peachsim 0.1.1644 → 0.1.1653

package/src/dev-bundle-resolution.ts

@@ -38,29 +38,40 @@ function buildBaseUrl(protocol: string, host: string, port: number) {
   return `${protocol}//${host}:${port}`
 }
 
-function shouldProxyLoopbackProbe(targetUrl: string) {
-  if (typeof window === 'undefined') return false
+// a sim page names its own origin (`pageOrigin`); node and bun callers pass
+// none. the page reads another loopback port only through its bridge proxy: a
+// direct fetch carries the page Origin, which dev servers such as Expo's
+// CorsMiddleware reject.
+function shouldProxyLoopbackProbe(targetUrl: string, pageOrigin: string) {
   try {
-    const parsed = new URL(targetUrl)
+    const target = new URL(targetUrl)
+    const page = new URL(pageOrigin)
     return (
-      isLoopbackHost(parsed.hostname) &&
-      isLoopbackHost(window.location.hostname) &&
-      parsed.origin !== window.location.origin
+      isLoopbackHost(target.hostname) &&
+      isLoopbackHost(page.hostname) &&
+      target.origin !== page.origin
     )
   } catch {
     return false
   }
 }
 
-async function fetchDevProbe(targetUrl: string, init?: RequestInit): Promise<Response> {
+async function fetchDevProbe(
+  targetUrl: string,
+  pageOrigin: string | undefined,
+  init?: RequestInit,
+): Promise<Response> {
   const requestInit: RequestInit = {
     ...init,
     cache: init?.cache ?? 'no-store',
   }
-  if (!shouldProxyLoopbackProbe(targetUrl)) {
+  if (!pageOrigin || !shouldProxyLoopbackProbe(targetUrl, pageOrigin)) {
     return fetch(targetUrl, requestInit)
   }
-  return fetch(`/__fetch-proxy?url=${encodeURIComponent(targetUrl)}`, requestInit)
+  return fetch(
+    `${pageOrigin}/__fetch-proxy?url=${encodeURIComponent(targetUrl)}`,
+    requestInit,
+  )
 }
 
 function getDefaultPortForProtocol(protocol: string) {
@@ -87,8 +98,8 @@ function isBaseServerUrl(url: URL) {
 // expo-platform header) and reads `launchAsset.url` correctly.
 //
 // env-agnostic by design: it just attempts `/__server-scan` and lets the result
-// decide. in the tenant worker (which has no `location`) the patched fetch
-// resolves the relative path to the shell origin and returns the scan json. in a
+// decide. in the tenant worker (whose `location` is hidden from guests) the
+// relative path resolves against the worker's shell url and returns the scan json. in a
 // node/bun CLI a relative-URL fetch with no base throws → null → the direct probe
 // runs (correct there, since node can read the cross-origin manifest). in prod
 // the path SPA-falls-back to HTML → the json content-type guard returns null →
@@ -164,7 +175,10 @@ const manifestRequests = new Map<string, Promise<Response | undefined>>()
 
 // the scanner, its enrichment and explicit opens share the complete response.
 // a short scan deadline must not discard work that an open is still awaiting.
-export async function fetchDevManifest(baseUrl: string): Promise<Response | undefined> {
+export async function fetchDevManifest(
+  baseUrl: string,
+  pageOrigin?: string,
+): Promise<Response | undefined> {
   const normalizedBaseUrl = baseUrl.replace(/\/+$/, '')
   const existing = manifestRequests.get(normalizedBaseUrl)
   if (existing) return (await existing)?.clone()
@@ -175,7 +189,7 @@ export async function fetchDevManifest(baseUrl: string): Promise<Response | unde
   // One's manifest middleware and can exit the user's dev server. so nothing
   // here aborts. wait on this one request until the startup deadline, then
   // report a terminal timeout instead of restarting the same slow work.
-  const pending = fetchDevProbe(`${normalizedBaseUrl}/`, {
+  const pending = fetchDevProbe(`${normalizedBaseUrl}/`, pageOrigin, {
     headers: { 'expo-platform': 'ios' },
   })
     .then(async (res) => {
@@ -211,8 +225,9 @@ export async function fetchDevManifest(baseUrl: string): Promise<Response | unde
 async function probeExpoManifest(
   normalizedBaseUrl: string,
   port: number,
+  pageOrigin: string | undefined,
 ): Promise<ManifestProbe> {
-  const answered = await fetchDevManifest(normalizedBaseUrl)
+  const answered = await fetchDevManifest(normalizedBaseUrl, pageOrigin)
   if (answered === undefined) return { state: 'no-answer' }
   if (answered.status === 404 || answered.status === 405) return { state: 'no-manifest' }
   if (answered.status < 200 || answered.status >= 300)
@@ -269,9 +284,12 @@ async function probeExpoManifest(
   }
 }
 
