@synopackageland/cli 0.4.1 → 0.5.0

package/dist/standalone/worker-registry.js

@@ -0,0 +1,167 @@
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { inertWorkerRegistry } from "./helper-inventory.js";
+import { WORKER_CONTRACT } from "./worker-contract.js";
+import { fail, strictJSON } from "./worker-contract-json.js";
+const actions = ["nas.files.list", "nas.files.stat", "nas.files.read", "nas.files.read-stream"];
+const modes = ["interactive", "background"];
+const checkpoints = ["before-step", "before-chunk", "before-result"];
+const ceilings = {
+    inputBytes: 8192, steps: 16, totalMs: 120000, idleMs: 10000, metadataMs: 5000,
+    boundedMs: 10000, boundedBytes: 1048576, streamBytes: 67108864, chunkBytes: 65536, outstandingLeases: 1,
+};
+const idPattern = /^[a-z][a-z0-9_]{0,31}$/;
+const digestPattern = /^[a-f0-9]{64}$/;
+const asciiCompare = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+function object(value, required, optional = []) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return fail();
+    const o = value;
+    if (required.some(k => !Object.hasOwn(o, k)) || Object.keys(o).some(k => !required.includes(k) && !optional.includes(k)))
+        fail();
+    return o;
+}
+function bounded(value, max, min = 1) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < min)
+        return fail();
+    if (value > max)
+        fail("limit-exceeded");
+    return value;
+}
+function digest(value) {
+    if (typeof value !== "string" || !digestPattern.test(value))
+        return fail();
+    return value;
+}
+function subset(value, allowed) {
+    if (!Array.isArray(value) || !value.length || new Set(value).size !== value.length || value.some(v => !allowed.includes(v)))
+        return fail();
+    return allowed.filter(v => value.includes(v));
+}
+function limits(value, partial) {
+    const keys = Object.keys(ceilings);
+    const raw = object(value, partial ? [] : keys, partial ? keys : []);
+    const result = { ...ceilings };
+    for (const k of keys)
+        if (Object.hasOwn(raw, k))
+            result[k] = bounded(raw[k], ceilings[k]);
+    if (result.idleMs > result.totalMs || result.metadataMs > result.totalMs || result.boundedMs > result.totalMs || result.chunkBytes > result.streamBytes)
+        fail();
+    return result;
+}
+/** Manifest metadata only; never accepts a source path or a caller-chosen digest. */
+export function parseSDKWorkers(value, inertIDs = []) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return fail();
+    const entries = Object.entries(value);
+    if (!entries.length || entries.length + inertIDs.length > WORKER_CONTRACT.maxWorkers)
+        fail("limit-exceeded");
+    return Object.fromEntries(entries.sort(([a], [b]) => asciiCompare(a, b)).map(([id, value]) => {
+        if (!idPattern.test(id) || inertIDs.includes(id))
+            fail();
+        const o = object(value, ["kind", "workerRevision", "actions", "modes"], ["limits"]);
+        if (o.kind !== "sdk-read-plan")
+            fail("unsupported");
+        return [id, {
+                kind: "sdk-read-plan", workerRevision: bounded(o.workerRevision, Number.MAX_SAFE_INTEGER),
+                actions: subset(o.actions, actions), modes: subset(o.modes, modes),
+                limits: limits(Object.hasOwn(o, "limits") ? o.limits : {}, true),
+            }];
+    }));
+}
+/** Must match jobcontract/bindings.go; filenames and exact source bytes are bound. */
+export function sourceWorkerBindings(backend) {
+    const hash = (kind, names, root = "internal/helper/jobcontract", version = 1) => {
+        const h = createHash("sha256").update(`synopkgland/m3/${kind}/source-v${version}\0`);
+        for (const name of names) {
+            const path = join(backend, root, name);
+            if (!lstatSync(path).isFile() || lstatSync(path).size > 1048576)
+                fail();
+            for (const b of [Buffer.from(name), readFileSync(path)]) {
+                const size = Buffer.alloc(4);
+                size.writeUInt32BE(b.length);
+                h.update(size).update(b);
+            }
+        }
+        return h.digest("hex");
+    };
+    return {
+        handlerBinding: hash("handler", ["jobcontract/stub.go", "sdk_job_child_linux.go", "sdk_job_process_linux.go", "sdk_job.go", "sdk_attach.go", "sdk_rpc.go", "sdk_session.go", "sdk_session_contract.go"], "internal/helper", 2),
