@volter/world-core 3.0.38 → 3.0.40

package/inject.cjs

@@ -29,7 +29,7 @@
 //
 // A client can still open its own sockets (npm `undici`'s own Agent, which
 // @turbopuffer/turbopuffer uses under Node, honours neither patch nor HTTPS_PROXY).
-// `net.connect`/`tls.connect` are the seam every Node client ends at, so they carry
+// Node TCP clients using `net.connect`/`tls.connect` or Socket instances reach guarded seams, which carry
 // the backstop: a connect to a twinned vendor host went around the rewrite and is
 // refused, never sent to the real vendor; a connect to an untwinned host is refused
 // wherever strict egress or the World's network policy refuses it. The refusal
@@ -38,11 +38,14 @@ const http = require('http');
 const https = require('https');
 const net = require('net');
 const tls = require('tls');
+const dgram = require('node:dgram');
 const { isIP } = require('node:net');
 const { EventEmitter } = require('events');
 const { Readable } = require('stream');
 const Module = require('module');
-const { worldNetworkPolicyFromEnv, isWorldInternalHost, worldEgressRefusal } = require('./network-policy.cjs');
+const { urlToHttpOptions } = require('node:url');
+const claimsRefreshChannel = require('node:diagnostics_channel').channel('volter.inject.claims-refresh');
+const { allowsWorldNetworkEgress, worldNetworkPolicyFromEnv, isWorldInternalHost, worldEgressRefusal, worldNetworkNeedsPathInspection, worldNetworkUsesPassthrough } = require('./network-policy.cjs');
 const { createPublicKey, createVerify } = require('crypto');
 
 // the vendor host table (VENDOR_HOSTS: a hostname, and a path where two vendors share a host, to the vendor whose twin
@@ -247,8 +250,8 @@ const { appRouteFor, appForwardHeaders, appRequestOptions, sessionCa } = require
 // HOSTS A TWIN CLAIMS WHILE IT RUNS (packRegistry `hostsClaimed`): no descriptor can list a name a person makes answer
 // to a vendor, so each claiming twin lists its own at its door, read here every five seconds from the moment the
 // injector installs (or, in a process that only resolves, the proxy, from its first resolve). A fetch that would be
-// refused while a first read is still in flight waits for it; a name connected moments ago is refused until the next
-// read, as a new DNS record takes a moment. The door's `appHosts` are the names a hosting twin serves as the
+// refused refreshes the claims once before deciding, so a name connected by a child process is usable immediately.
+// The door's `appHosts` are the names a hosting twin serves as the
 // customer's own application (a domain added to a Vercel project): those route to the application, not the twin.
 const CLAIMERS = {};
 {
@@ -256,30 +259,45 @@ const CLAIMERS = {};
   for (const vendor of Object.keys(packs)) if (packs[vendor].hostsClaimed) CLAIMERS[vendor] = packs[vendor].hostsClaimed.door;
 }
 const CLAIMS = new Map(); // cache: origin -> the hosts its twin last listed; refreshed by the poll below
+// dfb9058, Node 23.11.0 build-policy World, 15 co-located twins, no app/build concurrent there:
+// attach cookbook-dub-build -- node $T/cookbook/dub/claim-refresh.mjs measured five batches
+// at 2.34–14.08 ms with one claiming twin. Retain the existing first-read ceiling for headroom.
+// The host was shared; other actors' workloads were not controlled or measured.
+// Full command, conditions and transcript: cookbook/dub/README.md, Claim refresh measurement.
+const CLAIMS_WAIT_MS = 1500;
 function claimsAt(origin, door) {
   const held = CLAIMS.get(origin);
   if (held) return held;
-  const entry = { hosts: new Set(), appHosts: new Set(), loaded: false, ready: null };
+  const entry = { hosts: new Set(), appHosts: new Set(), loaded: false, ready: null, refresh: null };
   let settle;
   entry.ready = new Promise((resolve) => { settle = resolve; });
   CLAIMS.set(origin, entry);
+  let reading = null;
   const read = () => {
+    if (reading) return reading;
     // the unpatched fetch: the door is the twin's own origin, never a vendor host to redirect
     const f = (ORIGINALS && ORIGINALS.fetch) || globalThis.fetch;
-    if (typeof f !== 'function') return;
-    Promise.resolve()
-      .then(() => f(`${origin}${door}`, { headers: attachTwinsKey({}) }))
+    if (typeof f !== 'function') { entry.loaded = true; settle(); return Promise.resolve(); }
+    const controller = new AbortController();
+    const deadline = setTimeout(() => controller.abort(), CLAIMS_WAIT_MS);
+    reading = Promise.resolve()
+      .then(() => f(`${origin}${door}`, { headers: attachTwinsKey({}), signal: controller.signal }))
       .then((r) => (r.ok ? r.json() : null))
       .then((body) => {
         if (body && Array.isArray(body.hosts)) entry.hosts = new Set(body.hosts.map((h) => String(h).toLowerCase()));
         if (body) entry.appHosts = new Set(Array.isArray(body.appHosts) ? body.appHosts.map((h) => String(h).toLowerCase()) : []);
       })
       .catch(() => {})
-      .then(() => { entry.loaded = true; settle(); });
+      .then(() => { entry.loaded = true; settle(); reading = null; })
+      .finally(() => clearTimeout(deadline));
+    return reading;
   };
+  let refreshing = null;
+  // An in-flight read may precede a mutation made while this process was blocked in a child.
+  // Finish that read, then obtain a new snapshot; simultaneous misses share that refresh.
+  entry.refresh = () => refreshing ??= Promise.resolve(reading).then(read).finally(() => { refreshing = null; });
   read();
-  // every five seconds: each process that loads the injector reads (the app's workers, the proxy), and a custom domain
-  // takes Cloudflare minutes to turn Active, so a faster read buys nothing and loads the twin
+  // Periodic discovery keeps already known claims current; a fetch miss refreshes on demand.
   const timer = setInterval(read, 5000);
   if (timer.unref) timer.unref();
   return entry;
@@ -307,6 +325,13 @@ function strictEgressEnabled() {
   return process.env.VOLTER_TWIN_STRICT_EGRESS === '1' || process.env.VOLTER_TWIN_STRICT_EGRESS === 'true';
 }
 