-async function isPackagerRunning(normalizedBaseUrl: string): Promise<boolean> {
+async function isPackagerRunning(
+  normalizedBaseUrl: string,
+  pageOrigin: string | undefined,
+): Promise<boolean> {
   try {
-    const res = await fetchDevProbe(`${normalizedBaseUrl}/status`, {
+    const res = await fetchDevProbe(`${normalizedBaseUrl}/status`, pageOrigin, {
       signal: AbortSignal.timeout(5_000),
     })
     if (!res.ok) return false
@@ -284,10 +302,11 @@ async function isPackagerRunning(normalizedBaseUrl: string): Promise<boolean> {
 async function probeBaseUrlBundleDirect(
   baseUrl: string,
   port: number,
+  pageOrigin: string | undefined,
 ): Promise<ResolvedDevBundle | null> {
   const normalizedBaseUrl = baseUrl.replace(/\/+$/, '')
 
-  const manifest = await probeExpoManifest(normalizedBaseUrl, port)
+  const manifest = await probeExpoManifest(normalizedBaseUrl, port, pageOrigin)
   if (manifest.state === 'resolved') return manifest.bundle
   // a server that never says what it is gets no guessed entry point.
   if (manifest.state === 'no-answer') return null
@@ -304,7 +323,7 @@ async function probeBaseUrlBundleDirect(
   // the Expo manifest probe above already returns the correct launchAsset.url
   // for One apps (which serve the Expo manifest format via vxrn), so we
   // drop the bespoke One probe entirely.
-  if (!(await isPackagerRunning(normalizedBaseUrl))) return null
+  if (!(await isPackagerRunning(normalizedBaseUrl, pageOrigin))) return null
   return {
     bundleUrl: `${normalizedBaseUrl}${METRO_BUNDLE_PATH}`,
     port,
@@ -315,6 +334,7 @@ async function probeBaseUrlBundleDirect(
 async function probeBaseUrlBundle(
   baseUrl: string,
   port: number,
+  pageOrigin: string | undefined,
 ): Promise<ResolvedDevBundle | null> {
   // browser/worker loopback targets resolve through the server-side scanner so
   // they match the dev-server list exactly — see resolvePortViaServerScan.
@@ -324,10 +344,13 @@ async function probeBaseUrlBundle(
       if (viaScan) return viaScan
     }
   } catch {}
-  return probeBaseUrlBundleDirect(baseUrl, port)
+  return probeBaseUrlBundleDirect(baseUrl, port, pageOrigin)
 }
 
-export async function probePortBundle(port: number): Promise<ResolvedDevBundle | null> {
+export async function probePortBundle(
+  port: number,
+  pageOrigin?: string,
+): Promise<ResolvedDevBundle | null> {
   const viaScan = await resolvePortViaServerScan(port)
   if (viaScan) return viaScan
   const unresolved = buildUnresolvedTargetError(`localhost:${port}`)
@@ -338,6 +361,7 @@ export async function probePortBundle(port: number): Promise<ResolvedDevBundle |
         const bundle = await probeBaseUrlBundleDirect(
           buildLoopbackProbeBaseUrl('http:', hostname, port),
           port,
+          pageOrigin,
         )
         if (!bundle) throw unresolved
         return bundle
@@ -351,12 +375,15 @@ export async function probePortBundle(port: number): Promise<ResolvedDevBundle |
   }
 }
 
-export async function resolveConnectionInput(input: string): Promise<ResolvedDevBundle> {
+export async function resolveConnectionInput(
+  input: string,
+  pageOrigin?: string,
+): Promise<ResolvedDevBundle> {
   const trimmed = input.trim()
 
   if (/^\d+$/.test(trimmed)) {
     const port = parseInt(trimmed, 10)
-    const resolved = await probePortBundle(port)
+    const resolved = await probePortBundle(port, pageOrigin)
     if (resolved) return resolved
     throw buildUnresolvedTargetError(`localhost:${port}`)
   }
@@ -383,7 +410,7 @@ export async function resolveConnectionInput(input: string): Promise<ResolvedDev
   // guessing that the origin itself is the bundle URL. loopback vs. remote
   // only affects how the probe fetch is routed (see shouldProxyLoopbackProbe).
   if (isBaseServerUrl(parsed)) {
-    const resolved = await probeBaseUrlBundle(baseUrl, port)
+    const resolved = await probeBaseUrlBundle(baseUrl, port, pageOrigin)
     if (resolved) return resolved
     throw buildUnresolvedTargetError(baseUrl)
   }