlers through node:http. Bun.serve discards
+ * Content-Length on a still-streaming Response, even when its bytes are
+ * unchanged. ServerResponse preserves the declared length while pipeline
+ * propagates backpressure and cancellation without buffering the whole body.
+ * This is also the HTTP/1 listener behind the TLS terminator.
+ */
+export declare function startIngressServer(options: {
+    port: number;
+    hostname?: string;
+    reusePort?: boolean;
+    fetch(req: Request, server: IngressServer): Response | undefined | Promise<Response | undefined>;
+}): Promise<IngressServer>;

package/dist/harness/ingress-server.js

@@ -0,0 +1,166 @@
+import http from "node:http";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { WS_BRIDGE_HANDLERS } from "./ws-bridge.js";
+// Load the installed implementation, not Bun's built-in `ws` replacement.
+// On Bun 1.4.0 that replacement cannot upgrade node:http sockets after the
+// asynchronous upstream handshake. The package uses the ordinary socket API.
+const require = createRequire(import.meta.url);
+const { WebSocketServer } = require(join(dirname(require.resolve("ws/package.json")), "index.js"));
+/**
+ * Serve the ingress's Fetch handlers through node:http. Bun.serve discards
+ * Content-Length on a still-streaming Response, even when its bytes are
+ * unchanged. ServerResponse preserves the declared length while pipeline
+ * propagates backpressure and cancellation without buffering the whole body.
+ * This is also the HTTP/1 listener behind the TLS terminator.
+ */
+export async function startIngressServer(options) {
+    const peers = new WeakMap();
+    const upgrades = new WeakMap();
+    const protocols = new WeakMap();
+    const sockets = new Set();
+    const websockets = new WebSocketServer({
+        noServer: true,
+        // The upstream handshake has already selected a protocol. Never select
+        // the client's first offer on its behalf.
+        handleProtocols: (_offered, req) => protocols.get(req) || false,
+    });
+    const server = http.createServer({ requestTimeout: 0 }, (req, res) => {
+        void dispatch(req, res);
+    });
+    server.on("connection", socket => {
+        sockets.add(socket);
+        socket.once("close", () => sockets.delete(socket));
+    });
+    server.on("upgrade", (req, socket, head) => {
+        void dispatch(req, undefined, { req, socket: socket, head, upgraded: false });
+    });
+    const facade = {
+        port: 0,
+        stop(force = false) {
+            if (force) {
+                for (const ws of websockets.clients)
+                    ws.terminate();
+                for (const socket of sockets)
+                    socket.destroy();
+                server.closeAllConnections();
+            }
+            websockets.close();
+            server.close();
+        },
+        requestIP(req) {
+            const socket = peers.get(req);
+            return socket?.remoteAddress && socket.remotePort
+                ? { address: socket.remoteAddress, port: socket.remotePort } : undefined;
+        },
+        upgrade(req, opts) {
+            const pending = upgrades.get(req);
+            if (!pending || pending.upgraded || pending.socket.destroyed)
+                return false;
+            protocols.set(pending.req, opts.headers?.["sec-websocket-protocol"]);
+            websockets.handleUpgrade(pending.req, pending.socket, pending.head, ws => {
+                pending.upgraded = true;
+                const client = {
+                    data: opts.data,
+                    send: (data) => ws.send(data),
+                    close: (code, reason) => ws.close(code, reason),
+                };
+                ws.on("message", (data, binary) => WS_BRIDGE_HANDLERS.message(client, binary ? Buffer.from(data) : data.toString()));
+                ws.on("close", (code, reason) => WS_BRIDGE_HANDLERS.close(client, code, reason.toString()));
+                ws.on("error", () => opts.data.upstream.close());
+                WS_BRIDGE_HANDLERS.open(client);
+            });
+            return pending.upgraded;
+        },
+    };
+    async function dispatch(incoming, outgoing, upgrade) {
+        const abort = new AbortController();
+        const onClose = () => {
+            if (!outgoing?.writableFinished && !upgrade?.upgraded)
+                abort.abort();
+        };
+        const connection = outgoing ?? upgrade.socket;
+        connection.once("close", onClose);
+        const responseWriter = () => {
+            if (!outgoing) {
+                // Only attach an HTTP response after a refused upgrade. Attaching
+                // one before handleUpgrade conflicts with Bun's native handshake.
+                outgoing = new http.ServerResponse(incoming);
+                outgoing.assignSocket(upgrade.socket);
+                outgoing.once("finish", () => upgrade.socket.end());
+            }
+            return outgoing;
+        };
+        let response;
+        try {
+            const headers = new Headers();
+            for (let i = 0; i < incoming.rawHeaders.length; i += 2) {
+                headers.append(incoming.rawHeaders[i], incoming.rawHeaders[i + 1]);
+            }
+            const method = incoming.method ?? "GET";
+            const req = new Request(new URL(incoming.url ?? "/", `http://${headers.get("host") ?? "localhost"}`), {
+                method, headers, signal: abort.signal,
+                body: method === "GET" || method === "HEAD" ? undefined : Readable.toWeb(incoming),
+                duplex: "half",
+            });
+            peers.set(req, incoming.socket);
+            if (upgrade)
+                upgrades.set(req, upgrade);
+            response = await options.fetch(req, facade);
+            if (upgrade?.upgraded)
+                return;
+            if (!response)
+                throw new Error("Ingress handler returned no response");
+            if (abort.signal.aborted) {
+                await response.body?.cancel();
+                return;
+            }
+            const writer = responseWriter();
+            writer.statusCode = response.status;
+            writer.statusMessage = response.statusText;
+            response.headers.forEach((value, key) => {
+                if (key !== "set-cookie")
+                    writer.setHeader(key, value);
+            });
+            const cookies = response.headers.getSetCookie();
+            if (cookies.length)
+                writer.setHeader("set-cookie", cookies);
+            // Flush even for a body already buffered by fetch. An upstream with
+            // no length must not acquire an invented Content-Length from end().
+            writer.flushHeaders();
+            if (method === "HEAD" || response.status === 204 || response.status === 304 || !response.body) {
+                await response.body?.cancel();
+                writer.end();
+            }
+            else {
+                await pipeline(Readable.fromWeb(response.body), writer);
+            }
+        }
+        catch (error) {
+            if (upgrade?.upgraded)
+                return;
+            outgoing = responseWriter();
+            if (!outgoing.headersSent && !outgoing.destroyed) {
+                outgoing.writeHead(500, { "content-type": "text/plain" });
+                outgoing.end("spectest-daemon: ingress response failed\n");
+            }
+            else {
+                outgoing.destroy(error instanceof Error ? error : new Error(String(error)));
+            }
+        }
+        finally {
+            connection.off("close", onClose);
+        }
+    }
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen({ port: options.port, host: options.hostname ?? "0.0.0.0", reusePort: options.reusePort }, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    facade.port = server.address().port;
+    return facade;
+}

