feat(net,gui,sched): async HTTP client + Web browser app, and the scheduler fix that makes background work possible

The visible goal was a Web app: type a URL, see the page, fetched over the
TCP stack SUB-OS built. Getting there surfaced -- and forced fixes to --
two deeper problems.

Async HTTP client (net/http_client.c)
  tcp_connect/recv all block, so fetching from the GUI would freeze the
  compositor. Fetches now run on one long-lived kernel worker thread that
  services a single-slot mailbox; the requester posts a job and polls its
  state. Ownership follows the state, and the two hand-off points (worker
  completion, requester release) run under interrupts-off, so a window can
  close mid-fetch with neither leak nor use-after-free. do_fetch returns
  its terminal state rather than publishing it, closing a window where the
  requester could free the job before finalize read it.

Cooperative scheduling for the idle thread (the core fix)
  The login prompt, the shell and the GUI compositor all run on the pid-0
  idle thread, which the scheduler by design never preempts (sched_tick
  skips pid 0) and never requeues on a yield (weave_on clear). So it could
  neither be preempted to let the worker run, nor cleanly yield -- the
  worker was simply starved, and an early attempt to yield from it froze
  the shell outright. The idle thread now joins the weave rotation once
  hardware interrupts are live, and the network wait loops (tcp, dns, ping,
  the worker's idle) yield through a new net_wait() instead of halting the
  CPU. The compositor spends its frame-budget slack yielding too. Result:
  a background fetch progresses while the desktop holds 54 FPS.

Web app (gui/gui_app_web.c)
  A text browser: URL bar, Go, and a Raw/Reader toggle. Raw shows the
  response verbatim; Reader strips markup (dropping <script>/<style>
  bodies), decodes the common entities, and word-wraps the body. The line
  index is cached against content/view/width so scrolling and idle
  repaints are free. It only ever polls the worker, so it never stalls.

TCP throughput (the limit flagged last time)
  The 32-slot table with a 2 s TIME_WAIT linger capped sustained serving
  at ~16 req/s. The table is now 64 slots, a connection this end closed
  after serving a request lingers 250 ms rather than 2 s, and expired
  TIME_WAIT entries are reaped from the count path so a quiet table still
  drains. netstat/netmon gained served-since-boot and peak-slots counters.

Also: a `webget` CLI (the async client from a shell), listen/accept
introspection already present, and a globe icon for the app.

Verified on x86_64: `webget` fetched an 812-byte page (HTTP 200, 10 ms) on
the worker thread; the GUI Web app rendered the same page in Reader mode
while the desktop held 54 FPS; an 80-request burst through the 64-slot
table returned 80/80 (was 39/40 before) and netstat reported "80 served,
peak 33 of 64 slots" -- a peak that would have overflowed the old table.
Builds clean on x86_64, aarch64 and armv8i.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Fh5z6V7nGPbHvqVG5p4CXX

net/core/net.c

@@ -7,6 +7,7 @@
 #include <lib/printf.h>
 #include <mm/kmalloc.h>
 #include <arch/arch.h>
+#include <kernel/sched.h>
 #include <kernel/printk.h>
 
 #define MAX_ARP_ENTRIES 16
@@ -321,7 +322,7 @@ int net_ping(uint32_t target_ip, uint32_t count, uint32_t timeout_ms) {
         if (wait_ticks == 0) wait_ticks = 100;
 
         while (!ping_received && (pit_get_ticks() - t_start < wait_ticks)) {
-            arch_halt();
+            net_wait();
         }
 
         if (ping_received && ping_id == p_id && ping_seq == seq) {
@@ -341,6 +342,15 @@ int net_ping(uint32_t target_ip, uint32_t count, uint32_t timeout_ms) {
     return received;
 }
 
