@lamplitisles/dsh-nanocodex 0.1.0-beta.0

package/vendor/nanocodex/tools/browser/browserBuffer.mjs

@@ -0,0 +1,18 @@
+import * as bufferModule from "buffer";
+
+// CommonJS interop differs between Vite's page optimizer, Worker graph, and
+// production bundler. A namespace import requests no synthetic binding; read
+// the constructor from whichever CJS namespace shape that graph provides.
+const buffer = bufferModule.Buffer === undefined ? bufferModule.default : bufferModule;
+export const { Buffer } = buffer;
+if (typeof Buffer !== "function") {
+  throw new Error("the browser Buffer compatibility module did not expose Buffer");
+}
+// isomorphic-git still reads Buffer from the global scope in its browser build.
+// Install it in every browser/Worker realm before a Git operation can run.
+globalThis.Buffer ??= Buffer;
+// A few CommonJS browser libraries (notably the SSH stream dependencies) use
+// Node's `global` spelling even when their implementation selects Web Crypto.
+const commonJsGlobal = globalThis;
+commonJsGlobal.global ??= globalThis;
+commonJsGlobal.process ??= { versions: {} };

package/vendor/nanocodex/tools/browser/browserCompiler.mjs

@@ -0,0 +1,155 @@
+import { defineCommand } from "../../../nanocodex-tools/tools/just-bash-browser.mjs";
+const runtimes = new WeakMap();
+export function createCompilerCommand(name, filesystem, egress) {
+    const runtime = runtimes.get(filesystem) ?? new BrowserCompilerRuntime(egress);
+    runtimes.set(filesystem, runtime);
+    return defineCommand(name, async (args, context) => {
+        const parsed = parseArguments(name, args, context);
+        if ("result" in parsed)
+            return parsed.result;
+        try {
+            const files = await collectCompilerFiles(filesystem, context.cwd, parsed.sources);
+            const result = await runtime.execute({ ...parsed, files }, context.signal);
+            if (result.exitCode === 0 && result.output) {
+                await filesystem.writeFile(parsed.output, result.output);
+            }
+            return { stdout: result.stdout, stderr: result.stderr, exitCode: result.exitCode };
+        }
+        catch (error) {
+            return fail(`${name}: ${error instanceof Error ? error.message : String(error)}\n`, context.signal?.aborted ? 124 : 1);
+        }
+    });
+}
+class BrowserCompilerRuntime {
+    #egress;
+    #worker;
+    #nextId = 1;
+    #queue = Promise.resolve();
+    constructor(egress) {
+        this.#egress = egress;
+    }
+    execute(input, signal) {
+        const run = this.#queue.then(() => this.#run(input, signal));
+        this.#queue = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    #run(input, signal) {
+        const worker = this.#worker ?? this.#createWorker();
+        const id = this.#nextId++;
+        return new Promise((resolve, reject) => {
+            const cleanup = () => {
+                worker.removeEventListener("message", onMessage);
+                worker.removeEventListener("error", onError);
+                signal?.removeEventListener("abort", onAbort);
+            };
+            const onMessage = (event) => {
+                if (event.data.id !== id)
+                    return;
+                cleanup();
+                if (event.data.result)
+                    resolve(event.data.result);
+                else
+                    reject(new Error(event.data.error ?? "compiler worker failed"));
+            };
+            const onError = (event) => {
+                cleanup();
+                this.#discard(worker);
+                reject(new Error(event.message || "compiler worker crashed"));
+            };
+            const onAbort = () => {
+                cleanup();
+                this.#discard(worker);
+                reject(signal?.reason instanceof Error ? signal.reason : new Error("compilation aborted"));
+            };
+            worker.addEventListener("message", onMessage);
+            worker.addEventListener("error", onError);
+            signal?.addEventListener("abort", onAbort, { once: true });
