From aeddd0badcde5ec5150015bc22054e284c2fb8a9 Mon Sep 17 00:00:00 2001
From: Luca Bolognese <lucabol@microsoft.com>
Date: Thu, 23 Jul 2026 18:34:05 +0200
Subject: [PATCH] Validate hosted native HTTPS

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 523fe3c1-7fe4-4f3e-ad27-0a057a2af4ea
---
 .gitattributes                 |   1 +
 .github/workflows/ci.yml       |   7 +-
 .github/workflows/release.yml  |   7 +-
 README.md                      |  15 +++--
 docs/MANUAL_TESTS.md           |  12 ++++
 http.osc                       |  71 ++++++++++++--------
 js_bridge.c                    |  86 ++++++++++++++++++++++--
 tests/test_http_request.osc    |  89 +++++++++++++++++++++++++
 tests/test_posix_net_bridge.sh | 116 +++++++++++++++++++++++++++++++++
 tests/test_redirect.osc        |  17 +++++
 tools/build_common.ps1         |   2 +-
 tools/smoke_urls.osc           |  34 +++++++++-
 12 files changed, 413 insertions(+), 44 deletions(-)
 create mode 100644 .gitattributes
 create mode 100644 tests/test_http_request.osc
 create mode 100644 tests/test_posix_net_bridge.sh

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..dfdb8b7
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+*.sh text eol=lf
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index df988f1..a8e4bd5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,7 @@ permissions:
   contents: read
 
 env:
-  OSCAN_VERSION: 0.0.37
+  OSCAN_VERSION: 0.0.39
 
 concurrency:
   group: ci-${{ github.ref }}
@@ -50,6 +50,11 @@ jobs:
         shell: pwsh
         run: ./tests/test_build_common.ps1
 
+      - name: POSIX net bridge tests
+        if: runner.os == 'Linux'
+        shell: bash
+        run: bash ./tests/test_posix_net_bridge.sh
+
       - name: Install Oscan
         shell: bash
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e7a1f7e..7628fe5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ permissions:
   contents: write
 
 env:
-  OSCAN_VERSION: 0.0.37
+  OSCAN_VERSION: 0.0.39
 
 jobs:
   build:
@@ -52,6 +52,11 @@ jobs:
         shell: pwsh
         run: ./tests/test_build_common.ps1
 
+      - name: POSIX net bridge tests
+        if: runner.os == 'Linux'
+        shell: bash
+        run: bash ./tests/test_posix_net_bridge.sh
+
       - name: Resolve version
         id: version
         shell: bash
diff --git a/README.md b/README.md
index ca0a089..4d8a531 100644
--- a/README.md
+++ b/README.md
@@ -74,7 +74,7 @@ Switch to a TrueType font (`TT`) and bump the size (`16pt`) for a clean, modern
 
 ## Prerequisites
 
-- **[Oscan compiler](https://github.com/lucabol/Oscan)** — required (includes TLS support). Native Windows/Linux builds require Oscan `v0.0.37` or newer with `--backend c|native`, `--native-target`, `--extra-obj`, `--extra-lib`, `--allow-elevated-native-link`, native user-extern `str` parameter/return shims, and native hosted Windows canvas/gfx/clipboard/img/svg/tt runtime support.
+- **[Oscan compiler](https://github.com/lucabol/Oscan)** — required (includes TLS support). Native Windows/Linux builds require Oscan `v0.0.39` or newer with `--backend c|native`, `--native-target`, `--extra-obj`, `--extra-lib`, `--allow-elevated-native-link`, native user-extern `str` parameter/return shims, and native hosted Windows/Linux TLS plus Windows canvas/gfx/clipboard/img/svg/tt runtime support.
