rnxsim 0.1.427 → 0.1.428

package/dist-lib/vite.cjs

@@ -1,4 +1,4 @@
-/*! rnx v0.1.427 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! rnx v0.1.428 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rnxsim",
-  "version": "0.1.427",
+  "version": "0.1.428",
   "description": "Vite and Metro plugins, testing drivers, and SDK exports for rnx.",
   "author": "Tamagui LLC",
   "license": "SEE LICENSE IN LICENSE",

package/src/host/websocket-proxy.ts

@@ -1,8 +1,19 @@
-import { WebSocket, WebSocketServer } from 'ws'
-import type { IncomingMessage } from 'http'
+import { createHash } from 'crypto'
+import { request as requestHttp, type IncomingMessage } from 'http'
+import { request as requestHttps } from 'https'
 import type { Duplex } from 'stream'
 
 export const WEBSOCKET_PROXY_PATH = '/__websocket-proxy'
+export const WEBSOCKET_PROXY_HANDSHAKE_TIMEOUT_MS = 10_000
+
+const WEBSOCKET_PROTOCOL_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/
+const WEBSOCKET_KEY = /^[+/0-9A-Za-z]{22}==$/
+
+type UpgradeRejection = {
+  status: number
+  message: string
+  headers?: Record<string, string>
+}
 
 const STRIP_UPSTREAM_HEADERS = new Set([
   'host',
@@ -17,15 +28,74 @@ const STRIP_UPSTREAM_HEADERS = new Set([
   'sec-websocket-version',
 ])
 
-function rejectUpgrade(socket: Duplex, status: number, message: string) {
+function rejectUpgrade(
+  socket: Duplex,
+  status: number,
+  message: string,
+  headers: Record<string, string> = {},
+) {
   try {
+    const extraHeaders = Object.entries(headers)
+      .map(([name, value]) => `${name}: ${value}\r\n`)
+      .join('')
     socket.write(
-      `HTTP/1.1 ${status} ${message}\r\nConnection: close\r\nContent-Type: text/plain\r\nContent-Length: ${message.length}\r\n\r\n${message}`,
+      `HTTP/1.1 ${status} ${message}\r\nConnection: close\r\nContent-Type: text/plain\r\nContent-Length: ${message.length}\r\n${extraHeaders}\r\n${message}`,
     )
   } catch {}
   socket.destroy()
 }
 
+function hasHeaderToken(value: string | undefined, token: string): boolean {
+  return (value || '').split(',').some((part) => part.trim().toLowerCase() === token)
+}
+
+function hasValidProtocolOffer(value: string | undefined): boolean {
+  if (value === undefined) return true
+  if (!WEBSOCKET_PROTOCOL_TOKEN.test(value[0] || '')) return false
+  if (!WEBSOCKET_PROTOCOL_TOKEN.test(value[value.length - 1] || '')) return false
+  const protocols = new Set<string>()
+  for (const part of value.split(',')) {
+    const protocol = part.trim()
+    if (!WEBSOCKET_PROTOCOL_TOKEN.test(protocol) || protocols.has(protocol)) {
+      return false
+    }
+    protocols.add(protocol)
+  }
+  return true
+}
+
+function validateUpgradeRequest(req: IncomingMessage): UpgradeRejection | null {
+  if (req.method !== 'GET') {
+    return { status: 405, message: 'invalid websocket http method' }
+  }
+  if (
+    !hasHeaderToken(req.headers.connection, 'upgrade') ||
+    !hasHeaderToken(req.headers.upgrade, 'websocket')
+  ) {
+    return { status: 400, message: 'invalid websocket upgrade headers' }
+  }
+  const key = req.headers['sec-websocket-key']
+  if (
+    typeof key !== 'string' ||
+    !WEBSOCKET_KEY.test(key) ||
+    Buffer.from(key, 'base64').byteLength !== 16 ||
+    Buffer.from(key, 'base64').toString('base64') !== key
+  ) {
+    return { status: 400, message: 'invalid websocket key' }
+  }
+  if (req.headers['sec-websocket-version'] !== '13') {
+    return {
+      status: 400,
+      message: 'invalid websocket version',
+      headers: { 'Sec-WebSocket-Version': '13' },
+    }
+  }
+  if (!hasValidProtocolOffer(req.headers['sec-websocket-protocol'])) {
+    return { status: 400, message: 'invalid websocket protocol offer' }
+  }
+  return null
+}
+
 function isSameOriginUpgrade(req: IncomingMessage): boolean {
   const origin = req.headers.origin
   const host = req.headers.host
@@ -58,66 +128,12 @@ function getDefaultWebSocketOrigin(targetUrl: URL): string {
   return origin.origin
 }
 
