peachsim 0.1.1481 → 0.1.1619

package/dist-lib/host/replacement-module-handler.cjs

@@ -1,4 +1,4 @@
-/*! peach v0.1.1481 | (c) 2026 Tamagui LLC | Proprietary; see LICENSE */
+/*! peach v0.1.1619 | (c) 2026 Tamagui LLC | Proprietary; see LICENSE */
 let __sootsim_import_meta_url = '', __sootsim_import_meta_dirname = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; __sootsim_import_meta_dirname = __dirname; } catch {}
 "use strict";
 var __create = Object.create;
@@ -394,6 +394,12 @@ function resolveReplacementModuleFile(fromFile, specifier) {
   }
   return found;
 }
+function isInsideAny(roots, file) {
+  return roots.some((root) => {
+    const relative2 = import_node_path.default.relative(root, file);
+    return !relative2.startsWith("..") && !import_node_path.default.isAbsolute(relative2);
+  });
+}
 function isReplacementModuleRequestUrl(rawUrl) {
   if (!rawUrl) return false;
   try {
@@ -452,16 +458,11 @@ async function handleReplacementModuleRequest(req, res, options = {}) {
     return true;
   }
   const runtimePackages = new Set(url.searchParams.getAll("runtimePackage"));
-  let resolvedProjectRoot;
-  if (options.projectRoot) {
-    const lexicalProjectRoot = import_node_path.default.resolve(options.projectRoot);
-    resolvedProjectRoot = await import_promises.default.realpath(options.projectRoot);
-    const lexicalTarget = import_node_path.default.relative(lexicalProjectRoot, targetPath);
-    if (lexicalTarget.startsWith("..") || import_node_path.default.isAbsolute(lexicalTarget)) {
-      res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
-      res.end("replacement file must be inside the project root");
-      return true;
-    }
+  const servedRoots = options.servedRoots?.map((root) => import_node_path.default.resolve(root));
+  if (servedRoots && !isInsideAny(servedRoots, targetPath)) {
+    res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+    res.end("replacement file must be inside a folder the bundler serves");
+    return true;
   }
   let resolvedTargetPath;
   try {
@@ -472,11 +473,11 @@ async function handleReplacementModuleRequest(req, res, options = {}) {
     res.end(`replacement file not found: ${message}`);
     return true;
   }
-  if (resolvedProjectRoot) {
-    const relativeTarget = import_node_path.default.relative(resolvedProjectRoot, resolvedTargetPath);
-    if (relativeTarget.startsWith("..") || import_node_path.default.isAbsolute(relativeTarget)) {
+  if (servedRoots) {
+    const realRoots = (await Promise.all(servedRoots.map((root) => import_promises.default.realpath(root).catch(() => null)))).filter((root) => root !== null);
+    if (!isInsideAny(realRoots, resolvedTargetPath)) {
       res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
-      res.end("replacement file must be inside the project root");
+      res.end("replacement file must be inside a folder the bundler serves");
       return true;
     }
   }

package/dist-lib/host/websocket-proxy.cjs

@@ -1,4 +1,4 @@
-/*! peach v0.1.1481 | (c) 2026 Tamagui LLC | Proprietary; see LICENSE */
+/*! peach v0.1.1619 | (c) 2026 Tamagui LLC | Proprietary; see LICENSE */
 let __sootsim_import_meta_url = '', __sootsim_import_meta_dirname = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; __sootsim_import_meta_dirname = __dirname; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;
@@ -22,6 +22,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/host/websocket-proxy.ts
 var websocket_proxy_exports = {};
 __export(websocket_proxy_exports, {
+  TCP_RELAY_PATH: () => TCP_RELAY_PATH,
   WEBSOCKET_PROXY_HANDSHAKE_TIMEOUT_MS: () => WEBSOCKET_PROXY_HANDSHAKE_TIMEOUT_MS,
   WEBSOCKET_PROXY_PATH: () => WEBSOCKET_PROXY_PATH,
   handleWebSocketProxyUpgrade: () => handleWebSocketProxyUpgrade,
@@ -32,6 +33,9 @@ module.exports = __toCommonJS(websocket_proxy_exports);
 var import_crypto = require("crypto");
 var import_http = require("http");
 var import_https = require("https");
+var import_net = require("net");
+var import_tls = require("tls");
+var import_ws = require("ws");
 
 // src/backend-origin.ts
 function normalizeHostname(hostname) {
@@ -54,8 +58,40 @@ function isTrustedBridgeRequest(headers) {
   }
 }
 
