@volter/tabnode 0.5.47 → 0.5.49

package/src/node-response.ts

@@ -0,0 +1,160 @@
+import { defineOnHost, takeFromHost } from './host-globals';
+import { nodeResponseBody } from './node-body';
+
+/**
+ * A web `Response` that keeps its `Set-Cookie` headers, as Node's does.
+ *
+ * Node's `Response` (undici's) is built with a `Headers` that holds every
+ * header it was given, `Set-Cookie` and `Set-Cookie2` among them, readable
+ * through `get` (joined with ", "), iteration (one entry per cookie) and
+ * `getSetCookie()`, and mutable afterwards. A browser's applies the fetch
+ * specification's response guard, which drops both silently, on construction
+ * and on every later `append` or `set`: `new Response('', { headers:
+ * { 'set-cookie': 'a=1' } }).headers` is empty in a tab. A server that answers
+ * with a web Response (Next's route handlers and middleware, Hono, Remix,
+ * SvelteKit's adapters, NextAuth among them) then loses every cookie it sets
+ * before its answer is written to the socket, and no one can sign in.
+ *
+ * The realm's `Response` stays the browser's own class in all but its
+ * constructor: the constructor is a function whose `prototype` is the
+ * browser's `Response.prototype`, so a fetch's answer, `Response.error()` and
+ * a program's subclass are each `instanceof Response`, share its prototype and
+ * name it as their `constructor`, as on Node. A response a program constructs
+ * keeps a `Headers` of its own, made without a guard (a `Headers` a program
+ * constructs is one, in a browser too), holding the browser's headers and every
+ * cookie the program gave; `headers` answers it. The body methods whose answer
+ * depends on the content type (`formData`, `blob`) read the kept one, as Node
+ * reads the response's own headers.
+ */
+const INSTALLED = Symbol.for('tabnode.response.keepsSetCookie');
+
+type ResponseConstructor = typeof Response & { [INSTALLED]?: true };
+
+/** The browser's headers with the cookies its guard dropped. */
+function withCookies(own: Headers, given: Headers | undefined): Headers {
+  const headers = new Headers(own);
+  if (!given) return headers;
+  const cookies: string[] = [];
+  if (typeof given.getSetCookie === 'function') cookies.push(...given.getSetCookie());
+  else given.forEach((value, name) => { if (name === 'set-cookie') cookies.push(value); });
+  if (cookies.length) {
+    headers.delete('set-cookie');
+    for (const cookie of cookies) headers.append('set-cookie', cookie);
+  }
+  const cookie2 = given.get('set-cookie2');
+  if (cookie2 !== null) headers.set('set-cookie2', cookie2);
+  return headers;
+}
+
+/** The headers an init names, read once (an iterable may be a generator), as a guard-free `Headers`. */
+function givenHeaders(init: ResponseInit | undefined): Headers | undefined {
+  const headers = init?.headers;
+  return headers === undefined || headers === null ? undefined : new Headers(headers);
+}
+
+/**
+ * The init with its headers replaced, read as the platform reads a
+ * dictionary: each member by name, inherited ones too (a `Response` passed as
+ * the init, as Next's `NextResponse` does, carries its status on a getter of
+ * its prototype, which a spread would not copy).
+ */
+function withHeaders(init: ResponseInit | undefined, headers: Headers): ResponseInit {
+  const status = init?.status;
+  const statusText = init?.statusText;
+  return {
+    headers,
+    ...(status === undefined ? {} : { status }),
+    ...(statusText === undefined ? {} : { statusText }),
+  };
+}
+
+/**
+ * Install the corrected constructor on `target` (the realm's global object),
+ * over the `Response` it has. Every property it changes is remembered for the
+ * host to have back (`restoreHostGlobals`); a realm that has it already is left.
+ */
+export function installNodeResponse(target: { Response?: typeof Response }): void {
+  const Native = target.Response as ResponseConstructor | undefined;
+  if (typeof Native !== 'function' || Native[INSTALLED]) return;
+  const proto = Native.prototype;
+  // The getter is the prototype's own in a browser; found up the chain wherever it is.
+  let nativeHeaders: (() => unknown) | undefined;
