@openclaw/openshell-sandbox 2026.9.5 → 2026.9.6

package/node_modules/zod/src/v4/core/tests/polyfill-collision.test.ts

@@ -0,0 +1,46 @@
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { build, transform } from "esbuild";
+import { expect, test } from "vitest";
+import * as core from "zod/v4/core";
+
+// Browser polyfills for node globals land as raw text in the bundle's top scope — an esbuild `banner`, a scope-unaware injector — so the bundler never sees the collision and the browser is the first thing to read both declarations. zod must therefore declare none of these names at module scope. The JSON Schema pass shipped an `export function process` for three minors before #6397 reported the white screen it caused.
+const INJECTED = ["process", "Buffer", "global", "__dirname", "__filename"];
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const CLASSIC = path.resolve(here, "../../../index.ts");
+const MINI = path.resolve(here, "../../../mini/index.ts");
+
+const polyfills = INJECTED.map((name) => `const ${name} = {};`).join("\n");
+
+// toJSONSchema has to be reachable: a bundle that only parses a schema tree-shakes the offending module away and would pass no matter what it declares. `z.core.process` is the pre-rename export name, read as a namespace property so the entry itself declares no `process` binding.
+const ENTRY = `import * as z from "%ENTRY%";\nglobalThis.__out = [z.toJSONSchema(z.string()), z.core.process];`;
+
+test.each([
+  ["classic", CLASSIC],
+  ["mini", MINI],
+])(
+  "a %s bundle reaching toJSONSchema parses beside polyfilled node globals",
+  async (_flavor, entrypoint) => {
+    const result = await build({
+      stdin: { contents: ENTRY.replace("%ENTRY%", entrypoint), loader: "ts", resolveDir: here },
+      bundle: true,
+      format: "esm",
+      target: "es2020",
+      write: false,
+      logLevel: "silent",
+      banner: { js: polyfills },
+    });
+    const out = result.outputFiles[0]!.text;
+
+    expect(out).toContain("https://json-schema.org/draft/2020-12/schema");
+
+    // the banner is appended after esbuild has already renamed its own symbols, so this second pass is where a duplicate surfaces: `The symbol "process" has already been declared`
+    await expect(transform(out, { loader: "js", format: "esm" })).resolves.toBeTruthy();
+  },
+  30000
+);
+
+test("the pre-rename `process` export still resolves to the helper", () => {
+  expect(core.process).toBe(core.processSchema);
+});

package/node_modules/zod/src/v4/core/tests/url-no-canparse.test.ts

@@ -1,31 +1,133 @@
 import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
 
-// schemas.ts resolves URL.canParse on first use, not at module load. Resetting the module registry gives the re-imported copy a fresh, unresolved `urlCanParseImpl`, so deleting URL.canParse before the first parse still selects the inline fallback branch (URL.canParse may be undefined on older runtimes).
-describe("z.url() with URL.canParse absent", () => {
-  const original = URL.canParse;
+const URLDescriptor = Object.getOwnPropertyDescriptor(globalThis, "URL")!;
+const NativeURL = globalThis.URL;
+const canParseDescriptor = Object.getOwnPropertyDescriptor(NativeURL, "canParse")!;
+const parseDescriptor = Object.getOwnPropertyDescriptor(NativeURL, "parse")!;
 
+function restoreURL() {
+  Object.defineProperty(globalThis, "URL", URLDescriptor);
+  Object.defineProperty(NativeURL, "canParse", canParseDescriptor);
+  Object.defineProperty(NativeURL, "parse", parseDescriptor);
+}
+
+describe("URL parser fallbacks", () => {
   beforeEach(() => {
+    restoreURL();
     vi.resetModules();
-    // @ts-expect-error force the fallback branch (URL.canParse may be undefined on older runtimes)
-    delete URL.canParse;
   });
 
