feat(socks5): added internal SOCKS5 parser for local testing

- Implement internal SOCKS5 parser in relay server for direct target dialing in local tests.
- Add postMessage hooks to preserve frame target origins across compartments.
- Add stable test runner for consistent local and CI test execution.
- Update README and ARCHITECTURE documentation for internal SOCKS5 mode.
- Extend E2E test suite with additional proxy behavior and origin validation.

Author: lemon-mint

ARCHITECTURE.md

@@ -3,10 +3,10 @@
 ZeroProxy is a client-owned virtual browsing prototype that runs target pages on the proxy origin without a browser extension. Its design goal is that target-site HTTP, TLS, and WebSocket traffic leaves only through this path:
 
 ```text
-Service Worker -> Go WASM kernel -> WebSocket/yamux -> Tor SOCKS5 -> uTLS -> HTTP/2 or HTTP/1.1
+Service Worker -> Go WASM kernel -> WebSocket/yamux -> SOCKS5 CONNECT -> uTLS -> HTTP/2 or HTTP/1.1
 ```
 
-The relay server terminates only the browser WebSocket/yamux pipe. Target HTTP parsing, redirects, cookies, header policy, HTML rewriting, and target WebSocket framing are owned by the Go WASM kernel and browser-side runtime.
+The relay server terminates only the browser WebSocket/yamux pipe. In production it byte-bridges each yamux stream to a Tor SOCKS5 listener; for local compatibility tests `-socks internal` makes the relay parse the kernel's SOCKS5 CONNECT itself and dial the requested target directly. Target HTTP parsing, redirects, cookies, header policy, HTML rewriting, and target WebSocket framing are owned by the Go WASM kernel and browser-side runtime.
 
 ## Status
 
@@ -18,16 +18,16 @@ Implemented core spine:
 - AES-256-CBC + HMAC-SHA256 URL envelope with HKDF-separated encryption/MAC keys and HMAC verification before decryption.
 - Service Worker request classifier that handles every controlled request, blocks unknown requests instead of falling back to native `fetch(event.request)`, and requires a per-tab runtime capability token on privileged runtime bridge messages.
 - Go WASM exports: `__go_jshttp`, `__zp_stream`, `__zp_kernel_init`, and `__zp_cookie_set`.
-- A single browser WebSocket pipe carrying yamux streams to the relay server, then Tor SOCKS5 DOMAINNAME CONNECT, uTLS for HTTPS, HTTP/2 when ALPN selects `h2`, and HTTP/1.1 fallback/direct handling.
-- Tokenizer-based HTML transform that injects the runtime prelude, launders document navigation URLs through encrypted `/p` routes, drops dangerous tags and headers, and handles `srcdoc`.
+- A single browser WebSocket pipe carrying yamux streams to the relay server, then SOCKS5 DOMAINNAME CONNECT, uTLS for HTTPS, HTTP/2 when ALPN selects `h2`, and HTTP/1.1 fallback/direct handling. `-socks 127.0.0.1:9050` preserves the Tor bridge; `-socks internal` is a Tor-free development/test mode that parses SOCKS5 on the relay and dials targets directly from the relay process.
+- Tokenizer-based HTML transform that injects the runtime prelude, launders executable external scripts through `/__zp/api/script?u=...`, rewrites iframe/frame document URLs to encrypted `/p` routes, preserves author-visible anchor/form attributes for runtime navigation interception, drops dangerous tags and headers, strips executable event attributes through the JS rewriter, and handles `srcdoc`.
 - Runtime containment for main-window `fetch`, XHR, EventSource, WebSocket, `sendBeacon`, navigation, forms, history/location masking, storage facades, workers, iframes, and high-risk device/network APIs. Main-window and worker `fetch` paths are bridged through `/__zp/api/fetch` so strict `connect-src 'self'` does not block target API calls before the Service Worker can route them. Runtime-to-Service-Worker control messages carry a closure-held per-tab capability token. The runtime also applies basic self-fingerprint masking for patched function source strings, Canvas/Audio extraction jitter, and speech voice lists; broad anti-bot spoofing is not a project goal.
 - Phase 2 JavaScript rewriting is wired through an OXC parser/WASM service: target-response CSP no longer permits `connect-src *`, external and inline script sources are parsed before execution, dangerous global/window/location access is rewritten to runtime membrane helpers, parse/transform failures fail closed, and dynamic compilation paths such as `Function`, constructor-constructor escapes, `eval`, and string timers execute under the runtime's virtual global scope; blob/data worker scripts remain blocked when they cannot be rewritten synchronously.
 - Relay server static asset service and `/__zp/ws-pipe` WebSocket endpoint.
 - Go and JavaScript share URL implementations that use the same envelope format.
 