-function getRequestedProtocols(req: IncomingMessage): string[] {
-  const header = req.headers['sec-websocket-protocol']
-  const value = Array.isArray(header) ? header.join(',') : header || ''
-  return value
-    .split(',')
-    .map((part) => part.trim())
-    .filter(Boolean)
-}
-
-function safeClose(ws: WebSocket, code: number, reason: string) {
-  if (ws.readyState === WebSocket.CLOSED || ws.readyState === WebSocket.CLOSING) {
-    return
-  }
-  try {
-    ws.close(code, reason)
-  } catch {
-    ws.terminate()
-  }
-}
-
-function connectProxyPair(clientWs: WebSocket, upstream: WebSocket) {
-  let closing = false
-
-  const closeBoth = (
-    source: WebSocket,
-    target: WebSocket,
-    code: number,
-    reason: Buffer,
-  ) => {
-    if (closing) return
-    closing = true
-    safeClose(target, code, reason.toString())
-    if (source.readyState === WebSocket.OPEN) {
-      safeClose(source, code, reason.toString())
-    }
-  }
-
-  clientWs.on('message', (data, isBinary) => {
-    if (upstream.readyState === WebSocket.OPEN) {
-      upstream.send(data, { binary: isBinary })
-    }
-  })
-  upstream.on('message', (data, isBinary) => {
-    if (clientWs.readyState === WebSocket.OPEN) {
-      clientWs.send(data, { binary: isBinary })
-    }
-  })
-
-  clientWs.on('close', (code, reason) => closeBoth(clientWs, upstream, code, reason))
-  upstream.on('close', (code, reason) => closeBoth(upstream, clientWs, code, reason))
-  clientWs.on('error', () => safeClose(upstream, 1011, 'proxy client error'))
-  upstream.on('error', () => safeClose(clientWs, 1011, 'upstream websocket error'))
-}
-
-function createUpstreamWebSocket(
+function createUpstreamHeaders(
+  req: IncomingMessage,
   targetUrl: URL,
-  protocols: string[],
   headers: Record<string, string>,
   forwardOrigin: boolean,
-): WebSocket {
+): Record<string, string> {
   const upstreamHeaders = { ...headers }
   const originKeys = Object.keys(upstreamHeaders).filter(
     (key) => key.toLowerCase() === 'origin',
@@ -127,11 +143,19 @@ function createUpstreamWebSocket(
   } else if (!forwardOrigin) {
     for (const key of originKeys) delete upstreamHeaders[key]
   }
-  if (Object.keys(upstreamHeaders).length === 0)
-    return new WebSocket(targetUrl.href, protocols)
-  return new WebSocket(targetUrl.href, protocols, {
-    headers: upstreamHeaders,
-  })
+  upstreamHeaders.connection = 'Upgrade'
+  upstreamHeaders.upgrade = 'websocket'
+  const key = req.headers['sec-websocket-key']
+  if (typeof key === 'string') upstreamHeaders['sec-websocket-key'] = key
+  const version = req.headers['sec-websocket-version']
+  if (typeof version === 'string') upstreamHeaders['sec-websocket-version'] = version
+  const protocol = req.headers['sec-websocket-protocol']
+  if (typeof protocol === 'string') upstreamHeaders['sec-websocket-protocol'] = protocol
+  const extensions = req.headers['sec-websocket-extensions']
+  if (typeof extensions === 'string') {
+    upstreamHeaders['sec-websocket-extensions'] = extensions
+  }
+  return upstreamHeaders
 }
 