package/dist/harness/tls-terminator.js

@@ -33,15 +33,11 @@
  * ## The shape, and why it is a byte pipe
  *
  * The terminator does TLS and *nothing else*: it accepts on :443, picks a
- * leaf by SNI, and pipes the decrypted stream to a plaintext `Bun.serve`
- * bound on loopback. Opted-in HTTP/2 routes select a separate stream router
- * by ALPN; HTTP/1.1 and WebSockets retain the existing listener. Everything downstream — routing, fakes,
- * interceptors, reverse-proxying, and `server.upgrade()` WebSocket
- * bridging — is the same `Bun.serve` code that already serves :80, run
- * unchanged. Terminating HTTP here instead (`node:https`, `(req, res)`)
- * would have meant reimplementing the WebSocket bridge against a
- * different API, which is exactly the kind of trade this change exists to
- * avoid: one flake removed, another introduced somewhere subtler.
+ * leaf by SNI, and pipes the decrypted stream to the plaintext ingress
+ * server bound on loopback. Opted-in HTTP/2 routes select a separate stream
+ * router by ALPN; HTTP/1.1 and WebSockets use the shared ingress listener.
+ * Routing, fakes, interceptors and reverse-proxying stay in that listener;
+ * this layer never parses or rewrites HTTP response framing.
  *
  * Measured cost of the extra hop on this host (Bun 1.4.0, undici client,
  * 50 MB bodies): ~11 % fewer small requests per second, download

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.101.0",
+  "version": "0.102.0",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",
@@ -56,11 +56,13 @@
     "@kubernetes/client-node": "^1.0.0",
     "@xterm/headless": "^5.5.0",
     "dns-packet": "^5.6.1",
-    "playwright-core": "^1.61.1"
+    "playwright-core": "^1.61.1",
+    "ws": "^8.20.1"
   },
   "devDependencies": {
     "@types/dns-packet": "^5.6.5",
     "@types/bun": "^1.3.0",
+    "@types/ws": "^8",
     "typescript": "^5.6.3"
   },
   "spectestCapabilities": [

package/src/daemon.ts

@@ -131,7 +131,6 @@ import {
   upstreamRequestHeaders,
 } from "./harness/http-proxy.js";
 import {
-  WS_BRIDGE_HANDLERS,
   openUpstreamWebSocket,
   parseSubprotocols,
   upstreamHandshakeHeaders,
@@ -157,6 +156,7 @@ import {
   unbindRoute,
   type Route as IngressRoute,
 } from "./harness/ingress-table.js";
+import { startIngressServer, type IngressServer } from "./harness/ingress-server.js";
 import { startHttp2Proxy } from "./harness/http2-proxy.js";
 import { startTlsTerminator, type TlsTerminator } from "./harness/tls-terminator.js";
 import { runContainerArgs } from "./harness/container-run.js";
@@ -1920,12 +1920,11 @@ let LOWERED: LoweredIngress = {
   aliasesByService: {},
   wildcards: [],
 };
-/** Running HTTP servers per port (Bun.Server). Rebuilt on /load. */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const INGRESS_HTTP_SERVERS = new Map<number, any>();
+/** Running HTTP servers per port. Rebuilt on /load. */
+const INGRESS_HTTP_SERVERS = new Map<number, IngressServer>();
+const INGRESS_HTTP_STARTING = new Map<number, Promise<void>>();
 /** Running HTTPS servers per port (currently always {INGRESS_HTTPS_PORT}). */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const INGRESS_HTTPS_SERVERS = new Map<number, any>();
+const INGRESS_HTTPS_SERVERS = new Map<number, IngressServer>();
 /**
  * The :443 TLS terminator, once per harness process.
  *
@@ -1989,6 +1988,7 @@ function stopIngressServers(): void {
     }
   }
   INGRESS_HTTP_SERVERS.clear();
+  INGRESS_HTTP_STARTING.clear();
   for (const [port, srv] of INGRESS_HTTPS_SERVERS) {
     try {
       srv.stop?.(true);
@@ -2129,7 +2129,7 @@ async function startIngress(): Promise<void> {
     );
   }
 
-  const Bun = requireBun();
+  requireBun();
 
   // Resolve every ingress hostname to its handler into the live per-port
   // route tables (module scope, so runtime `tls` can extend them later).
@@ -2168,12 +2168,12 @@ async function startIngress(): Promise<void> {
   // ── HTTP listeners (one per non-443 port).
   for (const [port, byHost] of INGRESS.routesByPort) {
     if (port === INGRESS_HTTPS_PORT) continue;
-    INGRESS_HTTP_SERVERS.set(port, bindIngressServer(Bun, port, byHost, `port ${port}`));
+    await ensureHttpIngress(port, byHost);
     // eslint-disable-next-line no-console
     console.log(`[ingress] http :${port} for ${[...byHost.keys()].join(", ")}`);
   }
   // ── HTTPS listener on INGRESS_HTTPS_PORT: SNI per certificated hostname.
-  if (INGRESS.certByHost.size > 0) await ensureHttpsIngress(Bun);
+  if (INGRESS.certByHost.size > 0) await ensureHttpsIngress();
 