+        inputSchemaDigest: hash("input", ["decode.go", "digest.go", "types.go", "validate.go"]),
+        outputSchemaDigest: hash("result", ["decode.go", "result.go", "types.go", "validate.go"]),
+    };
+}
+export function buildWorkerRegistry(inert, sdkWorkers, backend) {
+    // Do not even read new SDK files for legacy projects (including old templates).
+    if (sdkWorkers === undefined)
+        return inertWorkerRegistry(inert);
+    const configs = parseSDKWorkers(sdkWorkers, inert.map(w => w.id));
+    const bindings = sourceWorkerBindings(backend);
+    const registry = {
+        registrySchema: 2, productionAvailability: "unavailable",
+        inert: inert.map(({ id, digest }) => ({ id, digest })).sort((a, b) => asciiCompare(a.id, b.id)),
+        sdk: Object.entries(configs).map(([workerId, c]) => ({
+            registrySchema: 2, workerId, workerRevision: c.workerRevision, kind: c.kind,
+            ...bindings, actions: c.actions, modes: c.modes, checkpoints: [...checkpoints], limits: c.limits,
+        })),
+    };
+    const raw = JSON.stringify(registry);
+    decodeSDKRegistry(raw);
+    return raw;
+}
+/** Structural/artifact inspection only; the compiled Go consumer checks source bindings. */
+export function decodeSDKRegistry(raw) {
+    const r = object(strictJSON(raw, WORKER_CONTRACT.maxArtifactBytes), ["registrySchema", "productionAvailability", "inert", "sdk"]);
+    if (r.registrySchema !== 2 || r.productionAvailability !== "unavailable")
+        fail("incompatible");
+    if (!Array.isArray(r.inert) || !Array.isArray(r.sdk) || !r.sdk.length || r.inert.length + r.sdk.length > WORKER_CONTRACT.maxWorkers)
+        return fail();
+    const ids = new Set();
+    let previous = "";
+    const id = (value) => {
+        if (typeof value !== "string" || !idPattern.test(value) || value <= previous || ids.has(value))
+            return fail();
+        previous = value;
+        ids.add(value);
+        return value;
+    };
+    const inert = r.inert.map(value => {
+        const w = object(value, ["id", "digest"]);
+        return { id: id(w.id), digest: digest(w.digest) };
+    });
+    previous = "";
+    const sdk = r.sdk.map(value => {
+        const w = object(value, ["registrySchema", "workerId", "workerRevision", "kind", "handlerBinding", "inputSchemaDigest", "outputSchemaDigest", "actions", "modes", "checkpoints", "limits"]);
+        if (w.registrySchema !== 2 || w.kind !== "sdk-read-plan")
+            fail("incompatible");
+        if (JSON.stringify(w.checkpoints) !== JSON.stringify(checkpoints))
+            fail();
+        return {
+            registrySchema: 2, workerId: id(w.workerId), workerRevision: bounded(w.workerRevision, Number.MAX_SAFE_INTEGER), kind: "sdk-read-plan",
+            handlerBinding: digest(w.handlerBinding), inputSchemaDigest: digest(w.inputSchemaDigest), outputSchemaDigest: digest(w.outputSchemaDigest),
+            actions: subset(w.actions, actions), modes: subset(w.modes, modes), checkpoints: [...checkpoints], limits: limits(w.limits, false),
+        };
+    });
+    const result = { registrySchema: 2, productionAvailability: "unavailable", inert, sdk };
+    // One byte representation is compiled and approved; no aliases or reordering.
+    if (JSON.stringify(result) !== (typeof raw === "string" ? raw : Buffer.from(raw).toString("utf8")))
+        fail();
+    return result;
+}
+const safeReasons = ["invalid-request", "incompatible", "unsupported", "replay", "stale", "expired", "denied", "unavailable", "suspended", "revoked", "fenced", "busy", "limit-exceeded", "canceled", "timeout", "partial", "commit-uncertain", "cleanup-required", "internal"];
+export function decodeWorkerResult(raw) {
+    const r = object(strictJSON(raw, WORKER_CONTRACT.maxProgressBytes), ["resultSchema", "completedSteps", "entries", "bytesRead"], ["safeReason"]);
+    if (r.resultSchema !== 1)
+        fail("incompatible");
+    const result = {
+        resultSchema: 1, completedSteps: bounded(r.completedSteps, 16, 0),
+        entries: bounded(r.entries, 3200, 0), bytesRead: bounded(r.bytesRead, 67108864, 0),
+    };
+    if (Object.hasOwn(r, "safeReason")) {
+        if (!safeReasons.includes(r.safeReason))
+            fail();
+        result.safeReason = r.safeReason;
+    }
+    return result;
+}