 - **PowerShell** — for the build script
 
 ## Build backends
@@ -382,7 +382,7 @@ supported CSS feature.
   do one request per socket, but servers that don't send a
   `Content-Length` and instead stream chunked responses now work)
 - **TLS built-in** — SChannel on Windows, BearSSL on Linux (zero external dependencies)
-- **Redirects** — automatic follow of 301/302/307/308 (up to 5 hops)
+- **Redirects** — automatic follow of 301/302/303/307/308 (up to 5 hops)
 - **Default ports** — 80 for HTTP, 443 for HTTPS
 - **Persistent HTTP cache** — text responses (HTML, CSS, JS, JSON, XML)
   survive browser restarts; saved to
@@ -433,9 +433,14 @@ Refresh the captured snapshots when sites change layout:
 .\tools\smoke.ps1
 ```
 
-Hits the public internet to verify the full HTTP→gzip→parse pipeline
-end-to-end. Flaky by design; not part of CI. Use after touching
-`http.osc`, `gzip_bridge.c`, or TLS-related code.
+Hits the public internet to verify HTTPS/TLS, SNI hostname handling,
+redirects, `Host` header construction, gzip/chunked/content-length body
+handling, and HTML parsing end-to-end, including the lucabol.com regression
+URL. Flaky by design; not part of CI. A self-signed local TLS fixture would
+require disabling certificate validation or changing host trust stores, so
+offline tests keep coverage to deterministic request construction and
+response parsing. Use after touching `http.osc`, `gzip_bridge.c`, or
+TLS-related code.
 
 ## Reader Mode, Bookmarks & Zoom
 
diff --git a/docs/MANUAL_TESTS.md b/docs/MANUAL_TESTS.md
index bcf40f6..0074f54 100644
--- a/docs/MANUAL_TESTS.md
+++ b/docs/MANUAL_TESTS.md
@@ -14,6 +14,18 @@ end-to-end. All can be run against a local Python server
 Wikipedia streams responses as `Transfer-Encoding: chunked` without
 `Content-Length`.
 
+## 1a. Native hosted HTTPS smoke
+
+```powershell
+.\tools\smoke.ps1 -Backend native
+```
+
+**Expect:** the public live-smoke URLs pass, including
+`https://www.lucabol.com/posts/2026-03-27-notes-the-metamorphosis-franz-kafka`.
+That URL should connect with SNI `www.lucabol.com`, send `Host:
+www.lucabol.com`, request the `/posts/...` path, receive a `Content-Length`
+response, and render text containing `Gregor`.
+
 ## 2. External `<script src>`
 
 Create `tests/scratch_script.html`:
diff --git a/http.osc b/http.osc
index 30495a8..8be54bd 100644
--- a/http.osc
+++ b/http.osc
@@ -70,6 +70,39 @@ fn! http_make_error(msg: str) -> HttpResponse {
     }
 }
 
+fn! http_host_header(host: str, port: i32, use_tls: bool) -> str {
+    let is_default_port: bool =
+        (use_tls and port == 443) or
+        (not use_tls and port == 80);
+    if is_default_port { host } else { "{host}:{port}" }
+}
+
+fn! http_build_get_request(host: str, port: i32, path: str, use_tls: bool,
+                           extra_headers: str) -> str {
+    let host_header: str = http_host_header(host, port, use_tls);
+    "GET {path} HTTP/1.1\r\nHost: {host_header}\r\nConnection: close\r\nUser-Agent: OscaWeb/0.1\r\nAccept: text/html,application/xhtml+xml,image/*,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip\r\n{extra_headers}\r\n"
+}
+
+fn! http_build_post_request(host: str, port: i32, path: str, use_tls: bool,
+                            body: str, content_type: str, extra_headers: str,
+                            page_url: str) -> str {
+    let body_len: i32 = str_len(body);
+    let host_header: str = http_host_header(host, port, use_tls);
+    let mut origin_hdr: str = "";
+    let mut referer_hdr: str = "";
+    if str_len(page_url) > 0 {
+        let pu: Url = url_parse(page_url);
+        if str_len(pu.host) > 0 and str_len(pu.scheme) > 0 {
+            let default_port: bool = (str_eq(pu.scheme, "https") and pu.port == 443) or
+                                     (str_eq(pu.scheme, "http") and pu.port == 80);
+            let port_part: str = if default_port { "" } else { ":{pu.port}" };
+            origin_hdr = "Origin: {pu.scheme}://{pu.host}{port_part}\r\n";
+            referer_hdr = "Referer: {page_url}\r\n";
+        };
+    };
+    "POST {path} HTTP/1.1\r\nHost: {host_header}\r\nConnection: close\r\nUser-Agent: OscaWeb/0.1\r\nAccept: text/html,application/xhtml+xml,image/*,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip\r\nContent-Type: {content_type}\r\nContent-Length: {body_len}\r\n{origin_hdr}{referer_hdr}{extra_headers}\r\n{body}"
+}
+
 // Collect every `Set-Cookie:` header value (without the key prefix)
 // from a CRLF-separated header block. Case-insensitive on the key.
