@volter/world-runtime 3.0.38 → 3.0.40

package/src/process-groups.ts

@@ -1,33 +1 @@
-import { spawnSync } from 'node:child_process';
-
-/** Inspect only groups already owned by the lifecycle. A dead leader does not prove that its
- * descendants exited. Zombies hold no resources; unknown inspection remains live. This is
- * retirement evidence, never an ownership token or a way to discover processes to kill. */
-export function survivingOwnedGroups(pids: number[]): number[] {
-  const candidates = pids.filter(pid => {
-    try { process.kill(process.platform === 'win32' ? pid : -pid, 0); return true; }
-    catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== 'ESRCH') return true;
-      try { process.kill(pid, 0); return true; }
-      catch (cause) { return (cause as NodeJS.ErrnoException).code !== 'ESRCH'; }
-    }
-  });
-  if (!candidates.length || process.platform === 'win32') return candidates;
-  const result = spawnSync('ps', ['-axo', 'pid=,pgid=,stat='], { windowsHide: true,
-    encoding: 'utf8', timeout: 1000, killSignal: 'SIGKILL', maxBuffer: 4 * 1024 * 1024,
-  });
-  if (result.status !== 0 || result.error) return candidates;
-  const rows = result.stdout.trim().split('\n').map(line => line.trim().split(/\s+/));
-  return candidates.filter(pid => {
-    const members = rows.filter(([id, group]) => Number(group) === pid || Number(id) === pid);
-    // Visibility restrictions can omit a live group. Only ESRCH proves absence.
-    if (!members.length) {
-      for (const target of [-pid, pid]) {
-        try { process.kill(target, 0); return true; }
-        catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ESRCH') return true; }
-      }
-      return false;
-    }
-    return members.some(([, , state]) => !state || !state.startsWith('Z'));
-  });
-}
+export { survivingOwnedGroups, processStarts } from './process-groups.mjs';

package/src/process-receipt.d.mts

@@ -0,0 +1,6 @@
+import type { ReceiptRead, SpawnIdentity } from './process-receipt.js';
+export { spawnIdentity, verifySpawnIdentity, signalOwnedProcess } from './process-signal.mjs';
+export function publishProcessReceipt(path: string, text: string): void;
+export function readProcessReceipt<T>(path: string, parse: (text: string) => T): ReceiptRead<T>;
+export function spawnReceiptPath(path: string): string;
+export function readSpawnReceipt(path: string): ReceiptRead<SpawnIdentity>;

package/src/process-receipt.mjs

@@ -0,0 +1,45 @@
+import fs from 'node:fs';
+import { dirname } from 'node:path';
+import { randomUUID } from 'node:crypto';
+export { spawnIdentity, verifySpawnIdentity, signalOwnedProcess } from './process-signal.mjs';
+
+/** A failed publication never truncates the previous receipt. */
+export function publishProcessReceipt(path, text) {
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  let descriptor;
+  const failures = [];
+  try {
+    descriptor = fs.openSync(temporary, 'wx', 0o600);
+    fs.writeFileSync(descriptor, text);
+    fs.fsyncSync(descriptor);
+    fs.closeSync(descriptor); descriptor = undefined;
+    fs.renameSync(temporary, path);
+    descriptor = fs.openSync(dirname(path), 'r');
+    fs.fsyncSync(descriptor);
+  } catch (error) { failures.push(error); }
+  if (descriptor !== undefined) {
+    try { fs.closeSync(descriptor); } catch (error) { failures.push(error); }
+  }
+  try { fs.rmSync(temporary, { force: true }); } catch (error) { failures.push(error); }
+  if (failures.length) throw new AggregateError(failures, `Process receipt publication failed: ${path}`);
+}
+
+/** Unreadable is uncertainty, not absence; a separate spawn receipt may still establish ownership. */
+export function readProcessReceipt(path, parse) {
+  try { return { present: true, value: parse(fs.readFileSync(path, 'utf8')) }; }
+  catch (cause) {
+    if (cause.code === 'ENOENT') return { present: false };
+    return { present: true, error: new Error(`Process receipt unreadable; ownership uncertain: ${path}`, { cause }) };
+  }
+}
+
+export const spawnReceiptPath = (path) => `${path}.spawn.json`;
+export function readSpawnReceipt(path) {
+  return readProcessReceipt(spawnReceiptPath(path), text => {
+    const value = JSON.parse(text);
+    if (!Number.isInteger(value?.pid) || value.pid <= 0 || (typeof value.start !== 'string' || !value.start.trim())) {
+      throw new Error('Invalid process spawn identity');
+    }
+    return value;
+  });
+}