+void net_wait(void) {
+    // A cooperative hand-off rather than a CPU halt: other runnable tasks get
+    // to run while this one blocks on the wire. If nothing else is runnable the
+    // scheduler returns immediately, so the enclosing timeout still bounds the
+    // wait. The NIC interrupt fills the receive path independently of which
+    // task holds the CPU, so yielding never delays packet delivery.
+    sched_yield();
+}
+
 void net_init(void) {
     strcpy(primary_if.name, "eth0");
     e1000_get_mac(primary_if.mac);

net/http_client.c

@@ -0,0 +1,247 @@
+/*
+ * Asynchronous HTTP/1.0 client for SUB-OS.
+ *
+ * One worker thread, created at boot, services a single-slot mailbox. A
+ * requester parses a URL into a job, drops it in the mailbox, and polls the
+ * job's state; the worker performs the blocking DNS + TCP fetch and marks the
+ * job DONE or ERROR. Because the blocking happens on the worker rather than in
+ * the caller, the GUI compositor keeps running at full frame rate during a
+ * fetch that may take seconds.
+ *
+ * See http_client.h for the ownership rules; the two critical sections that
+ * enforce them (worker completion and requester release) run with interrupts
+ * disabled, which on this single-CPU kernel makes the hand-off indivisible.
+ */
+#include <net/http_client.h>
+#include <net/tcp.h>
+#include <net/dns.h>
+#include <net/net.h>
+#include <mm/kmalloc.h>
+#include <lib/string.h>
+#include <lib/printf.h>
+#include <kernel/printk.h>
+#include <kernel/task.h>
+#include <kernel/sched.h>
+#include <arch/arch.h>
+
+#define HTTP_CONNECT_TIMEOUT_MS 4000
+#define HTTP_RECV_TIMEOUT_MS    3000
+
+static task_t*                 worker_task = NULL;
+static http_fetch_t* volatile  mailbox     = NULL;   // job awaiting the worker
+
+// ===========================================================================
+// URL parsing
+//
+// Accepts host, host/path, host:port/path, with an optional http:// prefix.
+// Anything it cannot make sense of leaves the job unusable and is reported as
+// an error rather than guessed at.
+// ===========================================================================
+static void parse_url(const char* url, http_fetch_t* f) {
+    f->host[0] = '\0';
+    strcpy(f->path, "/");
+    f->port = 80;
+
+    if (!url) return;
+    if (strncmp(url, "http://", 7) == 0) url += 7;
+    else if (strncmp(url, "https://", 8) == 0) url += 8;   // no TLS; try plain
+
+    // Host (and optional :port) up to the first '/'.
+    int i = 0;
+    char hostport[192];
+    while (url[i] && url[i] != '/' && i < (int)sizeof(hostport) - 1) {
+        hostport[i] = url[i];
+        i++;
+    }
+    hostport[i] = '\0';
+
+    const char* rest = url + i;      // "" or "/path..."
+
+    // Split host:port.
+    char* colon = strchr(hostport, ':');
+    if (colon) {
+        *colon = '\0';
+        int p = 0;
+        for (const char* c = colon + 1; *c >= '0' && *c <= '9'; c++) p = p * 10 + (*c - '0');
+        if (p > 0 && p < 65536) f->port = (uint16_t)p;
+    }
+    strncpy(f->host, hostport, sizeof(f->host) - 1);
+    f->host[sizeof(f->host) - 1] = '\0';
+
+    if (rest[0] == '/') {
+        strncpy(f->path, rest, sizeof(f->path) - 1);
+        f->path[sizeof(f->path) - 1] = '\0';
+    }
+}
+
+// Parse the numeric status out of "HTTP/1.x NNN ...", or 0 if absent.
+static int parse_status(const char* buf, int len) {
+    if (len < 12 || strncmp(buf, "HTTP/", 5) != 0) return 0;
+    const char* p = buf;
+    const char* end = buf + len;
+    while (p < end && *p != ' ') p++;        // skip "HTTP/1.x"
+    while (p < end && *p == ' ') p++;
+    int code = 0;
+    while (p < end && *p >= '0' && *p <= '9') code = code * 10 + (*p++ - '0');
+    return code;
+}
+
+// ===========================================================================
+// The fetch itself, run on the worker thread.
+//
+// It fills in the result fields but deliberately does NOT touch f->state:
+// publishing the terminal state is the finalize step's job, done under
+// interrupts-off. If do_fetch flipped the state itself, the requester could
+// observe DONE and free the job in the instant before finalize ran, and
+// finalize would then read freed memory. Returning the state instead keeps the
+// job private to the worker until the atomic hand-off.
+// ===========================================================================
+static int do_fetch(http_fetch_t* f) {
+    uint64_t t0 = pit_get_ticks();
+
+    // Resolve: a dotted quad is taken as-is, otherwise the DNS resolver runs
+    // (itself bounded, so an unreachable server times out rather than hangs).