 // Kept separate from http_parse_headers because a map collapses the
@@ -169,7 +202,7 @@ fn! http_get_tls(host: str, port: i32, request: str) -> HttpResponse {
     let mut handle: i32 = 0;
     match conn_result {
         Result::Ok(h) => { handle = h; },
-        Result::Err(e) => { return http_make_error("TLS connection failed: {e}"); },
+        Result::Err(e) => { return http_make_error("TLS connection to {host}:{port} failed: {e}"); },
     };
     defer tls_close(handle);
     vlog_msg("tls_connected", "");
@@ -177,7 +210,7 @@ fn! http_get_tls(host: str, port: i32, request: str) -> HttpResponse {
     let send_result: Result<i32, str> = tls_send(handle, request);
     match send_result {
         Result::Ok(_n) => {},
-        Result::Err(e) => { return http_make_error("TLS send failed: {e}"); },
+        Result::Err(e) => { return http_make_error("TLS send to {host}:{port} failed: {e}"); },
     };
     vlog_msg("tls_sent", "");
 
@@ -326,7 +359,7 @@ fn! http_get_plain(host: str, port: i32, request: str, timeout_ms: i32) -> HttpR
     let mut sock: i32 = 0;
     match sock_result {
         Result::Ok(s) => { sock = s; },
-        Result::Err(e) => { return http_make_error("Socket creation failed: {e}"); },
+        Result::Err(e) => { return http_make_error("Socket creation for {host}:{port} failed: {e}"); },
     };
     defer socket_close(sock);
 
@@ -340,14 +373,14 @@ fn! http_get_plain(host: str, port: i32, request: str, timeout_ms: i32) -> HttpR
     let conn_result: Result<str, str> = socket_connect(sock, host, port);
     match conn_result {
         Result::Ok(_s) => {},
-        Result::Err(e) => { return http_make_error("Connection failed: {e}"); },
+        Result::Err(e) => { return http_make_error("Connection to {host}:{port} failed: {e}"); },
     };
     vlog_msg("plain connected", "");
 
     let send_result: Result<i32, str> = socket_send(sock, request);
     match send_result {
         Result::Ok(_n) => {},
-        Result::Err(e) => { return http_make_error("Send failed: {e}"); },
+        Result::Err(e) => { return http_make_error("Send to {host}:{port} failed: {e}"); },
     };
     vlog_msg("plain sent", "");
 
@@ -362,7 +395,7 @@ fn! http_get_plain(host: str, port: i32, request: str, timeout_ms: i32) -> HttpR
             // got any data treat it as an error so the caller can fall
             // back to TLS.
             if not got_any {
-                return http_make_error("recv timeout or empty response");
+                return http_make_error("Receive from {host}:{port} timed out or returned empty response");
             };
             done = true;
         } else {
@@ -396,7 +429,7 @@ fn! http_get(host: str, port: i32, path: str, use_tls: bool, extra_headers: str)
     // HTTP/1.1 + Connection: close — we advertise 1.1 so servers unlock
     // chunked transfer-encoding and modern header behaviour, but we still
     // close the socket after one response (no keep-alive pipelining).