package/dist/templates/_daemon/go.mod

@@ -1,3 +1,5 @@
 module synopkgland-daemon
 
 go 1.24
+
+toolchain go1.26.8

package/dist/templates/_gateway/auth.go

@@ -0,0 +1,101 @@
+package main
+
+// DSM runs a package's CGI as the package account and forwards the browser's
+// cookies. The authenticator hands only the session carriers (cookie,
+// SynoToken, client address) to DSM's own authenticate.cgi, which prints the
+// signed-in user name, then resolves local groups or directory groups through DSM NSS.
+// It never parses the session cookie or trusts a user name from the request.
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"os/exec"
+	"regexp"
+	"strings"
+	"time"
+)
+
+// authenticateCGI is DSM's session check for third-party CGIs.
+const authenticateCGI = "/usr/syno/synoman/webman/modules/authenticate.cgi"
+
+var errNoSession = errors.New("no valid DSM session")
+
+type identity struct {
+	User   string
+	Groups []string
+}
+
+type authenticator interface {
+	Authenticate(r *http.Request) (identity, error)
+}
+
+type dsmAuthenticator struct {
+	groupFile       string
+	passwdFile      string
+	directoryGroups func(context.Context, string) ([]string, error)
+	timeout         time.Duration
+	run             func(ctx context.Context, path string, env []string) ([]byte, error)
+}
+
+func newDSMAuthenticator() *dsmAuthenticator {
+	return &dsmAuthenticator{groupFile: "/etc/group", passwdFile: "/etc/passwd", timeout: 10 * time.Second, run: runCGI, directoryGroups: (directoryLookup{timeout: 2 * time.Second, run: runDirectoryCommand}).groups}
+}
+
+var userName = regexp.MustCompile(`^[A-Za-z0-9._@\\-]{1,193}$`)
+
+func (a *dsmAuthenticator) Authenticate(r *http.Request) (identity, error) {
+	cookie := r.Header.Get("Cookie")
+	if cookie == "" {
+		return identity{}, errNoSession
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), a.timeout)
+	defer cancel()
+	out, err := a.run(ctx, authenticateCGI, sessionEnv(r, cookie))
+	var exit interface{ ExitCode() int }
+	if errors.As(err, &exit) {
+		return identity{}, errNoSession
+	}
+	if err != nil {
+		return identity{}, fmt.Errorf("run %s: %w", authenticateCGI, err)
+	}
+	user := strings.TrimSpace(string(out))
+	if !userName.MatchString(user) {
+		return identity{}, errNoSession
+	}
+	groups, err := a.groupsOf(ctx, user)
+	if err != nil {
+		return identity{}, err
+	}
+	return identity{User: user, Groups: groups}, nil
+}
+
+// sessionEnv is the complete environment authenticate.cgi sees: nothing from
+// this process and no request header besides the session carriers.
+func sessionEnv(r *http.Request, cookie string) []string {
+	token := r.Header.Get("X-SYNO-TOKEN")
+	if token == "" {
+		// A navigation or iframe cannot send the header; DSM's front end appends ?SynoToken= instead.
+		token = r.URL.Query().Get("SynoToken")
+	}
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		host = r.RemoteAddr
+	}
+	return []string{
+		"REQUEST_METHOD=GET",
+		"HTTP_COOKIE=" + cookie,
+		"HTTP_X_SYNO_TOKEN=" + token,
+		"QUERY_STRING=SynoToken=" + url.QueryEscape(token),
+		"REMOTE_ADDR=" + host,
+	}
+}
+
+func runCGI(ctx context.Context, path string, env []string) ([]byte, error) {
+	cmd := exec.CommandContext(ctx, path)
+	cmd.Env = env
+	return cmd.Output()
+}