+// Only an explicit public build grant takes precedence over vendor substitution.
+function publicBuildRequest(url) {
+  if (!url || strictEgressEnabled()) return false;
+  const policy = worldNetworkPolicyFromEnv(process.env);
+  return !!policy && policy.phase === 'build' && allowsWorldNetworkEgress(policy, url);
+}
+
 function shouldBlockUntwinned(url) {
   const routed = url && resolveTwin(url.hostname, MAP, url.pathname);
   if (!url || (routed && routed.vendor !== 'app')) return false;
@@ -355,37 +380,59 @@ function annotateUntwinnedTlsError(error, hostname) {
 // --- request-args → { url, method, headers, callback } across every overload ---
 function describe(args, defaultProtocol) {
   const input = args[0];
-  let options = {};
-  let callback;
-  if (typeof args[1] === 'function') callback = args[1];
-  else {
-    options = args[1] || {};
-    if (typeof args[2] === 'function') callback = args[2];
-  }
-  let url = null;
-  let headers = {};
-  let method = 'GET';
-  if (input instanceof URL || typeof input === 'string') {
-    try { url = new URL(String(input)); } catch { url = null; }
-    headers = options.headers || {};
-    method = options.method || 'GET';
-  } else {
-    const merged = Object.assign({}, input || {}, options);
-    headers = merged.headers || {};
-    method = merged.method || 'GET';
-    const proto = String(merged.protocol || defaultProtocol);
-    const host = merged.hostname || merged.host;
-    const path = merged.path || '/';
-    // A request addressed to a proxy (axios and others honour the World's HTTPS_PROXY) names the proxy as its host
-    // and carries the real target as its path: "When making a request to a proxy ... a client MUST send the target
-    // URI in "absolute-form" as the request-target" (RFC 9112 §3.2.2). That target is the request's URL.
+  const options = args[1] && typeof args[1] === 'object' ? args[1] : {};
+  const callback = typeof args[1] === 'function' ? args[1] : typeof args[2] === 'function' ? args[2] : undefined;
+  let merged;
+  try {
+    merged = Object.assign({}, input instanceof URL || typeof input === 'string'
+      ? urlToHttpOptions(input instanceof URL ? input : new URL(input)) : input || {}, options);
+  } catch { merged = {}; }
+  const headers = merged.headers || {};
+  const proto = String(merged.protocol || defaultProtocol);
+  const host = merged.hostname || merged.host || 'localhost';
+  // The mediated transport owns its agent. Do not invoke a caller getter (agent-base infers
+  // protocol from Node's native HTTPS stack, which is absent during this authorization).
+  const port = merged.port || merged.defaultPort || (proto === 'https:' ? 443 : 80);
+  const path = merged.path ?? '/';
+  let url = null; let invalid = false;
+  try {
+    const authority = isIP(String(host)) === 6 ? `[${host}]` : host;
+    const physical = new URL(`${proto.endsWith(':') ? proto : `${proto}:`}//${authority}:${port}`);
     if (/^[a-z][a-z0-9+.-]*:\/\//i.test(path)) {
-      try { url = new URL(path); } catch { url = null; }
-    } else if (host) {
-      try { url = new URL(`${proto.endsWith(':') ? proto : `${proto}:`}//${host}${path}`); } catch { url = null; }
+      url = new URL(path);
+      // Absolute-form names a target only on this World's own proxy. Else retain both authorities.
+      let proxy;
+      try { proxy = new URL(process.env.VOLTER_WORLD_PROXY || ''); } catch { /* no proxy */ }
+      invalid = physical.origin !== url.origin && physical.origin !== proxy?.origin;
+    } else {
+      if (!String(path).startsWith('/') || /\\/.test(path)) invalid = true;
+      url = new URL(String(path), physical.origin);
+      if (url.origin !== physical.origin) invalid = true;
     }
+  } catch { invalid = true; }
+  return { url, method: String(merged.method || 'GET').toUpperCase(), headers, callback, options: merged, invalid };
+}
+
+function headersForProxy(headers, url) {
+  const entries = Array.isArray(headers) ? headers.reduce((out, _v, i) => i % 2 ? out : [...out, [headers[i], headers[i + 1]]], []) : Object.entries(headers);
+  const out = Object.create(null);
+  for (const [key, value] of entries) {
+    const name = String(key).toLowerCase();
+    if (name === 'host') {
+      for (const host of Array.isArray(value) ? value : [value]) {
+        const at = new URL(`${url.protocol}//${String(host)}`);
+        if (at.host !== url.host || at.username || at.password || at.pathname !== '/' || at.search || at.hash) throw new Error('path-granted request Host differs from its authority');
+      }
+    }
+    if (!['x-twins-key', 'x-volter-twin-original-host', 'proxy-authorization', 'proxy-connection', 'connection', 'host'].includes(name)) out[key] = value;
   }
-  return { url, method: String(method).toUpperCase(), headers, callback };
+  return Object.assign(out, { host: url.host, connection: 'close' });
+}
+
+function pathGrantProxy() {
+  const proxy = new URL(process.env.VOLTER_WORLD_PROXY || '');
+  if (proxy.protocol !== 'http:' || !isLocalOrPrivateHost(proxy.hostname) || proxy.username || proxy.password) throw new Error('inspected egress needs the World proxy');
+  return proxy;
 }
 