-    let request: str = "GET {path} HTTP/1.1\r\nHost: {host}\r\nConnection: close\r\nUser-Agent: OscaWeb/0.1\r\nAccept: text/html,application/xhtml+xml,image/*,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip\r\n{extra_headers}\r\n";
+    let request: str = http_build_get_request(host, port, path, use_tls, extra_headers);
 
     let mut raw_response: str = "";
 
@@ -442,7 +475,7 @@ fn! http_get(host: str, port: i32, path: str, use_tls: bool, extra_headers: str)
     };
 
     if str_len(raw_response) == 0 {
-        return http_make_error("Empty response");
+        return http_make_error("Empty response from {host}:{port}");
     };
 
     http_parse_raw_response(raw_response)
@@ -583,24 +616,8 @@ fn! http_parse_raw_response(raw_response: str) -> HttpResponse {
 fn! http_post(host: str, port: i32, path: str, use_tls: bool,
               body: str, content_type: str, extra_headers: str,
               page_url: str) -> HttpResponse {
-    let body_len: i32 = str_len(body);
-    let mut origin_hdr: str = "";
-    let mut referer_hdr: str = "";
-    if str_len(page_url) > 0 {
-        let pu: Url = url_parse(page_url);
-        if str_len(pu.host) > 0 and str_len(pu.scheme) > 0 {
-            // Origin is scheme + host (+ non-default port). No path.
-            let default_port: bool = (str_eq(pu.scheme, "https") and pu.port == 443) or
-                                     (str_eq(pu.scheme, "http") and pu.port == 80);
-            let port_part: str = if default_port { "" } else { ":{pu.port}" };
-            origin_hdr = "Origin: {pu.scheme}://{pu.host}{port_part}\r\n";
-            // Referer can include the path (but never the fragment, which
-            // url_parse already stripped). Skip when the page URL is
-            // suspicious (no host).
-            referer_hdr = "Referer: {page_url}\r\n";
-        };
-    };
-    let request: str = "POST {path} HTTP/1.1\r\nHost: {host}\r\nConnection: close\r\nUser-Agent: OscaWeb/0.1\r\nAccept: text/html,application/xhtml+xml,image/*,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip\r\nContent-Type: {content_type}\r\nContent-Length: {body_len}\r\n{origin_hdr}{referer_hdr}{extra_headers}\r\n{body}";
+    let request: str = http_build_post_request(host, port, path, use_tls,
+        body, content_type, extra_headers, page_url);
 
     let mut raw_response: str = "";
     if use_tls {
@@ -623,7 +640,7 @@ fn! http_post(host: str, port: i32, path: str, use_tls: bool,
     };
 
     if str_len(raw_response) == 0 {
-        return http_make_error("Empty response");
+        return http_make_error("Empty response from {host}:{port}");
     };
 
     http_parse_raw_response(raw_response)
diff --git a/js_bridge.c b/js_bridge.c
index c887e07..5b77553 100644
--- a/js_bridge.c
+++ b/js_bridge.c
@@ -17,6 +17,15 @@
 #include <ws2tcpip.h>
 #include <windows.h>
 #include <winhttp.h>
+#else
+#include <errno.h>
+#include <fcntl.h>
+#include <netdb.h>
+#include <netinet/in.h>
+#include <poll.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <unistd.h>
 #endif
 
 /* ── osc_str helpers ──────────────────────────────────────── */
@@ -1103,8 +1112,15 @@ int32_t net_set_recv_timeout(int32_t sock, int32_t ms) {
                         (const char *)&tv, sizeof(tv));
     return (int32_t)(r1 | r2);
 #else
-    (void)sock; (void)ms;
-    return -1;
+    if (ms < 0) return -1;
+    struct timeval tv;
+    tv.tv_sec = ms / 1000;
+    tv.tv_usec = (ms % 1000) * 1000;
+    int r1 = setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO,
+                        (const void *)&tv, sizeof(tv));
+    int r2 = setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO,
+                        (const void *)&tv, sizeof(tv));
+    return (int32_t)(r1 | r2);
 #endif
 }
 