   // Seed the resolver's names registry: ingress hostnames (fakes, TLS
   // proxies, dnsName(→ingress)) → bridge gateway, plus ingress-targeted
@@ -2188,7 +2188,7 @@ function requireBun(): any {
   const Bun = (globalThis as any).Bun;
   if (!Bun?.serve) {
     throw new Error(
-      "ingress requires Bun.serve; the daemon must run under Bun (it does in-VM)",
+      "ingress requires Bun; the daemon must run under Bun (it does in-VM)",
     );
   }
   return Bun;
@@ -2198,10 +2198,10 @@ function requireBun(): any {
 /**
  * Bring :443 up, once.
  *
- * Two pieces: a plaintext `Bun.serve` on an ephemeral loopback port that
+ * Two pieces: a plaintext HTTP server on an ephemeral loopback port that
  * carries the HTTPS route table (and therefore all the routing, fake
- * dispatch, interception, reverse-proxying and `server.upgrade()`
- * WebSocket bridging that :80 already gets, unchanged), and the TLS
+ * dispatch, interception, reverse-proxying and WebSocket
+ * bridging that :80 already gets, unchanged), and the TLS
  * terminator in front of it on :443.
  *
  * **This is idempotent, and that is the feature.** Adding a certificate
@@ -2222,27 +2222,25 @@ function requireBun(): any {
  * container can reach (containers arrive at the bridge gateway), so the
  * only way in is through the terminator.
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-async function ensureHttpsIngress(Bun: any): Promise<void> {
+async function ensureHttpsIngress(): Promise<void> {
   if (INGRESS_HTTPS_SERVERS.has(INGRESS_HTTPS_PORT)) return;
   if (!HTTPS_INGRESS_STARTING) {
     // Cleared on both outcomes: once bound, the check above short-circuits
     // every later caller, and a failed bind must be retryable rather than
     // remembered as a rejection for the life of the project.
-    HTTPS_INGRESS_STARTING = startHttpsIngress(Bun).finally(() => {
+    HTTPS_INGRESS_STARTING = startHttpsIngress().finally(() => {
       HTTPS_INGRESS_STARTING = undefined;
     });
   }
   return HTTPS_INGRESS_STARTING;
 }
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-async function startHttpsIngress(Bun: any): Promise<void> {
+async function startHttpsIngress(): Promise<void> {
   const routes = routesFor(INGRESS, INGRESS_HTTPS_PORT);
   // `proto` is passed rather than inferred: this listener speaks plain
   // HTTP, but everything reaching it arrived over TLS, so X-Forwarded-Proto
   // must say https.
-  const plain = bindIngressServer(Bun, 0, routes, `https :${INGRESS_HTTPS_PORT}`, {
+  const plain = await bindIngressServer(0, routes, `https :${INGRESS_HTTPS_PORT}`, {
     proto: "https",
     hostname: "127.0.0.1",
   });
@@ -2327,7 +2325,7 @@ async function bindRuntimeTls(hostname: string, service: string, port: number, h
       `runtime tls for ${JSON.stringify(host)} requires the in-VM root CA at ${CA_PATH}`,
     );
   }
-  const Bun = requireBun();
+  requireBun();
   const route: Route = { kind: "proxy", service, port, http2, cors };
 
   // Decide the cost before mutating anything: an already-covered hostname
@@ -2344,24 +2342,14 @@ async function bindRuntimeTls(hostname: string, service: string, port: number, h
   // the route is only reachable once the hostname resolves, which is the
   // registry write at the end.
   bindRoute(INGRESS, host, route);
-  if (!INGRESS_HTTP_SERVERS.has(INGRESS_HTTP_PORT)) {
-    INGRESS_HTTP_SERVERS.set(
-      INGRESS_HTTP_PORT,
-      bindIngressServer(
-        Bun,
-        INGRESS_HTTP_PORT,
-        routesFor(INGRESS, INGRESS_HTTP_PORT),
-        `port ${INGRESS_HTTP_PORT}`,
-      ),
-    );
-  }
+  await ensureHttpIngress(INGRESS_HTTP_PORT, routesFor(INGRESS, INGRESS_HTTP_PORT));
   if (plan.needsCert) {
     // The terminator reads this table on every handshake, so the leaf is
     // live the moment it lands — no listener is touched, and no connection
     // already on :443 notices.
     INGRESS.certByHost.set(host, await generateHostCert(host, [host]));
   }
-  if (plan.needsHttpsListener) await ensureHttpsIngress(Bun);
+  if (plan.needsHttpsListener) await ensureHttpsIngress();
 
   // Resolve the hostname to the daemon gateway (where :443/:80 listen).
   // A wildcard can only live in the resolver's suffix table.
@@ -2398,63 +2386,32 @@ async function unbindRuntimeTls(hostname: string): Promise<void> {
   }
 }
 