+  for (let at: object | null = proto; at && !nativeHeaders; at = Object.getPrototypeOf(at)) nativeHeaders = Object.getOwnPropertyDescriptor(at, 'headers')?.get;
+  const nativeFormData = proto.formData;
+  const nativeBlob = proto.blob;
+  const nativeArrayBuffer = proto.arrayBuffer;
+  const nativeClone = proto.clone;
+  if (!nativeHeaders) return;
+  const kept = new WeakMap<object, Headers>();
+
+  const NodeResponse = function Response(this: unknown, body?: BodyInit | null, init?: ResponseInit): Response {
+    if (!new.target) throw new TypeError("Class constructor Response cannot be invoked without 'new'");
+    const given = givenHeaders(init);
+    const response = Reflect.construct(Native, [nodeResponseBody(body) as BodyInit | null | undefined, given ? withHeaders(init, given) : init], (new.target as unknown) === NodeResponse ? Native : new.target) as Response;
+    kept.set(response, withCookies(nativeHeaders.call(response) as Headers, given));
+    return response;
+  } as unknown as ResponseConstructor;
+  NodeResponse.prototype = proto;
+  Object.defineProperty(NodeResponse, 'length', { value: 0, configurable: true });
+  Object.defineProperty(NodeResponse, INSTALLED, { value: true });
+  Object.setPrototypeOf(NodeResponse, Object.getPrototypeOf(Native));
+
+  // Node's statics answer a response whose headers are as mutable as a
+  // constructed one's (json) or immutable (redirect, error), as here.
+  Object.defineProperty(NodeResponse, 'json', {
+    value: function json(data: unknown, init?: ResponseInit): Response {
+      const given = givenHeaders(init);
+      const response = Native.json(data, given ? withHeaders(init, given) : init);
+      kept.set(response, withCookies(nativeHeaders.call(response) as Headers, given));
+      return response;
+    },
+    writable: true, configurable: true,
+  });
+  Object.defineProperty(NodeResponse, 'redirect', { value: function redirect(url: string | URL, status?: number): Response { return Native.redirect(url, status); }, writable: true, configurable: true });
+  Object.defineProperty(NodeResponse, 'error', { value: function error(): Response { return Native.error(); }, writable: true, configurable: true });
+
+  defineOnHost(proto, 'headers', {
+    get(this: Response): Headers { return kept.get(this) ?? (nativeHeaders.call(this) as Headers); },
+    enumerable: true, configurable: true,
+  });
+  defineOnHost(proto, 'constructor', { value: NodeResponse, writable: true, enumerable: false, configurable: true });
+
+  // A clone's headers are a copy of the original's, cookies and all.
+  defineOnHost(proto, 'clone', {
+    value: function clone(this: Response): Response {
+      const copy = nativeClone.call(this);
+      const headers = kept.get(this);
+      if (headers) kept.set(copy, new Headers(headers));
+      return copy;
+    },
+    writable: true, enumerable: true, configurable: true,
+  });
+
+  /** The kept content type where it is no longer the one the browser's body was built with. */
+  const changedType = (response: Response): string | null | undefined => {
+    const headers = kept.get(response);
+    if (!headers) return undefined;
+    const current = headers.get('content-type');
+    return current === (nativeHeaders.call(response) as Headers).get('content-type') ? undefined : current;
+  };
+  defineOnHost(proto, 'formData', {
+    value: async function formData(this: Response): Promise<FormData> {
+      const type = changedType(this);
+      if (type === undefined) return nativeFormData.call(this);
+      const bytes = await nativeArrayBuffer.call(this);
+      return nativeFormData.call(Reflect.construct(Native, [bytes, type === null ? {} : { headers: { 'content-type': type } }]) as Response);
+    },
+    writable: true, enumerable: true, configurable: true,
+  });
+  defineOnHost(proto, 'blob', {
+    value: async function blob(this: Response): Promise<Blob> {
+      const type = changedType(this);
+      if (type === undefined) return nativeBlob.call(this);
+      return new Blob([await nativeArrayBuffer.call(this)], type === null ? {} : { type });
+    },
+    writable: true, enumerable: true, configurable: true,
+  });
+
+  takeFromHost(target, 'Response', NodeResponse);
+}
+

