rnxsim 0.1.344 → 0.1.346

package/dist-lib/host/fetch-proxy-handler.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.344 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.346 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/dist-lib/host/fetch-proxy-overrides.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.344 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.346 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;

package/dist-lib/host/fetch-proxy-overrides.mjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.344 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.346 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 
 // src/host/fetch-proxy-overrides.ts
 var FETCH_PROXY_BROWSER_USER_AGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36";

package/dist-lib/host/replacement-module-handler.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.344 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.346 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;
@@ -41,6 +41,17 @@ module.exports = __toCommonJS(replacement_module_handler_exports);
 var import_promises = __toESM(require("node:fs/promises"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
 var import_esbuild = require("esbuild");
+
+// src/backend-origin.ts
+function normalizeHostname(hostname) {
+  return hostname.replace(/^\[|\]$/g, "").toLowerCase();
+}
+function isLoopbackHost(hostname) {
+  const normalized = normalizeHostname(hostname);
+  return normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "0.0.0.0" || normalized === "::1" || /^127(?:\.\d{1,3}){3}$/.test(normalized);
+}
+
+// src/host/replacement-module-handler.ts
 var REPLACEMENT_MODULE_ROUTE = "/__sootsim-replacement-module";
 var REPLACEMENT_RUNTIME_PREFIX = "/__sootsim-replacement-runtime";
 function getReplacementLoader(filePath) {
@@ -141,9 +152,18 @@ export const Appearance = rn.Appearance
 `;
 }
 function sendJavaScript(req, res, source) {
+  const origin = req.headers.origin;
+  let allowedOrigin;
+  if (origin) {
+    try {
+      if (isLoopbackHost(new URL(origin).hostname)) allowedOrigin = origin;
+    } catch {
+    }
+  }
   res.writeHead(200, {
     "Content-Type": "application/javascript; charset=utf-8",
-    "Cache-Control": "no-cache"
+    "Cache-Control": "no-cache",
+    ...allowedOrigin ? { "Access-Control-Allow-Origin": allowedOrigin, Vary: "Origin" } : {}
   });
   res.end(req.method === "HEAD" ? void 0 : source);
 }
@@ -164,6 +184,23 @@ async function handleReplacementModuleRequest(req, res, options = {}) {
   } catch {
     return false;
   }
+  if (options.requireLoopbackOrigin) {
+    const origin = req.headers.origin;
+    const remoteAddress = req.socket.remoteAddress?.replace(/^::ffff:/, "");
+    let allowed = Boolean(remoteAddress && isLoopbackHost(remoteAddress));
+    if (allowed && origin) {
+      try {
+        allowed = isLoopbackHost(new URL(origin).hostname);
+      } catch {
+        allowed = false;
+      }
+    }
+    if (!allowed) {
+      res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("replacement modules are available only to loopback origins");
+      return true;
+    }
+  }
   if (url.pathname === `${REPLACEMENT_RUNTIME_PREFIX}/react`) {
     sendJavaScript(req, res, reactRuntimeSource(options.reactBridgeUrl));
     return true;
@@ -173,6 +210,11 @@ async function handleReplacementModuleRequest(req, res, options = {}) {
     return true;
   }
   if (url.pathname !== REPLACEMENT_MODULE_ROUTE) return false;
+  if (options.requestToken && url.searchParams.get("token") !== options.requestToken) {
+    res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+    res.end("replacement module request token is invalid");
+    return true;
+  }
   const targetPath = url.searchParams.get("path");
   if (!targetPath) {
     res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
@@ -185,17 +227,42 @@ async function handleReplacementModuleRequest(req, res, options = {}) {
     res.end("replacement files must be .js, .jsx, .ts, or .tsx");
     return true;
   }
+  if (!import_node_path.default.isAbsolute(targetPath)) {
+    res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+    res.end("replacement file path must be absolute");
+    return true;
+  }
+  let resolvedProjectRoot;
+  if (options.projectRoot) {
+    const lexicalProjectRoot = import_node_path.default.resolve(options.projectRoot);
+    resolvedProjectRoot = await import_promises.default.realpath(options.projectRoot);
+    const lexicalTarget = import_node_path.default.relative(lexicalProjectRoot, targetPath);
+    if (lexicalTarget.startsWith("..") || import_node_path.default.isAbsolute(lexicalTarget)) {
+      res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("replacement file must be inside the project root");
+      return true;
+    }
+  }
+  let resolvedTargetPath;
   try {
-    await import_promises.default.access(targetPath);
+    resolvedTargetPath = await import_promises.default.realpath(targetPath);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
     res.end(`replacement file not found: ${message}`);
     return true;
   }
+  if (resolvedProjectRoot) {
+    const relativeTarget = import_node_path.default.relative(resolvedProjectRoot, resolvedTargetPath);
+    if (relativeTarget.startsWith("..") || import_node_path.default.isAbsolute(relativeTarget)) {
+      res.writeHead(403, { "Content-Type": "text/plain; charset=utf-8" });
+      res.end("replacement file must be inside the project root");
+      return true;
+    }
+  }
   try {
     const result = await (0, import_esbuild.build)({
-      entryPoints: [targetPath],
+      entryPoints: [resolvedTargetPath],
       bundle: true,
       write: false,
       format: "esm",

package/dist-lib/host/websocket-proxy.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.344 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.346 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __defProp = Object.defineProperty;