+            if (signal?.aborted)
+                return onAbort();
+            worker.postMessage({ type: "compile", id, input });
+        });
+    }
+    #createWorker() {
+        const worker = new Worker(new URL("./compiler.worker.mjs", import.meta.url), { type: "module" });
+        worker.postMessage({ type: "initialize", egress: this.#egress });
+        this.#worker = worker;
+        return worker;
+    }
+    #discard(worker) {
+        worker.terminate();
+        if (this.#worker === worker)
+            this.#worker = undefined;
+    }
+}
+function parseArguments(name, args, context) {
+    if (args.includes("--help")) {
+        return { result: ok(`usage: ${name} [-c] [-O0|-O1|-O2|-O3] [-o OUTPUT] SOURCE...\n`) };
+    }
+    let output = "a.wasm";
+    let outputWasSet = false;
+    let optimize = "2";
+    let compileOnly = false;
+    const sources = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "-c")
+            compileOnly = true;
+        else if (/^-O[0-3]$/.test(arg))
+            optimize = arg.slice(2);
+        else if (arg === "-o") {
+            const value = args[++index];
+            if (!value)
+                return { result: fail(`${name}: -o requires a filename\n`, 1) };
+            output = context.fs.resolvePath(context.cwd, value);
+            outputWasSet = true;
+        }
+        else if (arg.startsWith("-")) {
+            return { result: fail(`${name}: unsupported browser compiler option '${arg}'\n`, 1) };
+        }
+        else {
+            sources.push(context.fs.resolvePath(context.cwd, arg));
+        }
+    }
+    if (!sources.length)
+        return { result: fail(`${name}: no input files\n`, 1) };
+    if (compileOnly && sources.length > 1) {
+        return { result: fail(`${name}: browser compilation does not support -c with multiple source files; compile one source at a time\n`, 1) };
+    }
+    if (!output.startsWith("/"))
+        output = context.fs.resolvePath(context.cwd, output);
+    if (compileOnly && !outputWasSet)
+        output = sources[0].replace(/\.[^.]+$/, ".o");
+    return { sources, output, optimize, compileOnly };
+}
+async function collectCompilerFiles(filesystem, cwd, sources) {
+    const indexed = filesystem;
+    const paths = indexed.getAllPaths?.() ?? sources;
+    const sourceSet = new Set(sources);
+    const relevant = paths.filter((path) => sourceSet.has(path) || /\.(?:h|hh|hpp|hxx|inc)$/.test(path));
+    const files = [];
+    for (const path of relevant) {
+        if (!await filesystem.exists(path))
+            continue;
+        const stat = await filesystem.stat(path);
+        if (!stat.isFile)
+            continue;
+        const relative = relativeWorkspacePath(path, cwd);
+        files.push({ path: relative, contents: await filesystem.readFileBuffer(path) });
+    }
+    for (const source of sources) {
+        if (!files.some((file) => file.path === relativeWorkspacePath(source, cwd))) {
+            throw new Error(`input file not found: ${source}`);
+        }
+    }
+    return files;
+}
+function relativeWorkspacePath(path, cwd) {
+    const root = cwd.split("/").slice(0, 2).join("/") || "/workspace";
+    return path.startsWith(`${root}/`) ? path.slice(root.length + 1) : path.replace(/^\/+/, "");
+}
+function ok(stdout) {
+    return { stdout, stderr: "", exitCode: 0 };
+}
+function fail(stderr, exitCode) {
+    return { stdout: "", stderr, exitCode };
+}

package/vendor/nanocodex/tools/browser/browserEgress.mjs

@@ -0,0 +1,161 @@
+const THREAD_ID = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-5][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/;
+const VAULT_ID = /^[A-Za-z0-9_-]{22,64}$/;
+const VAULT_ID_HEADER = "x-nanocodex-vault-id";
+const VAULT_PLACEHOLDER = /\{\{NANOCODEX_VAULT_(?:USERNAME|PASSWORD|API_KEY|BASIC|CARD_NUMBER|EXPIRY_MONTH|EXPIRY_YEAR|CVV|BILLING_ZIP)\}\}/;
+const PRIVATE_HEADER = /(?:^|[-_])(?:auth(?:orization)?|cookie|credential|password|proxy|secret|token|api[-_]?key)(?:$|[-_])/i;
+const FORBIDDEN_HEADERS = new Set([
+  "connection", "host", "origin", "proxy-connection", "referer", "te", "trailer",