-  afterEach(() => {
-    URL.canParse = original;
+  afterEach(restoreURL);
+
+  test("uses the boolean and object APIs on modern runtimes", async () => {
+    const canParse = vi.spyOn(NativeURL, "canParse");
+    const URLStatic = NativeURL as typeof URL & { parse: (input: string) => URL | null };
+    const parse = vi.spyOn(URLStatic, "parse");
+    const z = await import("../../index.js");
+
+    expect(z.validate(z.url(), "https://example.com")).toBe(true);
+    expect(canParse).toHaveBeenCalledOnce();
+    expect(parse).not.toHaveBeenCalled();
+
+    canParse.mockClear();
+    expect(z.validate(z.url({ normalize: true }), "https://example.com")).toBe(true);
+    expect(parse).toHaveBeenCalledOnce();
+    expect(canParse).not.toHaveBeenCalled();
+
+    parse.mockClear();
+    expect(z.validate(z.ipv6(), "2001:db8::1")).toBe(true);
+    expect(canParse).toHaveBeenCalledOnce();
+    expect(parse).not.toHaveBeenCalled();
   });
 
-  test("z.url() validates correctly without URL.canParse (runtime)", async () => {
-    expect(URL.canParse).toBeUndefined();
+  test("URL fast-path selection preserves live option getter reads", async () => {
     const z = await import("../../index.js");
-    expect(z.url().safeParse("https://example.com").success).toBe(true);
-    expect(z.url().safeParse("not a url").success).toBe(false);
+    const postProcessor = z.core.globalConfig.postProcessor;
+    z.core.globalConfig.postProcessor = undefined;
+    try {
+      for (const inherited of [false, true]) {
+        const schema = z.url();
+        const target = inherited ? Object.create(Object.getPrototypeOf(schema.def)) : schema.def;
+        let reads = 0;
+        Object.defineProperty(target, "hostname", {
+          get: () => (++reads === 1 ? /^example\.com$/ : undefined),
+        });
+        if (inherited) Object.setPrototypeOf(schema.def, target);
+        expect(z.validate(schema, "https://example.com")).toBe(false);
+        expect(reads).toBe(2);
+        reads = 0;
+        expect(schema.safeParse("https://example.com").success).toBe(false);
+        expect(reads).toBe(2);
+      }
+    } finally {
+      z.core.globalConfig.postProcessor = postProcessor;
+    }
+  });
+
+  test("the exported object parser still returns a URL", async () => {
+    const { parseURLObject } = await import("../schemas.js");
+    const result = parseURLObject("https://example.com", {});
+    expect(result).toBeInstanceOf(NativeURL);
+    if (typeof result === "number") expect.unreachable();
+    expect(result.hostname).toBe("example.com");
+    expect(parseURLObject("invalid", {})).toBe(2);
   });
 
-  test("z.url() validates correctly without URL.canParse (compiled)", async () => {
-    expect(URL.canParse).toBeUndefined();
+  test("falls back when URL.canParse is absent", async () => {
+    Reflect.deleteProperty(NativeURL, "canParse");
     const z = await import("../../index.js");
-    const compiled = z.compile(z.url());
-    expect(compiled.safeParse("https://example.com").success).toBe(true);
-    expect(compiled.safeParse("not a url").success).toBe(false);
+    const cases = [
+      [z.url(), "https://example.com", "not a url"],
+      [z.ipv6(), "2001:db8::1", "not-an-ip"],
+      [z.cidrv6(), "2001:db8::/32", "not-an-ip/32"],
+    ] as const;
+
+    for (const [schema, valid, invalid] of cases) {
+      for (const subject of [schema, z.compile(schema)]) {
+        expect(z.validate(subject, valid)).toBe(true);
+        expect(z.validate(subject, invalid)).toBe(false);
+        expect(subject.safeParse(valid).success).toBe(true);
+        expect(subject.safeParse(invalid).success).toBe(false);
+      }
+    }
+  });
+
+  test("falls back when URL.parse is absent", async () => {
+    Reflect.deleteProperty(NativeURL, "parse");
+    const z = await import("../../index.js");
+    const cases = [
+      [z.url({ normalize: true }), "https://example.com", "not a url"],
+      [z.url({ hostname: /^example\.com$/ }), "https://example.com", "https://other.com"],
+      [z.httpUrl(), "https://example.com", "mailto:a@example.com"],
+    ] as const;
+
+    for (const [schema, valid, invalid] of cases) {
+      for (const subject of [schema, z.compile(schema)]) {
+        expect(z.validate(subject, valid)).toBe(true);
+        expect(z.validate(subject, invalid)).toBe(false);
+        expect(subject.safeParse(valid).success).toBe(true);
+        expect(subject.safeParse(invalid).success).toBe(false);
+      }
+    }
+  });
+
+  test("rejects without a global URL constructor", async () => {
+    const z = await import("../../index.js");
+    const cases = [
+      [z.url(), "https://example.com"],
+      [z.url({ normalize: true }), "https://example.com"],
+      [z.ipv6(), "2001:db8::1"],
+      [z.cidrv6(), "2001:db8::/32"],
+    ] as const;
+    const subjects = cases.flatMap(([schema, input]) => [
+      [schema, input] as const,
+      [z.compile(schema), input] as const,
+    ]);
+    Object.defineProperty(globalThis, "URL", { configurable: true, value: undefined });
+
+    for (const [schema, input] of subjects) {
+      expect(z.validate(schema, input)).toBe(false);
+      expect(schema.safeParse(input).success).toBe(false);
+    }
   });
 });

