peachsim 0.1.527

package/src/host/plane-host.ts

@@ -0,0 +1,203 @@
+// `plane:*` — the project file plane over the loopback bridge, so a browser
+// tab can reach a real local box. the envelope and its constraints are decided
+// in plans/rnx-cloud/transport-decision.md; this is the local half.
+//
+// the vocabulary is exactly ProjectFilePlane's members, because the point is
+// that a remote plane is a third provider behind that seam rather than a
+// second file API. it is remotable without changing the interface because
+// `index()` is synchronous but `refresh()` is the async step the contract
+// already requires before an index read: a remote plane refreshes into a local
+// cache and reads that.
+//
+// WHY A ROOT MUST BE REGISTERED FIRST. this listener is loopback-only, but a
+// WebSocket to 127.0.0.1 is not subject to CORS, so any page the user visits
+// can open one. if `plane:open` took an arbitrary path, that page could read
+// any file on the machine through this daemon. a root is reachable only while
+// a box has registered it, and the registration dies with its socket.
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { dispatchPlaneCommand, indexVersion } from '@rnx/box/plane'
+import { CheckoutFilePlane } from '../../cli/commands/box/checkout-plane.ts'
+import type { ProjectFilePlane } from '@rnx/box/plane'
+import type { WebSocket } from 'ws'
+
+const WS_OPEN = 1
+
+interface OpenPlane {
+  root: string
+  plane: ProjectFilePlane
+  version: string
+  sockets: Set<WebSocket>
+}
+
+export class PlaneNotRegisteredError extends Error {}
+
+export class PlaneHost {
+  // roots a box authorized, each tied to the socket that authorized it
+  private registered = new Map<string, Set<WebSocket>>()
+  private open = new Map<string, OpenPlane>()
+  private byRoot = new Map<string, string>()
+  private nextPlaneId = 1
+
+  /** handle a plane:* message. returns true iff it was one. */
+  async handleMessage(ws: WebSocket, msg: unknown): Promise<boolean> {
+    if (typeof msg !== 'object' || msg === null) return false
+    const record: Record<string, unknown> = { ...msg }
+    const type = record.type
+    if (typeof type !== 'string' || !type.startsWith('plane:')) return false
+    const id = record.id
+    try {
+      this.respond(ws, id, await this.dispatch(ws, type, record))
+    } catch (err) {
+      const code =
+        err instanceof PlaneNotRegisteredError ? 'plane-not-registered' : undefined
+      this.respondError(ws, id, err instanceof Error ? err.message : String(err), code)
+    }
+    return true
+  }
+
+  unregisterSocket(ws: WebSocket): void {
+    for (const [root, sockets] of [...this.registered]) {
+      if (!sockets.delete(ws)) continue
+      if (sockets.size > 0) continue
+      // the box that authorized this root is gone, so drop the plane with it
+      // rather than leaving a reachable handle behind.
+      this.registered.delete(root)
+      const planeId = this.byRoot.get(root)
+      if (planeId) {
+        this.open.delete(planeId)
+        this.byRoot.delete(root)
+      }
+    }
+    for (const [planeId, entry] of [...this.open]) {
+      entry.sockets.delete(ws)
+      if (entry.sockets.size === 0 && !this.registered.has(entry.root)) {
+        this.open.delete(planeId)
+        this.byRoot.delete(entry.root)
+      }
+    }
+  }
+
+  /** roots currently reachable, for the daemon's status output. */
+  registeredRoots(): string[] {
+    return [...this.registered.keys()]
+  }
+
+  private async dispatch(
+    ws: WebSocket,
+    type: string,
+    msg: Record<string, unknown>,
+  ): Promise<unknown> {
+    switch (type) {
+      case 'plane:register': {
+        const root = this.realRoot(String(msg.root ?? ''))
+        const sockets = this.registered.get(root) ?? new Set<WebSocket>()
+        sockets.add(ws)
+        this.registered.set(root, sockets)
+        // `holders` INCLUDING this one, because two boxes over one checkout is
+        // a mistake only the daemon can see: CheckoutFilePlane re-runs
+        // `git ls-files` before every command, so each box changes the file
+        // set the other is working from mid-run. the daemon reports it rather
+        // than refusing, because a box whose socket dropped and reconnected
+        // can briefly race its own stale entry, and a refusal there would
+        // brick a legitimate restart. the caller decides; see box.ts, which
+        // already refuses a box inside a box for the same reason.