-/**
- * Spin up one Bun.serve listener bound to (port, optional TLS) that
- * dispatches every request to the matching Route by Host header.
- *
- * Shared by the HTTP and HTTPS branches. Also carries the `websocket`
- * handler set so reverse-proxy targets can transparently bridge WS
- * upgrades through to their upstream service.
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function bindIngressServer(
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  Bun: any,
+/** Concurrent runtime routes must share the asynchronous first bind. */
+async function ensureHttpIngress(port: number, byHost: Map<string, Route>): Promise<void> {
+  if (INGRESS_HTTP_SERVERS.has(port)) return;
+  let starting = INGRESS_HTTP_STARTING.get(port);
+  if (!starting) {
+    starting = bindIngressServer(port, byHost, `port ${port}`).then(server => {
+      INGRESS_HTTP_SERVERS.set(port, server);
+    }).finally(() => INGRESS_HTTP_STARTING.delete(port));
+    INGRESS_HTTP_STARTING.set(port, starting);
+  }
+  await starting;
+}
+
+/** Bind the shared HTTP/1 ingress handler, including the listener behind TLS. */
+async function bindIngressServer(
   port: number,
   byHost: Map<string, Route>,
   listenerLabel: string,
-  // Every ingress listener speaks plain HTTP now — the one behind :443
-  // sits under the TLS terminator. So the scheme a client actually used
-  // can no longer be inferred from the socket and is declared instead; it
-  // stamps X-Forwarded-Proto, which upstreams that build absolute URLs or
-  // redirect depend on.
   serve: { proto: "http" | "https"; hostname?: string } = { proto: "http" },
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-): any {
-  const proto = serve.proto;
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  const opts: Record<string, any> = {
+): Promise<IngressServer> {
+  return startIngressServer({
     port,
     hostname: serve.hostname ?? "0.0.0.0",
-    // SO_REUSEPORT on every ingress listener. It was introduced so a
-    // replacement :443 could overlap the original during a certificate
-    // swap; the terminator removed that swap, and this stays for the
-    // remaining case — the `/load` teardown force-closes and rebinds, and
-    // a socket the kernel has not finished releasing would otherwise fail
-    // the next bind with "Is port 443 in use?". Note the flip side, which
-    // {@link stopIngressServers} depends on: a half-alive listener shares
-    // the port silently instead of colliding loudly.
     reusePort: true,
-    // OCI layer uploads can exceed Bun's default 128 MiB request limit.
-    // Large proxy bodies stream through; this limit does not allocate a buffer.
-    maxRequestBodySize: 1024 ** 4,
-    // Bun.serve defaults to a 10s idleTimeout, which kills any proxied
-    // request whose upstream takes >10s to produce bytes — under parallel
-    // test load that surfaced as "fetch failed"/"other side closed" on
-    // deploy-archive uploads and ERR_EMPTY_RESPONSE in browser tests
-    // ([Bun.serve]: request timed out after 10 seconds). Ingress fronts
-    // arbitrarily slow app endpoints (deploys can legitimately take
-    // minutes), so disable the idle timeout entirely; forked test VMs are
-    // short-lived, leaked-connection risk is bounded by the fork.
-    idleTimeout: 0,
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    fetch: (req: Request, server: any): Response | Promise<Response> =>
-      dispatchIngress(req, server, byHost, listenerLabel, proto),
-    // The frame relay for bridged WebSocket upgrades; `proxyToService`
-    // opens the upstream before it upgrades the client (harness/ws-bridge.ts).
-    websocket: WS_BRIDGE_HANDLERS,
-  };
-  return Bun.serve(opts);
+    fetch: (req, server) => dispatchIngress(req, server, byHost, listenerLabel, serve.proto),
+  });
 }
 
 /**
@@ -2610,7 +2567,7 @@ async function proxyToService(
       headers: selected ? { "sec-websocket-protocol": selected } : undefined,
     });
     if (ok) {
-      // Bun has already taken over the response — return a stub.
+      // The WebSocket has already taken over the response — return a stub.
       return new Response(null, { status: 101 });
     }
     try {
@@ -2676,6 +2633,7 @@ async function proxyToService(
         headers: fwdHeaders,
         body: hasBody ? (bufferedBody ?? req.body) : undefined,
         redirect: "manual",
+        signal: req.signal,
       });
       // decompress:false → forward the encoded body untouched (see fn doc).
       // keepalive:false → fresh connection per request (see fwdHeaders above).
@@ -2685,7 +2643,7 @@ async function proxyToService(
         keepalive: false,
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
       } as any);
-      // Strip hop-by-hop response headers; let Bun set content-length / TE.
+      // Strip connection framing while preserving the unchanged body's length.
       const respHeaders = new Headers();
       for (const [k, v] of upstreamRes.headers) {
         if (HOP_BY_HOP_HEADERS.has(k.toLowerCase())) continue;

package/src/harness/ingress-cors.test.ts

@@ -3,6 +3,7 @@ import { defineEnvironment, defineFake, lowerIngress, provides, proxy, type Cors
 import { supabase } from "../components/supabase.js";
 import { withIngressCors, upstreamRequestHeaders } from "./http-proxy.js";
 import { InterceptRegistry, runChain } from "./intercept.js";
+import { startIngressServer } from "./ingress-server.js";
 
 const allowed = "https://app.tangent.test";
 const denied = "https://untrusted.test";
@@ -56,12 +57,12 @@ for (const kind of ["fake", "service"] as const) {
             method: req.method, headers: upstreamRequestHeaders(req.headers, { proto: "https" }),
             body: req.body, redirect: "manual",
           });
-        const ingress = Bun.serve({ port: 0, hostname: "127.0.0.1", fetch: req =>
+        const ingress = await startIngressServer({ port: 0, hostname: "127.0.0.1", fetch: req =>
           withIngressCors(req, mode, current => runChain(
             interceptors.chainFor("bucket.test", new URL(current.url).pathname), current, forward)),
         });
         try {
-          const send = (path: string, init: RequestInit) => fetch(new URL(path, ingress.url), init);
+          const send = (path: string, init: RequestInit) => fetch(new URL(path, `http://127.0.0.1:${ingress.port}`), init);
           const ok = await send("/probe", preflight(allowed));
           expect(ok.status).toBe(204);
           expect(ok.headers.get("access-control-allow-origin")).toBe(allowed);