package/dist/templates/_gateway/auth_test.go

@@ -0,0 +1,216 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+)
+
+const groupFile = `root:x:0:
+users:x:100:
+administrators:x:101:admin,alice
+staff:x:1030:alice,carol
+http:x:1023:
+`
+
+// DSM keeps no member list for users: the group is every local account's primary group.
+const passwdFile = `root:x:0:0::/root:/bin/sh
+alice:x:1001:100::/var/services/homes/alice:/sbin/nologin
+bob:x:1002:100::/var/services/homes/bob:/sbin/nologin
+carol:x:1003:100::/var/services/homes/carol:/sbin/nologin
+dave:x:1004:1030::/var/services/homes/dave:/sbin/nologin
+`
+
+type fakeRunner struct {
+	out  string
+	err  error
+	env  []string
+	path string
+}
+
+func (f *fakeRunner) run(_ context.Context, path string, env []string) ([]byte, error) {
+	f.path, f.env = path, env
+	return []byte(f.out), f.err
+}
+
+type exitError struct{}
+
+func (*exitError) Error() string { return "exit status 1" }
+func (*exitError) ExitCode() int { return 1 }
+
+func newTestAuth(t *testing.T, runner *fakeRunner) *dsmAuthenticator {
+	t.Helper()
+	dir := t.TempDir()
+	groups, passwd := filepath.Join(dir, "group"), filepath.Join(dir, "passwd")
+	for path, content := range map[string]string{groups: groupFile, passwd: passwdFile} {
+		if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	a := newDSMAuthenticator()
+	a.groupFile, a.passwdFile = groups, passwd
+	a.run = runner.run
+	return a
+}
+
+func sessionRequest() *http.Request {
+	r := httptest.NewRequest(http.MethodGet, "/webman/3rdparty/App/cgi/gateway.cgi/", nil)
+	r.RemoteAddr = "192.0.2.7:51234"
+	r.Header.Set("Cookie", "id=abc; did=xyz")
+	r.Header.Set("X-SYNO-TOKEN", "tok+en/=")
+	r.Header.Set("User-Agent", "should-not-pass")
+	return r
+}
+
+func TestUserAndGroupsComeFromAuthenticateCGIAndGroupFile(t *testing.T) {
+	runner := &fakeRunner{out: "alice\n"}
+	id, err := newTestAuth(t, runner).Authenticate(sessionRequest())
+	if err != nil || id.User != "alice" {
+		t.Fatalf("got %+v, %v", id, err)
+	}
+	if want := []string{"users", "administrators", "staff"}; !slices.Equal(id.Groups, want) {
+		t.Errorf("groups = %v, want %v", id.Groups, want)
+	}
+	if runner.path != authenticateCGI {
+		t.Errorf("ran %q", runner.path)
+	}
+}
+
+func TestOrdinaryUserHasNoAdministratorsGroup(t *testing.T) {
+	id, err := newTestAuth(t, &fakeRunner{out: "bob\n"}).Authenticate(sessionRequest())
+	if err != nil || id.User != "bob" || slices.Contains(id.Groups, "administrators") {
+		t.Fatalf("got %+v, %v", id, err)
+	}
+}
+
+func TestPrimaryGroupCountsAsMembershipEvenWithoutAMemberListEntry(t *testing.T) {
+	id, err := newTestAuth(t, &fakeRunner{out: "bob\n"}).Authenticate(sessionRequest())
+	if err != nil || !slices.Equal(id.Groups, []string{"users"}) {
+		t.Fatalf("got %+v, %v", id, err)
+	}
+}
+
+func TestPrimaryGroupIsNotDuplicatedWhenAlsoListedAsMember(t *testing.T) {
+	a := newTestAuth(t, &fakeRunner{out: "dave"})
+	if err := os.WriteFile(a.groupFile, []byte("staff:x:1030:dave\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	id, _ := a.Authenticate(sessionRequest())
+	if !slices.Equal(id.Groups, []string{"staff"}) {
+		t.Fatalf("groups = %v", id.Groups)
+	}
+}
+
+func TestMissingPasswdFileFailsClosedWithoutBeingNoSession(t *testing.T) {
+	a := newTestAuth(t, &fakeRunner{out: "bob"})
+	a.passwdFile = filepath.Join(t.TempDir(), "absent")
