@volter/world-runtime 3.0.128 → 3.0.130

package/dist/src/process-signal.mjs

@@ -1,5 +1,6 @@
 import { spawn } from 'node:child_process';
 import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 
 // Retain the existing 1000 ms inspection ceiling, not a new timeout chosen from one sample.
 // Measured 2026-10-03 on shared Darwin 25.4.0 ARM64, Bun 1.3.11 (process.version
@@ -8,10 +9,33 @@ import { readFileSync } from 'node:fs';
 // TZ=UTC took 9.26 ms from spawn to close; time printed real/user/sys 0.00 s.
 // This includes the time wrapper/event-loop overhead, not an isolated benchmark.
 // Full command/output: cookbook/calcom/output/held-backing-lifecycle.txt.
+// Windows, measured 2026-10-07 on Windows 11 Home 10.0.26200 x64 (volter-desktop, a livestream
+// running, CPU load 30%), Node v24.18.0, parent e8d4b55f plus this change: `await processBirth(process.pid)`
+// from this module, timed with performance.now() around the await, took 237-319 ms over 10
+// sequential runs, at most 298 ms with 4 awaited at once and at most 424 ms with 8.
 const BIRTH_LOOKUP_MS = 1000;
+/** The command that prints a pid's birth, and how its output reads. Windows has no `ps` and no /proc: its birth is the
+ *  process's creation time (GetProcessTimes, a FILETIME of 100 ns ticks in UTC, so neither the caller's zone nor its
+ *  locale changes it), read through .NET by the Windows PowerShell every Windows 10 and 11 install ships. */
+function birthProbe(pid) {
+  if (process.platform === 'win32') {
+    return {
+      command: join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe'),
+      args: ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', `[Diagnostics.Process]::GetProcessById(${pid}).StartTime.ToFileTimeUtc()`],
+      read: output => (/^\d+$/.test(output) ? `filetime ${output}` : undefined),
+    };
+  }
+  return {
+    command: 'ps', args: ['-o', 'pid=,lstart=', '-p', String(pid)],
+    read: output => {
+      const match = /^\s*(\d+)\s+(.+?)\s*$/.exec(output);
+      return match && Number(match[1]) === pid ? match[2] : undefined;
+    },
+  };
+}
 /** No subprocess on Linux; elsewhere the lookup never blocks the lifecycle event loop. */
 export async function processBirth(pid) {
-  if (process.platform === 'win32') return undefined;
+  if (!Number.isInteger(pid) || pid <= 0) return undefined; // a pid enters a probe's command only as an integer
   if (process.platform === 'linux') {
     try {
       const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
@@ -19,13 +43,14 @@ export async function processBirth(pid) {
       return /^\d+$/.test(tick ?? '') ? `tick ${tick}` : undefined;
     } catch { return undefined; }
   }
+  const probe = birthProbe(pid);
   return new Promise(resolve => {
     // A probe that cannot run is a birth unknown, never a lifecycle failure: spawn throws synchronously where the
     // process may not exec `ps` at all (setuid root on macOS, which a sandbox-exec profile refuses: EPERM), and reports
     // other failures as 'error' (below). Either way the identity is the pid without a start time.
     let child;
     try {
-      child = spawn('ps', ['-o', 'pid=,lstart=', '-p', String(pid)], {
+      child = spawn(probe.command, probe.args, {
         windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'],
         env: { ...process.env, LC_ALL: 'C', LANG: 'C', TZ: 'UTC' },
       });
@@ -42,10 +67,7 @@ export async function processBirth(pid) {
     }, BIRTH_LOOKUP_MS);
     child.stdout.on('data', chunk => { output += chunk; });
     child.once('error', () => finish(undefined));
-    child.once('close', code => {
-      const match = /^\s*(\d+)\s+(.+?)\s*$/.exec(output.trim());
-      finish(code === 0 && match && Number(match[1]) === pid ? match[2] : undefined);
-    });
+    child.once('close', code => finish(code === 0 ? probe.read(output.trim()) : undefined));
   });
 }
 /** Capture at spawn for durable ownership, never when retrying a retained PID. */