package/src/harness/ingress-server.test.ts

@@ -0,0 +1,250 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import http from "node:http";
+import https from "node:https";
+import { once } from "node:events";
+import { createHash, randomBytes } from "node:crypto";
+import { gzipSync } from "node:zlib";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { execFileSync } from "node:child_process";
+import { forwardableHeaders, withIngressCors } from "./http-proxy";
+import { startIngressServer, type IngressServer } from "./ingress-server";
+import { startTlsTerminator, type TlsTerminator } from "./tls-terminator";
+
+const object = randomBytes(65536);
+const compressed = gzipSync(object);
+const digest = (body: Uint8Array) => createHash("sha256").update(body).digest("hex");
+let upstream: http.Server;
+let upstreamPort: number;
+let ingress: IngressServer;
+let tls: TlsTerminator;
+let dir: string;
+let release: (() => void) | undefined;
+let upstreamClosed: Promise<unknown>;
+
+beforeAll(async () => {
+  upstream = http.createServer((req, res) => {
+    const path = req.url!;
+    let body = path === "/8960" ? object.subarray(0, 8960) : path === "/gzip" ? compressed : object;
+    res.setHeader("content-type", "application/octet-stream");
+    res.setHeader("etag", '"original"');
+    res.setHeader("set-cookie", ["a=1", "b=2"]);
+    if (path === "/empty") body = Buffer.alloc(0);
+    if (path === "/gzip") res.setHeader("content-encoding", "gzip");
+    if (req.headers.range) {
+      body = body.subarray(512, 8704);
+      res.statusCode = 206;
+      res.setHeader("content-range", `bytes 512-8703/${object.length}`);
+    }
+    if (path !== "/unknown" && path !== "/unknown-small") res.setHeader("content-length", body.length);
+    if (path === "/large") res.setHeader("content-length", 1024 ** 3);
+    if (path === "/not-modified") res.statusCode = 304;
+    if (path === "/no-content") { res.statusCode = 204; res.removeHeader("content-length"); }
+    if (req.method === "HEAD" || [204, 304].includes(res.statusCode) || body.length === 0) { res.end(); return; }
+    if (path === "/unknown-small") { res.write("small"); res.end(); return; }
+    // Force multiple reads by sending the tail after headers + first chunk.
+    res.write(body.subarray(0, 1024));
+    if (path === "/gated" || path === "/large" || path === "/unknown") {
+      upstreamClosed = once(res, "close");
+      release = () => res.end(body.subarray(1024));
+    } else {
+      setTimeout(() => res.end(body.subarray(1024)), 5);
+    }
+  });
+  upstream.listen(0, "127.0.0.1");
+  await once(upstream, "listening");
+  upstreamPort = (upstream.address() as { port: number }).port;
+  ingress = await startIngressServer({
+    port: 0, hostname: "127.0.0.1",
+    fetch: req => withIngressCors(req, "permissive", async current => {
+      const res = await fetch(`http://127.0.0.1:${upstreamPort}${new URL(current.url).pathname}`, {
+        method: current.method, headers: current.headers, signal: current.signal,
+        decompress: false, keepalive: false,
+      });
+      return new Response(res.body, {
+        status: res.status, statusText: res.statusText, headers: forwardableHeaders(res.headers),
+      });
+    }),
+  });
+  dir = mkdtempSync(join(tmpdir(), "spectest-length-"));
+  execFileSync("openssl", ["req", "-x509", "-newkey", "rsa:2048", "-nodes", "-days", "2",
+    "-subj", "/CN=bucket.test", "-keyout", join(dir, "key.pem"), "-out", join(dir, "cert.pem")], { stdio: "ignore" });
+  const leaf = { key: readFileSync(join(dir, "key.pem"), "utf8"), cert: readFileSync(join(dir, "cert.pem"), "utf8") };
+  tls = await startTlsTerminator({ port: 0, hostname: "127.0.0.1", upstreamPort: ingress.port, certFor: () => leaf });
+});
+
+afterAll(() => {
+  release?.();
+  tls?.close();
+  ingress?.stop(true);
+  upstream?.closeAllConnections();
+  upstream?.close();
+  if (dir) rmSync(dir, { recursive: true, force: true });
+});
+
+function request(path: string, options: { boundary?: "storage" | "http" | "https"; method?: string; headers?: Record<string, string> } = {}) {
+  const boundary = options.boundary ?? "https";
+  return new Promise<http.IncomingMessage>((resolve, reject) => {
+    const req = (boundary === "https" ? https : http).request({
+      host: "127.0.0.1", port: boundary === "https" ? tls.port : boundary === "http" ? ingress.port : upstreamPort,
+      path, method: options.method ?? "GET", headers: { host: "bucket.test", ...options.headers },
+      agent: false, rejectUnauthorized: false,
+    }, resolve);
+    req.once("error", reject);
+    req.setTimeout(2000, () => req.destroy(new Error("ingress request timed out")));
+    req.end();
+  });
+}
+
+async function bytes(res: http.IncomingMessage) {
+  const chunks: Buffer[] = [];
+  for await (const chunk of res) chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks);
+}
+
+describe("ingress response framing", () => {
+  for (const boundary of ["storage", "http", "https"] as const) {
+    test(`${boundary}: repeated multi-chunk GETs keep length and digest`, async () => {
+      for (const size of [8960, 65536]) {
+        for (let n = 0; n < 20; n++) {
+          const res = await request(`/${size}`, { boundary });
+          const body = await bytes(res);
+          expect(res.statusCode).toBe(200);
+          expect(res.headers["content-length"]).toBe(String(size));
+          expect(res.headers["transfer-encoding"]).toBeUndefined();
+          expect(body.length).toBe(size);
+          expect(digest(body)).toBe(digest(object.subarray(0, size)));
+        }
+      }
+    });
+  }
+
+  test("HEAD, empty objects, ranges, cookies and CORS preserve their metadata", async () => {
+    const head = await request("/65536", { method: "HEAD" });
+    expect(head.headers["content-length"]).toBe("65536");