@@ -1202,8 +1218,51 @@ int32_t net_connect_timeout_ipv4(int32_t sock, int32_t ip_be, int32_t port, int3
     ioctlsocket(s, FIONBIO, &nb);
     return rc;
 #else
-    (void)sock; (void)ip_be; (void)port; (void)ms;
-    return -1;
+    if (ms < 0) return -1;
+
+    struct sockaddr_in addr;
+    memset(&addr, 0, sizeof(addr));
+    addr.sin_family = AF_INET;
+    addr.sin_port = htons((uint16_t)port);
+    addr.sin_addr.s_addr = (in_addr_t)ip_be; /* already network byte order */
+
+    int old_flags = fcntl(sock, F_GETFL, 0);
+    if (old_flags < 0) return -1;
+    if (fcntl(sock, F_SETFL, old_flags | O_NONBLOCK) != 0) return -1;
+
+    int rc = 0;
+    if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) != 0) {
+        int err = errno;
+        if (err != EINPROGRESS) {
+            rc = -2;
+        } else {
+            struct pollfd pfd;
+            memset(&pfd, 0, sizeof(pfd));
+            pfd.fd = sock;
+            pfd.events = POLLOUT;
+
+            int pr;
+            do {
+                pr = poll(&pfd, 1, ms);
+            } while (pr < 0 && errno == EINTR);
+
+            if (pr <= 0) {
+                rc = -3;
+            } else {
+                int so_error = 0;
+                socklen_t opt_len = (socklen_t)sizeof(so_error);
+                if (getsockopt(sock, SOL_SOCKET, SO_ERROR,
+                               (void *)&so_error, &opt_len) != 0) {
+                    rc = -4;
+                } else if (so_error != 0) {
+                    rc = -5;
+                }
+            }
+        }
+    }
+
+    if (fcntl(sock, F_SETFL, old_flags) != 0) return -6;
+    return rc;
 #endif
 }
 
@@ -1246,8 +1305,23 @@ int32_t net_resolve_ipv4(osc_str host) {
     freeaddrinfo(res);
     return ip;
 #else
-    (void)host;
-    return 0;
+    char *h = osc_str_to_cstr_alloc(host);
+    if (!h) return 0;
+    struct addrinfo hints, *res = NULL;
+    memset(&hints, 0, sizeof(hints));
+    hints.ai_family = AF_INET;
+    hints.ai_socktype = SOCK_STREAM;
+    int r = getaddrinfo(h, NULL, &hints, &res);
+    free(h);
+    if (r != 0 || !res) return 0;
+    if (!res->ai_addr || res->ai_addrlen < (socklen_t)sizeof(struct sockaddr_in)) {
+        freeaddrinfo(res);
+        return 0;
+    }
+    struct sockaddr_in *sa = (struct sockaddr_in *)res->ai_addr;
+    int32_t ip = (int32_t)sa->sin_addr.s_addr;
+    freeaddrinfo(res);
+    return ip;
 #endif
 }
 
diff --git a/tests/test_http_request.osc b/tests/test_http_request.osc
new file mode 100644
index 0000000..4c28135
--- /dev/null
+++ b/tests/test_http_request.osc
@@ -0,0 +1,89 @@
+// Tests for HTTP request construction. These are deterministic and avoid
+// the network; live TLS/runtime coverage lives in tools/smoke_urls.osc.
+
+use "../http.osc"
+
+fn! assert_true(cond: bool, test_name: str) {
+    if cond {
+        println("PASS: {test_name}");
+    } else {
+        println("FAIL: {test_name}");
+    };
+}
+
+fn! assert_eq_str(actual: str, expected: str, test_name: str) {
+    if str_eq(actual, expected) {
+        println("PASS: {test_name}");
+    } else {
+        println("FAIL: {test_name} - expected '{expected}', got '{actual}'");
+    };
+}
+
+fn! assert_contains(haystack: str, needle: str, test_name: str) {
+    assert_true(str_contains(haystack, needle), test_name);
+}
+
+fn! assert_not_contains(haystack: str, needle: str, test_name: str) {
+    assert_true(not str_contains(haystack, needle), test_name);
+}
+
+fn! main() {
+    assert_eq_str(http_host_header("www.lucabol.com", 443, true),
+                  "www.lucabol.com",
+                  "default HTTPS Host omits port");
+    assert_eq_str(http_host_header("example.test", 8443, true),
+                  "example.test:8443",
+                  "non-default HTTPS Host includes port");
+    assert_eq_str(http_host_header("example.test", 80, false),
