@nuxt/devtools-nightly 4.0.0-beta.3-29854425.7b9e10f → 4.0.0-beta.3-29854535.ff0512e

package/dist/chunks/module-main.mjs

@@ -3,13 +3,13 @@ import { onDevtoolsReady, deprecate, registerHostDiagnostics, NUXT_DEVTOOLS_GROU
 import { logger, useNuxt, addPlugin, addVitePlugin, addTemplate, extendViteConfig, addImports } from '@nuxt/kit';
 import { colors } from 'consola/utils';
 import { serveStaticNodeMiddleware } from 'devframe/utils/serve-static';
-import { join, dirname, resolve } from 'pathe';
+import { join, dirname, resolve, extname } from 'pathe';
 import { isLess, isGreaterOrEqual } from 'verkit';
 import { version as version$1, searchForWorkspaceRoot } from 'vite';
 import { d as defaultAllowedExtensions, c as createDefaultTabOptions, s as setServerTasksEnabledByDefault } from '../shared/devtools-nightly.C3s9ubDZ.mjs';
 import { runtimeDir, packageDir } from '../dirs.mjs';
 import { execFile } from 'node:child_process';
-import fs, { readFileSync, existsSync, promises, accessSync, constants } from 'node:fs';
+import fs, { existsSync, readFileSync, promises, accessSync, constants } from 'node:fs';
 import fsp from 'node:fs/promises';
 import { promisify } from 'node:util';
 import { glob } from 'tinyglobby';
@@ -31,9 +31,9 @@ import { createRequire } from 'node:module';
 import { DEVTOOLS_TERMINALS_DOCK_ID } from '@vitejs/devtools-kit/constants';
 import { normalizeBaseKey, normalizeKey, createStorage, builtinDrivers } from 'unstorage';
 
-const version = "4.0.0-beta.3-29854425.7b9e10f";
+const version = "4.0.0-beta.3-29854535.ff0512e";
 const peerDependencies = {
-	"@nuxt/devtools-assets": "npm:@nuxt/devtools-assets-nightly@4.0.0-beta.3-29854425.7b9e10f",
+	"@nuxt/devtools-assets": "npm:@nuxt/devtools-assets-nightly@4.0.0-beta.3-29854535.ff0512e",
 	"@nuxt/kit": "^4.0.0-0 || ^5.0.0-0",
 	nitro: "*",
 	nitropack: "^2.0.0",
@@ -212,12 +212,21 @@ function setupAnalyzeBuildRPC(ctx) {
   };
 }
 