package/src/runtime.ts

@@ -8,6 +8,8 @@
 import { VirtualFS } from './virtual-fs';
 import { guestPromise, intrinsicPromise } from './promise-ownership';
 import { guestFetch, rememberRequestBodySource } from './fetch-transport';
+import { installNodeResponse } from './node-response';
+import { withNodeRequestBody } from './node-body';
 import { forGuestRealm, installGuestRealm, takeFromHost, defineOnHost, heldWork } from './host-globals';
 import type { IRuntime, IExecuteResult, IRuntimeOptions } from './runtime-interface';
 import type { PackageJson } from './types/package-json';
@@ -2952,6 +2954,8 @@ forGuestRealm(() => {
     const kept = new WeakMap<object, Headers>();
     class NodeRequest extends Native {
       constructor(input: RequestInfo | URL, init?: RequestInit) {
+        // An async-iterable body (a Node stream) is read as undici reads it.
+        init = withNodeRequestBody(init);
         super(input as RequestInfo, init);
         rememberRequestBodySource(this, input, init);
         const asked = new Headers(init?.headers ?? (input instanceof Native ? (input as Request).headers : undefined));
@@ -2974,6 +2978,12 @@ forGuestRealm(() => {
   }
 });
 
+forGuestRealm(() => {
+  // A response keeps the Set-Cookie headers it was built with, as Node's
+  // does; the browser's response guard drops them (see node-response.ts).
+  installNodeResponse(globalThis);
+});
+
 forGuestRealm(() => {
   // Node's `stream.finished()` on a web stream waits on a promise Node's own
   // web streams carry (`nodejs.webstream.isClosedPromise`), settled when the

package/src/shims/child_process.ts

@@ -268,6 +268,22 @@ export function registerRunStreams(token: ProcessToken, streams: RunStreams): vo
 /** Forget a run that has ended. */
 export function releaseRunStreams(token: ProcessToken): void {
   _runStreams.delete(token);
+  shellRuns.delete(token);
+  hostedNodes.delete(token);
+}
+
+/** Runs whose program is a shell or another non-node program: a `node` they run is their child. */
+const shellRuns = new Set<ProcessToken>();
+/** Runs that are themselves a hosted `node`: a further `node` under them is a child. */
+const hostedNodes = new Set<ProcessToken>();
+
+/** A child identity for a `node` a run's shell runs: its own token and pid under the run's, on the run's streams. */
+function nestedNodeToken(parentToken: ProcessToken, args: readonly string[], cwd: string | undefined): ProcessToken {
+  const token: ProcessToken = `child-${__nextChildRun++}`;
+  setRunPid(token, mintPid(), runPid(parentToken)?.pid ?? 0, { argv: ['node', ...args], ...(cwd ? { cwd } : {}) });
+  const parentStreams = runStreamsFor(parentToken);
+  if (parentStreams) registerRunStreams(token, parentStreams);
+  return token;
 }
 
 /** What the host gave the named run, while it lasts. */
@@ -429,14 +445,30 @@ export function initChildProcess(vfs: VirtualFS): void {
 