 Not complete enough for production or high-assurance acceptance:
 
-- Browser E2E tests cover the current iframe clean-realm and basic fingerprint-masking checks, but do not yet prove every worker, direct navigation, form, device API, and unclassified subresource non-escape path.
+- Browser E2E tests cover internal SOCKS5 relay mode, dynamic script laundering, compound location assignments, iframe postMessage delivery, iframe clean-realm containment, and basic fingerprint-masking checks, but do not yet prove every worker, direct navigation, form, device API, and unclassified subresource non-escape path.
 - Dynamic iframe containment is synchronous for `contentWindow`/`contentDocument` reads and common insertion APIs, but remains prototype-level and should keep gaining adversarial browser coverage.
 - Main-window runtime API compatibility is prototype-level for fetch, XHR, EventSource, WebSocket, uploads, descriptor edge cases, and fingerprinting surface fidelity.
 - Response bodies are streamed into JavaScript `Response` objects, but request/upload body handling and browser backpressure/cancellation behavior are still prototype-level.
@@ -41,7 +41,7 @@ See [`ARCHITECTURE.md`](./ARCHITECTURE.md) for the implementation map and accept
 - Go 1.26 or the Go toolchain version required by `go.mod`.
 - Node.js LTS and npm for the JavaScript and Puppeteer E2E tests.
 - A browser with Service Worker and WebAssembly support. CI uses Puppeteer's pinned Chrome for Testing.
-- A Tor SOCKS5 listener configured with stream isolation for manual target browsing. CI uses an in-process test SOCKS5 proxy instead of Tor.
+- A Tor SOCKS5 listener configured with stream isolation for anonymized manual target browsing. Tor is not required for the automated Puppeteer suite or local compatibility checks that run the relay with `-socks internal`.
 
 Example Tor setting:
 
@@ -58,6 +58,14 @@ tor --SocksPort "127.0.0.1:9050 IsolateSOCKSAuth" --DataDirectory /tmp/zeroproxy
 
 Keep that process running and wait until Tor logs `Bootstrapped 100% (done)` before expecting target browsing to work. If Tor is managed by your OS service manager instead, use the same `SocksPort` setting in `torrc` and start the service before starting ZeroProxy.
 
+For Tor-free local compatibility testing, start ZeroProxy with the internal relay SOCKS5 parser instead of starting Tor:
+
+```sh
+./dist/zeroproxy-server -addr :8080 -socks internal
+```
+
+Internal mode is not an anonymity mode: target TCP connections are direct dials from the relay process. It exists so CI and local browser compatibility tests can exercise the browser → Service Worker → WASM → WebSocket/yamux → SOCKS5 parsing pipeline without an external proxy daemon.
+
 ## Build and run locally
 
 Build the browser bundle, Go WASM kernel, and relay server from the repository root:
@@ -92,15 +100,15 @@ Server flags:
 - `-addr`: HTTP listen address. Default: `:8080`.
 - `-web`: built static web asset directory containing `index.html`, `sw.js`, and `/__zp/*` assets. Default: `dist/web`.
 - `-kernel`: compiled Go WASM kernel served at `/__zp/kernel.wasm`. Default: `dist/kernel.wasm`.
-- `-socks`: Tor SOCKS5 address. Default: `127.0.0.1:9050`.
+- `-socks`: Tor SOCKS5 address, or `internal` for the relay's built-in SOCKS5 CONNECT parser/direct dialer used by tests. Default: `127.0.0.1:9050`.
 