+const MAX_TEXT_PREVIEW = 1e4;
 function setupAssetsRPC({ nuxt, refresh, options }) {
   const _imageMetaCache = /* @__PURE__ */ new Map();
   let cache = null;
   const extensions = options.assets?.uploadExtensions || defaultAllowedExtensions;
   const publicDir = resolve(nuxt.options.srcDir, nuxt.options.dir.public);
   const layerDirs = [publicDir, ...nuxt.options._layers.map((layer) => resolve(layer.cwd, "public"))];
+  async function assertInsideAssets(path, action) {
+    const resolved = resolve(path);
+    const real = await realpathOfNearestAncestor(resolved);
+    const realLayerDirs = await Promise.all(layerDirs.filter((dir) => existsSync(dir)).map((dir) => fsp.realpath(dir)));
+    if (!realLayerDirs.some((dir) => real === dir || real.startsWith(`${dir}/`)))
+      throw new Error(`[Nuxt DevTools] File ${path} is not allowed to ${action}, it's outside of the public directory`);
+    return resolved;
+  }
   const refreshDebounced = debounce(() => {
     cache = null;
     refresh("getStaticAssets");
@@ -269,6 +278,7 @@ function setupAssetsRPC({ nuxt, refresh, options }) {
       return await scan();
     },
     async getImageMeta(filepath) {
+      filepath = await assertInsideAssets(filepath, "read");
       if (_imageMetaCache.has(filepath))
         return _imageMetaCache.get(filepath);
       try {
@@ -282,9 +292,10 @@ function setupAssetsRPC({ nuxt, refresh, options }) {
       }
     },
     async getTextAssetContent(filepath, limit = 300) {
+      filepath = await assertInsideAssets(filepath, "read");
       try {
         const content = await fsp.readFile(filepath, "utf-8");
-        return content.slice(0, limit);
+        return content.slice(0, Math.min(limit, MAX_TEXT_PREVIEW));
       } catch (e) {
         console.error(e);
         return void 0;
@@ -312,17 +323,8 @@ You can configure it in Nuxt config at \`devtools.assets.uploadExtensions\`.`);
           const targetStat = await fsp.lstat(finalPath).catch(() => void 0);
           if (targetStat?.isSymbolicLink())
             throw new Error(`[Nuxt DevTools] File ${path} is not allowed to upload, it's a symbolic link`);
-          if (!override) {
-            try {
-              await fsp.stat(finalPath);
-              const base = finalPath.slice(0, finalPath.length - ext.length - 1);
-              let i = 1;
-              while (await fsp.access(`${base}-${i}.${ext}`).then(() => true).catch(() => false))
-                i++;
-              finalPath = `${base}-${i}.${ext}`;
-            } catch {
-            }
-          }
+          if (!override)
+            finalPath = await collisionFreePath(finalPath);
           await fsp.writeFile(finalPath, content, {
             encoding: encoding ?? "utf-8"
           });
@@ -331,9 +333,11 @@ You can configure it in Nuxt config at \`devtools.assets.uploadExtensions\`.`);
       );
     },
     async deleteStaticAsset(path) {
-      return await fsp.unlink(path);
+      return await fsp.unlink(await assertInsideAssets(path, "delete"));
     },
     async renameStaticAsset(oldPath, newPath) {
+      oldPath = await assertInsideAssets(oldPath, "rename");
+      newPath = await assertInsideAssets(newPath, "rename to");
       const exist = cache?.find((asset) => asset.filePath === newPath);
       if (exist)
         throw new Error(`[Nuxt DevTools] File ${newPath} already exists, failed to rename`);
@@ -341,6 +345,16 @@ You can configure it in Nuxt config at \`devtools.assets.uploadExtensions\`.`);
     }
   };
 }
+async function collisionFreePath(path, exists = (p) => fsp.access(p).then(() => true, () => false)) {
+  if (!await exists(path))
+    return path;
+  const ext = extname(path);
+  const stem = path.slice(0, path.length - ext.length);
+  let i = 1;
+  while (await exists(`${stem}-${i}${ext}`))
+    i++;
+  return `${stem}-${i}${ext}`;
+}
 async function realpathOfNearestAncestor(dir) {
   try {
     return await fsp.realpath(dir);
@@ -1889,7 +1903,8 @@ const AGENTS = [
   "bun",
   "deno",
   "nub",
-  "aube"
+  "aube",
+  "upm"
 ];
 const LOCKS = {
   "aube-lock.yaml": "aube",
@@ -1898,6 +1913,7 @@ const LOCKS = {
   "bun.lockb": "bun",
   "deno.lock": "deno",
   "nub.lock": "nub",
+  "upm.lock": "upm",
   "pnpm-lock.yaml": "pnpm",
   "pnpm-workspace.yaml": "pnpm",
   "yarn.lock": "yarn",
@@ -1908,6 +1924,7 @@ const INSTALL_METADATA = {
   "node_modules/.aube/": "aube",
   "node_modules/.deno/": "deno",
   "node_modules/.pnpm/": "pnpm",
+  "node_modules/.upm/": "upm",
   "node_modules/.yarn-state.yml": "yarn",
   // yarn v2+ (node-modules)
   "node_modules/.yarn_integrity": "yarn",
@@ -1998,16 +2015,18 @@ async function detect(options = {}) {
   }
   return null;
 }
+function normalizeAgentVersion(version) {
+  return version?.match(/\d+(\.\d+){0,2}/)?.[0] ?? version;
+}
 function getNameAndVer(pkg) {
-  const handelVer = (version) => version?.match(/\d+(\.\d+){0,2}/)?.[0] ?? version;
   if (typeof pkg.packageManager === "string") {
     const [name, ver] = pkg.packageManager.replace(/^\^/, "").split("@");
-    return { name, ver: handelVer(ver) };
+    return { name, ver: normalizeAgentVersion(ver) };
   }
   if (typeof pkg.devEngines?.packageManager?.name === "string") {
     return {
       name: pkg.devEngines.packageManager.name,
-      ver: handelVer(pkg.devEngines.packageManager.version)
+      ver: normalizeAgentVersion(pkg.devEngines.packageManager.version)
     };
   }
   return void 0;
@@ -2016,30 +2035,29 @@ async function handlePackageManager(filepath, options) {
   try {
     const content = await fsp.readFile(filepath, "utf8");
     const pkg = options.packageJsonParser ? await options.packageJsonParser(content, filepath) : JSON.parse(content);
-    let agent;
     const nameAndVer = getNameAndVer(pkg);
     if (nameAndVer) {
-      const name = nameAndVer.name;
-      const ver = nameAndVer.ver;
-      let version = ver;
-      if (name === "yarn" && ver && Number.parseInt(ver) > 1) {
-        agent = "yarn@berry";
-        version = "berry";
-        return { name, agent, version };
-      } else if (name === "pnpm" && ver && Number.parseInt(ver) < 7) {
-        agent = "pnpm@6";
-        return { name, agent, version };
-      } else if (AGENTS.includes(name)) {
-        agent = name;
-        return { name, agent, version };
-      } else {
-        return options.onUnknown?.(pkg.packageManager) ?? null;
-      }
+      return resolveAgent(nameAndVer.name, nameAndVer.ver) ?? options.onUnknown?.(pkg.packageManager) ?? null;
     }
   } catch {
   }
   return null;
 }
+function resolveAgent(name, ver) {
+  let agent;
+  let version = ver;
+  if (name === "yarn" && ver && Number.parseInt(ver) > 1) {
+    agent = "yarn@berry";
+    version = "berry";
+    return { name, agent, version };
+  } else if (name === "pnpm" && ver && Number.parseInt(ver) < 7) {
+    agent = "pnpm@6";
+    return { name, agent, version };
+  } else if (AGENTS.includes(name)) {
+    agent = name;
+    return { name, agent, version };
+  }
+}
 function isMetadataYarnClassic(metadataPath) {
   return metadataPath.endsWith(".yarn_integrity");
 }
@@ -3114,7 +3132,7 @@ async function watchStorageMount(storage, mountName, onChange) {
 
