CH-J Server Manager

# Bundled HTTP diagnostics runtime

HTTP/1.1, HTTP/2 and HTTP/3 use the same bundled curl client. macOS arm64 and Linux x64 use curl 8.22.0, OpenSSL 3.5.9, nghttp2 1.70.0, ngtcp2 1.25.0 and nghttp3 1.18.0. Windows x64 uses the official curl.se curl-for-win 8.22.0_3 static build with LibreSSL 4.3.3 and the same HTTP libraries. No system curl fallback, runtime download or administrator permission is needed. The Windows upstream reproducible build recipe is https://github.com/curl/curl-for-win/tree/9d77e31e .

Build with `python3 scripts/native/build.py` (Windows: `python scripts/native/build.py`) before packaging. macOS/Linux require C/C++ tools, CMake, Ninja, Perl, make and pkg-config. Sources are pinned by version and upstream SHA-256 in `scripts/native/dependencies.lock.json`. The script verifies every download, statically links third-party transport libraries and fails without HTTP2/HTTP3/SSL features. Only operating-system libraries remain dynamic. Windows uses the pinned official binary archive, not a locally compiled Windows transport stack. The bundled CA file has its own pinned hash; component licenses and upstream build provenance accompany the runtime.

The client and trust store are installed outside app.asar in `resources/native-runtime/<platform>-<arch>/`. Each diagnostic verifies component hashes, architecture and executable capabilities before use. Config files, proxies, TLS trust environment overrides and library injection variables are excluded. curl runs with an absolute path, shell disabled, verified CA trust, an explicit resolved IP family, no cookies, no automatic redirects, and bounded output and time. Redirects are validated and re-resolved by the application. HTTPS on ports other than 443 is supported.

HTTP/3 uses `--http3-only` and is confirmed only after a completed transfer reporting HTTP version 3 and successful certificate verification. HTTP error responses such as 404 can confirm the protocol. Alt-Svc is an advertisement, not proof. QUIC timeout, certificate failure, DNS failure, connection refusal, incompatible protocol and component failure remain distinct. A UDP timeout leaves server support unverified. QUIC handshake timing is not reported as TCP timing.

Every measurement starts a separate process/connection. The warm option does not claim connection reuse for the bundled client. This keeps protocol comparisons consistent. Reports include runtime versions, capabilities, TLS verification and QUIC timing, while history/export remove bodies, URL queries and authentication headers.

Update these pins and rebuild every supported platform when updating the transport stack or CA trust store. Published artifacts and source snapshots are immutable.