     // Capture this run's name, streams and cancellation before another Node
     // entry can start. Forks and shell entries reach this same dispatch seam.
-    const runToken = runTokenOf(ctx);
+    const parentToken = runTokenOf(ctx);
+    // A `node` a shell runs is a process of its own unless it is the run
+    // itself: the first `node` of a run that is not a shell's child is the
+    // run (the CMD `node server.js`, the page's `node -e`), and every other
+    // one, a line of a start script, the second command of a `-c` line, a
+    // step of a `sh file` child, gets a child token under the run's pid,
+    // the run's streams, and its own admission at the host. Admitted under
+    // the shell's own token, its exit was read as the shell's: a script
+    // ended at its first `node` line with nothing after it (measured
+    // 2026-09-28: `sh start.sh` printed its first step and stopped).
+    const nested = parentToken !== null && (shellRuns.has(parentToken) || hostedNodes.has(parentToken));
+    const runToken = nested ? nestedNodeToken(parentToken!, args, ctx.cwd) : parentToken;
     const streams = runToken === null ? undefined : runStreamsFor(runToken);
     const processHost = nodeProcessHostFor(runToken);
     if (processHost && runToken !== null) {
-      return runHostedNode(processHost, {
-        token: runToken, argv: [...args], cwd: ctx.cwd, filesystem: tree, env: guestEnvironmentOf(ctx),
-        ...(typeof ctx.stdin === 'string' ? { stdin: ctx.stdin } : {}), ...(streams ? { streams } : {}),
-      });
+      if (!nested) hostedNodes.add(runToken);
+      try {
+        return await runHostedNode(processHost, {
+          token: runToken, argv: [...args], cwd: ctx.cwd, filesystem: tree, env: guestEnvironmentOf(ctx),
+          ...(typeof ctx.stdin === 'string' ? { stdin: ctx.stdin } : {}), ...(streams ? { streams } : {}),
+        });
+      } finally {
+        if (nested) releaseRunStreams(runToken);
+      }
     }
 
     // Node reads its own options before the script: `node --turbo-fast-api-calls
@@ -1719,6 +1751,9 @@ function existsInTree(path: string): boolean {
  * a program the engine can run; the engine's own `node`, written to
  * `/usr/local/bin/node` when the shim is initialized, is one of those.
  */
+/** The shells a script or a `-c` line runs under; a child of these goes to the host when there is one. */
+const SHELL_PROGRAMS = new Set(['sh', 'bash', 'dash', '/bin/sh', '/bin/bash', '/usr/bin/sh', '/usr/bin/bash']);
+
 function engineProgramFor(file: string, cwd?: string): string {
   const name = __substrateProgramName(file);
   if (!name.includes('/')) return name;
@@ -1794,6 +1829,7 @@ function startChildRun(request: RunRequest): StartedRun {
   // A host terminal consumes input incrementally. The old string-only
   // route dropped every keystroke that arrived after a child was launched.
   const admittedNode = nodeProcessHostInstalled() && engineProgramFor(request.file, request.cwd) === 'node';
+  if (!admittedNode) shellRuns.add(token);
   const hostTerminal = request.terminal !== undefined && hostExecutor() !== null && !admittedNode;
   let wakeInput: (() => void) | undefined;
   /**
@@ -1904,7 +1940,14 @@ function startChildRun(request: RunRequest): StartedRun {
   const begin = (): void => {
     if (started || finished) return;
     started = true;
-    const engineFirst = !hostTerminal && programExists(request.file, request.cwd, request.env);
+    // A shell a hosted program spawns (`sh start.sh`, `sh -c '…'`) runs at
+    // the host when there is one, not in this worker's own bash: the host is
+    // where the programs the page registered live (`npx` under /usr/bin),
+    // and where a `node` inside the script is given a named run. Run here,
+    // the script's `node` found no name and was refused, and its `npx` was
+    // not found at all.
+    const shellChild = SHELL_PROGRAMS.has(engineProgramFor(request.file, request.cwd)) && hostExecutor() !== null;
+    const engineFirst = !hostTerminal && !shellChild && programExists(request.file, request.cwd, request.env);
     liveInput = !hostTerminal && !admittedNode && request.stdinIsPipe && !engineFirst;
     if (liveInput) {
       pendingStdin.unshift(...initialStdin);

package/src/shims/shell-jobs.ts

@@ -386,6 +386,78 @@ export function installShellJobs(bash: Bash, host: ShellJobsHost): void {
     return { stdout: held.stdout, stderr: held.stderr + stderr, exitCode: status };
   }));
 
