@scelar/nodepod 1.0.7 → 1.0.9

package/src/sdk/nodepod.ts

@@ -18,6 +18,7 @@ import { NodepodFS } from "./nodepod-fs";
 import { NodepodProcess } from "./nodepod-process";
 import { NodepodTerminal } from "./nodepod-terminal";
 import { ProcessManager } from "../threading/process-manager";
+import { setAllowedDomains } from "../cross-origin";
 import type { ProcessHandle } from "../threading/process-handle";
 import { VFSBridge } from "../threading/vfs-bridge";
 import {
@@ -171,6 +172,13 @@ export class Nodepod {
       onServerReady: opts.onServerReady,
     });
 
+    // set up fetch domain whitelist (null = allow everything)
+    if (opts.allowedFetchDomains === null) {
+      setAllowedDomains(null);
+    } else {
+      setAllowedDomains(opts.allowedFetchDomains ?? []);
+    }
+
     const nodepod = new Nodepod(volume, packages, proxy, cwd, handler);
 
     if (opts.files) {

package/src/sdk/types.ts

@@ -15,6 +15,9 @@ export interface NodepodOptions {
   memory?: MemoryHandlerOptions;
   /** Cache installed node_modules in IndexedDB for faster re-boots. Default: true. */
   enableSnapshotCache?: boolean;
+  /** domains allowed through the cors proxy. merged with built-in defaults
+   *  (npm, github, esm.sh etc). pass null to allow everything */
+  allowedFetchDomains?: string[] | null;
 }
 
 /* ---- Terminal ---- */

package/src/shell/shell-builtins.ts

@@ -1,19 +1,19 @@
-// Assembles all builtin commands from category modules into one map.
-
-import type { BuiltinFn } from "./shell-types";
-import { fileOpsCommands } from "./commands/file-ops";
-import { directoryCommands } from "./commands/directory";
-import { textProcessingCommands } from "./commands/text-processing";
-import { searchCommands } from "./commands/search";
-import { shellEnvCommands, setBuiltinsRef } from "./commands/shell-env";
-
-export const builtins = new Map<string, BuiltinFn>([
-  ...fileOpsCommands,
-  ...directoryCommands,
-  ...textProcessingCommands,
-  ...searchCommands,
-  ...shellEnvCommands,
-]);
-
-// shell-env needs the builtins ref for `which` and `type`
-setBuiltinsRef(builtins);
+// Assembles all builtin commands from category modules into one map.
+
+import type { BuiltinFn } from "./shell-types";
+import { fileOpsCommands } from "./commands/file-ops";
+import { directoryCommands } from "./commands/directory";
+import { textProcessingCommands } from "./commands/text-processing";
+import { searchCommands } from "./commands/search";
+import { shellEnvCommands, setBuiltinsRef } from "./commands/shell-env";
+
+export const builtins = new Map<string, BuiltinFn>([
+  ...fileOpsCommands,
+  ...directoryCommands,
+  ...textProcessingCommands,
+  ...searchCommands,
+  ...shellEnvCommands,
+]);
+
+// shell-env needs the builtins ref for `which` and `type`
+setBuiltinsRef(builtins);