+	if _, err := a.Authenticate(sessionRequest()); err == nil || errors.Is(err, errNoSession) {
+		t.Fatalf("err = %v", err)
+	}
+}
+
+func TestOnlySessionCarriersReachAuthenticateCGI(t *testing.T) {
+	runner := &fakeRunner{out: "alice"}
+	if _, err := newTestAuth(t, runner).Authenticate(sessionRequest()); err != nil {
+		t.Fatal(err)
+	}
+	want := []string{
+		"HTTP_COOKIE=id=abc; did=xyz",
+		"HTTP_X_SYNO_TOKEN=tok+en/=",
+		"QUERY_STRING=SynoToken=tok%2Ben%2F%3D",
+		"REMOTE_ADDR=192.0.2.7",
+		"REQUEST_METHOD=GET",
+	}
+	got := slices.Clone(runner.env)
+	slices.Sort(got)
+	if !slices.Equal(got, want) {
+		t.Fatalf("env = %q\nwant  %q", got, want)
+	}
+}
+
+func TestMissingCookieNeverRunsAuthenticateCGI(t *testing.T) {
+	runner := &fakeRunner{out: "alice"}
+	r := sessionRequest()
+	r.Header.Del("Cookie")
+	_, err := newTestAuth(t, runner).Authenticate(r)
+	if !errors.Is(err, errNoSession) || runner.path != "" {
+		t.Fatalf("err=%v ran=%q", err, runner.path)
+	}
+}
+
+func TestExpiredOrMalformedSessionsAreNoSession(t *testing.T) {
+	for name, runner := range map[string]*fakeRunner{
+		"expired session (exit status)": {err: &exitError{}},
+		"empty output":                  {out: "\n"},
+		"two lines":                     {out: "alice\nadmin\n"},
+		"html output":                   {out: "<html>login</html>"},
+		"overlong name":                 {out: strings.Repeat("a", 200)},
+		"space in name":                 {out: "alice admin"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			_, err := newTestAuth(t, runner).Authenticate(sessionRequest())
+			if !errors.Is(err, errNoSession) {
+				t.Fatalf("err = %v", err)
+			}
+		})
+	}
+}
+
+func TestAuthenticateCGIThatCannotRunFailsClosedWithoutBeingNoSession(t *testing.T) {
+	_, err := newTestAuth(t, &fakeRunner{err: errors.New("fork/exec: no such file")}).Authenticate(sessionRequest())
+	if err == nil || errors.Is(err, errNoSession) {
+		t.Fatalf("err = %v", err)
+	}
+}
+
+func TestGroupMembershipIsReadFreshOnEveryRequest(t *testing.T) {
+	runner := &fakeRunner{out: "carol"}
+	a := newTestAuth(t, runner)
+	id, _ := a.Authenticate(sessionRequest())
+	if !slices.Equal(id.Groups, []string{"users", "staff"}) {
+		t.Fatalf("groups = %v", id.Groups)
+	}
+	if err := os.WriteFile(a.groupFile, []byte("users:x:100:\nstaff:x:1030:alice\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	id, _ = a.Authenticate(sessionRequest())
+	if !slices.Equal(id.Groups, []string{"users"}) {
+		t.Fatalf("groups after removal = %v", id.Groups)
+	}
+}
+
+func tokenEnv(t *testing.T, r *http.Request) []string {
+	t.Helper()
+	runner := &fakeRunner{out: "alice"}
+	if _, err := newTestAuth(t, runner).Authenticate(r); err != nil {
+		t.Fatal(err)
+	}
+	return runner.env
+}
+
+func TestQueryTokenIsUsedWhenHeaderIsEmpty(t *testing.T) {
+	r := sessionRequest()
+	r.Header.Del("X-SYNO-TOKEN")
+	r.URL.RawQuery = "a=b&SynoToken=q%2Btok"
+	env := tokenEnv(t, r)
+	for _, want := range []string{"HTTP_X_SYNO_TOKEN=q+tok", "QUERY_STRING=SynoToken=q%2Btok"} {
+		if !slices.Contains(env, want) {
+			t.Fatalf("env = %q, missing %q", env, want)
+		}
+	}
+}
+
+func TestHeaderTokenWinsOverQueryToken(t *testing.T) {
+	r := sessionRequest()
+	r.URL.RawQuery = "SynoToken=from-query"
+	env := tokenEnv(t, r)
+	if !slices.Contains(env, "HTTP_X_SYNO_TOKEN=tok+en/=") || slices.Contains(env, "QUERY_STRING=SynoToken=from-query") {
+		t.Fatalf("env = %q", env)
+	}
+}