+                  "example.test",
+                  "default HTTP Host omits port");
+    assert_eq_str(http_host_header("example.test", 8080, false),
+                  "example.test:8080",
+                  "non-default HTTP Host includes port");
+
+    let supplied_path: str = "/posts/2026-03-27-notes-the-metamorphosis-franz-kafka";
+    let get_req: str = http_build_get_request(
+        "www.lucabol.com", 443, supplied_path, true, "Cookie: sid=abc\r\n");
+    assert_contains(get_req,
+                    "GET /posts/2026-03-27-notes-the-metamorphosis-franz-kafka HTTP/1.1\r\n",
+                    "GET uses origin-form request target");
+    assert_contains(get_req, "Host: www.lucabol.com\r\n",
+                    "GET sends Host header");
+    assert_not_contains(get_req, "Host: www.lucabol.com:443\r\n",
+                        "GET does not include default HTTPS port in Host");
+    assert_contains(get_req, "Connection: close\r\n",
+                    "GET asks server to close connection");
+    assert_contains(get_req, "Accept-Encoding: gzip\r\n",
+                    "GET advertises gzip only");
+    assert_contains(get_req, "Cookie: sid=abc\r\n",
+                    "GET preserves extra headers");
+    assert_true(str_ends_with(get_req, "\r\n\r\n"),
+                "GET terminates headers with blank line");
+    assert_not_contains(get_req, "https://www.lucabol.com",
+                        "GET request target does not include scheme or host");
+
+    let get_port_req: str = http_build_get_request(
+        "localhost", 9443, "/tls-fixture?chunked=1", true, "");
+    assert_contains(get_port_req, "Host: localhost:9443\r\n",
+                    "GET includes non-default TLS port in Host");
+    assert_not_contains(get_port_req, "Host: localhost:443\r\n",
+                        "GET does not confuse SNI host with Host port");
+
+    let post_req: str = http_build_post_request(
+        "example.test", 8443, "/submit", true,
+        "a=1&b=two", "application/x-www-form-urlencoded",
+        "Cookie: form=1\r\n",
+        "https://example.test:8443/form");
+    assert_contains(post_req, "POST /submit HTTP/1.1\r\n",
+                    "POST uses origin-form request target");
+    assert_contains(post_req, "Host: example.test:8443\r\n",
+                    "POST Host includes non-default HTTPS port");
+    assert_contains(post_req, "Origin: https://example.test:8443\r\n",
+                    "POST Origin includes non-default port");
+    assert_contains(post_req, "Referer: https://example.test:8443/form\r\n",
+                    "POST includes Referer");
+    assert_contains(post_req, "Content-Length: 9\r\n",
+                    "POST Content-Length matches body");
+    assert_true(str_ends_with(post_req, "\r\na=1&b=two"),
+                "POST appends body after header terminator");
+}
diff --git a/tests/test_posix_net_bridge.sh b/tests/test_posix_net_bridge.sh
new file mode 100644
index 0000000..4992caf
--- /dev/null
+++ b/tests/test_posix_net_bridge.sh
@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+case "$(uname -s)" in
+  Linux) ;;
+  *)
+    echo "PASS: POSIX net bridge tests skipped on non-Linux"
+    exit 0
+    ;;
+esac
+
+BUILD_DIR="$ROOT/build/posix-net-bridge-test"
+mkdir -p "$BUILD_DIR"
+SRC="$BUILD_DIR/posix_net_bridge_test.c"
+BIN="$BUILD_DIR/posix_net_bridge_test"
+JS_BRIDGE="$ROOT/js_bridge.c"
+
+cat > "$SRC" <<EOF_C
+#include "$JS_BRIDGE"
+
+#include <arpa/inet.h>
+
+static int failures = 0;
+
+static void check(int cond, const char *name) {
+    if (cond) {
+        printf("PASS: %s\\n", name);
+    } else {
+        printf("FAIL: %s\\n", name);
+        failures++;
+    }
+}
+
+static int nonblock_flag(int fd) {
+    int flags = fcntl(fd, F_GETFL, 0);
+    if (flags < 0) return -1;