+    f->ip = ip_parse(f->host);
+    if (f->ip == 0) f->ip = dns_resolve(f->host);
+    if (f->ip == 0) {
+        snprintf(f->err, sizeof(f->err), "cannot resolve %s", f->host);
+        return HTTP_STATE_ERROR;
+    }
+
+    tcp_conn_t* c = tcp_connect(f->ip, f->port, HTTP_CONNECT_TIMEOUT_MS);
+    if (!c) {
+        snprintf(f->err, sizeof(f->err), "connect to :%u refused/timed out", f->port);
+        return HTTP_STATE_ERROR;
+    }
+
+    char req[512];
+    int rl = snprintf(req, sizeof(req),
+                      "GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: SUB-OS/webfetch\r\n"
+                      "Connection: close\r\n\r\n", f->path, f->host);
+    if (tcp_send(c, req, (uint16_t)rl) < 0) {
+        snprintf(f->err, sizeof(f->err), "send failed");
+        tcp_close(c);
+        return HTTP_STATE_ERROR;
+    }
+
+    // Drain the response until the peer closes or the buffer fills.
+    f->len = 0;
+    while (f->len < f->cap - 1) {
+        int n = tcp_recv(c, f->buf + f->len, (uint16_t)(f->cap - 1 - f->len),
+                         HTTP_RECV_TIMEOUT_MS);
+        if (n <= 0) break;
+        f->len += n;
+    }
+    f->buf[f->len] = '\0';
+    tcp_close(c);
+
+    f->status_code = parse_status(f->buf, f->len);
+    f->elapsed_ms  = (uint32_t)((pit_get_ticks() - t0) * 10);
+
+    if (f->len == 0) {
+        snprintf(f->err, sizeof(f->err), "no data received");
+        return HTTP_STATE_ERROR;
+    }
+    return HTTP_STATE_DONE;
+}
+
+static void free_job(http_fetch_t* f) {
+    if (!f) return;
+    if (f->buf) kfree(f->buf);
+    kfree(f);
+}
+
+// Publish the terminal state, or free the job if the requester walked away
+// while the fetch was in flight. Interrupts are off across the decision so it
+// serialises against http_fetch_release: exactly one of the two frees the job,
+// and the requester never sees a non-RUNNING state for a job it has released.
+static void finalize(http_fetch_t* f, int result) {
+    unsigned long fl = arch_irq_save();
+    bool abandoned = f->abandoned;
+    if (!abandoned) f->state = result;
+    arch_irq_restore(fl);
+
+    if (abandoned) free_job(f);
+}
+
+static void http_worker_main(void* arg) {
+    (void)arg;
+    for (;;) {
+        unsigned long fl = arch_irq_save();
+        http_fetch_t* job = mailbox;
+        mailbox = NULL;
+        arch_irq_restore(fl);
+
+        if (!job) {
+            // Idle: yield rather than halt. Halting would hold the CPU until a
+            // timer tick and starve the compositor between ticks; a cooperative
+            // yield hands the CPU straight back and the two ping-pong cheaply.
+            net_wait();
+            continue;
+        }
+
+        int result = do_fetch(job);
+        finalize(job, result);
+    }
+}
+
+// ===========================================================================
+// Public API
+// ===========================================================================
+void http_client_init(void) {
+    mailbox = NULL;
+    worker_task = task_create("http-worker", http_worker_main, NULL, 0);
+    if (worker_task) {
+        printk(KERN_INFO "NET: async HTTP client worker online\n");
+    } else {
+        printk(KERN_WARNING "NET: async HTTP client worker failed to start\n");
+    }
+}
+
+bool http_client_busy(void) {
+    return mailbox != NULL;
+}
+
+http_fetch_t* http_fetch_start(const char* url, int cap) {
+    if (!worker_task || !url || cap < 64) return NULL;
+    if (mailbox) return NULL;                  // a fetch is already queued
+
+    http_fetch_t* f = (http_fetch_t*)kzalloc(sizeof(http_fetch_t));
+    if (!f) return NULL;
+
+    f->buf = (char*)kzalloc(cap);
+    if (!f->buf) { kfree(f); return NULL; }
+    f->cap   = cap;
+    f->state = HTTP_STATE_RUNNING;
+
+    parse_url(url, f);
+    if (f->host[0] == '\0') {
+        kfree(f->buf); kfree(f);
+        return NULL;
+    }
+
+    // Hand the job to the worker. Re-check the mailbox under interrupts-off so
+    // two near-simultaneous starts cannot both install a job.
+    unsigned long fl = arch_irq_save();
+    if (mailbox) { arch_irq_restore(fl); kfree(f->buf); kfree(f); return NULL; }
+    mailbox = f;
+    arch_irq_restore(fl);
+
+    return f;
+}
+
+void http_fetch_release(http_fetch_t* f) {
+    if (!f) return;
+
+    unsigned long fl = arch_irq_save();
+    if (f->state == HTTP_STATE_RUNNING) {
+        // The worker still owns it (queued or in flight): let it free the job
+        // when it finishes rather than pulling the memory out from under it.
+        f->abandoned = true;
+        arch_irq_restore(fl);
+        return;
+    }
+    arch_irq_restore(fl);
+
+    free_job(f);
+}