package/src/process-receipt.ts

@@ -0,0 +1,5 @@
+// Native Node guests and the World use one atomic process-receipt implementation.
+export { spawnIdentity, verifySpawnIdentity, signalOwnedProcess } from './process-signal.mjs';
+export { publishProcessReceipt, readProcessReceipt, spawnReceiptPath, readSpawnReceipt } from './process-receipt.mjs';
+export interface ReceiptRead<T> { present: boolean; value?: T; error?: Error }
+export interface SpawnIdentity { pid: number; start?: string }

package/src/process-signal.d.mts

@@ -0,0 +1,9 @@
+import type { SpawnIdentity } from './process-receipt.js';
+import type { ChildProcess } from 'node:child_process';
+export function processBirth(pid: number): Promise<string | undefined>;
+export function spawnIdentity(pid: number): Promise<SpawnIdentity>;
+export function verifySpawnIdentity(identity: SpawnIdentity | undefined): Promise<void>;
+export function signalOwnedProcess(identity: SpawnIdentity | undefined, signal: NodeJS.Signals, group?: boolean): Promise<boolean>;
+export function signalChild(child: ChildProcess, signal: NodeJS.Signals, group?: boolean): boolean;
+export function signalHeldChild(child: ChildProcess, signal: NodeJS.Signals, group?: boolean, birth?: Promise<SpawnIdentity | undefined>): Promise<boolean>;
+export function childIdentity(child: ChildProcess): Promise<SpawnIdentity | undefined>;

package/src/process-signal.mjs

@@ -0,0 +1,92 @@
+import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+
+// Retain the existing 1000 ms inspection ceiling, not a new timeout chosen from one sample.
+// Measured 2026-10-03 on shared Darwin 25.4.0 ARM64, Bun 1.3.11 (process.version
+// v24.3.0), parent 38b5290 plus this change; no Cal server, one live driver PID:
+// `/usr/bin/time -p /bin/ps -o pid=,lstart= -p <driver-pid>` with LC_ALL/LANG=C,
+// TZ=UTC took 9.26 ms from spawn to close; time printed real/user/sys 0.00 s.
+// This includes the time wrapper/event-loop overhead, not an isolated benchmark.
+// Full command/output: cookbook/calcom/output/held-backing-lifecycle.txt.
+const BIRTH_LOOKUP_MS = 1000;
+/** No subprocess on Linux; elsewhere the lookup never blocks the lifecycle event loop. */
+export async function processBirth(pid) {
+  if (process.platform === 'win32') return undefined;
+  if (process.platform === 'linux') {
+    try {
+      const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+      const tick = stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19];
+      return /^\d+$/.test(tick ?? '') ? `tick ${tick}` : undefined;
+    } catch { return undefined; }
+  }
+  return new Promise(resolve => {
+    const child = spawn('ps', ['-o', 'pid=,lstart=', '-p', String(pid)], {
+      windowsHide: true, stdio: ['ignore', 'pipe', 'ignore'],
+      env: { ...process.env, LC_ALL: 'C', LANG: 'C', TZ: 'UTC' },
+    });
+    let output = '', settled = false;
+    const finish = value => { if (!settled) { settled = true; clearTimeout(timer); child.stdout.destroy(); resolve(value); } };
+    // This is our still-held inspector, not a PID from a receipt.
+    const timer = setTimeout(() => {
+      try { signalChild(child, 'SIGKILL'); } catch { /* failed inspection remains unavailable */ }
+      finish(undefined); // an exited wrapper's descendant may keep stdout open indefinitely
+    }, BIRTH_LOOKUP_MS);
+    child.stdout.on('data', chunk => { output += chunk; });
+    child.once('error', () => finish(undefined));
+    child.once('close', code => {
+      const match = /^\s*(\d+)\s+(.+?)\s*$/.exec(output.trim());
+      finish(code === 0 && match && Number(match[1]) === pid ? match[2] : undefined);
+    });
+  });
+}
+/** Capture at spawn for durable ownership, never when retrying a retained PID. */
+export async function spawnIdentity(pid) {
+  const start = await processBirth(pid);
+  return { pid, ...(start === undefined ? {} : { start }) };
+}
+/** An async capture is accepted only while its original child is still held and live. */
+export async function childIdentity(child) {
+  if (!child.pid) return undefined;
+  const identity = await spawnIdentity(child.pid);
+  return child.exitCode === null && child.signalCode === null ? identity : undefined;
+}
+/** A birth token is required even when an absent leader leaves a surviving group. */
+export async function verifySpawnIdentity(identity) {
+  if (!identity || !Number.isInteger(identity.pid) || identity.pid <= 0 || typeof identity.start !== 'string' || !identity.start.trim()) {
+    throw new Error('Process recorded birth token missing; retirement refused; ownership retained');
+  }
+  const current = await processBirth(identity.pid);
+  if (current !== undefined && current !== identity.start) {
+    throw new Error(`Process ${identity.pid} no longer matches its recorded spawn identity; retirement refused`);
+  }
+  if (current === undefined) {
+    try { process.kill(identity.pid, 0); }
+    catch (error) { if (error.code === 'ESRCH') return; throw error; }
+    throw new Error(`Process ${identity.pid} identity cannot be established; ownership retained`);
+  }
+}
+/** Stored or retained numbers use birth verification before every delivery. */
+export async function signalOwnedProcess(identity, signal, group = false) {
+  await verifySpawnIdentity(identity);
+  try { return process.kill(group && process.platform !== 'win32' ? -identity.pid : identity.pid, signal); }
+  catch (error) { if (error.code === 'ESRCH') return false; throw error; }
+}
+/** A live ChildProcess is ownership until exit. A group additionally needs its leader alive.
+ * False means no held delivery was possible; a caller with surviving descendants needs a birth. */
+export function signalChild(child, signal, group = false) {
+  if (!child.pid || child.exitCode !== null || child.signalCode !== null) return false;
+  if (!group || process.platform === 'win32') return child.kill(signal);
+  try { process.kill(child.pid, 0); }
+  catch (error) { if (error.code === 'ESRCH') return false; throw error; }
+  try { return process.kill(-child.pid, signal); }
+  catch (error) { if (error.code === 'ESRCH') return false; throw error; }
+}
+
+/** Held first; an orphaned group then becomes retained numeric ownership. */
+export async function signalHeldChild(child, signal, group = false, birth = Promise.resolve(undefined)) {
+  if (signalChild(child, signal, group)) return true;
+  if (!group || process.platform === 'win32' || !child.pid) return false;
+  try { process.kill(-child.pid, 0); }
+  catch (error) { if (error.code === 'ESRCH') return false; throw error; }
+  return signalOwnedProcess(await birth, signal, true);
+}