+    expect((await bytes(head)).length).toBe(0);
+    const empty = await request("/empty");
+    expect(empty.headers["content-length"]).toBe("0");
+    expect((await bytes(empty)).length).toBe(0);
+    const range = await request("/65536", { headers: { range: "bytes=512-8703", origin: "https://app.test" } });
+    expect(range.statusCode).toBe(206);
+    expect(range.headers["content-length"]).toBe("8192");
+    expect(range.headers["content-range"]).toBe("bytes 512-8703/65536");
+    expect(range.headers.etag).toBe('"original"');
+    expect(range.headers["set-cookie"]).toEqual(["a=1", "b=2"]);
+    expect(range.headers["access-control-allow-origin"]).toBe("https://app.test");
+    expect(digest(await bytes(range))).toBe(digest(object.subarray(512, 8704)));
+  });
+
+  test("compressed bytes and their encoded length remain unchanged", async () => {
+    const res = await request("/gzip", { headers: { "accept-encoding": "gzip" } });
+    expect(res.headers["content-length"]).toBe(String(compressed.length));
+    expect(res.headers["content-encoding"]).toBe("gzip");
+    expect(digest(await bytes(res))).toBe(digest(compressed));
+  });
+
+  test("no length is invented for an already-complete unknown-length body", async () => {
+    const res = await request("/unknown-small");
+    expect(res.headers["content-length"]).toBeUndefined();
+    expect((await bytes(res)).toString()).toBe("small");
+  });
+
+  test("bodyless statuses stay bodyless", async () => {
+    for (const [path, status] of [["/not-modified", 304], ["/no-content", 204]] as const) {
+      const res = await request(path);
+      expect(res.statusCode).toBe(status);
+      expect(res.headers["transfer-encoding"]).toBeUndefined();
+      if (status === 304) expect(res.headers["content-length"]).toBe("65536");
+      expect((await bytes(res)).length).toBe(0);
+    }
+  });
+
+  for (const path of ["/gated", "/unknown", "/large"]) {
+    test(`${path}: first bytes arrive before upstream finishes; disconnect cancels`, async () => {
+      // The source cannot finish until the test releases it. This fails if
+      // ingress waits for an entire body, regardless of any buffering cap.
+      const res = await request(path);
+      const first = await once(res, "data");
+      expect(Buffer.from(first[0])).toEqual(object.subarray(0, 1024));
+      expect(res.headers["content-length"]).toBe(path === "/unknown" ? undefined : path === "/large" ? String(1024 ** 3) : "65536");
+      if (path === "/large") {
+        res.destroy();
+        await upstreamClosed;
+      } else {
+        const rest = bytes(res);
+        release!();
+        expect(digest(Buffer.concat([first[0], await rest]))).toBe(digest(object));
+      }
+    });
+  }
+});
+
+describe("ingress request lifecycle", () => {
+  test("streams uploads and preserves the request URL, headers and peer", async () => {
+    const server = await startIngressServer({
+      port: 0, hostname: "127.0.0.1",
+      async fetch(req, ingress) {
+        const body = await req.arrayBuffer();
+        return Response.json({ method: req.method, url: req.url, digest: digest(new Uint8Array(body)),
+          authorization: req.headers.get("authorization"), peer: ingress.requestIP(req)?.address });
+      },
+    });
+    try {
+      for (const chunked of [false, true]) {
+        const result = new Promise<http.IncomingMessage>((resolve, reject) => {
+          const req = http.request({ host: "127.0.0.1", port: server.port, path: "/upload?part=2", method: "PUT",
+            headers: { host: "bucket.test:8443", authorization: "signed", ...(chunked ? {} : { "content-length": object.length }) },
+          }, resolve);
+          req.on("error", reject);
+          req.write(object.subarray(0, 1024));
+          setTimeout(() => req.end(object.subarray(1024)), 5);
+        });
+        expect(JSON.parse((await bytes(await result)).toString())).toEqual({ method: "PUT",
+          url: "http://bucket.test:8443/upload?part=2", digest: digest(object), authorization: "signed", peer: "127.0.0.1" });
+      }
+    } finally { server.stop(true); }
+  });
+
+  test("disconnect before response headers aborts the handler", async () => {
+    let entered!: () => void;
+    const started = new Promise<void>(resolve => { entered = resolve; });
+    let cancelled!: () => void;
+    const aborted = new Promise<void>(resolve => { cancelled = resolve; });
+    const server = await startIngressServer({
+      port: 0, hostname: "127.0.0.1",
+      async fetch(req) {
+        req.signal.addEventListener("abort", cancelled, { once: true });
+        entered();
+        await aborted;
+        return new Response("cancelled");
+      },
+    });
+    try {
+      const req = http.get(`http://127.0.0.1:${server.port}/`);
+      req.on("error", () => {});
+      await started;
+      req.destroy();
+      await aborted;
+    } finally { server.stop(true); }
+  });
+
+  test("an error after headers closes the stream instead of appending a success or error body", async () => {
+    const server = await startIngressServer({
+      port: 0, hostname: "127.0.0.1",
+      fetch: () => new Response(new ReadableStream({
+        start(controller) {
+          controller.enqueue(object.subarray(0, 1024));
+          setTimeout(() => controller.error(new Error("upstream truncated")), 20);
+        },
+      }), { headers: { "content-length": String(object.length) } }),
+    });
+    try {
+      const res = await new Promise<http.IncomingMessage>((resolve, reject) => {
+        http.get(`http://127.0.0.1:${server.port}/`, resolve).on("error", reject);
+      });
+      expect(res.headers["content-length"]).toBe(String(object.length));
+      await expect(bytes(res)).rejects.toThrow();
+    } finally { server.stop(true); }
+  });
+});