 let ORIGINALS = null; // captured once, used to forward to the twin without re-entering the patch
@@ -413,6 +460,25 @@ function worldBase() {
   if (!ref || !/^https?:\/\//i.test(ref)) return null;
   try { const base = new URL(ref.replace(/\/\.well-known\/volter-world\/?$/, '').replace(/\/+$/, '')); return { origin: base.origin, path: base.pathname.replace(/\/+$/, '') }; } catch { return null; }
 }
+// The local Substrate agent keeps host control routing; its product commands select the
+// existing guest listener. Route original destinations through that listener before rewriting.
+function localGuestProxy() {
+  const guest = process.env.VOLTER_WORLD_GUEST_PROXY;
+  if (!guest || process.env.VOLTER_WORLD_PROXY !== guest) return null;
+  try { return new URL(guest); } catch { return null; }
+}
+function explicitTwinEndpoint(url) {
+  return url && Object.values(MAP).some(origin => {
+    try {
+      const endpoint = new URL(origin), path = endpoint.pathname.replace(/\/$/, '');
+      return endpoint.origin === url.origin && (!path || url.pathname === path || url.pathname.startsWith(path + '/'));
+    } catch { return false; }
+  });
+}
+function mediateLocalGuest(url) {
+  const proxy = localGuestProxy();
+  return proxy && url && /^https?:$/.test(url.protocol) && !addressedToWorld(url) && !explicitTwinEndpoint(url) && url.origin !== proxy.origin ? proxy : null;
+}
 function addressedToWorld(url) {
   const base = worldBase();
   if (!base || !url || !base.path || url.origin.replace(/^ws/, 'http') !== base.origin) return false;
@@ -467,6 +533,11 @@ function hopToWorld(opts) {
   const at = String(opts.path == null ? '/' : opts.path);
   return origin === base.origin && (at.startsWith(`${base.path}/`) || at.startsWith(`/-${base.path}/`));
 }
+function undiciHeaderObject(raw) {
+  const entries = Array.isArray(raw) && raw.length && !Array.isArray(raw[0])
+    ? Array.from({ length: raw.length / 2 }, (_, i) => [String(raw[i * 2]), String(raw[i * 2 + 1])]) : raw;
+  return Object.fromEntries(new Headers(entries ?? {}));
+}
 function keyedView(dispatcher) {
   if (!dispatcher || typeof dispatcher.dispatch !== 'function' || KEYED_VIEWS.has(dispatcher)) return dispatcher;
   const view = new Proxy(dispatcher, {
@@ -474,6 +545,42 @@ function keyedView(dispatcher) {
       if (name === 'dispatch') {
         return function keyedDispatch(opts, handler) {
           const key = ORIGINAL_DEFINE_PROPERTY ? twinsKey() : null;
+          if (ORIGINAL_DEFINE_PROPERTY && opts?.origin != null) {
+            const policy = worldNetworkPolicyFromEnv(process.env);
+            let at;
+            try {
+              const origin = new URL(String(opts.origin));
+              const path = String(opts.path ?? '/');
+              if (!path.startsWith('/') || /\\/.test(path)) throw new Error('invalid dispatch path');
+              at = new URL(origin.origin + path);
+            } catch {
+              if (policy) { process.nextTick(() => handler.onError(new Error('[twin-inject] invalid effective undici request'))); return false; }
+            }
+            if (at && !isLocalOrPrivateHost(at.hostname) && !isTwinOriginHost(at.hostname) && (!resolveTwin(at.hostname, MAP, at.pathname) || publicBuildRequest(at))
+                && (shouldBlockUntwinned(at) || (policy && worldNetworkNeedsPathInspection(policy, at)))) {
+              process.nextTick(() => handler.onError(new Error('[twin-inject] unmediated undici hop cannot use inspected egress')));
+              return false;
+            }
+          }
+          // Undici's shared dispatcher is an HTTP seam even when its caller bypasses global fetch.
+          // Rewrite the hop, not its socket: the original host remains available to the twin.
+          if (ORIGINAL_DEFINE_PROPERTY && opts?.origin != null) {
+            let at;
+            try { at = new URL(new URL(String(opts.origin)).origin + String(opts.path ?? '/')); } catch {}
+            const twin = at && !publicBuildRequest(at) && resolveTwin(at.hostname, MAP, at.pathname);
+            if (twin && twin.vendor !== 'app') {
+              const endpoint = new URL(twin.origin);
+              const headers = undiciHeaderObject(opts.headers);
+              headers['host'] = at.host;
+              headers['x-volter-twin-original-host'] = at.host;
+              if (key) headers['x-twins-key'] = key;
+              return target.dispatch(Object.assign({}, opts, {
+                origin: endpoint.origin,
+                path: endpoint.pathname.replace(/\/$/, '') + at.pathname + at.search,
+                headers, maxRedirections: 0,
+              }), handler);
+            }
+          }
           // a hop the caller asked undici to follow is not keyed; a keyed hop is sent with maxRedirections 0, so no
           // redirect follower below this view (a composed interceptor, a RetryAgent or proxy agent around one, undici
           // 6's option or interceptors) carries its headers to the next origin: the redirect comes back to the caller
@@ -490,7 +597,7 @@ function keyedView(dispatcher) {
 }
 let ORIGINAL_DEFINE_PROPERTY = null;
 function keyUndiciDispatches() {
-  if (ORIGINAL_DEFINE_PROPERTY || !worldBase() || Object.defineProperty.name === 'keyingDefineProperty') return;
+  if (ORIGINAL_DEFINE_PROPERTY || (!worldBase() && !worldNetworkPolicyFromEnv(process.env)) || Object.defineProperty.name === 'keyingDefineProperty') return;
   const define = ORIGINAL_DEFINE_PROPERTY = Object.defineProperty;
   Object.defineProperty = function keyingDefineProperty(target, name, descriptor) {
     if (ORIGINAL_DEFINE_PROPERTY && target === globalThis && UNDICI_DISPATCHERS.includes(name) && descriptor && 'value' in descriptor) descriptor = Object.assign({}, descriptor, { value: keyedView(descriptor.value) });
@@ -498,6 +605,53 @@ function keyUndiciDispatches() {
   };
   for (const name of UNDICI_DISPATCHERS) if (globalThis[name]) globalThis[name] = keyedView(globalThis[name]);
 }
+// Imported Undici APIs may hold a dispatcher obtained before the global view was installed.
+// Rewrite their public HTTP doors as well; an independent connector still faces the socket guards.
+let UNDICI_LOAD = null;
+function routeImportedUndici() {
+  if (UNDICI_LOAD) return;
+  const original = UNDICI_LOAD = Module._load;
+  const seen = new WeakMap();
+  Module._load = function volterUndiciLoad(request, parent, isMain) {
+    const exports = original.apply(this, arguments);
+    if (request !== 'undici' || !exports || typeof exports.request !== 'function') return exports;
+    if (seen.has(exports)) return seen.get(exports);
+    const view = Object.assign({}, exports);
+    view.fetch = function routedUndiciFetch(input, init) {
+      if (!installed) return exports.fetch(input, init);
+      let url; try { url = new URL(typeof input === 'object' && input?.url ? input.url : String(input)); } catch {}