package/src/project-inspect.ts

@@ -554,7 +554,7 @@ export function connectionProtocol(value: string): string | null {
 /** Native connections are independent of the vendor's HTTP SDK. Inspect ordinary URL schemes
  * and Prisma datasource declarations; never infer a selected Prisma adapter from its presence
  * in package.json. Dynamic/config-file-only datasources remain unknown, as do unbound drivers. */
-export function projectConnections(input = process.cwd(), attributedEnv = new Set<string>()): ProjectConnection[] {
+export function projectConnections(input = process.cwd(), attributedEnv = new Set<string>(), boundProtocols: ReadonlyMap<string, string> = new Map()): ProjectConnection[] {
   const root = resolve(input);
   const found: ProjectConnection[] = [];
   const dependencies = projectDependencies(root);
@@ -575,7 +575,9 @@ export function projectConnections(input = process.cwd(), attributedEnv = new Se
         // DATABASE_URL has none and must stay unknown, even beside an unrelated HTTP SDK.
         if (connectionProtocol(resolved) === null && attributedEnv.has(match[1]!) &&
           (/^https?:/i.test(resolved) || /_REST_URL$/.test(match[1]!))) continue;
-        found.push({ protocol: connectionProtocol(resolved), env: match[1]!, sources: [`env: ${relative(root, resolve(dir, file))}:${index + 1} ${match[1]}`] });
+        // An empty example leaves the actual value to environment injection. Only an owned binding supplies its protocol.
+        const protocol = connectionProtocol(resolved) ?? (value.trim() === '' ? boundProtocols.get(match[1]!) ?? null : null);
+        found.push({ protocol, env: match[1]!, sources: [`env: ${relative(root, resolve(dir, file))}:${index + 1} ${match[1]}`] });
       }
     }
   }