+        return { root, holders: sockets.size }
+      }
+      // READ ONLY, and that is the whole point of it existing beside the
+      // `holders` field on plane:register.
+      //
+      // registration is the AUTHORIZATION step: it is what permits any page on
+      // this machine to open that root over a loopback socket that CORS does
+      // not protect. so a caller asking "is anyone else in this checkout"
+      // cannot be made to authorize the root in order to find out, even
+      // briefly. it also means the count is the honest one: no box reads 0 and
+      // a single box reads 1, where asking through register would have made
+      // every answer one higher and forced a threshold that counts the asker.
+      case 'plane:status': {
+        const root = this.realRoot(String(msg.root ?? ''))
+        const sockets = this.registered.get(root)
+        return { root, holders: sockets?.size ?? 0, registered: Boolean(sockets) }
+      }
+      case 'plane:open': {
+        const root = this.realRoot(String(msg.root ?? ''))
+        if (!this.registered.has(root)) {
+          throw new PlaneNotRegisteredError(
+            `no box has registered ${root}; start one with \`rnx box\` there`,
+          )
+        }
+        const existingId = this.byRoot.get(root)
+        const existing = existingId ? this.open.get(existingId) : undefined
+        if (existingId && existing) {
+          existing.sockets.add(ws)
+          return { planeId: existingId, version: existing.version }
+        }
+        const plane = new CheckoutFilePlane(root)
+        await plane.refresh()
+        const planeId = `plane-${this.nextPlaneId++}`
+        const entry: OpenPlane = {
+          root,
+          plane,
+          version: indexVersion(plane.index()),
+          sockets: new Set([ws]),
+        }
+        this.open.set(planeId, entry)
+        this.byRoot.set(root, planeId)
+        return { planeId, version: entry.version }
+      }
+      case 'plane:close': {
+        const entry = this.open.get(String(msg.planeId ?? ''))
+        if (entry) entry.sockets.delete(ws)
+        return { ok: true }
+      }
+      default: {
+        const entry = this.entry(msg)
+        const handled = await dispatchPlaneCommand(entry.plane, type, msg)
+        if (!handled) throw new Error(`unknown plane command: ${type}`)
+        // no companion change event on a write. the write lands on the real
+        // checkout and the dev server's own watcher sees it, so a notification
+        // here would be a second channel for something the filesystem already
+        // reports. the cloud placement, whose store nothing can watch, is where
+        // a write has to fan one out.
+        if (handled.version) entry.version = handled.version
+        return handled.result
+      }
+    }
+  }
+
+  private entry(msg: Record<string, unknown>): OpenPlane {
+    const entry = this.open.get(String(msg.planeId ?? ''))
+    if (!entry) throw new Error(`unknown planeId: ${String(msg.planeId)}`)
+    return entry
+  }
+
+  // resolve symlinks and relative segments before comparing, so a registered
+  // root and an opened one cannot disagree about the same directory.
+  private realRoot(root: string): string {
+    if (!root) throw new Error('root is required')
+    const resolved = path.resolve(root)
+    let real: string
+    try {
+      real = fs.realpathSync(resolved)
+    } catch {
+      throw new Error(`no such directory: ${resolved}`)
+    }
+    if (!fs.statSync(real).isDirectory()) throw new Error(`not a directory: ${real}`)
+    return real
+  }
+
+  private respond(ws: WebSocket, id: unknown, result: unknown): void {
+    if (ws.readyState !== WS_OPEN) return
+    try {
+      ws.send(JSON.stringify({ id, result }))
+    } catch {}
+  }
+
+  private respondError(ws: WebSocket, id: unknown, error: string, code?: string): void {
+    if (ws.readyState !== WS_OPEN) return
+    try {
+      ws.send(JSON.stringify({ id, error, ...(code ? { code } : {}) }))
+    } catch {}
+  }
+}

package/src/host/replacement-module-handler.ts

@@ -0,0 +1,158 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import {
+  compileReplacementModule,
+  REPLACEMENT_MODULE_EXTENSIONS,
+} from '../../../contrast-bundler/src/replacementModule.ts'
+import { isLoopbackHost } from '../backend-origin.ts'
+import type { IncomingMessage, ServerResponse } from 'node:http'
+
+export const REPLACEMENT_MODULE_ROUTE = '/__sootsim-replacement-module'