+  // `sh file`, `sh -c line` and `sh` on stdin: the shell's own ran the script
+  // with the caller's exported variables alone, and a run's name travels in
+  // a variable the shell never exports, so a `node` on any line of a script
+  // found no named run and was refused ("Isolated Node execution requires a
+  // named run", a start script in browser-substrate's tab, 2026-09-28). The
+  // script is run as the shell's own would run it, with the name carried.
+  for (const shell of ['sh', 'bash'] as const) {
+    bash.registerCommand(defineCommand(shell, async (args, ctx) => {
+      const exec = ctx.exec;
+      if (!exec) return { stdout: '', stderr: `bash: ${shell}: needs a shell that can run a script\n`, exitCode: 1 };
+      let script: string;
+      let zero: string;
+      let positional: string[];
+      let sourced: string | undefined;
+      // Options before the script (`sh -e start.sh`, `bash -eu -c …`) are the
+      // shell's own; they are passed over rather than read as the file's name.
+      let at = 0;
+      while (at < args.length && /^[-+][a-bd-zA-Z]+$/u.test(args[at]!)) at++;
+      args = args.slice(at);
+      if (args[0] === '-c' && args.length >= 2) {
+        script = args[1]!;
+        zero = args[2] ?? shell;
+        positional = args.slice(3);
+      } else if (args.length === 0) {
+        if (!ctx.stdin?.trim()) return { stdout: '', stderr: '', exitCode: 0 };
+        script = ctx.stdin;
+        zero = shell;
+        positional = [];
+      } else {
+        const path = ctx.fs.resolvePath(ctx.cwd, args[0]!);
+        try { script = String(await ctx.fs.readFile(path)); }
+        catch { return { stdout: '', stderr: `${shell}: ${args[0]}: No such file or directory\n`, exitCode: 127 }; }
+        zero = args[0]!;
+        positional = args.slice(1);
+        sourced = path;
+      }
+      if (script.startsWith('#!')) {
+        const newline = script.indexOf('\n');
+        if (newline !== -1) script = script.slice(newline + 1);
+      }
+      const env: Record<string, string> = { ...(ctx.exportedEnv ?? {}), '0': zero, '#': String(positional.length), '@': positional.join(' '), '*': positional.join(' ') };
+      positional.forEach((word, index) => { env[String(index + 1)] = word; });
+      const token = ctx.env.get(PROCESS_TOKEN_ENV);
+      if (token) env[PROCESS_TOKEN_ENV] = token;
+      // A file is sourced by one statement of the nested run rather than run
+      // as the nested run's own script: a nested script of several lines
+      // stopped after its first hosted `node` in a tab (2026-09-28), while
+      // the same lines sourced from one statement ran whole. The shebang
+      // line is a comment to the shell that sources it.
+      if (sourced !== undefined) script = `. ${sourced.replace(/'/gu, "'\\''").replace(/^(.*)$/su, "'$1'")}`;
+      const result = await exec(script, { env, cwd: ctx.cwd, stdin: ctx.stdin, signal: (ctx as { signal?: AbortSignal }).signal });
+      return { stdout: result.stdout ?? '', stderr: result.stderr ?? '', exitCode: result.exitCode ?? 0 };
+    }));
+  }
+  // `exec command…` runs the command in the script's place, with the
+  // script's environment and its run's name, and answers with its status.
+  // The shell's own `exec` ran a builtin but a program the engine defines,
+  // `node`, ran nothing: a start script's `exec node server.js` ended with
+  // no server and no word. This one hands the line back to the shell, which
+  // is where `node`, `npm` and the host's programs are found. The shell is
+  // not replaced: a line after `exec` runs once the command ends, where
+  // bash would never reach it. A start script's `exec` is its last line, a
+  // server that does not end.
+  bash.registerCommand(defineCommand('exec', async (args, ctx) => {
+    if (args.length === 0) return { stdout: '', stderr: '', exitCode: 0 };
+    if (!ctx.exec) return { stdout: '', stderr: 'bash: exec: needs a shell that can run a line\n', exitCode: 1 };
+    const line = args.map((word) => /^[A-Za-z0-9_./:=@%+,-]+$/u.test(word) ? word : `'${word.replace(/'/gu, "'\\''")}'`).join(' ');
+    const env: Record<string, string> = Object.fromEntries(ctx.env);
+    const result = await ctx.exec(line, { env, cwd: ctx.cwd, replaceEnv: true });
+    return { stdout: result.stdout ?? '', stderr: result.stderr ?? '', exitCode: result.exitCode ?? 0 };
+  }));
+
   bash.registerCommand(defineCommand('kill', async (args) => {
     let signal = 'SIGTERM';
     let index = 0;