+  "transfer-encoding", "upgrade", "x-nanocodex-subject", "x-nanocodex-target-url",
+]);
+let installed;
+
+/** Installs one thread-owned external fetch route for the current browser Worker isolate. */
+export function installBrowserEgressFetch(options) {
+  const origin = new URL(options?.origin).origin;
+  if (installed) {
+    if (installed.origin !== origin || installed.threadId !== options.threadId) {
+      throw new Error("browser egress is already bound to a different thread");
+    }
+    return installed.fetch;
+  }
+  const routedFetch = createBrowserRuntimeFetch(options);
+  globalThis.fetch = routedFetch;
+  installed = Object.freeze({ fetch: routedFetch, origin, threadId: options.threadId });
+  return routedFetch;
+}
+
+/** Creates the browser harness fetch boundary without mutating the caller's global fetch. */
+export function createBrowserRuntimeFetch(options) {
+  const origin = new URL(options?.origin).origin;
+  const nativeFetch = (options.fetch ?? globalThis.fetch).bind(globalThis);
+  const externalFetch = standardFetchFromEgress(createBrowserEgressFetch({
+    fetch: nativeFetch,
+    headers: options.headers,
+    origin,
+    threadId: options.threadId,
+  }));
+  return async (input, init) => {
+    const request = input instanceof Request
+      ? new Request(input, init)
+      : new Request(new URL(String(input), origin), init);
+    return new URL(request.url).origin === origin
+      ? nativeFetch(request)
+      : externalFetch(request);
+  };
+}
+
+/** Creates the only workload-network capability installed in browser-side runtimes. */
+export function createBrowserEgressFetch(options) {
+  if (typeof options?.fetch !== "function") {
+    throw new TypeError("browser egress requires a fetch implementation");
+  }
+  if (typeof options.origin !== "string" || !options.origin) {
+    throw new TypeError("browser egress requires the application origin");
+  }
+  if (!THREAD_ID.test(options.threadId)) {
+    throw new TypeError("browser egress requires a valid thread id");
+  }
+  const endpoint = new URL("/v1/egress", options.origin);
+  const responseFetch = async (target, request = {}) => {
+    const url = new URL(target);
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) {
+      throw new Error("browser egress supports only credential-free http:// and https:// URLs");
+    }
+    const headers = new Headers(request.headers);
+    const vaultId = headers.get(VAULT_ID_HEADER);
+    if (vaultId !== null && !VAULT_ID.test(vaultId)) {
+      throw new Error("browser egress requires a valid Vault item id");
+    }
+    for (const [name, value] of headers) {
+      const lower = name.toLowerCase();
+      const privateVaultPlaceholder = vaultId !== null
+        && PRIVATE_HEADER.test(name)
+        && safeVaultHeaderValue(lower, value);
+      if ((!privateVaultPlaceholder && PRIVATE_HEADER.test(name)) || FORBIDDEN_HEADERS.has(lower)
+        || lower.startsWith("cf-") || lower.startsWith("forwarded")
+        || lower.startsWith("sec-") || lower.startsWith("x-forwarded-")) {
+        throw new Error(`browser egress does not accept credential or routing header '${name}'`);
+      }
+    }
+    const templateBody = request.body instanceof Uint8Array ? new TextDecoder().decode(request.body) : request.body;
+    if (vaultId !== null && ![...headers.values()].some((value) => VAULT_PLACEHOLDER.test(value))
+      && (typeof templateBody !== "string" || !VAULT_PLACEHOLDER.test(templateBody))) {
+      throw new Error("browser egress Vault requests require a supported placeholder");
+    }
+    try {
+      const gatewayHeaders = new Headers(options.headers);
+      gatewayHeaders.set("content-type", "application/json");
+      const response = await options.fetch(endpoint, {
+        method: "POST",
+        headers: gatewayHeaders,
+        body: JSON.stringify({
+          thread_id: options.threadId,
+          url: url.href,
+          method: request.method ?? "GET",
+          headers: Object.fromEntries(headers.entries()),