 const IGNORE_STORAGE_MOUNTS = ["root", "build", "src", "cache"];
 function shouldIgnoreStorageKey(key) {
-  return IGNORE_STORAGE_MOUNTS.includes(key.split(":")[0]);
+  return IGNORE_STORAGE_MOUNTS.includes(normalizeKey(key).split(":")[0]);
 }
 function setupStorageRPC(ctx) {
   const { nuxt } = ctx;
@@ -3178,17 +3196,17 @@ function setupStorageRPC(ctx) {
       }
     },
     async getStorageItem(key) {
-      if (!storage)
+      if (!storage || shouldIgnoreStorageKey(key))
         return null;
       return await storage.getItem(key);
     },
     async setStorageItem(key, value) {
-      if (!storage)
+      if (!storage || shouldIgnoreStorageKey(key))
         return;
       return await storage.setItem(key, value);
     },
     async removeStorageItem(key) {
-      if (!storage)
+      if (!storage || shouldIgnoreStorageKey(key))
         return;
       return await storage.removeItem(key);
     }

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@nuxt/devtools",
   "configKey": "devtools",
-  "version": "4.0.0-beta.3-29854425.7b9e10f",
+  "version": "4.0.0-beta.3-29854535.ff0512e",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nuxt/devtools-nightly",
   "type": "module",
-  "version": "4.0.0-beta.3-29854425.7b9e10f",
+  "version": "4.0.0-beta.3-29854535.ff0512e",
   "description": "The Nuxt DevTools gives you insights and transparency about your Nuxt App.",
   "license": "MIT",
   "homepage": "https://devtools.nuxt.com",
@@ -21,7 +21,7 @@
     "dist"
   ],
   "peerDependencies": {
-    "@nuxt/devtools-assets": "npm:@nuxt/devtools-assets-nightly@4.0.0-beta.3-29854425.7b9e10f",
+    "@nuxt/devtools-assets": "npm:@nuxt/devtools-assets-nightly@4.0.0-beta.3-29854535.ff0512e",
     "@nuxt/kit": "^4.0.0-0 || ^5.0.0-0",
     "nitro": "*",
     "nitropack": "^2.0.0",
@@ -46,7 +46,7 @@
     "@devframes/hub": "^1.2.0",
     "@devframes/plugin-code-server": "^1.2.0",
     "@devframes/plugin-data-inspector": "^1.2.0",
-    "@nuxt/devtools-kit": "npm:@nuxt/devtools-kit-nightly@4.0.0-beta.3-29854425.7b9e10f",
+    "@nuxt/devtools-kit": "npm:@nuxt/devtools-kit-nightly@4.0.0-beta.3-29854535.ff0512e",
     "@vitejs/devtools": "^0.7.6",
     "@vitejs/devtools-kit": "^0.7.6",
     "consola": "^3.4.2",
@@ -80,7 +80,7 @@
     "@iconify-json/ri": "^1.2.10",
     "@iconify-json/simple-icons": "^1.2.98",
     "@iconify-json/tabler": "^1.2.41",
-    "@nuxt/devtools-assets": "npm:@nuxt/devtools-assets-nightly@4.0.0-beta.3-29854425.7b9e10f",
+    "@nuxt/devtools-assets": "npm:@nuxt/devtools-assets-nightly@4.0.0-beta.3-29854535.ff0512e",
     "@nuxt/kit": "npm:@nuxt/kit-nightly@5.0.0-2610052343-36eafab",
     "@nuxt/schema": "npm:@nuxt/schema-nightly@5.0.0-2610052343-36eafab",
     "@parcel/watcher": "^2.6.0",