refactor: refactored ARCHITECTURE.md and 10 others

- Updated ARCHITECTURE.md
- Updated PLAN.md
- Updated README.md

Author: lemon-mint

ARCHITECTURE.md

@@ -54,7 +54,7 @@ The relay server terminates only the browser WebSocket and yamux session. It use
 | Service Worker | `web/sw.js` | Classifies every controlled request, blocks unknowns, manages in-memory tab/entry state, requires per-tab capability tokens on privileged runtime bridge messages, calls the WASM kernel, exposes runtime bridge APIs. |
 | Runtime prelude | `web/runtime-prelude.js`, `web/worker-prelude.js` | Installs target-realm containment hooks before target scripts run. Main-window WebSocket/navigation/form/history/location/storage/worker/iframe/device APIs are hooked; main-window fetch/XHR/EventSource are not runtime-polyfilled today. Worker `fetch` is bridged through `/__zp/api/fetch`. Patched function source strings, Canvas/Audio extraction, and speech voices receive basic masking to reduce runtime self-fingerprinting, not to provide full anti-bot spoofing. |
 | WASM kernel | `cmd/wasm-kernel/main.go`, `internal/swhttp/*` | Converts JS `Request`/`Response`, initializes transport, owns target HTTP and WebSocket execution. |
-| Transport | `internal/wsconn/*`, `internal/yamuxconn/*`, `internal/socks5/*`, `internal/utlskernel/*`, `internal/http1/*`, `internal/wsproto/*` | Browser WebSocket `net.Conn`, yamux streams, SOCKS5 DOMAINNAME CONNECT, uTLS, HTTP/2 and HTTP/1.1 target fetch, target WebSocket upgrade/framing. |
+| Transport | `internal/wsconn/*`, `internal/yamuxconn/*`, `internal/socks5/*`, `internal/utlskernel/*`, `internal/zphttp/*`, `internal/wsproto/*` | Browser WebSocket `net.Conn`, yamux streams, SOCKS5 DOMAINNAME CONNECT, uTLS, HTTP/2 and HTTP/1.1 target fetch, target WebSocket upgrade/framing. |
 | HTML/header/cookie policy | `internal/htmltx/*`, `internal/headers/*`, `internal/cookiejar/*`, `internal/zpiso/*` | HTML transformation, safe response header constructor policy, target cookie jar, Tor isolation token derivation. |
 | Relay server | `cmd/zeroproxy-server/main.go` | Serves assets, accepts `/__zp/ws-pipe` with Gorilla WebSocket, and bridges yamux streams to the configured Tor SOCKS5 address. |
 
@@ -67,7 +67,7 @@ The relay server terminates only the browser WebSocket and yamux session. It use
 5. The WASM kernel ensures one long-lived WebSocket connection to `/__zp/ws-pipe`, wraps it in a yamux client, and opens one yamux stream per target TCP connection.
 6. Each target connection performs SOCKS5 `CONNECT` with DOMAINNAME ATYP and a Tor `IsolateSOCKSAuth` username derived from the tab stream-isolation key and target site.
 7. HTTPS fetch targets advertise `h2` and `http/1.1` through uTLS ALPN; target WebSocket connections advertise only `http/1.1`.
-8. `internal/http1` dispatches negotiated `h2` connections through `golang.org/x/net/http2.ClientConn`; HTTP/1.1 fallback writes a direct request and reads the response with `http.ReadResponse`.
+8. `internal/zphttp` dispatches negotiated `h2` connections through `golang.org/x/net/http2.ClientConn`; HTTP/1.1 fallback writes a direct request and reads the response with `http.ReadResponse`.
 9. Redirects are followed inside the kernel so raw `Location` headers are not exposed to browser code.
 10. HTML document responses are transformed: runtime prelude is injected, document navigation URLs are rewritten to encrypted `/p/<encrypted>#k=<key>` routes, risky tags and headers are removed, and the browser receives a same-origin `Response` with ZeroProxy CSP.
 
@@ -99,7 +99,7 @@ The Service Worker keeps tab, entry, client-context, route, and stream maps in m
 
 The Go WASM kernel exposes `__zp_kernel_init`, `__go_jshttp`, `__zp_stream`, and `__zp_cookie_set` to the Service Worker. Initialization creates a browser WebSocket to `/__zp/ws-pipe`; the relay accepts it with Gorilla WebSocket and adapts binary messages to a stream-oriented `net.Conn`. A yamux client/server session runs over that connection, and per-target yamux streams are bridged by the relay to Tor SOCKS5.
 