package/src/harness/ingress-server.ts

@@ -0,0 +1,175 @@
+import http, { type IncomingMessage, type ServerResponse } from "node:http";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import type { Socket } from "node:net";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { WS_BRIDGE_HANDLERS, type WsBridgeData } from "./ws-bridge.js";
+
+// Load the installed implementation, not Bun's built-in `ws` replacement.
+// On Bun 1.4.0 that replacement cannot upgrade node:http sockets after the
+// asynchronous upstream handshake. The package uses the ordinary socket API.
+const require = createRequire(import.meta.url);
+const { WebSocketServer } = require(join(dirname(require.resolve("ws/package.json")), "index.js")) as typeof import("ws");
+
+export interface IngressServer {
+  port: number;
+  stop(force?: boolean): void;
+  requestIP(req: Request): { address: string; port: number } | undefined;
+  upgrade(req: Request, options: { data: WsBridgeData; headers?: Record<string, string> }): boolean;
+}
+
+/**
+ * Serve the ingress's Fetch handlers through node:http. Bun.serve discards
+ * Content-Length on a still-streaming Response, even when its bytes are
+ * unchanged. ServerResponse preserves the declared length while pipeline
+ * propagates backpressure and cancellation without buffering the whole body.
+ * This is also the HTTP/1 listener behind the TLS terminator.
+ */
+export async function startIngressServer(options: {
+  port: number;
+  hostname?: string;
+  reusePort?: boolean;
+  fetch(req: Request, server: IngressServer): Response | undefined | Promise<Response | undefined>;
+}): Promise<IngressServer> {
+  const peers = new WeakMap<Request, Socket>();
+  const upgrades = new WeakMap<Request, { req: IncomingMessage; socket: Socket; head: Buffer; upgraded: boolean }>();
+  const protocols = new WeakMap<IncomingMessage, string | undefined>();
+  const sockets = new Set<Socket>();
+  const websockets = new WebSocketServer({
+    noServer: true,
+    // The upstream handshake has already selected a protocol. Never select
+    // the client's first offer on its behalf.
+    handleProtocols: (_offered, req) => protocols.get(req) || false,
+  });
+  const server = http.createServer({ requestTimeout: 0 }, (req, res) => {
+    void dispatch(req, res);
+  });
+  server.on("connection", socket => {
+    sockets.add(socket);
+    socket.once("close", () => sockets.delete(socket));
+  });
+  server.on("upgrade", (req, socket, head) => {
+    void dispatch(req, undefined, { req, socket: socket as Socket, head, upgraded: false });
+  });
+
+  const facade: IngressServer = {
+    port: 0,
+    stop(force = false) {
+      if (force) {
+        for (const ws of websockets.clients) ws.terminate();
+        for (const socket of sockets) socket.destroy();
+        server.closeAllConnections();
+      }
+      websockets.close();
+      server.close();
+    },
+    requestIP(req) {
+      const socket = peers.get(req);
+      return socket?.remoteAddress && socket.remotePort
+        ? { address: socket.remoteAddress, port: socket.remotePort } : undefined;
+    },
+    upgrade(req, opts) {
+      const pending = upgrades.get(req);
+      if (!pending || pending.upgraded || pending.socket.destroyed) return false;
+      protocols.set(pending.req, opts.headers?.["sec-websocket-protocol"]);
+      websockets.handleUpgrade(pending.req, pending.socket, pending.head, ws => {
+        pending.upgraded = true;
+        const client = {
+          data: opts.data,
+          send: (data: string | ArrayBuffer | Uint8Array) => ws.send(data),
+          close: (code?: number, reason?: string) => ws.close(code, reason),
+        };
+        ws.on("message", (data, binary) => WS_BRIDGE_HANDLERS.message(client,
+          binary ? Buffer.from(data as Buffer) : data.toString()));
+        ws.on("close", (code, reason) => WS_BRIDGE_HANDLERS.close(client, code, reason.toString()));
+        ws.on("error", () => opts.data.upstream.close());
+        WS_BRIDGE_HANDLERS.open(client);
+      });
+      return pending.upgraded;
+    },
+  };
+
+  async function dispatch(
+    incoming: IncomingMessage,
+    outgoing: ServerResponse | undefined,
+    upgrade?: { req: IncomingMessage; socket: Socket; head: Buffer; upgraded: boolean },
+  ): Promise<void> {
+    const abort = new AbortController();
+    const onClose = () => {
+      if (!outgoing?.writableFinished && !upgrade?.upgraded) abort.abort();
+    };
+    const connection = outgoing ?? upgrade!.socket;
+    connection.once("close", onClose);
+    const responseWriter = () => {
+      if (!outgoing) {
+        // Only attach an HTTP response after a refused upgrade. Attaching
+        // one before handleUpgrade conflicts with Bun's native handshake.
+        outgoing = new http.ServerResponse(incoming);
+        outgoing.assignSocket(upgrade!.socket);
+        outgoing.once("finish", () => upgrade!.socket.end());
+      }
+      return outgoing;
+    };
+    let response: Response | undefined;
+    try {
+      const headers = new Headers();
+      for (let i = 0; i < incoming.rawHeaders.length; i += 2) {
+        headers.append(incoming.rawHeaders[i], incoming.rawHeaders[i + 1]);
+      }
+      const method = incoming.method ?? "GET";
+      const req = new Request(new URL(incoming.url ?? "/", `http://${headers.get("host") ?? "localhost"}`), {
+        method, headers, signal: abort.signal,
+        body: method === "GET" || method === "HEAD" ? undefined : Readable.toWeb(incoming) as unknown as ReadableStream<Uint8Array>,
+        duplex: "half",
+      } as RequestInit);
+      peers.set(req, incoming.socket);
+      if (upgrade) upgrades.set(req, upgrade);
+      response = await options.fetch(req, facade);
+      if (upgrade?.upgraded) return;
+      if (!response) throw new Error("Ingress handler returned no response");
+      if (abort.signal.aborted) {
+        await response.body?.cancel();
+        return;
+      }
+      const writer = responseWriter();
+      writer.statusCode = response.status;
+      writer.statusMessage = response.statusText;
+      response.headers.forEach((value, key) => {
+        if (key !== "set-cookie") writer.setHeader(key, value);
+      });
+      const cookies = response.headers.getSetCookie();
+      if (cookies.length) writer.setHeader("set-cookie", cookies);
+      // Flush even for a body already buffered by fetch. An upstream with
+      // no length must not acquire an invented Content-Length from end().
+      writer.flushHeaders();
+      if (method === "HEAD" || response.status === 204 || response.status === 304 || !response.body) {
+        await response.body?.cancel();
+        writer.end();
+      } else {
+        await pipeline(Readable.fromWeb(response.body as unknown as import("node:stream/web").ReadableStream), writer);
+      }
+    } catch (error) {
+      if (upgrade?.upgraded) return;
+      outgoing = responseWriter();
+      if (!outgoing.headersSent && !outgoing.destroyed) {
+        outgoing.writeHead(500, { "content-type": "text/plain" });
+        outgoing.end("spectest-daemon: ingress response failed\n");
+      } else {
+        outgoing.destroy(error instanceof Error ? error : new Error(String(error)));
+      }
+    } finally {
+      connection.off("close", onClose);
+    }
+  }
+
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen({ port: options.port, host: options.hostname ?? "0.0.0.0", reusePort: options.reusePort }, () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+  facade.port = (server.address() as { port: number }).port;
+  return facade;
+}