package/dist/templates/_gateway/cgi.go

@@ -0,0 +1,133 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"time"
+)
+
+// serveCGI answers one request the way net/http/cgi.Serve does: "Status:" and headers, a blank line, the body
+// on `out`. It is its own copy so that the reply can be hijacked: the handler then owns `in` and `out`, which
+// is how a WebSocket passes through DSM's CGI interface.
+func serveCGI(h http.Handler, req *http.Request, in io.Reader, out io.Writer) error {
+	if req.Body == nil {
+		req.Body = http.NoBody
+	}
+	rw := &cgiResponse{req: req, header: make(http.Header), in: in, out: out, bufw: bufio.NewWriter(out)}
+	h.ServeHTTP(rw, req)
+	if rw.hijacked {
+		return nil
+	}
+	rw.Write(nil) // make sure a reply is sent
+	return rw.bufw.Flush()
+}
+
+type cgiResponse struct {
+	req         *http.Request
+	header      http.Header
+	code        int
+	wroteHeader bool
+	wroteCGI    bool
+	hijacked    bool
+	in          io.Reader
+	out         io.Writer
+	bufw        *bufio.Writer
+}
+
+func (r *cgiResponse) Header() http.Header { return r.header }
+
+func (r *cgiResponse) Flush() {
+	if !r.hijacked {
+		r.bufw.Flush()
+	}
+}
+
+func (r *cgiResponse) WriteHeader(code int) {
+	if r.wroteHeader {
+		return
+	}
+	r.wroteHeader, r.code = true, code
+}
+
+func (r *cgiResponse) Write(p []byte) (int, error) {
+	if r.hijacked {
+		return 0, http.ErrHijacked
+	}
+	if !r.wroteHeader {
+		r.WriteHeader(http.StatusOK)
+	}
+	if !r.wroteCGI {
+		r.writeCGIHeader(p)
+	}
+	return r.bufw.Write(p)
+}
+
+// writeCGIHeader sends the header block; p, the first chunk of the body, is sniffed for a missing Content-Type.
+func (r *cgiResponse) writeCGIHeader(p []byte) {
+	r.wroteCGI = true
+	fmt.Fprintf(r.bufw, "Status: %d %s\r\n", r.code, http.StatusText(r.code))
+	if _, hasType := r.header["Content-Type"]; !hasType {
+		r.header.Set("Content-Type", http.DetectContentType(p))
+	}
+	r.header.Write(r.bufw)
+	r.bufw.WriteString("\r\n")
+	r.bufw.Flush()
+}
+
+// Hijack hands stdin and stdout to the handler. The first thing it writes is an HTTP/1.1 status line and
+// headers (that is what httputil.ReverseProxy writes for a 101); the CGI interface wants "Status: 101 ..."
+// there, so cgiConn rewrites the status line and leaves everything after the blank line alone.
+func (r *cgiResponse) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	if r.wroteHeader || r.wroteCGI || r.hijacked {
+		return nil, nil, errors.New("cgi: Hijack after the reply began")
+	}
+	r.hijacked = true
+	c := &cgiConn{in: r.in, out: r.out}
+	return c, bufio.NewReadWriter(bufio.NewReader(c), bufio.NewWriter(c)), nil
+}
+
+type cgiConn struct {
+	in       io.Reader
+	out      io.Writer
+	head     []byte // the header block, held back until it is complete
+	headSent bool
+}
+
+func (c *cgiConn) Read(p []byte) (int, error) { return c.in.Read(p) }
+
+func (c *cgiConn) Write(p []byte) (int, error) {
+	if c.headSent {
+		return c.out.Write(p)
+	}
+	c.head = append(c.head, p...)
+	end := bytes.Index(c.head, []byte("\r\n\r\n"))
+	if end < 0 {
+		return len(p), nil
+	}
+	c.headSent = true
+	statusLine, headers, _ := bytes.Cut(c.head[:end+4], []byte("\r\n"))
+	_, status, _ := bytes.Cut(statusLine, []byte(" ")) // "HTTP/1.1 101 Switching Protocols" -> "101 Switching Protocols"
+	rewritten := append(append([]byte("Status: "), status...), "\r\n"...)
+	rewritten = append(append(rewritten, headers...), c.head[end+4:]...)
+	if _, err := c.out.Write(rewritten); err != nil {
+		return 0, err
+	}
+	return len(p), nil
+}
+
+func (c *cgiConn) Close() error                     { return nil }
+func (c *cgiConn) LocalAddr() net.Addr              { return cgiAddr{} }
+func (c *cgiConn) RemoteAddr() net.Addr             { return cgiAddr{} }
+func (c *cgiConn) SetDeadline(time.Time) error      { return nil }
+func (c *cgiConn) SetReadDeadline(time.Time) error  { return nil }
+func (c *cgiConn) SetWriteDeadline(time.Time) error { return nil }
+
+type cgiAddr struct{}
+
+func (cgiAddr) Network() string { return "cgi" }
+func (cgiAddr) String() string  { return "cgi" }