+      const twin = url && !publicBuildRequest(url) && resolveTwin(url.hostname, MAP, url.pathname);
+      // Local control planes may use their own Request class and dispatcher. Preserve both;
+      // connections still pass the socket guards, and claimed vendor hops still enter routing.
+      if (url && isLocalOrPrivateHost(url.hostname) && (!twin || twin.vendor === 'app')) return exports.fetch(input, init);
+      if (input && typeof input === 'object' && typeof input.url === 'string' && !(input instanceof globalThis.Request)) {
+        const options = {};
+        for (const name of ['method', 'signal', 'redirect', 'cache', 'credentials', 'integrity', 'keepalive', 'referrer', 'referrerPolicy']) {
+          if (input[name] !== undefined) options[name] = input[name];
+        }
+        options.headers = Array.from(input.headers);
+        if (input.body !== null && input.body !== undefined) { options.body = input.body; options.duplex = 'half'; }
+        return globalThis.fetch(input.url, { ...options, ...init });
+      }
+      return globalThis.fetch(input, init);
+    };
+    view.request = function routedUndiciRequest(input, options, callback) {
+      if (!installed) return exports.request.apply(exports, arguments);
+      const opts = typeof options === 'function' ? {} : options ?? {};
+      let url; try { url = new URL(String(input)); if (opts.path !== undefined) url = new URL(url.origin + String(opts.path)); } catch {}
+      const twin = url && !publicBuildRequest(url) && resolveTwin(url.hostname, MAP, url.pathname);
+      if (!twin || twin.vendor === 'app') return exports.request.apply(exports, arguments);
+      const headers = undiciHeaderObject(opts.headers);
+      headers.host = url.host; headers['x-volter-twin-original-host'] = url.host;
+      const key = twinsKey(); if (key) headers['x-twins-key'] = key;
+      const target = twin.origin.replace(/\/$/, '') + url.pathname + url.search;
+      const { path: _path, ...requestOptions } = opts; // target already carries the effective path and endpoint prefix
+      return exports.request(target, { ...requestOptions, headers, maxRedirections: 0 }, typeof options === 'function' ? options : callback);
+    };
+    seen.set(exports, view);
+    return view;
+  };
+}
 function unkeyUndiciDispatches() {
   if (!ORIGINAL_DEFINE_PROPERTY) return;
   // only what this put in place is put back: a wrapper installed over it since stays
@@ -510,55 +664,94 @@ function unkeyUndiciDispatches() {
 // twin (or the World) answering 30x to an external URL would carry x-twins-key to a REAL host. A
 // keyed fetch follows redirects itself: a hop that is a twin or the World re-enters the patched
 // fetch (the key re-attached there); any other hop is fetched WITHOUT the key.
-async function followKeyless(first, target, reqInit) {
+// The HTTPS cache first needed the vendor URL rather than its loopback transport destination.
+function fetchLocation(response, url) {
+  Object.defineProperty(response, 'url', { value: String(url), configurable: true });
+  return response;
+}
+
+// WHATWG Fetch, HTTP-redirect fetch, step 13 removes Authorization when URL origins differ:
+// source: https://fetch.spec.whatwg.org/#http-redirect-fetch "delete headerName from request’s header list"
+// Cookie and Proxy-Authorization are also scoped credentials; do not copy them to another origin.
+const CROSS_ORIGIN_DROPPED = ['authorization', 'cookie', 'proxy-authorization', 'x-twins-key', 'x-volter-twin-original-host'];
+function dropCrossOriginHeaders(headers, from, to) {
+  if (new URL(from).origin === new URL(to).origin) return;
+  if (headers instanceof Headers) {
+    for (const name of CROSS_ORIGIN_DROPPED) headers.delete(name);
+  } else {
+    for (const name of Object.keys(headers)) if (CROSS_ORIGIN_DROPPED.includes(name.toLowerCase())) delete headers[name];
+  }
+}
+
+// A chain's bound belongs to the request, not to one transport follower.
+const redirectChains = new WeakSet();
+let patchedWorldFetch;
+function redirectChain(known) {
+  if (known && redirectChains.has(known)) return known;
+  const chain = { hops: 0 }; redirectChains.add(chain); return chain;
+}
+function takeRedirect(chain) {
+  // Fetch Standard, HTTP-redirect fetch: a redirect count of 20 returns a network error.
+  // https://fetch.spec.whatwg.org/#http-redirect-fetch
+  if (chain.hops >= 20) throw new TypeError('fetch failed: redirect count exceeded');
+  chain.hops++;
+}
+function reenterFetch(input, init, chain) {
+  return patchedWorldFetch(input, init, false, chain);
+}
+
+async function followKeyless(first, target, reqInit, chain) {
   let hop = await first();
   let hopUrl = target;
   let hopMethod = String(reqInit.method || 'GET').toUpperCase();
   let hopBody = reqInit.body;
-  for (let hops = 0; hops < 5; hops += 1) {
-    const location = hop.status >= 300 && hop.status < 400 ? hop.headers.get('location') : null;
-    if (!location) return hop;
+  const hopHeaders = new Headers(reqInit.headers || {});
+  for (;;) {
+    const location = [301, 302, 303, 307, 308].includes(hop.status) ? hop.headers.get('location') : null;
+    if (!location) return fetchLocation(hop, hopUrl);
+    try { takeRedirect(chain); } catch (error) { try { await hop.body?.cancel(); } catch {} throw error; }
     // RFC semantics per hop (audit M7): 303 → GET; 301/302 demote POST to GET
     // (the browser convention SDKs expect); 307/308 preserve method AND body.
-    if (hop.status === 303 || ((hop.status === 301 || hop.status === 302) && hopMethod === 'POST')) {
+    if ((hop.status === 303 && hopMethod !== 'HEAD') || ((hop.status === 301 || hop.status === 302) && hopMethod === 'POST')) {
       hopMethod = 'GET';
       hopBody = undefined;
     }
     // Resolve against the CURRENT hop (a relative Location from hop 2 is relative to hop 2),
-    // cancel the interim body, and re-enter the PATCHED fetch with the ORIGINAL headers minus
-    // the key.
+    // cancel the interim body, and re-enter the PATCHED fetch with the surviving headers.
+    // Keep that reduced set across hops, so credentials never return on a later same-origin hop.
     const nextUrl = new URL(location, hopUrl);
     try { hop.body && (await hop.body.cancel()); } catch { /* interim body */ }
-    const hopHeaders = new Headers(reqInit.headers || {});
+    dropCrossOriginHeaders(hopHeaders, hopUrl, nextUrl);
     hopHeaders.delete('x-twins-key');
     hopHeaders.delete('x-volter-twin-original-host');
-    hop = await globalThis.fetch(nextUrl, {
+    hop = await reenterFetch(nextUrl, {
       method: hopMethod,
       headers: hopHeaders,
       ...(hopBody === undefined ? {} : { body: hopBody }),
       redirect: 'manual',
-    });
+      ...(reqInit.signal ? { signal: reqInit.signal } : {}),
+    }, chain);
     hopUrl = nextUrl;
   }
-  return hop;
+  return fetchLocation(hop, hopUrl);
 }
 