 export function isWebSocketProxyRequestUrl(rawUrl: string | undefined): boolean {
@@ -154,6 +178,16 @@ export function handleWebSocketProxyUpgrade(
     rejectUpgrade(socket, 403, 'forbidden websocket proxy origin')
     return true
   }
+  const upgradeRejection = validateUpgradeRequest(req)
+  if (upgradeRejection) {
+    rejectUpgrade(
+      socket,
+      upgradeRejection.status,
+      upgradeRejection.message,
+      upgradeRejection.headers,
+    )
+    return true
+  }
 
   let targetUrl: URL
   let headers: Record<string, string>
@@ -175,36 +209,107 @@ export function handleWebSocketProxyUpgrade(
     return true
   }
 
-  const protocols = getRequestedProtocols(req)
-  const upstream = createUpstreamWebSocket(targetUrl, protocols, headers, forwardOrigin)
-  let completed = false
+  const upstreamHeaders = createUpstreamHeaders(req, targetUrl, headers, forwardOrigin)
+  let settled = false
+  const request = targetUrl.protocol === 'wss:' ? requestHttps : requestHttp
+  const upstreamRequestUrl = new URL(targetUrl)
+  upstreamRequestUrl.protocol = targetUrl.protocol === 'wss:' ? 'https:' : 'http:'
+  const upstreamRequest = request(upstreamRequestUrl, {
+    method: 'GET',
+    headers: upstreamHeaders,
+  })
+  let destroyUpstreamSocket = () => {}
+  upstreamRequest.once('socket', (upstreamSocket) => {
+    destroyUpstreamSocket = () => upstreamSocket.destroy()
+  })
+  const fail = (status: number, message: string) => {
+    if (settled) return
+    settled = true
+    clearTimeout(timer)
+    upstreamRequest.destroy()
+    destroyUpstreamSocket()
+    rejectUpgrade(socket, status, message)
+  }
+  const timer = setTimeout(() => {
+    fail(504, 'upstream websocket handshake timeout')
+  }, WEBSOCKET_PROXY_HANDSHAKE_TIMEOUT_MS)
   socket.once('close', () => {
-    if (!completed) upstream.terminate()
+    if (!settled) {
+      settled = true
+      clearTimeout(timer)
+    }
+    upstreamRequest.destroy()
+    destroyUpstreamSocket()
   })
-  upstream.once('open', () => {
-    if (completed) return
-    completed = true
-    const selectedProtocol = upstream.protocol
-    const proxyServer = new WebSocketServer({
-      noServer: true,
-      clientTracking: false,
-      handleProtocols(requestedProtocols) {
-        return selectedProtocol || requestedProtocols.values().next().value || false
-      },
-    })
-    proxyServer.handleUpgrade(req, socket, head, (clientWs) => {
-      connectProxyPair(clientWs, upstream)
-    })
+  upstreamRequest.once('response', (response) => {
+    response.resume()
+    fail(502, 'upstream websocket rejected upgrade')
   })
-  upstream.once('error', () => {
-    if (completed) return
-    completed = true
-    rejectUpgrade(socket, 502, 'upstream websocket error')
+  upstreamRequest.once('error', () => {
+    fail(502, 'upstream websocket error')
   })
-  upstream.once('close', () => {
-    if (completed) return
-    completed = true
-    rejectUpgrade(socket, 502, 'upstream websocket closed')
+  upstreamRequest.once('upgrade', (response, upstreamSocket, upstreamHead) => {
+    if (settled) {
+      upstreamSocket.destroy()
+      return
+    }
+    const accept = response.headers['sec-websocket-accept']
+    const upgrade = response.headers.upgrade
+    const requestKey = req.headers['sec-websocket-key']
+    const expectedAccept =
+      typeof requestKey === 'string'
+        ? createHash('sha1')
+            .update(`${requestKey}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`)
+            .digest('base64')
+        : ''
+    if (
+      typeof accept !== 'string' ||
+      accept !== expectedAccept ||
+      typeof upgrade !== 'string' ||
+      upgrade.toLowerCase() !== 'websocket'
+    ) {
+      upstreamSocket.destroy()
+      fail(502, 'upstream websocket handshake is invalid')
+      return
+    }
+    const selectedProtocol = response.headers['sec-websocket-protocol']
+    const requestedProtocols = (req.headers['sec-websocket-protocol'] || '')
+      .split(',')
+      .map((protocol) => protocol.trim())
+    if (
+      typeof selectedProtocol === 'string' &&
+      !requestedProtocols.includes(selectedProtocol)
+    ) {
+      upstreamSocket.destroy()
+      fail(502, 'upstream websocket selected an unrequested protocol')
+      return
+    }
+    settled = true
+    clearTimeout(timer)
+    const responseHeaders = [
+      'HTTP/1.1 101 Switching Protocols',
+      'Upgrade: websocket',
+      'Connection: Upgrade',
+      `Sec-WebSocket-Accept: ${accept}`,
+    ]
+    if (typeof selectedProtocol === 'string') {
+      responseHeaders.push(`Sec-WebSocket-Protocol: ${selectedProtocol}`)
+    }
+    const selectedExtensions = response.headers['sec-websocket-extensions']
+    if (typeof selectedExtensions === 'string') {
+      responseHeaders.push(`Sec-WebSocket-Extensions: ${selectedExtensions}`)
+    }
+    // the upstream and browser used the same websocket key and extension offer,
+    // so their negotiated byte streams can be relayed without decoding frames.
+    socket.write(`${responseHeaders.join('\r\n')}\r\n\r\n`)
+    if (head.length > 0) upstreamSocket.write(head)
+    if (upstreamHead.length > 0) socket.write(upstreamHead)
+    socket.once('close', () => upstreamSocket.destroy())
+    socket.once('error', () => upstreamSocket.destroy())
+    upstreamSocket.once('error', () => socket.destroy())
+    socket.pipe(upstreamSocket)
+    upstreamSocket.pipe(socket)
   })
+  upstreamRequest.end()
   return true
 }

