Enhance HTTP handling and connection management

- Added timeout checks before reading HTTP headers and body to prevent dangling async operations during shutdown.
- Improved error response handling to ensure proper framing in multi-process mode.
- Introduced a new method to check if the peer has closed the connection in the network layer.
- Refactored HTTP response reading logic to handle peer closure and ensure compliance with Content-Length.
- Updated tests to verify that original status codes are preserved and that responses are correctly handled in various scenarios.

Author: mikecovlee

.github/workflows/ci.yml

@@ -206,27 +206,47 @@ jobs:
           cspkg list
 
       # ------------------------------------------------------------------ #
-      # 10b. Reproducible build check (.csp only — date line is volatile) #
+      # 10b. Reproducible build check (Date header line is volatile)       #
       # ------------------------------------------------------------------ #
       - name: Reproducible build check
         shell: bash
         run: |
           set -e
-          for pkg in argparse netutils; do
+          # Check every source package in the repo, not a hardcoded list.
+          # nullglob avoids iterating the literal glob when nothing matches.
+          shopt -s nullglob
+          for src in *.ecs; do
+            pkg="${src%.ecs}"
             echo "=== Checking ${pkg}.csp reproducibility ==="
             cp "${pkg}.csp" "/tmp/${pkg}.csp.bak"
+            if [ -f "${pkg}.csym" ]; then
+              cp "${pkg}.csym" "/tmp/${pkg}.csym.bak"
+            fi
             cspkg build "${pkg}.ecs" --compile
-            # The .csp header contains a Date line (line 3) that always
-            # differs.  Strip it before comparing; everything else must
+            # The .csp header contains a Date line that always differs.
+            # Strip it by pattern before comparing; everything else must
             # be byte-identical when the source has not changed.
-            sed '3d' "/tmp/${pkg}.csp.bak" > "/tmp/${pkg}.csp.old"
-            sed '3d' "${pkg}.csp"             > "/tmp/${pkg}.csp.new"
+            sed '/^# Date:/d' "/tmp/${pkg}.csp.bak" > "/tmp/${pkg}.csp.old"
+            sed '/^# Date:/d' "${pkg}.csp"          > "/tmp/${pkg}.csp.new"
             if ! diff -q "/tmp/${pkg}.csp.old" "/tmp/${pkg}.csp.new"; then
               echo "ERROR: ${pkg}.csp changed beyond the date line!"
               echo "  Did you forget to recompile after editing ${pkg}.ecs?"
               diff "/tmp/${pkg}.csp.old" "/tmp/${pkg}.csp.new" || true
               exit 1
             fi
+            # The .csym has no volatile header — it must be byte-identical.
+            if [ -f "/tmp/${pkg}.csym.bak" ]; then
+              if [ ! -f "${pkg}.csym" ]; then
+                echo "ERROR: ${pkg}.csym is missing after build!"
+                echo "  Did you forget to regenerate ${pkg}.csym after editing ${pkg}.ecs?"
+                exit 1
+              fi
+              if ! cmp -s "/tmp/${pkg}.csym.bak" "${pkg}.csym"; then
+                echo "ERROR: ${pkg}.csym is stale!"
+                echo "  Did you forget to regenerate ${pkg}.csym after editing ${pkg}.ecs?"
+                exit 1
+              fi
+            fi
             echo "  ${pkg} reproducible — ok"
           done
 
@@ -294,7 +314,7 @@ jobs:
           cs tests/test_tls_errors.csc
 
       # ------------------------------------------------------------------ #
-      # 16c. Run master-slave integration tests                            #
+      # 16b. Run master-slave integration tests                            #
       # ------------------------------------------------------------------ #
       - name: Run master-slave integration tests
         shell: bash
@@ -304,7 +324,7 @@ jobs:
           cs tests/test_http_compliance.csc
 
       # ------------------------------------------------------------------ #
-      # 16b. Run TLS custom trust mode test (self-signed cert)            #
+      # 16c. Run TLS custom trust mode test (self-signed cert)            #
       # ------------------------------------------------------------------ #
       - name: Run TLS custom trust mode test
         shell: bash