package/src/proxy-daemon.ts

@@ -2,6 +2,7 @@
 // Detached entry for the ambient TLS redirect proxy. `activate` spawns this as its own process so a
 // long-lived proxy can serve the activated shell(s) for the world's lifetime; it records its
 // pid/url/CA in the instance dir and is stopped by `volter-world down`. Not a user-facing command.
+import { errorMessage } from './error-message.ts';
 import { runProxyDaemon } from './runtime.ts';
 
 const [name, ...rest] = process.argv.slice(2);
@@ -16,6 +17,6 @@ if (!name) {
 }
 
 runProxyDaemon(name, root, envFile).catch((error) => {
-  process.stderr.write(`proxy-daemon: ${error instanceof Error ? error.message : String(error)}\n`);
+  process.stderr.write(`proxy-daemon: ${errorMessage(error)}\n`);
   process.exit(1);
 });

package/src/redirect-proxy.ts

@@ -1,5 +1,6 @@
+import { errorMessage } from './error-message.ts';
 import { serveHttp, type HttpServer } from '@volter/world-core/runtime';
-import { worldNetworkPolicyFromEnv, allowsWorldNetworkEgress } from '@volter/world-core/network-policy';
+import { worldNetworkPolicyFromEnv, allowsWorldNetworkEgress, worldNetworkNeedsPathInspection, worldNetworkUsesPassthrough } from '@volter/world-core/network-policy';
 import { websocketRelay } from './websocket-relay.ts';
 // The ambient TLS redirect proxy — the substance of "any CLI, zero config" (WORLD_ACTIVATE.md §"How
 // redirection works", tier 1). A local TLS-terminating forward proxy that maps vendor API hosts
@@ -26,6 +27,9 @@ import { lookup as dnsLookup } from 'node:dns/promises';
 import { BlockList, Socket, isIP, connect as netConnect, createServer as createNetServer } from 'node:net';
 import { networkInterfaces } from 'node:os';
 import { connect as tlsConnect } from 'node:tls';
+import { request as httpsRequest } from 'node:https';
+import { createServer as createHttpServer } from 'node:http';
+import { Readable } from 'node:stream';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 // The host→twin table is loaded through the shared inject-map module (one world-runtime home
@@ -33,6 +37,7 @@ import { join } from 'node:path';
 // never re-encode the vendor host predicates — they stay one source of truth with the Node
 // injector. External callers go through `proxyTargetFor`/`activeVendorMap`.
 import { loadInject } from './inject-map.ts';
+import { packFacts } from './pack-facts.ts';
 import { sessionTrustEnv, type CaTrustInputs } from './ca-trust.ts';
 
 /**
@@ -160,7 +165,7 @@ export async function guestDestination(host: string): Promise<{ address: string
   const h = host.replace(/^\[|\]$/g, '');
   let addresses: string[];
   try { addresses = isIP(h) ? [h] : (await dnsLookup(h, { all: true })).map((r) => r.address); } catch (error) {
-    return { refused: `${host} does not resolve (${(error as Error).message})` };
+    return { refused: `${host} does not resolve (${errorMessage(error)})` };
   }
   const bad = addresses.find(isGuestForbiddenAddress);
   if (bad || !addresses.length) return { refused: `${host} is on the machine's host network (${bad ?? 'no address'}), which a World Machine cannot reach` };
@@ -309,7 +314,7 @@ type RedirectProxyHandle = {
  *  of which World to look at (`doctor`). Shared by every front that relays to twins. */
 export function twinUnreachableMessage(vendor: string, origin: string, err: Error, world?: string): string {
   const cause = (err as { cause?: { code?: string; message?: string } }).cause;
-  return `twin "${vendor}" at ${origin} is unreachable${world ? ` in World "${world}"` : ''}: ${err.message}${cause?.code ? ` (${cause.code})` : cause?.message ? ` (${cause.message})` : ''}; check \`volter-world doctor${world ? ` ${world}` : ''}\`\n`;
+  return `twin "${vendor}" at ${origin} is unreachable${world ? ` in World "${world}"` : ''}: ${errorMessage(err)}${cause?.code ? ` (${cause.code})` : cause?.message ? ` (${errorMessage(cause)})` : ''}; check \`volter-world doctor${world ? ` ${world}` : ''}\`\n`;
 }
 
 /** Start the ambient redirect proxy. Returns a handle with the listen port + the env to export.
@@ -336,6 +341,94 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
   // or real upstream would otherwise keep the server from closing).
   const openSockets = new Set<Socket>();
 