+// src/is-record.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/host/loopback-ports.ts
+var LOOPBACK_PORTS = /* @__PURE__ */ new Map();
+for (const pair of process.env.PEACH_LOOPBACK_PORTS?.split(",").filter(Boolean) ?? []) {
+  const match = /^\s*([1-9][0-9]{0,4}):([1-9][0-9]{0,4})\s*$/.exec(pair);
+  const from = Number(match?.[1]);
+  const to = Number(match?.[2]);
+  if (!match || from > 65535 || to > 65535 || LOOPBACK_PORTS.has(from)) {
+    throw new Error(`PEACH_LOOPBACK_PORTS has an invalid entry: ${JSON.stringify(pair)}`);
+  }
+  LOOPBACK_PORTS.set(from, to);
+}
+function projectLoopbackPort(hostname, port) {
+  return isLoopbackHost(hostname) ? LOOPBACK_PORTS.get(port) ?? port : port;
+}
+function projectLoopbackUrl(value) {
+  if (LOOPBACK_PORTS.size === 0) return value;
+  const url = new URL(value);
+  const port = Number(
+    url.port || (url.protocol === "https:" || url.protocol === "wss:" ? 443 : 80)
+  );
+  const projected = projectLoopbackPort(url.hostname, port);
+  if (projected === port) return value;
+  url.port = String(projected);
+  return url.href;
+}
+
 // src/host/websocket-proxy.ts
 var WEBSOCKET_PROXY_PATH = "/__websocket-proxy";
+var TCP_RELAY_PATH = "/__tcp-relay";
 var WEBSOCKET_PROXY_HANDSHAKE_TIMEOUT_MS = 1e4;
 var WEBSOCKET_PROTOCOL_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
 var WEBSOCKET_KEY = /^[+/0-9A-Za-z]{22}==$/;
@@ -185,20 +221,220 @@ function createUpstreamHeaders(req, targetUrl, headers, forwardOrigin) {
   }
   return upstreamHeaders;
 }
+function requestPathname(rawUrl) {
+  if (!rawUrl) return null;
+  try {
+    return new URL(rawUrl, "http://localhost").pathname;
+  } catch {
+    return null;
+  }
+}
 function isWebSocketProxyRequestUrl(rawUrl) {
-  if (!rawUrl) return false;
+  return requestPathname(rawUrl) === WEBSOCKET_PROXY_PATH;
+}
+function rawDataBytes(data) {
+  if (Array.isArray(data)) return Buffer.concat(data);
+  return Buffer.isBuffer(data) ? data : Buffer.from(data);
+}
+function optionalString(value) {
+  return typeof value === "string" && value !== "" ? value : void 0;
+}
+function optionalNumber(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function readTcpRelayTls(options) {
+  return {
+    rejectUnauthorized: options.rejectUnauthorized !== false,
+    ca: optionalString(options.ca)
+  };
+}
+function isTcpPort(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 65535;
+}
+function readTcpRelayCall(data) {
+  let call;
   try {
-    return new URL(rawUrl, "http://localhost").pathname === WEBSOCKET_PROXY_PATH;
+    call = JSON.parse(rawDataBytes(data).toString());
   } catch {
-    return false;
+    return null;
+  }
+  if (!isRecord(call)) return null;
+  switch (call.type) {
+    case "connect": {
+      const localAddress = optionalString(call.localAddress);
+      if (localAddress !== void 0 && (0, import_net.isIP)(localAddress) === 0) return null;
+      if (call.localPort != null && !isTcpPort(call.localPort)) return null;
+      return typeof call.host === "string" && !call.host.includes("\0") && isTcpPort(call.port) ? {
+        type: "connect",
+        host: call.host,
+        port: call.port,
+        localAddress,
+        localPort: optionalNumber(call.localPort),
+        connectTimeout: optionalNumber(call.connectTimeout),
+        tls: isRecord(call.tls) ? readTcpRelayTls(call.tls) : null
+      } : null;
+    }
+    case "startTLS":
+      return { type: "startTLS", ...readTcpRelayTls(call) };
+    case "end":
+    case "pause":
+    case "resume":
+      return { type: call.type };
+    case "setNoDelay":
+      return { type: "setNoDelay", noDelay: call.noDelay !== false };
+    case "setKeepAlive":
+      return {
+        type: "setKeepAlive",
+        enable: call.enable === true,
+        initialDelay: optionalNumber(call.initialDelay) ?? 0
+      };
+    default:
+      return null;
   }
 }
+function pemCertificateBytes(pem) {
+  return Buffer.from(
+    pem.replace(/-----(BEGIN|END) CERTIFICATE-----/g, "").replace(/\s+/g, ""),
+    "base64"
+  );
+}
+function connectionInfo(socket) {
+  return {
+    type: "connect",
+    localAddress: socket.localAddress,
+    localPort: socket.localPort,
+    remoteAddress: socket.remoteAddress,
+    remotePort: socket.remotePort,
+    remoteFamily: socket.remoteFamily
+  };
+}
+var tcpRelayServer = new import_ws.WebSocketServer({ noServer: true });
+function handleTcpRelay(ws) {
+  let socket = null;
+  let host = "";
+  let connecting = false;
+  let tls = false;
+  let held = null;
+  let ending = false;
+  const send = (event) => {
+    if (ws.readyState === ws.OPEN) ws.send(JSON.stringify(event));
+  };
+  const onData = (chunk) => {
+    if (ws.readyState === ws.OPEN) ws.send(chunk);
+  };
+  const onEnd = () => send({ type: "end" });