+          ...encodeRequestBody(vaultId === null ? request.body : templateBody),
+        }),
+        credentials: "same-origin",
+        redirect: "manual",
+        signal: request.signal,
+      });
+      return response;
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      throw new Error(`browser egress failed (${detail})`);
+    }
+  };
+  return Object.assign(async (target, request = {}) => {
+    const response = await responseFetch(target, request);
+    return {
+      status: response.status,
+      statusText: response.statusText,
+      headers: Object.fromEntries(response.headers.entries()),
+      body: new Uint8Array(await response.arrayBuffer()),
+      url: new URL(target).href,
+    };
+  }, { response: responseFetch });
+}
+
+function encodeRequestBody(body) {
+  if (body === undefined) return {};
+  if (typeof body === "string") return { body };
+  if (!(body instanceof Uint8Array)) throw new TypeError("browser egress body must be text or bytes");
+  let encoded = "";
+  for (let offset = 0; offset < body.length; offset += 32_768) {
+    encoded += String.fromCharCode(...body.subarray(offset, offset + 32_768));
+  }
+  return { body_base64: btoa(encoded) };
+}
+
+function safeVaultHeaderValue(name, value) {
+  if (name === "cookie" || name === "proxy-authorization") return false;
+  if (name === "authorization") {
+    return value === "Basic {{NANOCODEX_VAULT_BASIC}}"
+      || value === "Bearer {{NANOCODEX_VAULT_API_KEY}}"
+      || value === "Bearer {{NANOCODEX_VAULT_PASSWORD}}";
+  }
+  return /^\{\{NANOCODEX_VAULT_(?:PASSWORD|API_KEY|BASIC|CARD_NUMBER|EXPIRY_MONTH|EXPIRY_YEAR|CVV|BILLING_ZIP)\}\}$/.test(value);
+}
+
+/** Adapts the shell result to the standard Fetch API used inside browser Workers. */
+export function standardFetchFromEgress(secureFetch) {
+  return async (input, init = {}) => {
+    const request = new Request(input, init);
+    const method = request.method.toUpperCase();
+    const send = secureFetch.response ?? secureFetch;
+    const textBody = /^(?:text\/|application\/(?:[a-z.+-]*json|x-www-form-urlencoded)(?:;|$))/.test(request.headers.get("content-type") ?? "");
+    const result = await send(request.url, {
+      method,
+      headers: request.headers,
+      ...(method === "GET" || method === "HEAD" ? {} : { body: textBody ? await request.text() : new Uint8Array(await request.arrayBuffer()) }),
+      signal: request.signal,
+    });
+    if (result instanceof Response) return result;
+    return new Response(result.body, {
+      status: result.status,
+      statusText: result.statusText,
+      headers: result.headers,
+    });
+  };
+}

package/vendor/nanocodex/tools/browser/browserPython.mjs

@@ -0,0 +1,133 @@
+import { defineCommand } from "../../../nanocodex-tools/tools/just-bash-browser.mjs";
+export class BrowserPythonRuntime {
+    #workspaceRoot;
+    #egress;
+    #worker;
+    #nextId = 1;
+    #queue = Promise.resolve();
+    constructor(workspaceRoot, egress) {
+        this.#workspaceRoot = workspaceRoot;
+        this.#egress = egress;
+    }
+    execute(input, signal) {
+        const run = this.#queue.then(() => this.#run(input, signal));
+        this.#queue = run.then(() => undefined, () => undefined);
+        return run;
+    }
+    async #run(input, signal) {
+        const worker = this.#worker ?? this.#createWorker();
+        const id = this.#nextId++;
+        return new Promise((resolve, reject) => {
+            const cleanup = () => {
+                worker.removeEventListener("message", onMessage);
+                worker.removeEventListener("error", onError);
+                signal?.removeEventListener("abort", onAbort);
+            };
+            const onMessage = (event) => {
+                if (event.data.id !== id)
+                    return;
+                cleanup();
+                // NativeFS can push changes back to OPFS but cannot refresh an existing
+                // mount after bash edits. A process-like fresh worker per invocation
+                // guarantees each Python command begins from the latest workspace.