+  const publicBuildRequest = (target: URL, env: Record<string, string | undefined>): boolean => {
+    const policy = worldNetworkPolicyFromEnv(env);
+    return !strictEgressEnabled(env) && !!policy && policy.phase === 'build' && allowsWorldNetworkEgress(policy, target);
+  };
+
+  // One upstream HTTP operation, shared by plain-proxy and decrypted CONNECT requests.
+  // It never follows redirects and never lends the upstream socket to the caller.
+  const externalRequest = async (target: URL, method: string, incoming: Headers, body: ReadableStream | null, signal?: AbortSignal): Promise<Response> => {
+    const env = currentEnv();
+    const policy = worldNetworkPolicyFromEnv(env);
+    // the method is visible here: an egress grant reads, a write needs `writes`
+    if (!policy || !allowsWorldNetworkEgress(policy, target, method) || shouldBlockUntwinned(target, env)) throw new Error('World policy refuses the effective request');
+    const host = incoming.get('host');
+    if (host && new URL(`${target.protocol}//${host}`).host !== target.host) throw new Error('request Host differs from authorized authority');
+    if (method === 'CONNECT' || incoming.has('upgrade')) throw new Error('inspected egress cannot upgrade its transport');
+    if (!body && (Number(incoming.get('content-length') || 0) > 0 || incoming.has('transfer-encoding'))) throw new Error('transport cannot mediate this request body');
+    const headers = new Headers(incoming);
+    const hopHeaders = (headers.get('connection') ?? '').split(',').map(h => h.trim().toLowerCase()).filter(Boolean);
+    for (const h of [...hopHeaders, 'host', 'proxy-authorization', 'proxy-authenticate', 'proxy-connection', 'connection', 'keep-alive', 'te', 'trailer', 'transfer-encoding', 'upgrade', 'x-twins-key', 'x-volter-twin-original-host']) headers.delete(h);
+    return await new Promise<Response>((resolve, reject) => {
+      const upstream = httpsRequest({ hostname: target.hostname, port: Number(target.port || 443), servername: target.hostname,
+        path: target.pathname + target.search, method, headers: { ...Object.fromEntries(headers), host: target.host },
+        agent: false, ca: readFileSync(trust.SSL_CERT_FILE!), signal,
+      }, res => {
+        const out = new Headers();
+        const nominated = String(res.headers.connection ?? '').split(',').map(h => h.trim().toLowerCase());
+        for (const [key, value] of Object.entries(res.headers)) if (value !== undefined && ![...nominated, 'connection', 'transfer-encoding', 'keep-alive', 'trailer', 'upgrade'].includes(key)) {
+          for (const part of Array.isArray(value) ? value : [value]) out.append(key, String(part));
+        }
+        const empty = method === 'HEAD' || [204, 205, 304].includes(res.statusCode!);
+        if (empty) res.resume();
+        note(`inspected egress ${method} ${target.origin}${target.pathname} -> ${res.statusCode}`);
+        resolve(new Response(empty ? null : Readable.toWeb(res) as unknown as ReadableStream, { status: res.statusCode!, headers: out }));
+      });
+      upstream.on('socket', socket => { openSockets.add(socket); socket.on('close', () => openSockets.delete(socket)); });
+      upstream.on('error', reject);
+      upstream.on('upgrade', (_res, socket) => { socket.destroy(); reject(new Error('upstream upgrade refused')); });
+      if (body) {
+        const source = Readable.fromWeb(body as unknown as import('node:stream/web').ReadableStream);
+        source.on('error', error => upstream.destroy(error));
+        upstream.on('error', () => source.destroy());
+        source.pipe(upstream);
+      } else upstream.end();
+    });
+  };
+
+  // Use the HTTP parser for framing; never forward trailing bytes as a second raw request.
+  const usedPlainSockets = new WeakSet<Socket>();
+  const inspectedPlain = createHttpServer((req, res) => {
+    if (usedPlainSockets.has(req.socket)) { note('inspected egress refused extra plain request'); req.socket.destroy(); return; }
+    usedPlainSockets.add(req.socket);
+    res.shouldKeepAlive = false;
+    res.setHeader('connection', 'close');
+    res.on('finish', () => req.socket.end());
+    const abort = new AbortController();
+    req.on('aborted', () => abort.abort());
+    res.on('close', () => { if (!res.writableFinished) abort.abort(); });
+    void (async () => {
+      if (/\\/.test(req.url!.split(/[?#]/, 1)[0]!)) throw new Error('backslash in proxy target');
+      const target = new URL(req.url!);
+      if (proxyTargetFor(target.hostname, currentEnv()) && !publicBuildRequest(target, currentEnv())) throw new Error('inspected external request names a twinned host');
+      const headers = new Headers();
+      for (let i = 0; i < req.rawHeaders.length; i += 2) headers.append(req.rawHeaders[i]!, req.rawHeaders[i + 1]!);
+      const body = headers.has('transfer-encoding') || Number(headers.get('content-length') || 0) > 0 ? Readable.toWeb(req) as unknown as ReadableStream : null;
+      const response = await externalRequest(target, req.method!, headers, body, abort.signal);
+      res.statusCode = response.status;
+      for (const [key, value] of response.headers) res.setHeader(key, value);
+      if (response.body) {
+        const stream = Readable.fromWeb(response.body as unknown as import('node:stream/web').ReadableStream);
+        stream.on('error', () => res.destroy());
+        res.on('close', () => stream.destroy());
+        stream.pipe(res);
+      } else res.end();