+
+export interface ReplacementModuleHandlerOptions {
+  projectRoot?: string
+  requireLoopbackOrigin?: boolean
+  requestToken?: string
+}
+
+function sendJavaScript(req: IncomingMessage, res: ServerResponse, source: string): void {
+  const origin = req.headers.origin
+  let allowedOrigin: string | undefined
+  if (origin) {
+    try {
+      if (isLoopbackHost(new URL(origin).hostname)) allowedOrigin = origin
+    } catch {}
+  }
+  res.writeHead(200, {
+    'Content-Type': 'application/javascript; charset=utf-8',
+    'Cache-Control': 'no-cache',
+    ...(allowedOrigin
+      ? { 'Access-Control-Allow-Origin': allowedOrigin, Vary: 'Origin' }
+      : {}),
+  })
+  res.end(req.method === 'HEAD' ? undefined : source)
+}
+
+export function isReplacementModuleRequestUrl(rawUrl?: string): boolean {
+  if (!rawUrl) return false
+  try {
+    const pathname = new URL(rawUrl, 'http://rnx.local').pathname
+    return pathname === REPLACEMENT_MODULE_ROUTE
+  } catch {
+    return false
+  }
+}
+
+export async function handleReplacementModuleRequest(
+  req: IncomingMessage,
+  res: ServerResponse,
+  options: ReplacementModuleHandlerOptions = {},
+): Promise<boolean> {
+  const rawUrl = req.url || ''
+  let url: URL
+  try {
+    url = new URL(rawUrl, 'http://rnx.local')
+  } catch {
+    return false
+  }
+
+  if (options.requireLoopbackOrigin) {
+    const origin = req.headers.origin
+    const remoteAddress = req.socket.remoteAddress?.replace(/^::ffff:/, '')
+    let allowed = Boolean(remoteAddress && isLoopbackHost(remoteAddress))
+    if (allowed && origin) {
+      try {
+        allowed = isLoopbackHost(new URL(origin).hostname)
+      } catch {
+        allowed = false
+      }
+    }
+    if (!allowed) {
+      res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' })
+      res.end('replacement modules are available only to loopback origins')
+      return true
+    }
+  }
+
+  if (url.pathname !== REPLACEMENT_MODULE_ROUTE) return false
+
+  if (options.requestToken && url.searchParams.get('token') !== options.requestToken) {
+    res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' })
+    res.end('replacement module request token is invalid')
+    return true
+  }
+
+  const targetPath = url.searchParams.get('path')
+  if (!targetPath) {
+    res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' })
+    res.end('missing path param')
+    return true
+  }
+
+  const extension = path.extname(targetPath).toLowerCase()
+  if (!REPLACEMENT_MODULE_EXTENSIONS.some((allowed) => allowed === extension)) {
+    res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' })
+    res.end(`replacement files must be ${REPLACEMENT_MODULE_EXTENSIONS.join(', ')}`)
+    return true
+  }
+
+  if (!path.isAbsolute(targetPath)) {
+    res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' })
+    res.end('replacement file path must be absolute')
+    return true
+  }
+
+  const runtimePackages = new Set(url.searchParams.getAll('runtimePackage'))
+
+  let resolvedProjectRoot: string | undefined
+  if (options.projectRoot) {
+    const lexicalProjectRoot = path.resolve(options.projectRoot)
+    resolvedProjectRoot = await fs.realpath(options.projectRoot)
+    const lexicalTarget = path.relative(lexicalProjectRoot, targetPath)
+    if (lexicalTarget.startsWith('..') || path.isAbsolute(lexicalTarget)) {
+      res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' })
+      res.end('replacement file must be inside the project root')
+      return true
+    }
+  }
+
+  let resolvedTargetPath: string
+  try {
+    resolvedTargetPath = await fs.realpath(targetPath)
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' })
+    res.end(`replacement file not found: ${message}`)
+    return true
+  }
+
+  if (resolvedProjectRoot) {
+    const relativeTarget = path.relative(resolvedProjectRoot, resolvedTargetPath)
+    if (relativeTarget.startsWith('..') || path.isAbsolute(relativeTarget)) {
+      res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' })
+      res.end('replacement file must be inside the project root')
+      return true
+    }
+  }
+
+  try {
+    const compiled = compileReplacementModule({
+      filePath: resolvedTargetPath,
+      source: await fs.readFile(resolvedTargetPath, 'utf8'),
+      runtimePackages,
+    })
+    // inline the map: the file is the app author's own source, and the
+    // simulator page is the only thing that ever loads it.