-`internal/http1` builds sanitized target requests, applies the cookie jar, follows redirects up to `MaxRedirects`, dispatches HTTPS fetches to HTTP/2 when ALPN selects `h2`, and falls back to direct HTTP/1.1 request/response handling otherwise. HTTP/2 client connections and reusable HTTP/1.1 idle connections are pooled only within the same target authority, tab, and Tor isolation token. Idle target connections use a browser-style 90 second timeout; HTTP/1.1 connections are reused only after the response body reaches EOF and are closed on partial body cancellation or `Connection: close`. Target WebSocket support stays HTTP/1.1 Upgrade through `internal/wsproto` and the runtime `WebSocket` wrapper.
+`internal/zphttp` builds sanitized target requests, applies the cookie jar, follows redirects up to `MaxRedirects`, dispatches HTTPS fetches to HTTP/2 when ALPN selects `h2`, and falls back to direct HTTP/1.1 request/response handling otherwise. HTTP/2 client connections and reusable HTTP/1.1 idle connections are pooled only within the same target authority, tab, and Tor isolation token. Idle target connections use a browser-style 90 second timeout; HTTP/1.1 connections are reused only after the response body reaches EOF and are closed on partial body cancellation or `Connection: close`. Target WebSocket support stays HTTP/1.1 Upgrade through `internal/wsproto` and the runtime `WebSocket` wrapper.
 
 `internal/swhttp.ResponseToJS` constructs JavaScript `Response` objects with a `ReadableStream` backed by the Go response body. Document HTML transformation uses `htmltx.TransformTo` through an `io.Pipe`, so transformed HTML can flow to the browser without first buffering the full document. Request/upload body conversion and browser backpressure/cancellation fidelity are still prototype-level.
 

PLAN.md

@@ -56,7 +56,7 @@ Browser tab
   │       ├─ yamux: multiplexed target streams over the wsconn session
   │       ├─ socks5: DOMAINNAME CONNECT + SOCKS auth isolation
   │       ├─ utls: target TLS client in WASM
-  │       ├─ http1: net/http + net/textproto based HTTP/1.1 engine
+  │       ├─ zphttp: target HTTP/2 and HTTP/1.1 engine
   │       ├─ htmltx: x/net/html stream transform
   │       │   ├─ runtime prelude injection
   │       │   ├─ topbar injection
@@ -313,7 +313,7 @@ internal/zpiso/
   token.go                   // stream isolation token derivation
 internal/utlskernel/
   dial.go                    // uTLS UClient over yamux+socks5
-internal/http1/
+internal/zphttp/
   roundtrip.go               // net/http Request + net/textproto response parse
   redirect.go                // internal redirect engine
 internal/htmltx/

README.md

@@ -121,7 +121,7 @@ These checks cover source/unit policy invariants, buildability, and a local-brow
 | `web/runtime-prelude.js`, `web/worker-prelude.js` | Target-realm containment hooks and worker bootstrap. |
 | `cmd/wasm-kernel` | Go WASM transport kernel exposed to the Service Worker. |
 | `cmd/zeroproxy-server` | Static asset server and Gorilla WebSocket/yamux-to-Tor relay. |
-| `internal/http1`, `internal/socks5`, `internal/utlskernel`, `internal/wsproto`, `internal/yamuxconn`, `internal/wsconn` | Target transport path. |
+| `internal/zphttp`, `internal/socks5`, `internal/utlskernel`, `internal/wsproto`, `internal/yamuxconn`, `internal/wsconn` | Target transport path. |
 | `internal/htmltx`, `internal/headers`, `internal/cookiejar`, `internal/shareurl`, `internal/zpiso` | HTML rewriting, response header policy, cookie handling, share URL envelope, Tor isolation tokens. |
 | `test/js`, `test/e2e`, `internal/*/*_test.go` | JavaScript source-policy tests, Puppeteer browser E2E tests, and Go unit tests. |
 | `.github/workflows/ci.yml` | GitHub Actions CI for Go tests, JavaScript/Puppeteer tests, WASM build, and relay server build. |

cmd/wasm-kernel/main.go

@@ -18,20 +18,20 @@ import (
 	"github.com/gosuda/zeroproxy/internal/cookiejar"
 	"github.com/gosuda/zeroproxy/internal/headers"
 	"github.com/gosuda/zeroproxy/internal/htmltx"
-	"github.com/gosuda/zeroproxy/internal/http1"
 	"github.com/gosuda/zeroproxy/internal/swhttp"
 	"github.com/gosuda/zeroproxy/internal/wsconn"
 	"github.com/gosuda/zeroproxy/internal/wsproto"
 	"github.com/gosuda/zeroproxy/internal/yamuxconn"
+	"github.com/gosuda/zeroproxy/internal/zphttp"
 )
 
 type Kernel struct {
 	mu     sync.Mutex
-	engine *http1.Engine
-	tabs   map[string]*http1.TabState
+	engine *zphttp.Engine
+	tabs   map[string]*zphttp.TabState
 }
 