+    })().catch(error => { if (!res.headersSent) { res.statusCode = 502; res.end(note(`${(error as Error).message}\n`)); } else res.destroy(); });
+  });
+  inspectedPlain.maxRequestsPerSocket = 1;
+  inspectedPlain.on('dropRequest', (req, socket) => { note('inspected egress refused extra plain request'); socket.destroy(); });
+  inspectedPlain.on('clientError', (_error, socket) => socket.destroy());
+  // Bun's Node HTTP adapter parses only on a listening server, not a synthetic connection event.
+  // Relays below carry bytes solely to this local parser; only externalRequest opens public sockets.
+  await new Promise<void>((resolve, reject) => {
+    inspectedPlain.once('error', reject);
+    inspectedPlain.listen(0, '127.0.0.1', resolve);
+  });
+  const inspectedAddress = inspectedPlain.address();
+  if (!inspectedAddress || typeof inspectedAddress === 'string') throw new Error('inspected HTTP parser has no TCP address');
+  const inspectedPort = inspectedAddress.port;
+
   // The MITM TLS endpoint(s): a REAL listening TLS server PER vendor host (loopback, ephemeral port), each pinned
   // to that host's leaf cert. On CONNECT to a vendor host we tunnel the client's raw bytes to the matching per-host
   // server, which terminates TLS and forwards the decrypted request to the resolved twin. (One server per host
@@ -345,14 +438,17 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
   // websocket is relayed message by message to the twin's own websocket at the same path.
   const tlsServers = new Map<string, HttpServer>();
   const tlsPorts = new Map<string, number>();
-  const ensureHostServer = async (vendorHost: string): Promise<number> => {
-    const existing = tlsPorts.get(vendorHost);
+  const ensureHostServer = async (vendorHost: string, guest = false, originPort = 443): Promise<number> => {
+    const serverKey = `${vendorHost}:${originPort}:${guest}`;
+    const existing = tlsPorts.get(serverKey);
     if (existing) return existing;
     const leaf = leafCertFor(vendorHost, ca);
     const hostServer = await serveHttp({
       hostname: '127.0.0.1',
       port: 0,
       tls: { key: leaf.key, cert: leaf.cert },
+      // Carry a twin's declared transport cap through TLS termination; public grants add no cap.
+      maxRequestBodySize: (packFacts()[proxyTargetFor(vendorHost, currentEnv())?.vendor ?? ''] as { maxRequestBodySize?: number } | undefined)?.maxRequestBodySize,
       // A twin can think before its first byte (a git pack built from a cold cache took 19-28 s); Bun's 10 s idle
       // default cut those connections and the client read an empty reply. Bun's maximum, as reflect.ts serves.
       idleTimeout: 255,
@@ -363,12 +459,22 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
         // The request line is readable now, so resolve WITH the path: this is the point where a host two vendors
         // share (www.googleapis.com → googleauth vs youtube) gets split correctly; on a shared host there IS a twin
         // for the host and merely not for this path, and the bare message sends the next reader hunting.
-        const twin = proxyTargetFor(hostHeader, env, u.pathname) ?? proxyTargetFor(vendorHost, env, u.pathname);
+        const effective = new URL(`https://${vendorHost}:${originPort}${u.pathname}${u.search}`);
+        const publicBuild = publicBuildRequest(effective, env);
+        const twin = publicBuild ? null : proxyTargetFor(hostHeader, env, u.pathname) ?? proxyTargetFor(vendorHost, env, u.pathname);
         if (!twin) {
           // a host the World refuses (sealed, or outside its network policy): answered here, over the World's TLS, so
           // a person's browser shows where it was sent and why nothing is there, not an empty tunnel error; nothing
           // leaves the World
-          if (shouldBlockUntwinned(`https://${hostHeader}`, env)) return outsideWorld(hostHeader, `${u.pathname}${u.search}`, req.headers.get('accept'));
+          const target = new URL(`https://${vendorHost}:${originPort}${u.pathname}${u.search}`);
+          if (shouldBlockUntwinned(target.href, env)) return outsideWorld(hostHeader, `${u.pathname}${u.search}`, req.headers.get('accept'));
+          if (!publicBuild && proxyTargetFor(vendorHost, env)) return outsideWorld(vendorHost, target.pathname, req.headers.get('accept'));
+          const policy = worldNetworkPolicyFromEnv(env);
+          if (policy && worldNetworkNeedsPathInspection(policy, target)) {
+            if (guest) return outsideWorld(vendorHost, target.pathname, req.headers.get('accept'), 'guest inspected egress cannot preserve its checked destination pin');
+            try { return await externalRequest(target, req.method, req.headers, req.body, req.signal); }
+            catch (error) { return new Response(note(`inspected egress refused: ${(error as Error).message}\n`), { status: 502 }); }
+          }
           const unreachable = unreachableHosts.get(hostHeader.toLowerCase());
           if (unreachable) return outsideWorld(hostHeader, `${u.pathname}${u.search}`, req.headers.get('accept'), unreachable);
           return new Response(note(noTwinMessage(hostHeader, u.pathname)), { status: 502, headers: { 'content-type': 'text/plain; charset=utf-8' } });
@@ -414,8 +520,8 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
       }),
     });
     const p = hostServer.port ?? 0;
-    tlsServers.set(vendorHost, hostServer);
-    tlsPorts.set(vendorHost, p);
+    tlsServers.set(serverKey, hostServer);
+    tlsPorts.set(serverKey, p);
     return p;
   };
 