package/src/threading/offload-types.ts

@@ -1,112 +1,113 @@
-// Type definitions for the worker offloading system.
-// All types must be structured-clone compatible (postMessage-safe).
-
-// --- Task priority ---
-
-export enum TaskPriority {
-  HIGH = 0,    // runtime transforms (user waiting)
-  NORMAL = 1,  // install-time bulk transforms
-  LOW = 2,     // background pre-bundling
-}
-
-// --- Transform task ---
-
-export interface TransformTask {
-  type: "transform";
-  id: string;
-  source: string;
-  filePath: string;
-  options?: {
-    loader?: "js" | "jsx" | "ts" | "tsx";
-    format?: "cjs" | "esm";
-    target?: string;
-    platform?: string;
-    define?: Record<string, string>;
-  };
-  priority: TaskPriority;
-}
-
-export interface TransformResult {
-  type: "transform";
-  id: string;
-  code: string;
-  warnings: string[];
-}
-
-// --- Extract task ---
-
-export interface ExtractTask {
-  type: "extract";
-  id: string;
-  tarballUrl: string;
-  stripComponents: number;
-  priority: TaskPriority;
-}
-
-export interface ExtractedFile {
-  path: string;
-  // UTF-8 text, or base64-encoded binary
-  data: string;
-  isBinary: boolean;
-}
-
-export interface ExtractResult {
-  type: "extract";
-  id: string;
-  files: ExtractedFile[];
-}
-
-// --- Build task ---
-
-export interface BuildTask {
-  type: "build";
-  id: string;
-  files: Record<string, string>;
-  entryPoints?: string[];
-  stdin?: { contents: string; resolveDir?: string; loader?: string };
-  bundle?: boolean;
-  format?: "iife" | "cjs" | "esm";
-  platform?: "browser" | "node" | "neutral";
-  target?: string | string[];
-  minify?: boolean;
-  external?: string[];
-  absWorkingDir?: string;
-  priority: TaskPriority;
-}
-
-export interface BuildOutputFile {
-  path: string;
-  text: string;
-}
-
-export interface BuildResult {
-  type: "build";
-  id: string;
-  outputFiles: BuildOutputFile[];
-  errors: string[];
-  warnings: string[];
-}
-
-// --- Union types ---
-
-export type OffloadTask = TransformTask | ExtractTask | BuildTask;
-export type OffloadResult = TransformResult | ExtractResult | BuildResult;
-
-// --- Worker endpoint (exposed via Comlink) ---
-
-export interface OffloadWorkerEndpoint {
-  init(): Promise<void>;
-  transform(task: TransformTask): Promise<TransformResult>;
-  extract(task: ExtractTask): Promise<ExtractResult>;
-  build(task: BuildTask): Promise<BuildResult>;
-  ping(): boolean;
-}
-
-// --- Pool config ---
-
-export interface PoolConfig {
-  minWorkers?: number;
-  maxWorkers?: number;
-  idleTimeoutMs?: number;
-  warmUpOnCreate?: boolean;
-}
+// Type definitions for the worker offloading system.
+// All types must be structured-clone compatible (postMessage-safe).
+
+// --- Task priority ---
+
+export enum TaskPriority {
+  HIGH = 0,    // runtime transforms (user waiting)
+  NORMAL = 1,  // install-time bulk transforms
+  LOW = 2,     // background pre-bundling
+}
+
+// --- Transform task ---
+
+export interface TransformTask {
+  type: "transform";
+  id: string;
+  source: string;
+  filePath: string;
+  options?: {
+    loader?: "js" | "jsx" | "ts" | "tsx";
+    format?: "cjs" | "esm";
+    target?: string;
+    platform?: string;
+    define?: Record<string, string>;
+  };
+  priority: TaskPriority;
+}
+
+export interface TransformResult {
+  type: "transform";
+  id: string;
+  code: string;
+  warnings: string[];
+}
+
+// --- Extract task ---
+
+export interface ExtractTask {
+  type: "extract";
+  id: string;
+  tarballUrl: string;
+  stripComponents: number;
+  priority: TaskPriority;
+  expectedShasum?: string;
+}
+
+export interface ExtractedFile {
+  path: string;
+  // UTF-8 text, or base64-encoded binary
+  data: string;
+  isBinary: boolean;
+}
+
+export interface ExtractResult {
+  type: "extract";
+  id: string;
+  files: ExtractedFile[];
+}
+
+// --- Build task ---
+
+export interface BuildTask {
+  type: "build";
+  id: string;
+  files: Record<string, string>;
+  entryPoints?: string[];
+  stdin?: { contents: string; resolveDir?: string; loader?: string };
+  bundle?: boolean;
+  format?: "iife" | "cjs" | "esm";
+  platform?: "browser" | "node" | "neutral";
+  target?: string | string[];
+  minify?: boolean;
+  external?: string[];
+  absWorkingDir?: string;
+  priority: TaskPriority;
+}
+
+export interface BuildOutputFile {
+  path: string;
+  text: string;
+}
+
+export interface BuildResult {
+  type: "build";
+  id: string;
+  outputFiles: BuildOutputFile[];
+  errors: string[];
+  warnings: string[];
+}
+
+// --- Union types ---
+
+export type OffloadTask = TransformTask | ExtractTask | BuildTask;
+export type OffloadResult = TransformResult | ExtractResult | BuildResult;
+
+// --- Worker endpoint (exposed via Comlink) ---
+
+export interface OffloadWorkerEndpoint {
+  init(): Promise<void>;
+  transform(task: TransformTask): Promise<TransformResult>;
+  extract(task: ExtractTask): Promise<ExtractResult>;
+  build(task: BuildTask): Promise<BuildResult>;
+  ping(): boolean;
+}
+
+// --- Pool config ---
+
+export interface PoolConfig {
+  minWorkers?: number;
+  maxWorkers?: number;
+  idleTimeoutMs?: number;
+  warmUpOnCreate?: boolean;
+}

package/src/threading/offload-worker.ts

@@ -267,6 +267,21 @@ const workerEndpoint: OffloadWorkerEndpoint = {
     }
 
     const compressed = new Uint8Array(await response.arrayBuffer());
+
+    // check sha1 against what the registry told us
+    if (task.expectedShasum) {
+      const hashBuffer = await crypto.subtle.digest("SHA-1", compressed);
+      const hashHex = Array.from(new Uint8Array(hashBuffer))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+      if (hashHex !== task.expectedShasum) {
+        throw new Error(
+          `Integrity check failed for ${task.tarballUrl}: ` +
+            `expected shasum ${task.expectedShasum}, got ${hashHex}`,
+        );
+      }
+    }
+
     const tarBytes = pakoModule.inflate(compressed) as Uint8Array;
 
     const files: ExtractedFile[] = [];