CNI_API.md

@@ -105,6 +105,7 @@ sock.connect_ssl("localhost", {"trust_mode": "insecure"}.to_hash_map())
 | `set_opt_no_delay` | `(value: boolean)` | 设置 `TCP_NODELAY` 选项（禁用 Nagle 算法） |
 | `set_opt_keep_alive` | `(value: boolean)` | 设置 `SO_KEEPALIVE` 选项 |
 | `available` | `() → int` | 可读取的字节数（非阻塞） |
+| `peer_closed` | `() → boolean` | 对端是否已关闭连接（非阻塞、非破坏性，使用 1 字节 `MSG_PEEK` 探测）。空闲但存活返回 `false`；收到 FIN 或连接已失效返回 `true`。有异步读挂起时返回 `false`（该读操作自身会暴露 EOF）。TLS 套接字上探测的是底层传输而非解密流 |
 | `receive` | `(max: int) → string` | 读取最多 `max` 字节。阻塞直到至少 1 字节可读 |
 | `read` | `(size: int) → string` | 读取恰好 `size` 字节。阻塞直到全部读完 |
 | `send` | `(data: string) → int` | 发送数据（单次部分写入，返回实际写入字节数）。需完整发送时使用 `write` |

NETUTILS.md

@@ -181,7 +181,7 @@ Master 分配 `rank`：先尝试使用 `deprecated_rank`（回收的编号），
 控制逻辑：
 
 * 若某连接空闲时间超过 `keep_alive_timeout`，Master 会在关闭前尝试回写 `408 Request Timeout`（或直接关闭）。
-* 若单条连接处理的请求数超过 `max_keep_alive`，Master 会主动向客户端发送 `408` 并关闭连接。
+* 若单条连接处理的请求数达到 `max_keep_alive`，服务器会正常处理最后一个请求，并在该响应中携带 `Connection: close`，随后关闭连接（自 2.1 起不再发送 `408`）。
 * Slave 的请求处理若超时（`receive_content_s` 超时），Master 将用错误码构造响应并关闭该 Slave 连接。
 