 Open the browser shell on the proxy origin:
 
 ```text
 http://proxy.localhost:8080/
 ```
 
-Use `proxy.localhost` from the start so the shell, Service Worker, and encrypted `/p/<encrypted>#k=<key>` routes share one origin. The server starts even if Tor is not reachable, but target browsing needs the configured Tor SOCKS5 listener.
+Use `proxy.localhost` from the start so the shell, Service Worker, and encrypted `/p/<encrypted>#k=<key>` routes share one origin. The server starts even if Tor is not reachable. Target browsing needs either a configured Tor SOCKS5 listener or the explicit non-anonymous `-socks internal` test mode.
 
 ## Verification commands
 
@@ -113,11 +121,11 @@ npm test
 npm run build
 ```
 
-`npm test` runs both JavaScript source-policy tests and the Puppeteer E2E suite. The E2E test builds temporary ZeroProxy artifacts with `scripts/build.mjs`, starts a local target HTTP server, starts an in-process SOCKS5 proxy, launches Puppeteer's Chrome, and verifies browser traffic through the ZeroProxy server without requiring Tor.
+`npm test` runs both JavaScript source-policy tests and the Puppeteer E2E suite. The E2E test builds temporary ZeroProxy artifacts with `scripts/build.mjs`, starts a local target HTTP server, starts the relay with `-socks internal`, launches Puppeteer's Chrome, and verifies browser traffic through the ZeroProxy server without requiring Tor.
 
 CI is defined in `.github/workflows/ci.yml` and runs on pushes to `main`, pull requests, and manual dispatch. It uses an Ubuntu 24.04 LTS runner, installs Go from `go.mod`, installs the current Node.js LTS release, runs `npm ci`, runs the Go and full JavaScript/Puppeteer test suites, and builds deployable `dist/` artifacts.
 
-These checks cover source/unit policy invariants, buildability, and a local-browser E2E path through a test SOCKS5 proxy. They do not start Tor, validate real Tor deployment behavior, or prove production traffic compatibility.
+These checks cover source/unit policy invariants, buildability, and a local-browser E2E path through the relay's internal SOCKS5 parser/direct dialer. They do not start Tor, validate real Tor deployment behavior, or prove production traffic compatibility.
 
 ## Repository map
 
@@ -127,8 +135,9 @@ These checks cover source/unit policy invariants, buildability, and a local-brow
 | `web/sw.js` | Service Worker classifier, in-memory tab state, runtime API bridge, WASM kernel calls. |
 | `web/runtime-prelude.js`, `web/worker-prelude.js` | Target-realm containment hooks and worker bootstrap. |
 | `scripts/build.mjs` | Full build pipeline for browser bundles, generated WASM support assets, Go WASM kernel, and relay server. |
+| `scripts/test.mjs` | Stable local/CI test runner that executes JavaScript policy tests and the Puppeteer E2E suite in sequence. |
 | `cmd/wasm-kernel` | Go WASM transport kernel exposed to the Service Worker. |
-| `cmd/zeroproxy-server` | Static asset server and Gorilla WebSocket/yamux-to-Tor relay. |
+| `cmd/zeroproxy-server` | Static asset server and Gorilla WebSocket/yamux relay to Tor SOCKS5 or the `-socks internal` direct-dial SOCKS5 parser. |