+    return (flags & O_NONBLOCK) != 0;
+}
+
+int main(void) {
+    osc_str localhost = { "localhost", 9 };
+    int32_t ip = net_resolve_ipv4(localhost);
+    check(ip != 0, "net_resolve_ipv4 resolves localhost");
+
+    int timeout_sock = socket(AF_INET, SOCK_STREAM, 0);
+    check(timeout_sock >= 0, "timeout socket created");
+    if (timeout_sock >= 0) {
+        check(net_set_recv_timeout(timeout_sock, 250) == 0,
+              "net_set_recv_timeout succeeds");
+        struct timeval recv_tv;
+        socklen_t recv_len = (socklen_t)sizeof(recv_tv);
+        int recv_ok = getsockopt(timeout_sock, SOL_SOCKET, SO_RCVTIMEO,
+                                 &recv_tv, &recv_len);
+        check(recv_ok == 0 && recv_tv.tv_sec == 0 && recv_tv.tv_usec > 0,
+              "SO_RCVTIMEO applied");
+        close(timeout_sock);
+    }
+
+    int listen_sock = socket(AF_INET, SOCK_STREAM, 0);
+    check(listen_sock >= 0, "listener socket created");
+    int port = 0;
+    if (listen_sock >= 0) {
+        int one = 1;
+        setsockopt(listen_sock, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
+        struct sockaddr_in listen_addr;
+        memset(&listen_addr, 0, sizeof(listen_addr));
+        listen_addr.sin_family = AF_INET;
+        listen_addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+        listen_addr.sin_port = 0;
+        check(bind(listen_sock, (struct sockaddr *)&listen_addr, sizeof(listen_addr)) == 0,
+              "listener bind succeeds");
+        check(listen(listen_sock, 1) == 0, "listener listen succeeds");
+        socklen_t addr_len = (socklen_t)sizeof(listen_addr);
+        check(getsockname(listen_sock, (struct sockaddr *)&listen_addr, &addr_len) == 0,
+              "listener port discovered");
+        port = ntohs(listen_addr.sin_port);
+    }
+
+    int client_sock = socket(AF_INET, SOCK_STREAM, 0);
+    check(client_sock >= 0, "client socket created");
+    if (client_sock >= 0 && port > 0) {
+        int before_nb = nonblock_flag(client_sock);
+        int rc = net_connect_timeout_ipv4(client_sock, htonl(INADDR_LOOPBACK), port, 1000);
+        int after_nb = nonblock_flag(client_sock);
+        check(rc == 0, "net_connect_timeout_ipv4 connects to local listener");
+        check(before_nb == 0 && after_nb == 0,
+              "net_connect_timeout_ipv4 restores blocking mode after success");
+        int accepted = accept(listen_sock, NULL, NULL);
+        check(accepted >= 0, "listener accepts primed connection");
+        if (accepted >= 0) close(accepted);
+        close(client_sock);
+    }
+    if (listen_sock >= 0) close(listen_sock);
+
+    int error_sock = socket(AF_INET, SOCK_STREAM, 0);
+    check(error_sock >= 0, "error socket created");
+    if (error_sock >= 0) {
+        int before_nb = nonblock_flag(error_sock);
+        int rc = net_connect_timeout_ipv4(error_sock, htonl(INADDR_LOOPBACK), 1, 200);
+        int after_nb = nonblock_flag(error_sock);
+        check(rc != 0, "net_connect_timeout_ipv4 reports refused/timeout");
+        check(before_nb == 0 && after_nb == 0,
+              "net_connect_timeout_ipv4 restores blocking mode after error");
+        close(error_sock);
+    }
+
+    if (failures != 0) return 1;
+    return 0;
+}
+EOF_C
+
+cc -D_GNU_SOURCE -ffunction-sections -fdata-sections -I"$ROOT" \
+  "$SRC" -Wl,--gc-sections -o "$BIN"
+"$BIN"
diff --git a/tests/test_redirect.osc b/tests/test_redirect.osc
index b51b0ab..a23519a 100644
--- a/tests/test_redirect.osc
+++ b/tests/test_redirect.osc
@@ -88,4 +88,21 @@ fn! main() {
         make_resp("HTTP/1.1 302 Found",
                   "Content-Length: 0", ""));
     assert_eq_str(r8.redirect_url, "", "302 without Location yields empty redirect_url");
+
+    // Unknown encodings on redirects should not block the redirect chain.