 ## 7. 静态文件服务与安全（wwwroot、path_normalize）
@@ -443,8 +443,8 @@ sequenceDiagram
         M->>C: 发回 HTTP 回复
     end
 
-    opt 超出 Keep-alive 限制
-        M->>C: 发回 HTTP 回复（408）
+    opt 达到 Keep-alive 请求数上限
+        M->>C: 最后一个 HTTP 回复携带 Connection: close<br/>随后关闭连接
     end
 ```
 

README.md

@@ -8,7 +8,7 @@ A high-performance network extension for the [Covariant Script](http://covscript
 
 | Package | Type | Version | Description |
 |---|---|---|---|
-| `network` | C++ Extension | `1.38.0_v6.4` | TCP/UDP sockets, TLS/SSL, async I/O, event loop |
+| `network` | C++ Extension | `1.38.0_v6.5` | TCP/UDP sockets, TLS/SSL, async I/O, event loop |
 | `netutils` | CovScript | `2.1` | HTTP server/client framework with single-process, distributed master/slave, and OpenAI API modes |
 | `argparse` | CovScript | `1.1` | Lightweight command-line argument parser |
 

csbuild/network.json

@@ -3,7 +3,7 @@
     "Name": "network",
     "Info": "Socket Extension",
     "Author": "CovScript Organization",
-    "Version": "1.38.0_v6.4",
+    "Version": "1.38.0_v6.5",
     "Target": "build/imports/network.cse",
     "Dependencies": []
 }

include/network.hpp

@@ -717,6 +717,38 @@ namespace cs_impl {
 					return sock.available();
 				}
 
+				// For TLS sockets the probe reflects the raw transport, not
+				// the decrypted stream — MSG_PEEK sees encrypted bytes, so
+				// peer_closed() detects transport-level FIN but not TLS
+				// close_notify. Callers that need TLS-level closure should
+				// read the stream until eof.
+				bool peer_closed() noexcept
+				{
+					if (!try_begin_io_job(io_direction::read))
+						return false;
+					bool closed = false;
+					if (!sock.is_open()) {
+						closed = true;
+					}
+					else {
+						asio::error_code ec;
+						sock.non_blocking(true, ec);
+						if (!ec) {
+							char probe = 0;
+							std::size_t peeked = sock.receive(
+							                         asio::buffer(&probe, 1),
+							                         asio::socket_base::message_peek, ec);
+							asio::error_code restore_ec;
+							sock.non_blocking(false, restore_ec);
+							closed = peeked == 0 &&
+							         ec != asio::error::would_block &&
+							         ec != asio::error::try_again;
+						}
+					}
+					finish_io_job(io_direction::read);
+					return closed;
+				}
+
 				std::string receive(std::size_t maximum)
 				{
 					scoped_io_job job(*this, io_direction::read);

netutils.csp

@@ -1,6 +1,6 @@
 # Generated by Extended CovScript Compiler
 # DO NOT MODIFY
-# Date: Wed Jul 15 20:58:29 2026
+# Date: Wed Jul 15 23:03:06 2026
 @charset: utf8
 import ecs as netutils_ecs
 struct __netutils_ecs_lambda_impl_1__
@@ -479,12 +479,12 @@ function read_http_header(sock, state, keep_alive_timeout, max_body_size)
 	var error_code = null
 	var header_size = 0
 	loop
-		async.read_until(sock, state, "\r\n")
 		var timeout = keep_alive_timeout - runtime.time()
 		if timeout <= 0
 			error_code = state_codes.code_408
 			break
 		end
+		async.read_until(sock, state, "\r\n")
 		if !state.wait_for(timeout)
 			if state.has_done()
 				if state.eof()
@@ -542,12 +542,12 @@ function read_http_header(sock, state, keep_alive_timeout, max_body_size)
 		session.post_data = state.get_buffer(session.content_length)
 		var remaining = session.content_length - session.post_data.size
 		while remaining > 0
-			state = async.read(sock, remaining)
 			var timeout = keep_alive_timeout - runtime.time()
 			if timeout <= 0
 				error_code = state_codes.code_408
 				break
 			end
+			state = async.read(sock, remaining)
 			if !state.wait_for(timeout)
 				if state.has_done()
 					if state.eof()
@@ -642,7 +642,8 @@ function call_http_handler(session, server)
 		if server->url_map.exist(error_code)
 			server->url_map[error_code](*server, session)
 		else
-			send_error_response(session.sock, error_code)
+			session.connection = "close"
+			session.send_response(error_code, "", "text/html")
 		end
 		return false
 	else
@@ -680,19 +681,22 @@ function simple_worker(self)
 			if session == null
 				break
 			end
+			var force_close = false
 			if ++request_count >= self->server->max_keep_alive
 				session.connection = "close"
+				force_close = true
 			end
 			session.sock = sock
-			if !call_http_handler(session, self->server)
-				break
-			end
+			var handler_ok = call_http_handler(session, self->server)
 			if session.response_state != null && !session.response_state.wait()
 				log("Write response error: " + session.response_state.get_error())
 				break
 			end
+			if !handler_ok
+				break
+			end
 			last_request_time = runtime.time()
-			if !sock.is_open() || session.connection == "close"
+			if !sock.is_open() || force_close || session.connection == "close"
 				break
 			end
 		end
@@ -705,7 +709,6 @@ struct http_conn
 	var sock = null
 	var read_state = null
 	var state = 0
-	var close = false
 	var keep_alive = true
 	var request_count = 0
 	var last_request_time = 0
@@ -830,7 +833,6 @@ function master_request_worker(self)
 		conn->last_request_time = runtime.time()
 		if session.connection == "close"
 			conn->keep_alive = false
-			conn->close = true
 		end
 		conn->request_queue.push_back(move(session))
 		conn->state = 0
@@ -864,21 +866,18 @@ function master_response_worker(self)
 				if !response_state.wait()
 					log("Write response error: " + response_state.get_error())
 					conn->keep_alive = false
-					conn->close = true
 					conn->request_queue = new array
 					break
 				end
 				conn->request_queue.pop_front()
 				--conn->request_idx