 | `internal/zphttp`, `internal/socks5`, `internal/utlskernel`, `internal/wsproto`, `internal/yamuxconn`, `internal/wsconn` | Target transport path. |
 | `internal/htmltx`, `internal/headers`, `internal/cookiejar`, `internal/shareurl`, `internal/zpiso` | HTML rewriting, response header policy, cookie handling, share URL envelope, Tor isolation tokens. |
 | `test/js`, `test/e2e`, `internal/*/*_test.go` | JavaScript source-policy tests, Puppeteer browser E2E tests, and Go unit tests. |

README.md

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"encoding/binary"
 	"errors"
 	"flag"
 	"fmt"
@@ -27,13 +28,15 @@ type server struct {
 	socksAddr  string
 }
 
+const internalSOCKSMode = "internal"
+
 func main() {
 	var addr string
 	s := &server{}
 	flag.StringVar(&addr, "addr", ":8080", "HTTP listen address")
 	flag.StringVar(&s.webDir, "web", "dist/web", "built static web asset directory")
 	flag.StringVar(&s.kernelWASM, "kernel", "dist/kernel.wasm", "compiled Go WASM kernel path")
-	flag.StringVar(&s.socksAddr, "socks", "127.0.0.1:9050", "Tor SOCKS5 address configured with IsolateSOCKSAuth")
+	flag.StringVar(&s.socksAddr, "socks", "127.0.0.1:9050", "Tor SOCKS5 address with IsolateSOCKSAuth, or 'internal' for the built-in test SOCKS5 parser/direct dialer")
 	flag.Parse()
 	mux := http.NewServeMux()
 	mux.HandleFunc("/", s.handle)
@@ -235,8 +238,167 @@ func (s *server) acceptStreams(ctx context.Context, sess *yamuxconn.Session) {
 		if err != nil {
 			return
 		}
-		go s.bridgeToTor(ctx, stream)
+		go s.bridgeTargetStream(ctx, stream)
+	}
+}
+
+func (s *server) bridgeTargetStream(ctx context.Context, stream net.Conn) {
+	if strings.EqualFold(strings.TrimSpace(s.socksAddr), internalSOCKSMode) {
+		s.bridgeInternalSOCKS(ctx, stream)
+		return
+	}
+	s.bridgeToTor(ctx, stream)
+}
+
+func (s *server) bridgeInternalSOCKS(ctx context.Context, stream net.Conn) {
+	defer stream.Close()
+	stopDeadline := make(chan struct{})
+	go func() {
+		select {
+		case <-ctx.Done():
+			_ = stream.SetDeadline(time.Now())
+		case <-stopDeadline:
+		}
+	}()
+	host, port, err := readSOCKS5Connect(ctx, stream)
+	close(stopDeadline)
+	if err != nil {
+		return
+	}
+	d := net.Dialer{Timeout: 10 * time.Second, KeepAlive: 30 * time.Second}
+	target, err := d.DialContext(ctx, "tcp", net.JoinHostPort(host, port))
+	if err != nil {
+		_, _ = stream.Write([]byte{0x05, 0x01, 0x00, 0x01, 0, 0, 0, 0, 0, 0})
+		return
+	}
+	if _, err := stream.Write([]byte{0x05, 0x00, 0x00, 0x01, 0, 0, 0, 0, 0, 0}); err != nil {
+		_ = target.Close()
+		return
+	}
+	bridgeConns(ctx, stream, target)
+}
+
+func readSOCKS5Connect(ctx context.Context, rw net.Conn) (string, string, error) {
+	var head [2]byte
+	if err := readFull(ctx, rw, head[:]); err != nil {
+		return "", "", err
+	}
+	if head[0] != 0x05 || head[1] == 0 {
+		return "", "", fmt.Errorf("invalid SOCKS5 greeting")
+	}
+	methods := make([]byte, int(head[1]))
+	if err := readFull(ctx, rw, methods); err != nil {
+		return "", "", err
+	}
+	method := byte(0xff)
+	for _, m := range methods {
+		if m == 0x02 {
+			method = 0x02
+			break
+		}
+		if m == 0x00 {
+			method = 0x00
+		}
+	}
+	if _, err := rw.Write([]byte{0x05, method}); err != nil {
+		return "", "", err
+	}
+	if method == 0xff {