package/dist/src/redirect-proxy.js

@@ -288,6 +288,24 @@ export function twinUnreachableMessage(vendor, origin, err, world) {
     const cause = err.cause;
     return `twin "${vendor}" at ${origin} is unreachable${world ? ` in World "${world}"` : ''}: ${errorMessage(err)}${cause?.code ? ` (${cause.code})` : cause?.message ? ` (${errorMessage(cause)})` : ''}; check \`volter-world doctor${world ? ` ${world}` : ''}\`\n`;
 }
+/** The headers of one connection, not of the request (RFC 9110 §7.6.1), with `expect`: the hop that received them
+ *  answered them (Node's server sends the 100 Continue itself). Node's fetch refuses `transfer-encoding`,
+ *  `keep-alive`, `upgrade`, `expect` and a `connection` other than close/keep-alive outright, so a `git push` whose
+ *  pack came chunked (larger than `http.postBuffer`) failed `fetch failed (UND_ERR_INVALID_ARG)`; the body streams
+ *  on and fetch frames it afresh. */
+const HOP_BY_HOP = ['connection', 'keep-alive', 'proxy-connection', 'transfer-encoding', 'te', 'trailer', 'upgrade', 'expect'];
+const TOKEN = /^[!#$%&'*+.^_`|~0-9a-z-]+$/i;
+function forwardableHeaders(incoming) {
+    const headers = new Headers(incoming);
+    for (const listed of (incoming.get('connection') ?? '').split(',')) {
+        const name = listed.trim();
+        if (TOKEN.test(name))
+            headers.delete(name);
+    }
+    for (const h of HOP_BY_HOP)
+        headers.delete(h);
+    return headers;
+}
 /** Start the ambient redirect proxy. Returns a handle with the listen port + the env to export.
  * - Plain `http://` proxied requests to a vendor host → forwarded to the twin.
  * - `CONNECT host:443` to a vendor host → MITM-terminated with a session-signed leaf, decrypted, and
@@ -489,8 +507,8 @@ export async function startRedirectProxy(options) {
                     return new Response(note(noTwinMessage(hostHeader, u.pathname)) + refusalText(gap).trimStart(), { status: 502, headers: { 'content-type': 'text/plain; charset=utf-8', [REFUSAL_HEADER]: gap.missing } });
                 }
                 const origin = new URL(twin.origin);
-                const headers = new Headers(req.headers);
-                for (const h of ['proxy-connection', 'accept-encoding', 'connection', 'x-volter-world-browser'])
+                const headers = forwardableHeaders(req.headers);
+                for (const h of ['accept-encoding', 'x-volter-world-browser'])
                     headers.delete(h);
                 // the application is not a twin: it gets no World key, keeps its Host and hears it was reached over TLS
                 if (twin.vendor === 'app') {
@@ -521,7 +539,7 @@ export async function startRedirectProxy(options) {
                     return new Response(upRes.body, { status: upRes.status, headers: out });
                 }
                 catch (err) {
-                    return new Response(twinUnreachable(twin.vendor, origin.origin, err), { status: 502 });
+                    return new Response(twinUnreachable(twin.vendor, origin.origin, err), { status: 502, headers: { 'content-type': 'text/plain; charset=utf-8' } });
                 }
             },
             upgrade: websocketRelay(req => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-runtime",
-  "version": "3.0.128",
+  "version": "3.0.130",
   "description": "World configs for twins: boot named local runtimes, allocate ports, generate world.env/instance.json, and run apps against fake-key twin worlds.",
   "keywords": [
     "twin",
@@ -70,14 +70,14 @@
     "node": ">=22.3"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.128",
-    "@volter/world-console": "3.0.123"
+    "@volter/world-core": "3.0.130",
+    "@volter/world-console": "3.0.125"
   },
   "dependencies": {
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "@volter/world-access": "3.0.1",
-    "@volter/world-core": "3.0.128",
+    "@volter/world-core": "3.0.130",
     "mongodb": "~6.20.0",
     "pg-gateway": "0.3.0-beta.4",
     "smol-toml": "^1.8.0",