+				conn->last_request_time = runtime.time()
 			else
 				fiber.yield()
 				break
 			end
 		end
 		if conn->request_queue.empty() && !conn->keep_alive
-			if !conn->close
-				send_error_response(conn->sock, state_codes.code_408)
-			end
 			if !conn->sock.safe_shutdown()
 				log("safe_shutdown returned false — async jobs may still be pending")
 			end

netutils.csym

@@ -458,12 +458,14 @@ function read_http_header(sock, state, keep_alive_timeout, max_body_size)
     var error_code = null
     var header_size = 0
     loop
-        async.read_until(sock, state, "\r\n")
+        # Check the deadline before starting the read: breaking with a
+        # just-started async op pending would leave it dangling past shutdown.
         var timeout = keep_alive_timeout - runtime.time()
         if timeout <= 0
             error_code = state_codes.code_408
             break
         end
+        async.read_until(sock, state, "\r\n")
         if !state.wait_for(timeout)
             if state.has_done()
                 if state.eof()
@@ -524,12 +526,13 @@ function read_http_header(sock, state, keep_alive_timeout, max_body_size)
         session.post_data = state.get_buffer(session.content_length)
         var remaining = session.content_length - session.post_data.size
         while remaining > 0
-            state = async.read(sock, remaining)
+            # Same as above: check the deadline before starting the read.
             var timeout = keep_alive_timeout - runtime.time()
             if timeout <= 0
                 error_code = state_codes.code_408
                 break
             end
+            state = async.read(sock, remaining)
             if !state.wait_for(timeout)
                 if state.has_done()
                     if state.eof()
@@ -635,7 +638,11 @@ function call_http_handler(session, server)
         if server->url_map.exist(error_code)
             server->url_map[error_code](*server, session)
         else
-            send_error_response(session.sock, error_code)
+            # Route through the session so multi-process mode sends a framed
+            # response to the master instead of raw HTTP bytes on the
+            # slave<->master socket (which would desynchronize the framing).
+            session.connection = "close"
+            session.send_response(error_code, "", "text/html")
         end
         return false
     else
@@ -684,21 +691,27 @@ function simple_worker(self)
             end
             # Close cleanly once max_keep_alive requests are served: advertise
             # Connection: close on the final response
+            var force_close = false
             if ++request_count >= self->server->max_keep_alive
                 session.connection = "close"
+                force_close = true
             end
             # Call handler
             session.sock = sock
-            if !call_http_handler(session, self->server)
-                break
-            end
+            var handler_ok = call_http_handler(session, self->server)
+            # Wait for the response write (including error responses sent on
+            # handler failure) before deciding the connection's fate.
             if session.response_state != null && !session.response_state.wait()
                 log("Write response error: " + session.response_state.get_error())
                 break
             end
+            if !handler_ok
+                break
+            end
             last_request_time = runtime.time()
-            # Keep-Alive check
-            if !sock.is_open() || session.connection == "close"
+            # Keep-Alive check — force_close guards against handlers that
+            # overwrite session.connection after the limit was reached
+            if !sock.is_open() || force_close || session.connection == "close"
                 break
             end
         end
@@ -714,7 +727,6 @@ struct http_conn
     var read_state = null
     # -1 = close, 0 = established, 1 = busy
     var state = 0
-    var close = false
     var keep_alive = true
     var request_count = 0
     var last_request_time = 0
@@ -853,7 +865,6 @@ function master_request_worker(self)
         # Check connection type
         if session.connection == "close"
             conn->keep_alive = false
-            conn->close = true
         end
         conn->request_queue.push_back(move(session))
         conn->state = 0
@@ -890,21 +901,21 @@ function master_response_worker(self)
                 if !response_state.wait()
                     log("Write response error: " + response_state.get_error())
                     conn->keep_alive = false
-                    conn->close = true
                     conn->request_queue = new array
                     break
                 end
                 conn->request_queue.pop_front()
                 --conn->request_idx
+                # Restart the keep-alive idle window only once the response is
+                # written, matching simple_worker: slave processing time must
+                # not eat into the client's idle allowance.
+                conn->last_request_time = runtime.time()
             else
                 fiber.yield()
                 break
             end
         end
         if conn->request_queue.empty() && !conn->keep_alive
-            if !conn->close
-                send_error_response(conn->sock, state_codes.code_408)
-            end
             if !conn->sock.safe_shutdown()
                 log("safe_shutdown returned false — async jobs may still be pending")
             end