 // A request routed to the application is a real request to where it listens (the original http/https request, so
 // streaming, aborts and timeouts behave as the client expects); its options are app-route.cjs's, shared with the twins'
 // deliveries.
 function requestApp(route, url, method, headers, extra, callback) {
-  const options = appRequestOptions(route, url, method, headers, extra);
+  const options = route.proxy
+    ? { protocol: 'http:', hostname: route.proxy.hostname, port: route.proxy.port, path: url.href, method,
+      headers: headersForProxy(headers, url), agent: false, ...extra }
+    : appRequestOptions(route, url, method, headers, extra);
   const make = options.protocol === 'https:' ? ORIGINALS.httpsRequest : ORIGINALS.httpRequest;
   return callback ? make(options, callback) : make(options);
 }
 
-// What leaves the application with a redirect to anywhere else: what native fetch drops crossing origins, and the World's own.
-const CROSS_ORIGIN_DROPPED = ['authorization', 'cookie', 'proxy-authorization', 'x-twins-key', 'x-volter-twin-original-host'];
-
 /** fetch() routed to the application, as native fetch behaves: the caller's redirect mode, its signal, a streamed
  *  body, decoded content; redirects followed (at most 20) within the application while they stay on its hosts, and
  *  through the patched fetch, without credentials or the World's headers, once they leave. */
-async function fetchApp(route, url, input, init) {
+async function fetchApp(route, url, input, init, chain) {
   const request = typeof input === 'object' && input !== null && !(input instanceof URL) && typeof input.url === 'string' ? input : null;
   const mode = (init && init.redirect) || (request && request.redirect) || 'follow';
   const signal = (init && init.signal) || (request && request.signal) || undefined;
@@ -573,8 +766,8 @@ async function fetchApp(route, url, input, init) {
     if (type && !Object.keys(headers).some((k) => k.toLowerCase() === 'content-type')) headers['content-type'] = type;
     body = Buffer.from(await read.arrayBuffer());
   } else if (typeof body === 'string' && !Object.keys(headers).some((k) => k.toLowerCase() === 'content-type')) headers['content-type'] = 'text/plain;charset=UTF-8';
-  let at = url; let current = route;
-  for (let hops = 0; ; hops++) {
+  let at = url; let current = route; const firstHop = chain.hops;
+  for (;;) {
     if (signal && signal.aborted) throw signal.reason ?? new DOMException('This operation was aborted', 'AbortError');
     const res = await new Promise((resolve, reject) => {
       const req = requestApp(current, at, method, headers, { signal }, resolve);
@@ -586,17 +779,19 @@ async function fetchApp(route, url, input, init) {
     if (res.statusCode >= 300 && res.statusCode < 400 && location && [301, 302, 303, 307, 308].includes(res.statusCode) && mode !== 'manual') {
       res.resume();
       if (mode === 'error') throw new TypeError('fetch failed: unexpected redirect');
-      if (hops >= 20) throw new TypeError('fetch failed: redirect count exceeded');
+      takeRedirect(chain);
       const next = new URL(String(location), at);
       // 303 answers with a GET (a HEAD stays one); 301 and 302 turn only a POST into a GET, as fetch does
       if ((res.statusCode === 303 && method !== 'HEAD') || ((res.statusCode === 301 || res.statusCode === 302) && method === 'POST')) {
         method = 'GET'; body = undefined;
         for (const k of Object.keys(headers)) if (/^content-/i.test(k)) delete headers[k];
       }
+      dropCrossOriginHeaders(headers, at, next);
       const nextRoute = resolveTwin(next.hostname, MAP, next.pathname);
-      if (!nextRoute || nextRoute.vendor !== 'app') {
-        for (const k of Object.keys(headers)) if (CROSS_ORIGIN_DROPPED.includes(k.toLowerCase())) delete headers[k];
-        const onward = await globalThis.fetch(next.toString(), { method, headers, redirect: mode, ...(signal ? { signal } : {}), ...(body != null ? { body } : {}) });
+      if ((current.proxy && localGuestProxy()) || !nextRoute || nextRoute.vendor !== 'app') {
+        delete headers['x-twins-key'];
+        delete headers['x-volter-twin-original-host'];
+        const onward = await reenterFetch(next.toString(), { method, headers, redirect: mode, ...(signal ? { signal } : {}), ...(body != null ? { body } : {}) }, chain);
         return onward;
       }
       at = next; current = nextRoute;
@@ -613,7 +808,7 @@ async function fetchApp(route, url, input, init) {
     if (empty) res.resume();
     const response = new Response(empty ? null : Readable.toWeb(stream), { status: res.statusCode, statusText: res.statusMessage, headers: out });
     Object.defineProperty(response, 'url', { value: at.toString() });
-    if (hops > 0) Object.defineProperty(response, 'redirected', { value: true });
+    if (chain.hops > firstHop) Object.defineProperty(response, 'redirected', { value: true });
     return response;
   }
 }
@@ -869,7 +1064,30 @@ function lookupWaitsForClaims(hostname) {
  *  slow resolver would, and a name it claims is known from its next read. Null when every first read has landed. */
 function claimsPendingBriefly() {
   const pending = claimsPending(MAP);
-  return pending ? Promise.race([pending, new Promise((ok) => { const t = setTimeout(ok, 1500); if (t.unref) t.unref(); })]) : null;
+  return pending ? waitForClaims(pending) : null;
+}
+/** The caller's whole wait is bounded independently of reads already in flight. */
+function waitForClaims(pending, claimingTwins) {
+  return new Promise((resolve) => {
+    const started = performance.now();
+    let settled = false;
+    const finish = (outcome) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(deadline);
+      if (claimingTwins !== undefined && claimsRefreshChannel.hasSubscribers) {
+        claimsRefreshChannel.publish({ outcome, elapsedMs: performance.now() - started, limitMs: CLAIMS_WAIT_MS, claimingTwins });
+      }
+      resolve();
+    };
+    const deadline = setTimeout(() => finish('expired'), CLAIMS_WAIT_MS);
+    pending.then(() => finish('complete'), () => finish('failed'));
+  });
+}
+/** Refresh unresolved fetch destinations once; a claim acquired after startup must not await the poll. */
+function claimsRefreshBriefly() {
+  const reads = Object.keys(CLAIMERS).filter((v) => MAP[v]).map((v) => claimsAt(MAP[v], CLAIMERS[v]).refresh());
+  return reads.length ? waitForClaims(Promise.all(reads), reads.length) : null;
 }
 function patchedLookup(original) {
   return function patchedDnsLookup(hostname, options, callback) {
@@ -898,6 +1116,7 @@ function patchedPromisesLookup(original) {
 
 /** The port a net/tls connect names (`connect(port, host)`, `connect({ port, host })`), or undefined. */
 function socketTargetPort(args) {
+  if (Array.isArray(args[0])) args = args[0]; // Node factories pass their normalized argument tuple to the instance.
   const [first] = args;
   const raw = first !== null && typeof first === 'object' ? first.port : first;
   const port = Number(raw);
@@ -910,7 +1129,19 @@ function socketRefusal(hostname, port, isTls) {
     return `[twin-inject] refused a socket to ${host}, the address this World's DNS gives the names it routes: `
       + 'nothing listens there; connect by the name, which the World routes to its twin or its application.';
   }
+  if (localGuestProxy() && isLocalOrPrivateHost(host)) {
+    const endpoints = [localGuestProxy(), worldBase() && new URL(worldBase().origin), ...Object.values(MAP).map(origin => { try { return new URL(origin); } catch { return null; } })].filter(Boolean);
+    if (!endpoints.some(endpoint => endpoint.hostname.replace(/^\[|\]$/g, '') === host.replace(/^\[|\]$/g, '') && Number(endpoint.port || (endpoint.protocol === 'https:' ? 443 : 80)) === port)) {
+      return `[twin-inject] local guest private socket to ${host}:${port} requires its guest proxy`;
+    }
+  }
   if (!host || isLocalOrPrivateHost(host) || isTwinOriginHost(host)) return null;
+  // the destination as an origin, its port and its protocol included: a policy that lists https://host allows TLS to
+  // host:443, never another port or a plaintext connection to it
+  const authority = `${isIP(host) === 6 ? `[${host}]` : host}${port !== undefined && !(isTls && port === 443) ? `:${port}` : ''}`;
+  const url = (() => { try { return new URL(`${isTls ? 'https' : 'http'}://${authority}/`); } catch { return null; } })();
+  const policy = worldNetworkPolicyFromEnv(process.env);
+  if (url && policy && !strictEgressEnabled() && worldNetworkUsesPassthrough(policy, url)) return null;
   const vendors = twinnedHostVendors(host, MAP);
   if (vendors.length > 0) {
     const doors = vendors.map(endpointEnvFor).filter(Boolean);
@@ -924,10 +1155,7 @@ function socketRefusal(hostname, port, isTls) {
     return `[twin-inject] refused a raw socket to ${host}, which this world routes to the application (volter-world app-url --host): `
       + 'the client opened its own connection instead of going through http/https or fetch, so it could not be routed.';
   }
-  // the destination as an origin, its port and its protocol included: a policy that lists https://host allows TLS to
-  // host:443, never another port or a plaintext connection to it
-  const authority = `${isIP(host) === 6 ? `[${host}]` : host}${port !== undefined && !(isTls && port === 443) ? `:${port}` : ''}`;
-  const url = (() => { try { return new URL(`${isTls ? 'https' : 'http'}://${authority}/`); } catch { return null; } })();
+  if (url && policy && !strictEgressEnabled() && worldNetworkNeedsPathInspection(policy, url)) return `[twin-inject] inspected egress requires a mediated HTTP request to ${authority}`;
   if (url && shouldBlockUntwinned(url)) return `[twin-inject] blocked untwinned external socket to ${authority}`;
   return null;
 }
@@ -938,8 +1166,22 @@ function refusedSocket(message) {
   return socket;
 }
 