package/node_modules/zod/src/v4/core/to-json-schema.ts

@@ -128,7 +128,7 @@ export interface ToJSONSchemaContext {
    * covers both passes in `finalize`: the ref flattening and the `$defs` build.
    *
    * The passes are valid only while nothing they read has changed, so both are cleared in
-   * `process()` when the map grows, and in `JSONSchemaGenerator.emit()`, which can also change
+   * `processSchema()` when the map grows, and in `JSONSchemaGenerator.emit()`, which can also change
    * the `cycles` and `reused` they branch on.
    *
    * One case is deliberately not covered: an `override` callback that writes to
@@ -209,7 +209,8 @@ export function handleUnrepresentable(
   return true;
 }
 
-export function process<T extends schemas.$ZodType>(
+// never rename this back to `process`: bundler polyfills inject a top-level `const process` that a lexical declaration of the same name collides with (#6397)
+export function processSchema<T extends schemas.$ZodType>(
   schema: T,
   ctx: ToJSONSchemaContext,
   _params: ProcessParams = { path: [], schemaPath: [] }
@@ -264,7 +265,7 @@ export function process<T extends schemas.$ZodType>(
     if (parent) {
       // Also set ref if processor didn't (for inheritance)
       if (!result.ref) result.ref = parent;
-      process(parent, ctx, params);
+      processSchema(parent, ctx, params);
       ctx.seen.get(parent)!.isParent = true;
     }
   }
@@ -289,6 +290,9 @@ export function process<T extends schemas.$ZodType>(
   return _result.schema;
 }
 
+/** @deprecated Renamed to `processSchema`. An export alias declares no binding, so it is safe to keep. */
+export { processSchema as process };
+
 // Escape a reference token for use in a JSON Pointer fragment (RFC 6901): `~` becomes `~0` and `/` becomes `~1`. The `~` replacement must run first.
 function encodeJSONPointerSegment(segment: string): string {
   return segment.replace(/~/g, "~0").replace(/\//g, "~1");
@@ -429,8 +433,6 @@ export function extractDefs<T extends schemas.$ZodType>(
     if (seen.count > 1) {
       if (ctx.reused === "ref") {
         extractToDef(entry);
-        // biome-ignore lint:
-        continue;
       }
     }
   }
@@ -834,7 +836,7 @@ export const createToJSONSchemaMethod =
   <T extends schemas.$ZodType>(schema: T, processors: Record<string, Processor> = {}) =>
   (params?: ToJSONSchemaParams): ZodStandardJSONSchemaPayload<T> => {
     const ctx = initializeContext({ ...params, processors });
-    process(schema, ctx);
+    processSchema(schema, ctx);
     extractDefs(ctx, schema);
     return finalize(ctx, schema);
   };
@@ -849,7 +851,7 @@ export const createStandardJSONSchemaMethod =
   (params?: StandardJSONSchemaMethodParams): JSONSchema.BaseSchema => {
     const { libraryOptions, target } = params ?? {};
     const ctx = initializeContext({ ...(libraryOptions ?? {}), target, io, processors });
-    process(schema, ctx);
+    processSchema(schema, ctx);
     extractDefs(ctx, schema);
     return finalize(ctx, schema);
   };