2026.09.12-780f45055

Accelerate bounded ASCII JSON strings with direct Lua string push (#394)

2026.09.12-6c32f7a07

test: freeze JSON string compatibility before ASCII optimization (#393)

* test: add ljson ASCII compatibility corpus

* test: extend ljson ASCII golden cases

* test: diversify ljson corpus mutations

2026.09.12-5e791ba4e

http: bind net/http's request parser, unchunker and content types as …

2026.09.12-0a85fb59c

fetch: resolve the proxy from the environment by scheme (#396)

Fetch and FetchStream read only http_proxy/HTTP_PROXY, whatever the
request's scheme, so an https:// request ignored HTTPS_PROXY and was
sent directly. The failure is silent at the transport layer: the
request succeeds on the socket and fails later as whatever the proxy
would have supplied (an injected credential shows up as HTTP 401),
pointing debugging at the wrong layer.

The environment lookup now splits by scheme the way curl, wget, Python,
Go and Node do: an https:// request reads https_proxy then HTTPS_PROXY,
an http:// request reads http_proxy then HTTP_PROXY. no_proxy/NO_PROXY
is honoured as a comma-separated host list, so a caller can exempt a
host without unsetting the proxy for the process; an entry matches a
host equal to it or ending in "." + entry, case insensitively, leading
dots and surrounding whitespace are ignored, and a lone "*" exempts
every host. An explicit proxy option still wins over the environment
and is never filtered by no_proxy.

Uppercase HTTP_PROXY is KEPT. It is the httpoxy precondition
(CVE-2016-5385) — in CGI, request headers arrive as HTTP_* variables,
so a client sending a Proxy: header can set HTTP_PROXY in the process,
which is why curl ignores that spelling while still honouring uppercase
HTTPS_PROXY. Dropping it here is a behaviour removal that would break
any caller relying on it today, and it is separable from adding
HTTPS_PROXY: this change adds the safe variable without changing the
unsafe one, leaving the removal to a deliberate decision of its own.

Both copies of the lookup are fixed: LuaFetch in tool/net/fetch.inc
(shared by the lua binary and redbean) and LuaFetchStream in
tool/net/lfetch.c, which document the same options and must not
diverge. definitions.lua's Environment variables block for Fetch is
updated in the same commit, since it is the source of truth cosmic
generates its Teal declarations from.

Tests cover an https:// request picking up HTTPS_PROXY, an http://
request ignoring it, http_proxy still serving http://, the explicit
option overriding the environment, and no_proxy exempting a host. They
are hermetic: each starts a loopback listener and saves, clears and
restores the proxy environment around itself. test_fetch_local.lua now
drops https_proxy/HTTPS_PROXY too, so its https:// handshake test stays
direct on a host whose environment publishes them.


Claude-Session: https://claude.ai/code/session_017H2nukqoeG7vL4juiC14iu

Co-authored-by: Claude <noreply@anthropic.com>

cosmocc-2026.09.12-780f45055

Accelerate bounded ASCII JSON strings with direct Lua string push (#394)

cosmocc-2026.09.12-6c32f7a07

test: freeze JSON string compatibility before ASCII optimization (#393)

* test: add ljson ASCII compatibility corpus

* test: extend ljson ASCII golden cases

* test: diversify ljson corpus mutations

cosmocc-2026.09.12-5e791ba4e

http: bind net/http's request parser, unchunker and content types as …

cosmocc-2026.09.12-0a85fb59c

fetch: resolve the proxy from the environment by scheme (#396)

Fetch and FetchStream read only http_proxy/HTTP_PROXY, whatever the
request's scheme, so an https:// request ignored HTTPS_PROXY and was
sent directly. The failure is silent at the transport layer: the
request succeeds on the socket and fails later as whatever the proxy
would have supplied (an injected credential shows up as HTTP 401),
pointing debugging at the wrong layer.