+		return "", "", fmt.Errorf("no acceptable SOCKS5 auth method")
+	}
+	if method == 0x02 {
+		if err := acceptSOCKS5UserPass(ctx, rw); err != nil {
+			return "", "", err
+		}
+	}
+	var req [4]byte
+	if err := readFull(ctx, rw, req[:]); err != nil {
+		return "", "", err
+	}
+	if req[0] != 0x05 || req[1] != 0x01 || req[2] != 0x00 {
+		return "", "", fmt.Errorf("unsupported SOCKS5 request")
+	}
+	host, err := readSOCKS5Address(ctx, rw, req[3])
+	if err != nil {
+		return "", "", err
+	}
+	var portBuf [2]byte
+	if err := readFull(ctx, rw, portBuf[:]); err != nil {
+		return "", "", err
+	}
+	port := binary.BigEndian.Uint16(portBuf[:])
+	if port == 0 {
+		return "", "", fmt.Errorf("invalid SOCKS5 port")
+	}
+	return host, fmt.Sprint(port), nil
+}
+
+func acceptSOCKS5UserPass(ctx context.Context, rw net.Conn) error {
+	var head [2]byte
+	if err := readFull(ctx, rw, head[:]); err != nil {
+		return err
+	}
+	if head[0] != 0x01 {
+		_, _ = rw.Write([]byte{0x01, 0x01})
+		return fmt.Errorf("invalid SOCKS5 auth version")
+	}
+	user := make([]byte, int(head[1]))
+	if err := readFull(ctx, rw, user); err != nil {
+		return err
+	}
+	var passLen [1]byte
+	if err := readFull(ctx, rw, passLen[:]); err != nil {
+		return err
+	}
+	pass := make([]byte, int(passLen[0]))
+	if err := readFull(ctx, rw, pass); err != nil {
+		return err
+	}
+	_, err := rw.Write([]byte{0x01, 0x00})
+	return err
+}
+
+func readSOCKS5Address(ctx context.Context, rw net.Conn, atyp byte) (string, error) {
+	switch atyp {
+	case 0x01:
+		var ip [4]byte
+		if err := readFull(ctx, rw, ip[:]); err != nil {
+			return "", err
+		}
+		return net.IP(ip[:]).String(), nil
+	case 0x03:
+		var n [1]byte
+		if err := readFull(ctx, rw, n[:]); err != nil {
+			return "", err
+		}
+		if n[0] == 0 {
+			return "", fmt.Errorf("empty SOCKS5 domain")
+		}
+		host := make([]byte, int(n[0]))
+		if err := readFull(ctx, rw, host); err != nil {
+			return "", err
+		}
+		return string(host), nil
+	case 0x04:
+		var ip [16]byte
+		if err := readFull(ctx, rw, ip[:]); err != nil {
+			return "", err
+		}
+		return net.IP(ip[:]).String(), nil
+	default:
+		return "", fmt.Errorf("unsupported SOCKS5 address type")
+	}
+}
+
+func readFull(ctx context.Context, r io.Reader, p []byte) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	_, err := io.ReadFull(r, p)
+	if err != nil {
+		return err
 	}
+	return ctx.Err()
 }
 
 func (s *server) bridgeToTor(ctx context.Context, stream net.Conn) {
@@ -246,14 +408,18 @@ func (s *server) bridgeToTor(ctx context.Context, stream net.Conn) {
 		_ = stream.Close()
 		return
 	}
+	bridgeConns(ctx, stream, tor)
+}
+
+func bridgeConns(ctx context.Context, a, b net.Conn) {
 	closeBoth := func() {
-		_ = stream.Close()
-		_ = tor.Close()
+		_ = a.Close()
+		_ = b.Close()
 	}
 	defer closeBoth()
 	done := make(chan struct{}, 2)
-	go func() { _, _ = io.Copy(tor, stream); closeBoth(); done <- struct{}{} }()
-	go func() { _, _ = io.Copy(stream, tor); closeBoth(); done <- struct{}{} }()
+	go func() { _, _ = io.Copy(b, a); closeBoth(); done <- struct{}{} }()
+	go func() { _, _ = io.Copy(a, b); closeBoth(); done <- struct{}{} }()
 	select {
 	case <-ctx.Done():
 		closeBoth()