+// tls.connect over an existing World proxy socket creates no external connection. Verify the
+// actual socket peer, never its caller-supplied host/servername, before permitting that SNI.
+function isWorldProxySocket(options) {
+  if (!options || !(options.socket instanceof net.Socket) || options.socket.destroyed) return false;
+  let proxy;
+  try { proxy = new URL(process.env.VOLTER_WORLD_PROXY || ''); } catch { return false; }
+  const local = ['localhost', '127.0.0.1', '[::1]', '::1'];
+  if (!local.includes(proxy.hostname)) return false;
+  const peer = options.socket.remoteAddress;
+  if (!['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(peer)) return false;
+  return options.socket.remotePort === Number(proxy.port || (proxy.protocol === 'https:' ? 443 : 80));
+}
+
 function patchedConnect(originalConnect, isTls) {
   return function patchedSocketConnect(...args) {
+    if (isTls && isWorldProxySocket(args.find((a) => a && typeof a === 'object' && a.socket))) return originalConnect.apply(this, args);
     const port = socketTargetPort(args);
     for (const host of socketTargetHosts(args, isTls)) {
       const refusal = socketRefusal(host, port, isTls);
@@ -949,6 +1191,40 @@ function patchedConnect(originalConnect, isTls) {
   };
 }
 
+function patchedInstanceConnect(originalConnect) {
+  return function guardedInstanceConnect(...args) {
+    const target = Array.isArray(args[0]) ? args[0] : args;
+    const isTls = this instanceof tls.TLSSocket;
+    for (const host of socketTargetHosts(target, isTls)) {
+      const refusal = socketRefusal(host, socketTargetPort(target), isTls);
+      if (refusal) {
+        // Preserve the instance and its error listeners; never return a different socket.
+        process.nextTick(() => this.destroy(Object.assign(new Error(refusal), { code: 'ECONNREFUSED' })));
+        return this;
+      }
+    }
+    return originalConnect.apply(this, args);
+  };
+}
+
+function patchedDatagram(original, connecting) {
+  return function guardedDatagram(...args) {
+    let peer;
+    if (!connecting) { try { peer = this.remoteAddress(); } catch { /* unconnected UDP socket */ } }
+    const tail = connecting ? args : args.slice(1);
+    const host = peer?.address ?? tail.findLast(arg => typeof arg === 'string') ?? 'localhost';
+    const port = peer?.port ?? tail.findLast(arg => typeof arg === 'number');
+    const refusal = socketRefusal(host, port, false);
+    if (refusal) {
+      const error = Object.assign(new Error(refusal), { code: 'ECONNREFUSED' });
+      const callback = !connecting && typeof args.at(-1) === 'function' ? args.at(-1) : null;
+      process.nextTick(() => callback ? callback(error) : this.emit('error', error));
+      return;
+    }
+    return original.apply(this, args);
+  };
+}
+
 let MAP = {};
 let installed = false;
 
@@ -981,8 +1257,14 @@ function upgradeToTwin(origin, url, method, headers, args, callback) {
 
 function patchedFactory(originalRequest, defaultProtocol) {
   return function patchedRequest(...args) {
-    const { url, method, headers, callback } = describe(args, defaultProtocol);
-    const twin = url && resolveTwin(url.hostname, MAP, url.pathname);
+    const { url, method, headers, callback, options: given, invalid } = describe(args, defaultProtocol);
+    if (invalid && worldNetworkPolicyFromEnv(process.env)) return blockedClientRequest('[twin-inject] request has an invalid effective authority or path');
+    const guest = mediateLocalGuest(url);
+    if (guest) {
+      if (isUpgrade(headers) || method === 'CONNECT') return blockedClientRequest('[twin-inject] local guest upgrade requires a mediated transport');
+      return requestApp({ proxy: guest }, url, method, headers, { signal: given.signal, timeout: given.timeout }, callback);
+    }
+    const twin = url && !publicBuildRequest(url) && resolveTwin(url.hostname, MAP, url.pathname);
     if (twin && twin.vendor === 'app') {
       const given = args.find((a) => a && typeof a === 'object' && !(a instanceof URL)) || {};
       return requestApp(twin, url, method, headers, { signal: given.signal, timeout: given.timeout }, callback);
@@ -996,10 +1278,17 @@ function patchedFactory(originalRequest, defaultProtocol) {
     // No twin claims this path — but if configured twins claim the HOST, the path is an unclaimed
     // slice of a shared, virtualized host (the Cal.com /calendar/v3 case): refuse loudly, in every
     // mode, before the strict-egress check gets a chance to phrase it as an ordinary untwinned host.
-    if (url && twinnedHostVendors(url.hostname, MAP).length > 0) {
+    if (url && !publicBuildRequest(url) && twinnedHostVendors(url.hostname, MAP).length > 0) {
       return blockedClientRequest(unclaimedTwinnedHostPathMessage(url.hostname, url.pathname, MAP));
     }
     if (shouldBlockUntwinned(url)) return blockedClientRequest(`[twin-inject] blocked untwinned external request to ${url.hostname}`);
+    const policy = worldNetworkPolicyFromEnv(process.env);
+    if (url && policy && worldNetworkNeedsPathInspection(policy, url)) {
+      if (isUpgrade(headers) || method === 'CONNECT') return blockedClientRequest('[twin-inject] inspected egress cannot upgrade its transport');
+      try {
+        return requestApp({ proxy: pathGrantProxy() }, url, method, headers, { signal: given.signal, timeout: given.timeout }, callback);
+      } catch (error) { return blockedClientRequest(`[twin-inject] ${error.message}`); }
+    }
     const request = originalRequest.apply(this, addressedToWorld(url) ? withWorldKey(args) : args);
     // Local mode, untwinned external host, world CA in force: the TLS handshake against the
     // real vendor is about to fail with a bare OpenSSL message — annotate it in-place via an
@@ -1035,6 +1324,9 @@ function install(mapOverride) {
     fetch: typeof globalThis.fetch === 'function' ? globalThis.fetch : null,
     netConnect: net.connect,
     netCreateConnection: net.createConnection,
+    socketConnect: net.Socket.prototype.connect,
+    datagramConnect: dgram.Socket.prototype.connect,
+    datagramSend: dgram.Socket.prototype.send,
     tlsConnect: tls.connect,
     dnsLookup: dns.lookup,
     dnsPromisesLookup: dns.promises.lookup,
@@ -1047,18 +1339,27 @@ function install(mapOverride) {
   https.get = function patchedHttpsGet(...args) { const req = https.request(...args); req.end(); return req; };
   net.connect = patchedConnect(ORIGINALS.netConnect, false);
   net.createConnection = patchedConnect(ORIGINALS.netCreateConnection, false);
+  net.Socket.prototype.connect = patchedInstanceConnect(ORIGINALS.socketConnect);
+  dgram.Socket.prototype.connect = patchedDatagram(ORIGINALS.datagramConnect, true);
+  dgram.Socket.prototype.send = patchedDatagram(ORIGINALS.datagramSend, false);
   tls.connect = patchedConnect(ORIGINALS.tlsConnect, true);
   dns.lookup = patchedLookup(ORIGINALS.dnsLookup);
   dns.promises.lookup = patchedPromisesLookup(ORIGINALS.dnsPromisesLookup);
   keyUndiciDispatches();
+  routeImportedUndici();
   // gRPC (architecture, "Other wires": gRPC): an HTTP/2 session to a host a twin serves (grpc-js on google-gax: TLS to
   // webrisk.googleapis.com) connects to that twin's origin in plain text, where the kernel's HTTP/2 server answers it;
   // the client carries on unchanged. Any other authority is the real one's.
   http2.connect = function patchedHttp2Connect(authority, options, listener) {
     let url = null;
     try { url = new URL(typeof authority === 'string' ? authority : authority && authority.href ? authority.href : `https://${authority.hostname || authority.host}`); } catch { url = null; }
-    const twin = url && resolveTwin(url.hostname, MAP, '/');
-    if (!twin) return ORIGINALS.http2Connect.apply(this, arguments);
+    const twin = url && !publicBuildRequest(url) && resolveTwin(url.hostname, MAP, '/');
+    if (!twin) {
+      if (mediateLocalGuest(url)) throw new Error('[twin-inject] local guest HTTP/2 requires a mediated transport');
+      const policy = worldNetworkPolicyFromEnv(process.env);
+      if (url && policy && !isLocalOrPrivateHost(url.hostname) && worldNetworkNeedsPathInspection(policy, url)) throw new Error('[twin-inject] HTTP/2 cannot use inspected egress');
+      return ORIGINALS.http2Connect.apply(this, arguments);
+    }
     const cb = typeof options === 'function' ? options : listener;
     const opts = typeof options === 'function' || !options ? {} : Object.fromEntries(Object.entries(options).filter(([k]) => !['secureContext', 'servername', 'ca', 'cert', 'key', 'checkServerIdentity', 'ALPNProtocols', 'createConnection', 'rejectUnauthorized'].includes(k)));
     return ORIGINALS.http2Connect.call(this, new URL(twin.origin).origin, opts, cb);
@@ -1066,27 +1367,32 @@ function install(mapOverride) {
 
