dsh-unlag 1.7.6 → 1.7.8

package/client.js

@@ -115,6 +115,7 @@ window.__ModuleLoader__.load({
           for (const id of source.ids) {
             if (!body.includes(id)) return false;
           }
+          if (!parsesAsClassicScript(body)) return false;
         } catch {
           return false;
         }
@@ -125,6 +126,25 @@ window.__ModuleLoader__.load({
     // Every row kind a document boot understands; an unknown one ends the document.
     const STARTUP_ROW_KINDS = new Set(['global', 'script', 'script-src', 'script-preload', 'style', 'html']);
 
+    /**
+     * Whether a script body parses the way the document will parse it: as a classic script. A body
+     * that needs module syntax never runs, so the document that loads it fails to boot and the
+     * desktop shell ends. Compiling runs nothing, so nothing here has a side effect; a page that
+     * forbids compiling strings cannot answer, and then the checks already done stand.
+     * @param body - the served script.
+     * @returns true when the body parses, or when this page cannot compile one at all.
+     */
+    function parsesAsClassicScript(body) {
+      try {
+        new Function(body); // eslint-disable-line no-new-func
+        return true;
+      } catch (error) {
+        const text = String(error?.message ?? error);
+        if (/unsafe-eval|Content Security Policy/iu.test(text)) return true;
+        return false;
+      }
+    }
+
     /**
      * The startup list the desktop shell hands the next document, exactly as it hands it. The
      * shell reads that list once when the app starts and replays the same copy for every document
@@ -195,6 +215,7 @@ window.__ModuleLoader__.load({
           for (const id of bundledIds(target)) {
             if (!body.includes(id)) return false;
           }
+          if (!parsesAsClassicScript(body)) return false;
         } catch {
           return false;
         }

package/index.js

@@ -535,6 +535,36 @@ function releaseBundleShim(shim) {
   } catch {}
 }
 
+/**
+ * Wrap the bundle route unless the wrap already there is the one still on the route. The route can
+ * appear after this plugin starts and can be replaced afterwards, so every caller that is about to
+ * matter (a reload, a page asking for the graph) asks again instead of trusting an earlier answer.
+ */
+function ensureBundleShim(ctx) {
+  const shim = globalThis[SHIM_KEY]
+  if (shim !== null && shim !== undefined) {
+    const route = ctx.get('webServer')?.prefixes?.get?.(BUNDLE_ROUTE)
+    if (route === shim.route && route.handler === shim.wrapped && route[SHIM_MARK] === true) return shim
+    releaseBundleShim(shim)
+    globalThis[SHIM_KEY] = null
+  }
+  globalThis[SHIM_KEY] = serveBundlesAtCurrentRevision(ctx)
+  return globalThis[SHIM_KEY]
+}
+
+/** What the bundle route looks like from here, so a stale answer can be told from a missing wrap. */
+function bundleShimStatus(ctx) {
+  const route = ctx.get('webServer')?.prefixes?.get?.(BUNDLE_ROUTE)
+  const clientModules = ctx.get('clientModules')
+  return {
+    route: route !== null && route !== undefined,
+    handler: typeof route?.handler === 'function',
+    wrapped: route?.[SHIM_MARK] === true,
+    fetch: typeof clientModules?.fetchBundle === 'function',
+    graph: typeof clientModules?.graph === 'function',
+  }
+}
+
 /**
  * The entry points the header button calls. Each answers with the current switches so the page
  * never guesses: with both off it does nothing, and a turn still running is reported rather than
@@ -552,12 +582,13 @@ function serveButton(ctx, controller, config) {
     [
       `${BASE_PATH}/state`,
       (_req, res) => {
-        sendJson(res, 200, { plugins: settings.reloadPlugins, page: settings.reloadInterface })
+        sendJson(res, 200, { plugins: settings.reloadPlugins, page: settings.reloadInterface, shim: bundleShimStatus(ctx) })
       },
     ],
     [
       `${BASE_PATH}/graph`,
       (_req, res) => {
+        ensureBundleShim(ctx)
         sendJson(res, 200, { graph: liveBootGraph(server) })
       },
     ],
@@ -622,8 +653,7 @@ export function apply(ctx, config) {
      * half starts, and one that appears after it.
      */
     const syncBundles = () => {
-      if (globalThis[SHIM_KEY] !== null) return
-      globalThis[SHIM_KEY] = serveBundlesAtCurrentRevision(ctx)
+      ensureBundleShim(ctx)
     }
     /** Watching needs HMR; start as soon as it exists, drop the watcher when it goes away. */
     const syncWatching = () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-unlag",
-  "version": "1.7.6",
+  "version": "1.7.8",
   "type": "module",
   "description": "One press applies plugin edits right away and brings a laggy interface back; running turns, queued messages and unsent input are untouched, and nothing restarts.",
   "license": "MIT",