+    let r9: HttpResponse = http_parse_raw_response(
+        make_resp("HTTP/1.1 302 Found",
+                  "Location: /compressed\r\nContent-Encoding: br",
+                  "ignored"));
+    assert_eq_str(r9.error, "", "302 unknown encoding does not error");
+    assert_eq_str(r9.redirect_url, "/compressed", "302 unknown encoding keeps Location");
+    assert_eq_str(r9.body, "", "302 unknown encoding drops unused body");
+
+    // Unknown encodings on renderable responses are surfaced as errors.
+    let r10: HttpResponse = http_parse_raw_response(
+        make_resp("HTTP/1.1 200 OK",
+                  "Content-Encoding: br",
+                  "compressed"));
+    assert_eq_str(r10.error, "Unsupported Content-Encoding: br (no brotli decoder)",
+                  "200 unknown encoding surfaces error");
 }
diff --git a/tools/build_common.ps1 b/tools/build_common.ps1
index 2a2be26..fe13905 100644
--- a/tools/build_common.ps1
+++ b/tools/build_common.ps1
@@ -61,7 +61,7 @@ function Get-OscaWebBuildConfig {
         throw '-AllowElevatedNativeLink is only valid for native backend builds.'
     }
     if ($AllowElevatedNativeLink -and -not $capabilities.SupportsAllowElevatedNativeLink) {
-        throw 'Installed oscan does not expose --allow-elevated-native-link. Install Oscan v0.0.37 or newer, then rerun.'
+        throw 'Installed oscan does not expose --allow-elevated-native-link. Install Oscan v0.0.39 or newer, then rerun.'
     }
 
     [pscustomobject]@{
diff --git a/tools/smoke_urls.osc b/tools/smoke_urls.osc
index d9fa44a..7718761 100644
--- a/tools/smoke_urls.osc
+++ b/tools/smoke_urls.osc
@@ -23,6 +23,34 @@ struct UrlCase {
     must_contain: str,   // case-insensitive substring of body text; "" to skip
 }
 
+fn! fetch_follow_redirects(start_url: str) -> HttpResponse {
+    let mut current: str = start_url;
+    let mut redirects: i32 = 0;
+    let mut resp: HttpResponse = http_make_error("not fetched");
+    let mut done: bool = false;
+    while not done and redirects < 5 {
+        let u: Url = url_parse(current);
+        let use_tls: bool = str_eq(u.scheme, "https");
+        resp = http_get(u.host, u.port, u.path, use_tls, "");
+        if str_len(resp.error) > 0 {
+            done = true;
+        } else if str_len(resp.redirect_url) > 0 and
+                  (resp.status_code == 301 or resp.status_code == 302 or
+                   resp.status_code == 303 or resp.status_code == 307 or
+                   resp.status_code == 308) {
+            current = url_resolve_full(current, resp.redirect_url);
+            redirects = redirects + 1;
+            println("  redirect -> {current}");
+        } else {
+            done = true;
+        };
+    };
+    if redirects >= 5 and str_len(resp.redirect_url) > 0 {
+        return http_make_error("too many redirects");
+    };
+    resp
+}
+
 fn! count_links(nodes: [HtmlNode]) -> i32 {
     let mut n: i32 = 0;
     let mut i: i32 = 0;
@@ -40,9 +68,7 @@ fn! count_links(nodes: [HtmlNode]) -> i32 {
 
 fn! check_one(c: UrlCase) -> bool {
     println("---- {c.url}");
-    let u: Url = url_parse(c.url);
-    let use_tls: bool = str_eq(u.scheme, "https");
-    let resp: HttpResponse = http_get(u.host, u.port, u.path, use_tls, "");
+    let resp: HttpResponse = fetch_follow_redirects(c.url);
 
     if str_len(resp.error) > 0 {
         println("  FAIL: transport error: {resp.error}");
@@ -101,6 +127,8 @@ fn! main() {
                   min_links: 200, must_contain: "" },
         UrlCase { url: "https://lwn.net/",
                   min_links: 20, must_contain: "" },
+        UrlCase { url: "https://www.lucabol.com/posts/2026-03-27-notes-the-metamorphosis-franz-kafka",
+                  min_links: 4, must_contain: "Gregor" },
     ];
 
     let mut total: i32 = 0;