net/ipv4/dns.c

@@ -163,7 +163,7 @@ uint32_t dns_resolve(const char* hostname) {
 
             uint64_t wait_ticks = DNS_TIMEOUT_MS / 10;
             while (!dns_reply_ready && (pit_get_ticks() - t0 < wait_ticks)) {
-                arch_halt();
+                net_wait();
             }
 
             if (dns_reply_ready && dns_reply_id == qid && dns_reply_ip != 0) {

net/ipv4/tcp.c

@@ -35,7 +35,7 @@
 #include <crypto/crypto.h>
 #include <arch/arch.h>
 
-#define MAX_TCP_CONNS 32
+#define MAX_TCP_CONNS 64
 
 // The timer tick is 100 Hz, so one tick is 10 ms.
 #define TCP_RTO_TICKS        50   // 500 ms retransmission timeout
@@ -43,6 +43,13 @@
 #define TCP_CLOSE_TICKS      50   // how long tcp_close waits for the shutdown
 #define TCP_TIME_WAIT_TICKS 200   // 2 s; a deliberately shortened 2*MSL
 
+// A connection this end closed after serving one request (httpd/sshd) does not
+// need the full linger: we sent the FIN, the peer is expected to be a
+// short-lived client, and holding the slot for two seconds is what let a burst
+// of requests exhaust the table. A brief linger still absorbs a retransmitted
+// FIN while freeing the slot roughly ten times sooner.
+#define TCP_SVC_TIME_WAIT_TICKS 25   // 250 ms
+
 #define TCP_EPHEMERAL_LO 49152
 #define TCP_EPHEMERAL_HI 65535
 
@@ -60,6 +67,17 @@ typedef struct {
 
 static tcp_listener_t tcp_listeners[TCP_MAX_LISTENERS];
 
+// Cumulative connections that have reached ESTABLISHED, and the high-water mark
+// of simultaneously-live table entries. Diagnostic only.
+static uint64_t tcp_total_opened = 0;
+static int      tcp_peak_conns   = 0;
+
+static void tcp_note_peak(void) {
+    int live = 0;
+    for (size_t i = 0; i < MAX_TCP_CONNS; i++) if (tcp_connections[i].in_use) live++;
+    if (live > tcp_peak_conns) tcp_peak_conns = live;
+}
+
 static uint16_t tcp_checksum(uint32_t src_ip, uint32_t dst_ip, const tcp_header_t* tcp,
                              const void* payload, uint16_t payload_len) {
     uint16_t tcp_total_len = (uint16_t)(sizeof(tcp_header_t) + payload_len);
@@ -175,10 +193,11 @@ static void reap_time_wait(void) {
     uint64_t now = pit_get_ticks();
     for (size_t i = 0; i < MAX_TCP_CONNS; i++) {
         tcp_conn_t* c = &tcp_connections[i];
-        if (c->in_use && c->state == TCP_STATE_TIME_WAIT &&
-            (now - c->closed_at) >= TCP_TIME_WAIT_TICKS) {
-            conn_free(c);
-        }
+        if (!c->in_use || c->state != TCP_STATE_TIME_WAIT) continue;
+
+        uint64_t linger = (c->role == TCP_ROLE_SERVICE)
+                        ? TCP_SVC_TIME_WAIT_TICKS : TCP_TIME_WAIT_TICKS;
+        if ((now - c->closed_at) >= linger) conn_free(c);
     }
 }
 