   if (ORIGINALS.fetch) {
     const originalFetch = ORIGINALS.fetch;
-    globalThis.fetch = function patchedFetch(input, init, claimsWaited) {
+    globalThis.fetch = patchedWorldFetch = function patchedFetch(input, init, claimsWaited, knownChain) {
+      const chain = redirectChain(knownChain);
       let urlStr;
       try { urlStr = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input && input.url; } catch { urlStr = undefined; }
       let url = null;
-      if (urlStr) { try { url = new URL(urlStr); } catch { url = null; } }
-      const twin = url && resolveTwin(url.hostname, MAP, url.pathname);
+      if (urlStr) {
+        if (/\\/.test(String(urlStr).split(/[?#]/, 1)[0]) && worldNetworkPolicyFromEnv(process.env)) return Promise.reject(new Error('[twin-inject] backslash in fetch target'));
+        try { url = new URL(urlStr); } catch { url = null; }
+      }
+      const guest = mediateLocalGuest(url);
+      if (guest) return fetchApp({ proxy: guest }, url, input, init, chain);
+      // Resolve refreshed claims before evaluating the public build-artifact exception.
+      const claimed = url && resolveTwin(url.hostname, MAP, url.pathname);
+      const twin = claimed && !publicBuildRequest(url) ? claimed : null;
       if (!twin) {
-        // a host a twin may claim is decided once its door has been read (HOSTS A TWIN CLAIMS, above)
-        // waited once at most: a retry after the wait goes on with what is known
-        const pending = !claimsWaited && url && !isLocalOrPrivateHost(url.hostname) && !isTwinOriginHost(url.hostname) ? claimsPendingBriefly() : null;
-        if (pending) return pending.then(() => patchedFetch(input, init, true));
+        // A host may have been claimed since startup (including by a child process).
+        // Refresh once at most: a retry goes on with the claims actually returned.
+        const pending = !claimsWaited && url && !isLocalOrPrivateHost(url.hostname) && !isTwinOriginHost(url.hostname) ? claimsRefreshBriefly() : null;
+        if (pending) return pending.then(() => patchedFetch(input, init, true, chain));
         // Same shared-host rule as patchedFactory: an unclaimed path on a twinned host refuses
         // loudly in every mode — never mis-routed, never leaked to the real vendor.
-        if (url && twinnedHostVendors(url.hostname, MAP).length > 0) {
+        if (url && !publicBuildRequest(url) && twinnedHostVendors(url.hostname, MAP).length > 0) {
           return Promise.reject(new Error(unclaimedTwinnedHostPathMessage(url.hostname, url.pathname, MAP)));
         }
         if (shouldBlockUntwinned(url)) return Promise.reject(new Error(`[twin-inject] blocked untwinned external fetch to ${url.hostname}`));
-        // Automatic redirects run inside native fetch, past this interception
-        // point. Under an explicit World policy they must not open an unchecked
-        // second origin. Manual redirects remain readable for an SDK to follow
-        // through this same authorization door.
+        // Each followed redirect re-enters authorization; native fetch only receives manual hops under a policy.
         if (addressedToWorld(url) && twinsKey()) {
           const request = typeof input === 'object' && input !== null ? input : undefined;
           const headers = new Headers(init?.headers ?? request?.headers ?? {});
@@ -1095,16 +1401,23 @@ function install(mapOverride) {
           if (!keyed.method && request?.method) keyed.method = request.method;
           const redirect = keyed.redirect ?? request?.redirect ?? 'follow';
           if (redirect === 'follow') {
-            if (worldNetworkPolicyFromEnv(process.env)) return originalFetch(input, Object.assign(keyed, { redirect: 'error' }));
             keyed.redirect = 'manual';
-            return followKeyless(() => originalFetch(input, keyed), url, keyed);
+            return followKeyless(() => originalFetch(input, keyed), url, keyed, chain);
           }
           return originalFetch(input, keyed);
         }
         const policy = worldNetworkPolicyFromEnv(process.env);
         const redirect = init?.redirect ?? (typeof input === 'object' && input?.redirect) ?? 'follow';
-        const passthrough = originalFetch(input, policy && redirect === 'follow'
-          ? { ...init, redirect: 'error' } : init);
+        if (url && policy && worldNetworkNeedsPathInspection(policy, url)) {
+          try { return fetchApp({ proxy: pathGrantProxy() }, url, input, init, chain); }
+          catch (error) { return Promise.reject(error); }
+        }
+        const passthrough = policy && redirect === 'follow'
+          ? followKeyless(() => originalFetch(input, { ...init, redirect: 'manual' }), url, {
+            method: init?.method ?? input?.method, headers: init?.headers ?? input?.headers,
+            body: init?.body ?? input?.body, signal: init?.signal ?? input?.signal,
+          }, chain)
+          : originalFetch(input, init);
         // Same untwinned-host TLS naming as patchedFactory: fetch wraps the issuer error in
         // "fetch failed" with the code down the `cause` chain — annotate the surfaced error.
         if (url && !isLocalOrPrivateHost(url.hostname) && worldCaIsConfigured() && passthrough && typeof passthrough.catch === 'function') {
@@ -1116,7 +1429,7 @@ function install(mapOverride) {
         }
         return passthrough;
       }
-      if (twin.vendor === 'app') return fetchApp(twin, url, input, init);
+      if (twin.vendor === 'app') return fetchApp(twin, url, input, init, chain);
       const target = `${twin.origin.replace(/\/$/, '')}${url.pathname}${url.search}`;
       const reqInit = Object.assign({}, init);
       if (!reqInit.method && typeof input === 'object' && input && input.method) reqInit.method = input.method;
@@ -1128,7 +1441,6 @@ function install(mapOverride) {
         if (reqInit.duplex === undefined) reqInit.duplex = 'half';
       }
       if (reqInit.redirect === undefined && typeof input === 'object' && input?.redirect) reqInit.redirect = input.redirect;
-      if (worldNetworkPolicyFromEnv(process.env) && (reqInit.redirect === undefined || reqInit.redirect === 'follow')) reqInit.redirect = 'error';
       // Preserve the vendor destination for twins that serve more than one registry flavor from
       // one local origin. Host is honored by node:http; this explicit internal header is the
       // fetch-safe fallback when a runtime normalizes the forbidden Host header itself.
@@ -1141,9 +1453,9 @@ function install(mapOverride) {
       // through this same patch, so its next host is routed on its own.
       // Redirects are followed by followKeyless, so the key never reaches another origin. The
       // node path already behaves this way (the SDK sees the 30x and retries through the patch).
-      if (twinsKey() && (reqInit.redirect === undefined || reqInit.redirect === 'follow')) {
+      if ((twinsKey() || /^http:/i.test(twin.origin)) && (reqInit.redirect === undefined || reqInit.redirect === 'follow')) {
         reqInit.redirect = 'manual';
-        return followKeyless(() => originalFetch(target, reqInit), target, reqInit);
+        return followKeyless(() => originalFetch(target, reqInit), url, reqInit, chain);
       }
       // an https twin origin (a served world's door): undici cannot use a
       // session CA set after process start, so route through forward() — the
@@ -1161,10 +1473,10 @@ function install(mapOverride) {
           // branch used to prefix too, doubling the namespace on pathed https skins).
           const fullPath = `${url.pathname}${url.search}`;
           return forward(twin.origin, String(reqInit.method || 'GET').toUpperCase(), fullPath, headerObj, bodyValue === undefined ? undefined : Buffer.from(bodyValue))
-            .then((res) => new Response(res.body, { status: res.statusCode, headers: res.headers }));
+            .then((res) => fetchLocation(new Response(res.body, { status: res.statusCode, headers: res.headers }), url));
         }
       }
-      return originalFetch(target, reqInit);
+      return originalFetch(target, reqInit).then((response) => fetchLocation(response, url));
     };
   }
 