The environment lookup now splits by scheme the way curl, wget, Python,
Go and Node do: an https:// request reads https_proxy then HTTPS_PROXY,
an http:// request reads http_proxy then HTTP_PROXY. no_proxy/NO_PROXY
is honoured as a comma-separated host list, so a caller can exempt a
host without unsetting the proxy for the process; an entry matches a
host equal to it or ending in "." + entry, case insensitively, leading
dots and surrounding whitespace are ignored, and a lone "*" exempts
every host. An explicit proxy option still wins over the environment
and is never filtered by no_proxy.

Uppercase HTTP_PROXY is KEPT. It is the httpoxy precondition
(CVE-2016-5385) — in CGI, request headers arrive as HTTP_* variables,
so a client sending a Proxy: header can set HTTP_PROXY in the process,
which is why curl ignores that spelling while still honouring uppercase
HTTPS_PROXY. Dropping it here is a behaviour removal that would break
any caller relying on it today, and it is separable from adding
HTTPS_PROXY: this change adds the safe variable without changing the
unsafe one, leaving the removal to a deliberate decision of its own.

Both copies of the lookup are fixed: LuaFetch in tool/net/fetch.inc
(shared by the lua binary and redbean) and LuaFetchStream in
tool/net/lfetch.c, which document the same options and must not
diverge. definitions.lua's Environment variables block for Fetch is
updated in the same commit, since it is the source of truth cosmic
generates its Teal declarations from.

Tests cover an https:// request picking up HTTPS_PROXY, an http://
request ignoring it, http_proxy still serving http://, the explicit
option overriding the environment, and no_proxy exempting a host. They
are hermetic: each starts a loopback listener and saves, clears and
restores the proxy environment around itself. test_fetch_local.lua now
drops https_proxy/HTTPS_PROXY too, so its https:// handshake test stays
direct on a host whose environment publishes them.


Claude-Session: https://claude.ai/code/session_017H2nukqoeG7vL4juiC14iu

Co-authored-by: Claude <noreply@anthropic.com>

2026.09.06-e748d6a1e

unix: expose unix.CAP as a name->value lookup table (#392)

Linux capability constants (CAP_NET_ADMIN, ...) were only reachable
as individual named fields, with no way to resolve a name computed
at runtime -- the same gap unix.E/unix.SIG had before #391. Add a
kCapNames NameValue[] array and register it as unix.CAP via the
existing LuaSetNameValueTable helper (not LoadMagnums/MagnumStr,
which only works for OS-resolved extern symbols: CAP_* are
compile-time #define literals with none).

Every existing individual unix.CAP_<NAME> field is untouched.
CAP_LAST_CAP is excluded from the table: it aliases whichever CAP_*
constant is currently highest rather than naming its own capability,
the same shape as SIG's excluded SIG_DFL/SIG_IGN/sigprocmask `how`
values.

definitions.lua annotates unix.CAP as table<string, integer>,
extending the QALLOW_CONSTTYPE and CONST_MAP exceptions #391 already
carries for unix.E/unix.SIG to include it.


Claude-Session: https://claude.ai/code/session_01FfC3JJTfFskaeURnwkLU3o

Co-authored-by: Claude <noreply@anthropic.com>

2026.09.06-cbeb3eb6c

line_coverage_floor: lower lfetch.c to its true measured minimum (#390)

Decomposed lfetch.c's line coverage across ~50 serial MODE=cov runs:
it is a fixed base of 579 always-executed lines plus up to 16 lines
split across four independent, all-or-nothing branches -- a TLS
socket-read error path, FetchStreamRead's TLS body-read path (which
only fires when the streaming test's real external HTTPS fetch
succeeds), and two code paths for a chunked response whose final
chunk and terminator land in the same read vs. two. Every observed
local value (586, 588, 590, 592) and the CI-observed 582 fit this
model exactly as base plus some subset of the four, so 579 -- base
with none of them firing -- is the true minimum, not an estimate,
and the previous 585 floor sat inside that range rather than below
it. The comment now derives the number instead of guessing a margin.


Claude-Session: https://claude.ai/code/session_01HrDAg7zGvuPZuechv2xuEJ

Co-authored-by: Claude <noreply@anthropic.com>