@@ -199,6 +218,7 @@ static tcp_conn_t* alloc_conn(void) {
         if (!tcp_connections[i].in_use) {
             memset(&tcp_connections[i], 0, sizeof(tcp_conn_t));
             tcp_connections[i].in_use = true;
+            tcp_note_peak();
             return &tcp_connections[i];
         }
     }
@@ -322,6 +342,7 @@ static void tcp_stream_input(tcp_conn_t* c, uint32_t seq, uint32_t ack, uint8_t
             c->snd_una = ack;
             c->ack_num = seq + 1;
             c->state   = TCP_STATE_ESTABLISHED;
+            tcp_total_opened++;
             tcp_tx(c, TCP_FLAG_ACK, NULL, 0);
         } else if (flags & TCP_FLAG_SYN) {
             // Simultaneous open: both ends sent a SYN at once.
@@ -336,6 +357,7 @@ static void tcp_stream_input(tcp_conn_t* c, uint32_t seq, uint32_t ack, uint8_t
         if ((flags & TCP_FLAG_ACK) && seq_ge(ack, c->iss + 1)) {
             c->snd_una = ack;
             c->state   = TCP_STATE_ESTABLISHED;
+            tcp_total_opened++;
             // A passive open is only complete now: this is the third leg of
             // the handshake, so the connection can finally be handed out.
             if (c->role == TCP_ROLE_ACCEPTED) listener_enqueue(c);
@@ -439,6 +461,7 @@ static void tcp_server_input(tcp_conn_t* c, uint32_t src_ip, uint16_t src_port,
 
     if (c->state == TCP_STATE_SYN_RCVD) {
         c->state = TCP_STATE_ESTABLISHED;
+        tcp_total_opened++;
         if (is_ssh_port && payload_len == 0) {
             const char* banner = SSH_BANNER;
             uint16_t blen = (uint16_t)strlen(banner);
@@ -596,7 +619,7 @@ tcp_conn_t* tcp_connect(uint32_t dst_ip, uint16_t dst_port, uint32_t timeout_ms)
             tcp_tx_seq(c, c->iss, TCP_FLAG_SYN, NULL, 0);
             last = pit_get_ticks();
         }
-        arch_halt();
+        net_wait();
     }
 
     conn_free(c);
@@ -629,7 +652,7 @@ int tcp_send(tcp_conn_t* c, const void* data, uint16_t len) {
             uint64_t t0 = pit_get_ticks();
             while ((pit_get_ticks() - t0) < TCP_RTO_TICKS) {
                 if (seq_ge(c->snd_una, seg_end) || c->reset) break;
-                arch_halt();
+                net_wait();
             }
 
             if (seq_ge(c->snd_una, seg_end)) break;
@@ -653,7 +676,7 @@ int tcp_recv(tcp_conn_t* c, void* buf, uint16_t len, uint32_t timeout_ms) {
         if (c->reset) return -1;
         if (c->peer_fin) return 0;                       // stream ended
         if ((pit_get_ticks() - t0) >= wait) return 0;     // nothing arrived
-        arch_halt();
+        net_wait();
     }
 
     uint16_t before = c->rx_count;
@@ -692,7 +715,7 @@ void tcp_close(tcp_conn_t* c) {
         while ((pit_get_ticks() - t0) < TCP_CLOSE_TICKS) {
             if (c->reset) break;
             if (c->state == TCP_STATE_CLOSED || c->state == TCP_STATE_TIME_WAIT) break;
-            arch_halt();
+            net_wait();
         }
     }
 
@@ -746,7 +769,7 @@ tcp_conn_t* tcp_accept(uint16_t port, uint32_t timeout_ms) {
 
     while (l->count == 0) {
         if ((pit_get_ticks() - t0) >= wait) return NULL;
-        arch_halt();
+        net_wait();
     }
 
     tcp_conn_t* c = l->queue[0];
@@ -821,6 +844,10 @@ const tcp_conn_t* tcp_get_connection(size_t index) {
     return &tcp_connections[index];
 }
 
+int tcp_conn_table_size(void) { return MAX_TCP_CONNS; }
+uint64_t tcp_get_total_opened(void) { return tcp_total_opened; }
+int tcp_get_peak_connections(void) { return tcp_peak_conns; }
+
 const char* tcp_state_name(uint8_t state) {
     static const char* const names[] = {
         "CLOSED", "LISTEN", "SYN_SENT", "SYN_RCVD", "ESTABLISHED",