+    const map = Buffer.from(JSON.stringify(compiled.sourceMap), 'utf8').toString('base64')
+    sendJavaScript(
+      req,
+      res,
+      `${compiled.code}\n//# sourceMappingURL=data:application/json;base64,${map}\n`,
+    )
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    res.writeHead(500, { 'Content-Type': 'text/plain; charset=utf-8' })
+    res.end(`replacement compile failed: ${message}`)
+  }
+  return true
+}

package/src/host/websocket-proxy.ts

@@ -0,0 +1,315 @@
+import { createHash } from 'crypto'
+import { request as requestHttp, type IncomingMessage } from 'http'
+import { request as requestHttps } from 'https'
+import type { Duplex } from 'stream'
+
+export const WEBSOCKET_PROXY_PATH = '/__websocket-proxy'
+export const WEBSOCKET_PROXY_HANDSHAKE_TIMEOUT_MS = 10_000
+
+const WEBSOCKET_PROTOCOL_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/
+const WEBSOCKET_KEY = /^[+/0-9A-Za-z]{22}==$/
+
+type UpgradeRejection = {
+  status: number
+  message: string
+  headers?: Record<string, string>
+}
+
+const STRIP_UPSTREAM_HEADERS = new Set([
+  'host',
+  'connection',
+  'upgrade',
+  'transfer-encoding',
+  'content-length',
+  'sec-websocket-accept',
+  'sec-websocket-extensions',
+  'sec-websocket-key',
+  'sec-websocket-protocol',
+  'sec-websocket-version',
+])
+
+function rejectUpgrade(
+  socket: Duplex,
+  status: number,
+  message: string,
+  headers: Record<string, string> = {},
+) {
+  try {
+    const extraHeaders = Object.entries(headers)
+      .map(([name, value]) => `${name}: ${value}\r\n`)
+      .join('')
+    socket.write(
+      `HTTP/1.1 ${status} ${message}\r\nConnection: close\r\nContent-Type: text/plain\r\nContent-Length: ${message.length}\r\n${extraHeaders}\r\n${message}`,
+    )
+  } catch {}
+  socket.destroy()
+}
+
+function hasHeaderToken(value: string | undefined, token: string): boolean {
+  return (value || '').split(',').some((part) => part.trim().toLowerCase() === token)
+}
+
+function hasValidProtocolOffer(value: string | undefined): boolean {
+  if (value === undefined) return true
+  if (!WEBSOCKET_PROTOCOL_TOKEN.test(value[0] || '')) return false
+  if (!WEBSOCKET_PROTOCOL_TOKEN.test(value[value.length - 1] || '')) return false
+  const protocols = new Set<string>()
+  for (const part of value.split(',')) {
+    const protocol = part.trim()
+    if (!WEBSOCKET_PROTOCOL_TOKEN.test(protocol) || protocols.has(protocol)) {
+      return false
+    }
+    protocols.add(protocol)
+  }
+  return true
+}
+
+function validateUpgradeRequest(req: IncomingMessage): UpgradeRejection | null {
+  if (req.method !== 'GET') {
+    return { status: 405, message: 'invalid websocket http method' }
+  }
+  if (
+    !hasHeaderToken(req.headers.connection, 'upgrade') ||
+    !hasHeaderToken(req.headers.upgrade, 'websocket')
+  ) {
+    return { status: 400, message: 'invalid websocket upgrade headers' }
+  }
+  const key = req.headers['sec-websocket-key']
+  if (
+    typeof key !== 'string' ||
+    !WEBSOCKET_KEY.test(key) ||
+    Buffer.from(key, 'base64').byteLength !== 16 ||
+    Buffer.from(key, 'base64').toString('base64') !== key
+  ) {
+    return { status: 400, message: 'invalid websocket key' }
+  }
+  if (req.headers['sec-websocket-version'] !== '13') {
+    return {
+      status: 400,
+      message: 'invalid websocket version',
+      headers: { 'Sec-WebSocket-Version': '13' },
+    }
+  }
+  if (!hasValidProtocolOffer(req.headers['sec-websocket-protocol'])) {
+    return { status: 400, message: 'invalid websocket protocol offer' }
+  }
+  return null
+}
+
+function isSameOriginUpgrade(req: IncomingMessage): boolean {
+  const origin = req.headers.origin
+  const host = req.headers.host
+  if (!origin || !host) return false
+  try {