package/src/harness/tls-terminator.test.ts

@@ -28,6 +28,7 @@ import tls from "node:tls";
 import type { Leaf } from "./ingress-table";
 import { selectCertName } from "./hostmatch";
 import { startTlsTerminator, type TlsTerminator } from "./tls-terminator";
+import { startIngressServer } from "./ingress-server";
 
 // ── a throwaway CA and leaves, so the client can verify for real ──────────
 let dir: string;
@@ -80,10 +81,9 @@ let seenClientIp: string | undefined;
 
 beforeAll(async () => {
   certByHost = new Map([["app.test", leaves.get("app.test")!]]);
-  plain = Bun.serve({
+  plain = await startIngressServer({
     port: 0,
     hostname: "127.0.0.1",
-    idleTimeout: 0,
     fetch(req, server) {
       const peer = server.requestIP(req);
       seenClientIp = term.clientIpFor(peer?.port) ?? peer?.address;

package/src/harness/tls-terminator.ts

@@ -33,15 +33,11 @@
  * ## The shape, and why it is a byte pipe
  *
  * The terminator does TLS and *nothing else*: it accepts on :443, picks a
- * leaf by SNI, and pipes the decrypted stream to a plaintext `Bun.serve`
- * bound on loopback. Opted-in HTTP/2 routes select a separate stream router
- * by ALPN; HTTP/1.1 and WebSockets retain the existing listener. Everything downstream — routing, fakes,
- * interceptors, reverse-proxying, and `server.upgrade()` WebSocket
- * bridging — is the same `Bun.serve` code that already serves :80, run
- * unchanged. Terminating HTTP here instead (`node:https`, `(req, res)`)
- * would have meant reimplementing the WebSocket bridge against a
- * different API, which is exactly the kind of trade this change exists to
- * avoid: one flake removed, another introduced somewhere subtler.
+ * leaf by SNI, and pipes the decrypted stream to the plaintext ingress
+ * server bound on loopback. Opted-in HTTP/2 routes select a separate stream
+ * router by ALPN; HTTP/1.1 and WebSockets use the shared ingress listener.
+ * Routing, fakes, interceptors and reverse-proxying stay in that listener;
+ * this layer never parses or rewrites HTTP response framing.
  *
  * Measured cost of the extra hop on this host (Bun 1.4.0, undici client,
  * 50 MB bodies): ~11 % fewer small requests per second, download

package/src/harness/ws-bridge.test.ts

@@ -1,7 +1,7 @@
 import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { startIngressServer, type IngressServer } from "./ingress-server";
 
 import {
-  WS_BRIDGE_HANDLERS,
   openUpstreamWebSocket,
   parseSubprotocols,
   upstreamHandshakeHeaders,
@@ -65,11 +65,11 @@ describe("upstreamHandshakeHeaders", () => {
  */
 describe("the bridge on loopback", () => {
   let upstream: ReturnType<typeof Bun.serve>;
-  let bridge: ReturnType<typeof Bun.serve>;
+  let bridge: IngressServer;
   /** What the upstream saw on its last handshake. */
   let seen: { protocols: string[]; cookie: string | null; host: string | null; xfh: string | null } | null = null;
 
-  beforeAll(() => {
+  beforeAll(async () => {
     upstream = Bun.serve({
       port: 0,
       fetch(req, server) {
@@ -102,7 +102,7 @@ describe("the bridge on loopback", () => {
       },
     });
 
-    bridge = Bun.serve({
+    bridge = await startIngressServer({
       port: 0,
       async fetch(req, server) {
         const protocols = parseSubprotocols(req.headers.get("sec-websocket-protocol"));
@@ -128,7 +128,6 @@ describe("the bridge on loopback", () => {
         }
         return undefined;
       },
-      websocket: WS_BRIDGE_HANDLERS,
     });
   });