+                this.#discardWorker(worker);
+                if (event.data.result)
+                    resolve(event.data.result);
+                else
+                    reject(new Error(event.data.error ?? "Python worker failed"));
+            };
+            const onError = (event) => {
+                cleanup();
+                this.#discardWorker(worker);
+                reject(new Error(event.message || "Python worker crashed"));
+            };
+            const onAbort = () => {
+                cleanup();
+                this.#discardWorker(worker);
+                reject(signal?.reason instanceof Error ? signal.reason : new Error("Python execution aborted"));
+            };
+            worker.addEventListener("message", onMessage);
+            worker.addEventListener("error", onError);
+            signal?.addEventListener("abort", onAbort, { once: true });
+            if (signal?.aborted)
+                return onAbort();
+            worker.postMessage({ type: "execute", id, input });
+        });
+    }
+    #createWorker() {
+        const worker = new Worker(new URL("./python.worker.mjs", import.meta.url), { type: "module" });
+        worker.postMessage({
+            type: "initialize",
+            workspaceRoot: this.#workspaceRoot,
+            egress: this.#egress,
+        });
+        this.#worker = worker;
+        return worker;
+    }
+    #discardWorker(worker) {
+        worker.terminate();
+        if (this.#worker === worker)
+            this.#worker = undefined;
+    }
+}
+export function createPythonCommand(name, runtime, filesystem) {
+    const execute = async (args, context) => {
+        const parsed = parsePythonArguments(name, args, String(context.stdin));
+        if ("result" in parsed)
+            return parsed.result;
+        if (!runtime) {
+            return {
+                stdout: "",
+                stderr: `${name}: browser Python is unavailable without an OPFS workspace\n`,
+                exitCode: 1,
+            };
+        }
+        try {
+            const result = await runtime.execute({
+                ...parsed,
+                cwd: context.cwd,
+                stdin: String(context.stdin),
+            }, context.signal);
+            await filesystem.refreshPaths?.();
+            filesystem.recordRepositoryMutation?.();
+            return result;
+        }
+        catch (error) {
+            return {
+                stdout: "",
+                stderr: `${name}: ${error instanceof Error ? error.message : String(error)}\n`,
+                exitCode: context.signal?.aborted ? 124 : 1,
+            };
+        }
+    };
+    return defineCommand(name, execute);
+}
+export function parsePythonArguments(name, args, stdin) {
+    if (args[0] === "--help" || args[0] === "-h") {
+        return { result: { stdout: `usage: ${name} [-c code | -m module | script | -] [args...]\n`, stderr: "", exitCode: 0 } };
+    }
+    if (args[0] === "--version" || args[0] === "-V") {
+        return { result: { stdout: "Python 3 (Pyodide)\n", stderr: "", exitCode: 0 } };
+    }
+    if (args[0] === "-c") {
+        if (args[1] === undefined)
+            return pythonArgumentError(name, "argument expected for -c");
+        return { source: args[1], moduleName: null, filename: "<string>", argv: ["-c", ...args.slice(2)] };
+    }
+    if (args[0] === "-m") {
+        if (args[1] === undefined)
+            return pythonArgumentError(name, "argument expected for -m");
+        return { source: null, moduleName: args[1], filename: args[1], argv: [args[1], ...args.slice(2)] };
+    }
+    if (!args.length || args[0] === "-") {
+        if (!stdin)
+            return pythonArgumentError(name, "no input provided (use -c, -m, a script, or stdin)");
+        return { source: stdin, moduleName: null, filename: "<stdin>", argv: ["-", ...args.slice(1)] };
+    }
+    if (args[0].startsWith("-"))
+        return pythonArgumentError(name, `unrecognized option '${args[0]}'`);
+    return { source: null, moduleName: null, filename: args[0], argv: [args[0], ...args.slice(1)] };
+}
+function pythonArgumentError(name, message) {
+    return { result: { stdout: "", stderr: `${name}: ${message}\n`, exitCode: 2 } };
+}