-func NewKernel() *Kernel { return &Kernel{tabs: make(map[string]*http1.TabState)} }
+func NewKernel() *Kernel { return &Kernel{tabs: make(map[string]*zphttp.TabState)} }
 
 func main() {
 	k := NewKernel()
@@ -73,7 +73,7 @@ func (k *Kernel) ensure(ctx context.Context) error {
 	}
 	k.mu.Lock()
 	if k.engine == nil {
-		k.engine = &http1.Engine{Mux: sess}
+		k.engine = &zphttp.Engine{Mux: sess}
 		sess = nil
 	}
 	k.mu.Unlock()
@@ -228,11 +228,11 @@ func (k *Kernel) jsStream(this js.Value, args []js.Value) any {
 	})
 }
 
-func (k *Kernel) tabFor(req *http.Request) *http1.TabState {
+func (k *Kernel) tabFor(req *http.Request) *zphttp.TabState {
 	return k.tabFromValues(req.Header.Get("X-Zp-Tab-Id"), req.Header.Get("X-Zp-Stream-Isolation-Key"))
 }
 
-func (k *Kernel) tabFromValues(tabID, keyB64 string) *http1.TabState {
+func (k *Kernel) tabFromValues(tabID, keyB64 string) *zphttp.TabState {
 	if tabID == "" {
 		tabID = "default"
 	}
@@ -246,7 +246,7 @@ func (k *Kernel) tabFromValues(tabID, keyB64 string) *http1.TabState {
 		key = make([]byte, 32)
 		_, _ = rand.Read(key)
 	}
-	t := &http1.TabState{TabID: tabID, CookieJar: cookiejar.New(), StreamIsolationKey: key}
+	t := &zphttp.TabState{TabID: tabID, CookieJar: cookiejar.New(), StreamIsolationKey: key}
 	k.tabs[tabID] = t
 	return t
 }

internal/wsproto/client.go

@@ -15,7 +15,7 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/gosuda/zeroproxy/internal/http1"
+	"github.com/gosuda/zeroproxy/internal/zphttp"
 )
 
 const guid = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"
@@ -34,7 +34,7 @@ type Conn struct {
 	mu sync.Mutex
 }
 
-func Dial(ctx context.Context, engine *http1.Engine, target *url.URL, protocols []string, tab *http1.TabState) (*Conn, *http.Response, error) {
+func Dial(ctx context.Context, engine *zphttp.Engine, target *url.URL, protocols []string, tab *zphttp.TabState) (*Conn, *http.Response, error) {
 	if target.Scheme != "ws" && target.Scheme != "wss" {
 		return nil, nil, fmt.Errorf("TARGET_PROTOCOL_BLOCKED")
 	}
@@ -59,7 +59,7 @@ func Dial(ctx context.Context, engine *http1.Engine, target *url.URL, protocols
 	req.Header.Set("Upgrade", "websocket")
 	req.Header.Set("Sec-WebSocket-Version", "13")
 	req.Header.Set("Sec-WebSocket-Key", key)
-	req.Header.Set("User-Agent", http1.TargetUserAgent)
+	req.Header.Set("User-Agent", zphttp.TargetUserAgent)
 	if len(protocols) > 0 {
 		req.Header.Set("Sec-WebSocket-Protocol", strings.Join(protocols, ", "))
 	}

internal/http1/http2_test.go internal/zphttp/http2_test.gointernal/http1/http2_test.go renamed to internal/zphttp/http2_test.go

@@ -1,4 +1,4 @@
-package http1
+package zphttp
 
 import (
 	"context"

internal/http1/keepalive_test.go internal/zphttp/keepalive_test.gointernal/http1/keepalive_test.go renamed to internal/zphttp/keepalive_test.go

@@ -1,4 +1,4 @@
-package http1
+package zphttp
 
 import (
 	"bufio"

internal/http1/redirect.go internal/zphttp/redirect.gointernal/http1/redirect.go renamed to internal/zphttp/redirect.go

@@ -1,4 +1,4 @@
-package http1
+package zphttp
 
 import (
 	"context"

internal/http1/roundtrip.go internal/zphttp/roundtrip.gointernal/http1/roundtrip.go renamed to internal/zphttp/roundtrip.go

@@ -1,4 +1,4 @@
-package http1
+package zphttp
 
 import (
 	"bufio"

internal/http1/roundtrip_test.go internal/zphttp/roundtrip_test.gointernal/http1/roundtrip_test.go renamed to internal/zphttp/roundtrip_test.go

@@ -1,4 +1,4 @@
-package http1
+package zphttp
 
 import (
 	"bufio"