+  const onError = (error) => send({ type: "error", message: error.message });
+  const onClose = () => ws.close();
+  const relay = (next) => {
+    socket?.off("data", onData).off("end", onEnd).off("error", onError).off("close", onClose);
+    socket = next;
+    next.on("data", onData).on("end", onEnd).on("error", onError).on("close", onClose);
+  };
+  const write = (bytes) => {
+    if (ending) return;
+    if (held) held.push(bytes);
+    else socket?.write(bytes, () => send({ type: "written" }));
+  };
+  const end = (current) => current.end(() => current.destroy());
+  const startTls = (options, plain) => {
+    if (tls) return;
+    tls = true;
+    held = [];
+    const pinned = options.rejectUnauthorized ? options.ca : void 0;
+    const secured = (0, import_tls.connect)({
+      socket: plain,
+      servername: host,
+      rejectUnauthorized: options.rejectUnauthorized && pinned === void 0
+    });
+    relay(secured);
+    secured.once("secureConnect", () => {
+      const peer = secured.getPeerCertificate().raw;
+      if (pinned !== void 0 && !peer.equals(pemCertificateBytes(pinned))) {
+        secured.destroy(new Error("peer certificate does not match the pinned ca"));
+        return;
+      }
+      const queued = held ?? [];
+      held = null;
+      for (const bytes of queued) secured.write(bytes, () => send({ type: "written" }));
+      if (connecting) {
+        connecting = false;
+        send(connectionInfo(secured));
+      }
+      if (ending) end(secured);
+    });
+  };
+  ws.on("message", (data, isBinary) => {
+    if (isBinary) {
+      write(rawDataBytes(data));
+      return;
+    }
+    const call = readTcpRelayCall(data);
+    if (!call) {
+      onError(new Error("invalid tcp relay call"));
+      ws.close(1008, "invalid tcp relay call");
+      return;
+    }
+    if (call.type === "connect") {
+      if (socket) return;
+      host = call.host;
+      connecting = true;
+      const plain = (0, import_net.connect)({
+        host,
+        port: projectLoopbackPort(host, call.port),
+        localAddress: call.localAddress,
+        localPort: call.localPort
+      });
+      relay(plain);
+      const timeout = call.connectTimeout === void 0 ? void 0 : setTimeout(
+        () => plain.destroy(new Error("Attempt to connect to host timed out")),
+        Math.trunc(call.connectTimeout / 1e3) * 1e3
+      );
+      plain.once("close", () => clearTimeout(timeout));
+      plain.once("connect", () => {
+        clearTimeout(timeout);
+        if (!tls) send(connectionInfo(plain));
+      });
+      if (call.tls) startTls(call.tls, plain);
+      return;
+    }
+    const current = socket;
+    if (!current) return;
+    switch (call.type) {
+      case "startTLS":
+        startTls(call, current);
+        return;
+      case "end":
+        ending = true;
+        if (!held) end(current);
+        return;
+      case "pause":
+        current.pause();
+        return;
+      case "resume":
+        current.resume();
+        return;
+      case "setNoDelay":
+        current.setNoDelay(call.noDelay);
+        return;
+      case "setKeepAlive":
+        current.setKeepAlive(call.enable, call.initialDelay);
+        return;
+    }
+  });
+  ws.on("close", () => socket?.destroy());
+  ws.on("error", () => socket?.destroy());
+}
 function handleWebSocketProxyUpgrade(req, socket, head, forwardOrigin = true) {
-  if (!isWebSocketProxyRequestUrl(req.url)) return false;
+  const pathname = requestPathname(req.url);
+  if (pathname !== WEBSOCKET_PROXY_PATH && pathname !== TCP_RELAY_PATH) return false;
   if (!isSameOriginUpgrade(req)) {
     rejectUpgrade(socket, 403, "forbidden websocket proxy origin");
     return true;
   }
+  if (pathname === TCP_RELAY_PATH) {
+    tcpRelayServer.handleUpgrade(req, socket, head, handleTcpRelay);
+    return true;
+  }
   const upgradeRejection = validateUpgradeRequest(req);
   if (upgradeRejection) {
     rejectUpgrade(
@@ -231,7 +467,7 @@ function handleWebSocketProxyUpgrade(req, socket, head, forwardOrigin = true) {
   const upstreamHeaders = createUpstreamHeaders(req, targetUrl, headers, forwardOrigin);
   let settled = false;
   const request = targetUrl.protocol === "wss:" ? import_https.request : import_http.request;
-  const upstreamRequestUrl = new URL(targetUrl);
+  const upstreamRequestUrl = new URL(projectLoopbackUrl(targetUrl.href));
   upstreamRequestUrl.protocol = targetUrl.protocol === "wss:" ? "https:" : "http:";
   const upstreamRequest = request(upstreamRequestUrl, {
     method: "GET",
@@ -320,6 +556,7 @@ function handleWebSocketProxyUpgrade(req, socket, head, forwardOrigin = true) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  TCP_RELAY_PATH,
   WEBSOCKET_PROXY_HANDSHAKE_TIMEOUT_MS,
   WEBSOCKET_PROXY_PATH,
   handleWebSocketProxyUpgrade,