@@ -453,7 +559,7 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
         return;
       }
 
-      handlePlainProxyRequest(method, urlStr, version, headers, clientSocket, head, guest);
+      handlePlainProxyRequest(method, urlStr, version, headers, clientSocket, head, guest, buffered);
     };
     clientSocket.on('data', onData);
   };
@@ -524,7 +630,7 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
       : netConnect(Number(origin.port || 80), connectHost, connected);
     openSockets.add(upstream);
     upstream.on('close', () => openSockets.delete(upstream));
-    upstream.on('error', (err: Error) => writeResponse(socket, 'HTTP/1.1 502 Bad Gateway', vendor ? twinUnreachable(vendor, origin.origin, err) : note(`upstream ${origin.host} unreachable: ${err.message}\n`)));
+    upstream.on('error', (err: Error) => writeResponse(socket, 'HTTP/1.1 502 Bad Gateway', vendor ? twinUnreachable(vendor, origin.origin, err) : note(`upstream ${origin.host} unreachable: ${errorMessage(err)}\n`)));
   };
 
   const handlePlainProxyRequest = (
@@ -535,10 +641,12 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
     socket: Socket,
     head: Buffer,
     guest: boolean,
+    raw: Buffer,
   ): void => {
     try {
       const u = new URL(urlStr);
-      const twin = proxyTargetFor(u.hostname, currentEnv(), u.pathname);
+      const publicBuild = publicBuildRequest(u, currentEnv());
+      const twin = publicBuild ? null : proxyTargetFor(u.hostname, currentEnv(), u.pathname);
       const path = u.pathname + u.search;
       if (twin) {
         const target = new URL(twin.origin);
@@ -550,7 +658,7 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
       // No twin claims this PATH — but if the HOST is twinned (host-level candidacy), the path is
       // an unclaimed slice of a shared, virtualized host: refuse loudly (same rule as the MITM
       // handler's noTwinMessage), never pass through to the real vendor.
-      if (proxyTargetFor(u.hostname, currentEnv())) {
+      if (!publicBuild && proxyTargetFor(u.hostname, currentEnv())) {
         writeResponse(socket, 'HTTP/1.1 502 Bad Gateway', note(noTwinMessage(u.hostname, u.pathname)));
         return;
       }
@@ -558,6 +666,22 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
         writeResponse(socket, 'HTTP/1.1 502 Bad Gateway', note(`blocked untwinned external request to ${u.hostname}\n`));
         return;
       }
+      const policy = worldNetworkPolicyFromEnv(currentEnv());
+      if (policy && worldNetworkNeedsPathInspection(policy, u)) {
+        if (guest) { writeResponse(socket, 'HTTP/1.1 502 Bad Gateway', note('guest inspected egress requires a destination-pinned transport\n')); return; }
+        socket.pause();
+        const parser = netConnect(inspectedPort, '127.0.0.1', () => {
+          parser.write(raw);
+          socket.pipe(parser);
+          parser.pipe(socket);
+          socket.resume();
+        });
+        openSockets.add(parser);
+        parser.on('close', () => { openSockets.delete(parser); socket.destroy(); });
+        parser.on('error', () => socket.destroy());
+        socket.on('close', () => parser.destroy());
+        return;
+      }
       // Non-vendor: plain pass-through to the real host; for a World Machine, only off its host's own network, and to
       // the address checked (architecture, "The scoped proxy's local pass-through")
       if (guest) {