+    return new URL(origin).host === host
+  } catch {
+    return false
+  }
+}
+
+function decodeProxyHeaders(encoded: string | null): Record<string, string> {
+  if (!encoded) return {}
+  const base64 = encoded.replace(/-/g, '+').replace(/_/g, '/')
+  const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4)
+  const parsed = JSON.parse(Buffer.from(padded, 'base64').toString('utf8'))
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return {}
+  const headers: Record<string, string> = {}
+  for (const [key, value] of Object.entries(parsed)) {
+    if (value == null) continue
+    if (STRIP_UPSTREAM_HEADERS.has(key.toLowerCase())) continue
+    headers[key] = Array.isArray(value) ? value.join(', ') : String(value)
+  }
+  return headers
+}
+
+function getDefaultWebSocketOrigin(targetUrl: URL): string {
+  const origin = new URL(targetUrl.href)
+  origin.protocol = targetUrl.protocol === 'wss:' ? 'https:' : 'http:'
+  return origin.origin
+}
+
+function createUpstreamHeaders(
+  req: IncomingMessage,
+  targetUrl: URL,
+  headers: Record<string, string>,
+  forwardOrigin: boolean,
+): Record<string, string> {
+  const upstreamHeaders = { ...headers }
+  const originKeys = Object.keys(upstreamHeaders).filter(
+    (key) => key.toLowerCase() === 'origin',
+  )
+  if (forwardOrigin && originKeys.length === 0) {
+    upstreamHeaders.origin = getDefaultWebSocketOrigin(targetUrl)
+  } else if (!forwardOrigin) {
+    for (const key of originKeys) delete upstreamHeaders[key]
+  }
+  upstreamHeaders.connection = 'Upgrade'
+  upstreamHeaders.upgrade = 'websocket'
+  const key = req.headers['sec-websocket-key']
+  if (typeof key === 'string') upstreamHeaders['sec-websocket-key'] = key
+  const version = req.headers['sec-websocket-version']
+  if (typeof version === 'string') upstreamHeaders['sec-websocket-version'] = version
+  const protocol = req.headers['sec-websocket-protocol']
+  if (typeof protocol === 'string') upstreamHeaders['sec-websocket-protocol'] = protocol
+  const extensions = req.headers['sec-websocket-extensions']
+  if (typeof extensions === 'string') {
+    upstreamHeaders['sec-websocket-extensions'] = extensions
+  }
+  return upstreamHeaders
+}
+
+export function isWebSocketProxyRequestUrl(rawUrl: string | undefined): boolean {
+  if (!rawUrl) return false
+  try {
+    return new URL(rawUrl, 'http://localhost').pathname === WEBSOCKET_PROXY_PATH
+  } catch {
+    return false
+  }
+}
+
+export function handleWebSocketProxyUpgrade(
+  req: IncomingMessage,
+  socket: Duplex,
+  head: Buffer,
+  forwardOrigin = true,
+): boolean {
+  if (!isWebSocketProxyRequestUrl(req.url)) return false
+  if (!isSameOriginUpgrade(req)) {
+    rejectUpgrade(socket, 403, 'forbidden websocket proxy origin')
+    return true
+  }
+  const upgradeRejection = validateUpgradeRequest(req)
+  if (upgradeRejection) {
+    rejectUpgrade(
+      socket,
+      upgradeRejection.status,
+      upgradeRejection.message,
+      upgradeRejection.headers,
+    )
+    return true
+  }
+
+  let targetUrl: URL
+  let headers: Record<string, string>
+  try {
+    const requestUrl = new URL(req.url || '/', 'http://localhost')
+    const target = requestUrl.searchParams.get('url')
+    if (!target) {
+      rejectUpgrade(socket, 400, 'missing websocket proxy url')
+      return true
+    }
+    targetUrl = new URL(target)
+    if (targetUrl.protocol !== 'ws:' && targetUrl.protocol !== 'wss:') {
+      rejectUpgrade(socket, 400, 'invalid websocket proxy protocol')
+      return true
+    }
+    headers = decodeProxyHeaders(requestUrl.searchParams.get('headers'))
+  } catch {
+    rejectUpgrade(socket, 400, 'invalid websocket proxy request')
+    return true
+  }
+
+  const upstreamHeaders = createUpstreamHeaders(req, targetUrl, headers, forwardOrigin)