@@ -1207,6 +1519,9 @@ function restore() {
   if (ORIGINALS.fetch) globalThis.fetch = ORIGINALS.fetch;
   net.connect = ORIGINALS.netConnect;
   net.createConnection = ORIGINALS.netCreateConnection;
+  net.Socket.prototype.connect = ORIGINALS.socketConnect;
+  dgram.Socket.prototype.connect = ORIGINALS.datagramConnect;
+  dgram.Socket.prototype.send = ORIGINALS.datagramSend;
   tls.connect = ORIGINALS.tlsConnect;
   dns.lookup = ORIGINALS.dnsLookup;
   dns.promises.lookup = ORIGINALS.dnsPromisesLookup;
@@ -1262,7 +1577,71 @@ function installWorldTime() {
   globalThis.Date = WorldDate;
 }
 
+// A Cloudflare Worker started through miniflare (`wrangler dev`, Vitest's Workers pool) makes its outbound requests from
+// workerd, which neither the patched fetch nor the proxy sees. Each miniflare Worker hands them to its
+// `outboundService`; one that names none is given the patched fetch here, at construction and at setOptions, so its
+// vendor calls reach their twins as the process's do (architecture, the injector). Its own outbound service stands.
+function installMiniflareOutbound() {
+  if (Module.__volterMiniflareOutboundInstalled) return;
+  Module.__volterMiniflareOutboundInstalled = true;
+  // A host this process maps to a twin goes through the patched fetch. Any other goes where the World routes it: through
+  // its proxy (HTTPS_PROXY, trusting the World's CA), which Node's own fetch does not read, so through miniflare's undici
+  // with the environment's proxy agent; loopback stays direct.
+  const outboundFor = (miniflarePath) => {
+    let proxied = null;
+    try {
+      if (process.env.HTTPS_PROXY || process.env.HTTP_PROXY) {
+        const undici = Module.createRequire(miniflarePath)('undici');
+        const dispatcher = new undici.EnvHttpProxyAgent({ noProxy: localGuestProxy() ? '' : process.env.NO_PROXY || process.env.no_proxy || 'localhost,127.0.0.1,::1' });
+        proxied = (request) => undici.fetch(request, { dispatcher });
+      }
+    } catch { proxied = null; }
+    const mapped = (request) => { try { const url = new URL(request.url); return Boolean(resolveTwin(url.hostname, MAP, url.pathname)); } catch { return false; } };
+    // The Request itself is handed on: its method, headers and body are getters, which a copy of it as `init` loses.
+    return (request) => (!proxied || (installed && mapped(request)) ? globalThis.fetch(request) : proxied(request));
+  };
+  let outbound = null;
+  const routed = (options) => {
+    if (!options || typeof options !== 'object') return options;
+    // miniflare 5's Worker is `{ config, legacy, dev }`, its outbound a fetcher under `dev` (wrangler's own ProxyWorker, the
+    // one that turns the Cache API off, forwards to the app's Worker and keeps its own path); miniflare 4's names it inline.
+    const worker = (w) => {
+      if (!w || typeof w !== 'object') return w;
+      if ('config' in w) {
+        const dev = w.dev && typeof w.dev === 'object' ? w.dev : {};
+        return dev.outboundService === undefined && dev.cacheAPI !== false ? { ...w, dev: { ...dev, outboundService: { type: 'fetcher', handler: outbound } } } : w;
+      }
+      return w.outboundService === undefined ? { ...w, outboundService: outbound } : w;
+    };
+    return Array.isArray(options.workers) ? { ...options, workers: options.workers.map(worker) } : worker(options);
+  };
+  const originalLoad = Module._load;
+  const seen = new WeakMap();
+  Module._load = function volterMiniflareLoad(request, parent) {
+    const exports = originalLoad.apply(this, arguments);
+    if (request !== 'miniflare' || !exports || typeof exports.Miniflare !== 'function' || exports.Miniflare.__volterRouted) return exports;
+    if (seen.has(exports)) return seen.get(exports);
+    if (!outbound) {
+      let at = null;
+      try { at = Module._resolveFilename(request, parent); } catch { at = null; }
+      outbound = at ? outboundFor(at) : (request) => globalThis.fetch(request);
+    }
+    const Original = exports.Miniflare;
+    class Miniflare extends Original {
+      constructor(options) { super(routed(options)); }
+      setOptions(options) { return super.setOptions(routed(options)); }
+    }
+    Miniflare.__volterRouted = true;
+    // miniflare's build exports `Miniflare` as a getter that can be neither assigned nor redefined: its importer is given
+    // a view of the module whose `Miniflare` is this one, the same view each time it is required.
+    const view = new Proxy(exports, { get: (target, key, receiver) => (key === 'Miniflare' ? Miniflare : Reflect.get(target, key, receiver)) });
+    seen.set(exports, view);
+    return view;
+  };
+}
+
 // Auto-install as a preload (`--require`); strict refusal also applies without twin URLs.
 install();
 installWorldTime();
 installPrismaAdapterShim();
+installMiniflareOutbound();