package/src/process-signal.mjs

@@ -1,5 +1,6 @@
 import { spawn } from 'node:child_process';
 import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 
 // Retain the existing 1000 ms inspection ceiling, not a new timeout chosen from one sample.
 // Measured 2026-10-03 on shared Darwin 25.4.0 ARM64, Bun 1.3.11 (process.version
@@ -8,10 +9,33 @@ import { readFileSync } from 'node:fs';
 // TZ=UTC took 9.26 ms from spawn to close; time printed real/user/sys 0.00 s.
 // This includes the time wrapper/event-loop overhead, not an isolated benchmark.
 // Full command/output: cookbook/calcom/output/held-backing-lifecycle.txt.
+// Windows, measured 2026-10-07 on Windows 11 Home 10.0.26200 x64 (volter-desktop, a livestream
+// running, CPU load 30%), Node v24.18.0, parent e8d4b55f plus this change: `await processBirth(process.pid)`
+// from this module, timed with performance.now() around the await, took 237-319 ms over 10
+// sequential runs, at most 298 ms with 4 awaited at once and at most 424 ms with 8.
 const BIRTH_LOOKUP_MS = 1000;
+/** The command that prints a pid's birth, and how its output reads. Windows has no `ps` and no /proc: its birth is the
+ *  process's creation time (GetProcessTimes, a FILETIME of 100 ns ticks in UTC, so neither the caller's zone nor its
+ *  locale changes it), read through .NET by the Windows PowerShell every Windows 10 and 11 install ships. */
+function birthProbe(pid) {
+  if (process.platform === 'win32') {
+    return {
+      command: join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe'),
+      args: ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', `[Diagnostics.Process]::GetProcessById(${pid}).StartTime.ToFileTimeUtc()`],
+      read: output => (/^\d+$/.test(output) ? `filetime ${output}` : undefined),
+    };
+  }
+  return {
+    command: 'ps', args: ['-o', 'pid=,lstart=', '-p', String(pid)],
+    read: output => {
+      const match = /^\s*(\d+)\s+(.+?)\s*$/.exec(output);
+      return match && Number(match[1]) === pid ? match[2] : undefined;
+    },
+  };
+}
 /** No subprocess on Linux; elsewhere the lookup never blocks the lifecycle event loop. */
 export async function processBirth(pid) {
-  if (process.platform === 'win32') return undefined;
+  if (!Number.isInteger(pid) || pid <= 0) return undefined; // a pid enters a probe's command only as an integer
   if (process.platform === 'linux') {
     try {
       const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
@@ -19,13 +43,14 @@ export async function processBirth(pid) {
       return /^\d+$/.test(tick ?? '') ? `tick ${tick}` : undefined;
     } catch { return undefined; }
   }
+  const probe = birthProbe(pid);
   return new Promise(resolve => {
     // A probe that cannot run is a birth unknown, never a lifecycle failure: spawn throws synchronously where the
     // process may not exec `ps` at all (setuid root on macOS, which a sandbox-exec profile refuses: EPERM), and reports
     // other failures as 'error' (below). Either way the identity is the pid without a start time.
     let child;
     try {
-      child = spawn('ps', ['-o', 'pid=,lstart=', '-p', String(pid)], {
+      child = spawn(probe.command, probe.args, {
         windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'],
         env: { ...process.env, LC_ALL: 'C', LANG: 'C', TZ: 'UTC' },
       });
@@ -42,10 +67,7 @@ export async function processBirth(pid) {
     }, BIRTH_LOOKUP_MS);
     child.stdout.on('data', chunk => { output += chunk; });
     child.once('error', () => finish(undefined));
-    child.once('close', code => {
-      const match = /^\s*(\d+)\s+(.+?)\s*$/.exec(output.trim());
-      finish(code === 0 && match && Number(match[1]) === pid ? match[2] : undefined);
-    });
+    child.once('close', code => finish(code === 0 ? probe.read(output.trim()) : undefined));
   });
 }
 /** Capture at spawn for durable ownership, never when retrying a retained PID. */

package/src/redirect-proxy.ts

@@ -336,6 +336,20 @@ export function twinUnreachableMessage(vendor: string, origin: string, err: Erro
   return `twin "${vendor}" at ${origin} is unreachable${world ? ` in World "${world}"` : ''}: ${errorMessage(err)}${cause?.code ? ` (${cause.code})` : cause?.message ? ` (${errorMessage(cause)})` : ''}; check \`volter-world doctor${world ? ` ${world}` : ''}\`\n`;
 }
 
+/** The headers of one connection, not of the request (RFC 9110 §7.6.1), with `expect`: the hop that received them
+ *  answered them (Node's server sends the 100 Continue itself). Node's fetch refuses `transfer-encoding`,
+ *  `keep-alive`, `upgrade`, `expect` and a `connection` other than close/keep-alive outright, so a `git push` whose
+ *  pack came chunked (larger than `http.postBuffer`) failed `fetch failed (UND_ERR_INVALID_ARG)`; the body streams
+ *  on and fetch frames it afresh. */
+const HOP_BY_HOP = ['connection', 'keep-alive', 'proxy-connection', 'transfer-encoding', 'te', 'trailer', 'upgrade', 'expect'];
+const TOKEN = /^[!#$%&'*+.^_`|~0-9a-z-]+$/i;
+function forwardableHeaders(incoming: Headers): Headers {
+  const headers = new Headers(incoming);
+  for (const listed of (incoming.get('connection') ?? '').split(',')) { const name = listed.trim(); if (TOKEN.test(name)) headers.delete(name); }
+  for (const h of HOP_BY_HOP) headers.delete(h);
+  return headers;
+}
+
 /** Start the ambient redirect proxy. Returns a handle with the listen port + the env to export.
  * - Plain `http://` proxied requests to a vendor host → forwarded to the twin.
  * - `CONNECT host:443` to a vendor host → MITM-terminated with a session-signed leaf, decrypted, and
@@ -503,8 +517,8 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
         }
         const origin = new URL(twin.origin);
 
-        const headers = new Headers(req.headers);
-        for (const h of ['proxy-connection', 'accept-encoding', 'connection', 'x-volter-world-browser']) headers.delete(h);
+        const headers = forwardableHeaders(req.headers);
+        for (const h of ['accept-encoding', 'x-volter-world-browser']) headers.delete(h);
         // the application is not a twin: it gets no World key, keeps its Host and hears it was reached over TLS
         if (twin.vendor === 'app') {
           headers.delete('x-twins-key');
@@ -529,7 +543,7 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
           for (const h of ['content-encoding', 'content-length', 'transfer-encoding', 'connection', 'keep-alive']) out.delete(h);
           return new Response(upRes.body, { status: upRes.status, headers: out });
         } catch (err) {
-          return new Response(twinUnreachable(twin.vendor, origin.origin, err as Error), { status: 502 });
+          return new Response(twinUnreachable(twin.vendor, origin.origin, err as Error), { status: 502, headers: { 'content-type': 'text/plain; charset=utf-8' } });
         }
       },
       upgrade: websocketRelay(req => {