+  let settled = false
+  const request = targetUrl.protocol === 'wss:' ? requestHttps : requestHttp
+  const upstreamRequestUrl = new URL(targetUrl)
+  upstreamRequestUrl.protocol = targetUrl.protocol === 'wss:' ? 'https:' : 'http:'
+  const upstreamRequest = request(upstreamRequestUrl, {
+    method: 'GET',
+    headers: upstreamHeaders,
+  })
+  let destroyUpstreamSocket = () => {}
+  upstreamRequest.once('socket', (upstreamSocket) => {
+    destroyUpstreamSocket = () => upstreamSocket.destroy()
+  })
+  const fail = (status: number, message: string) => {
+    if (settled) return
+    settled = true
+    clearTimeout(timer)
+    upstreamRequest.destroy()
+    destroyUpstreamSocket()
+    rejectUpgrade(socket, status, message)
+  }
+  const timer = setTimeout(() => {
+    fail(504, 'upstream websocket handshake timeout')
+  }, WEBSOCKET_PROXY_HANDSHAKE_TIMEOUT_MS)
+  socket.once('close', () => {
+    if (!settled) {
+      settled = true
+      clearTimeout(timer)
+    }
+    upstreamRequest.destroy()
+    destroyUpstreamSocket()
+  })
+  upstreamRequest.once('response', (response) => {
+    response.resume()
+    fail(502, 'upstream websocket rejected upgrade')
+  })
+  upstreamRequest.once('error', () => {
+    fail(502, 'upstream websocket error')
+  })
+  upstreamRequest.once('upgrade', (response, upstreamSocket, upstreamHead) => {
+    if (settled) {
+      upstreamSocket.destroy()
+      return
+    }
+    const accept = response.headers['sec-websocket-accept']
+    const upgrade = response.headers.upgrade
+    const requestKey = req.headers['sec-websocket-key']
+    const expectedAccept =
+      typeof requestKey === 'string'
+        ? createHash('sha1')
+            .update(`${requestKey}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`)
+            .digest('base64')
+        : ''
+    if (
+      typeof accept !== 'string' ||
+      accept !== expectedAccept ||
+      typeof upgrade !== 'string' ||
+      upgrade.toLowerCase() !== 'websocket'
+    ) {
+      upstreamSocket.destroy()
+      fail(502, 'upstream websocket handshake is invalid')
+      return
+    }
+    const selectedProtocol = response.headers['sec-websocket-protocol']
+    const requestedProtocols = (req.headers['sec-websocket-protocol'] || '')
+      .split(',')
+      .map((protocol) => protocol.trim())
+    if (
+      typeof selectedProtocol === 'string' &&
+      !requestedProtocols.includes(selectedProtocol)
+    ) {
+      upstreamSocket.destroy()
+      fail(502, 'upstream websocket selected an unrequested protocol')
+      return
+    }
+    settled = true
+    clearTimeout(timer)
+    const responseHeaders = [
+      'HTTP/1.1 101 Switching Protocols',
+      'Upgrade: websocket',
+      'Connection: Upgrade',
+      `Sec-WebSocket-Accept: ${accept}`,
+    ]
+    if (typeof selectedProtocol === 'string') {
+      responseHeaders.push(`Sec-WebSocket-Protocol: ${selectedProtocol}`)
+    }
+    const selectedExtensions = response.headers['sec-websocket-extensions']
+    if (typeof selectedExtensions === 'string') {
+      responseHeaders.push(`Sec-WebSocket-Extensions: ${selectedExtensions}`)
+    }
+    // the upstream and browser used the same websocket key and extension offer,
+    // so their negotiated byte streams can be relayed without decoding frames.
+    socket.write(`${responseHeaders.join('\r\n')}\r\n\r\n`)
+    if (head.length > 0) upstreamSocket.write(head)
+    if (upstreamHead.length > 0) socket.write(upstreamHead)
+    socket.once('close', () => upstreamSocket.destroy())
+    socket.once('error', () => upstreamSocket.destroy())
+    upstreamSocket.once('error', () => socket.destroy())
+    socket.pipe(upstreamSocket)
+    upstreamSocket.pipe(socket)
+  })
+  upstreamRequest.end()
+  return true
+}