@@ -593,7 +717,7 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
       // a destination that cannot be reached at all (a name that does not resolve, a refused port) is answered by the
       // caller's fallback when it has one, before the tunnel was ever established; otherwise the client's socket ends
       upstream.on('error', (error: NodeJS.ErrnoException) => {
-        if (!connected && unreachable && unreachable(error.code ?? error.message)) return;
+        if (!connected && unreachable && unreachable(error.code ?? errorMessage(error))) return;
         clientSocket.destroy();
       });
     };
@@ -603,13 +727,22 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
       note(`${connectHost}:${connectPort} did not answer (${reason})`);
       refusedPages.add(connectHost);
       unreachableHosts.set(connectHost, reason);
-      ensureHostServer(connectHost).then((port) => tunnel(port, '127.0.0.1')).catch(() => clientSocket.destroy());
+      ensureHostServer(connectHost, guest, connectPort).then((port) => tunnel(port, '127.0.0.1')).catch(() => clientSocket.destroy());
       return true;
     };
     // MITM vendor hosts → tunnel to the per-host listening https server (terminates TLS, forwards to
     // the twin). Non-vendor hosts → blind-tunnel to the REAL origin, untouched.
-    if (twin && connectHost) {
-      ensureHostServer(connectHost)
+    const scopedOrigin = connectHost && new URL(`https://${connectHost}:${connectPort}`);
+    const scopedPolicy = worldNetworkPolicyFromEnv(currentEnv());
+    const inspected = scopedOrigin && scopedPolicy && worldNetworkNeedsPathInspection(scopedPolicy, scopedOrigin);
+    const passthrough = scopedOrigin && scopedPolicy && worldNetworkUsesPassthrough(scopedPolicy, scopedOrigin);
+    if (passthrough && !twin) note(`build TLS passthrough ${scopedOrigin.origin} (explicit origin scope)`);
+    if (inspected && guest && !twin) {
+      writeResponse(clientSocket, 'HTTP/1.1 502 Bad Gateway', note('guest inspected egress requires a destination-pinned transport\n'));
+      return;
+    }
+    if ((twin || (!strictEgressEnabled(currentEnv()) && inspected)) && connectHost) {
+      ensureHostServer(connectHost, guest, connectPort)
         .then((port) => tunnel(port, '127.0.0.1'))
         .catch(() => clientSocket.destroy());
     } else if (connectHost && shouldBlockUntwinned(`https://${connectHost}:${connectPort}`, currentEnv())) {
@@ -620,7 +753,7 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
       // line, as before
       if (connectPort === 443 && isDnsName(connectHost) && (refusedPages.has(connectHost) || refusedPages.size < REFUSED_PAGES_MAX)) {
         refusedPages.add(connectHost);
-        ensureHostServer(connectHost)
+        ensureHostServer(connectHost, guest, connectPort)
           .then((port) => tunnel(port, '127.0.0.1'))
           .catch(() => clientSocket.destroy());
       } else {
@@ -669,6 +802,8 @@ export async function startRedirectProxy(options: RedirectProxyOptions): Promise
         for (const s of openSockets) { try { s.destroy(); } catch { /* ignore */ } }
         openSockets.clear();
         for (const hostServer of tlsServers.values()) { try { hostServer.stop(true); } catch { /* ignore */ } }
+        inspectedPlain.closeAllConnections();
+        inspectedPlain.close();
         guestServer.close();
         server.close(() => resolveClose());
       }),