package/src/metro-production-bundle.ts

@@ -130,11 +130,34 @@ export function readRNXMetroModuleIdentity(
   }
 
   const version = Reflect.get(parsed, 'version')
-  // stored artifacts from before the versioned footer carry a bare module-path
-  // map with no version field. they are development bundles whose identity
-  // comes from Metro's verbose names, so treat their footer as absent rather
-  // than failing every stored replay.
-  if (version === undefined) return null
+  // stored artifacts from before the versioned footer carry a bare
+  // `{"<moduleId>":"<path>", ...}` map with no wrapper — the exact shape
+  // appendRNXModulePaths wrote before the footer was versioned, and the only
+  // writer of that shape used identitySource 'rnx-plugin'. normalize it into
+  // the current in-memory identity so callers get the same exact modulePaths
+  // map instead of falling back to name-scanning or fingerprint inference.
+  // validateRNXMetroModuleIdentity still detects a missing, extra, duplicate,
+  // or truncated module ID against the bundle's own __d() defines, so those
+  // legacy-map corruptions are caught there, not trusted here — it does not
+  // corroborate that a path or factory is itself correct.
+  if (version === undefined) {
+    const modulePaths: RNXMetroModulePathMap = Object.fromEntries(
+      Object.entries(parsed).map(([moduleId, modulePath]) => {
+        if (typeof modulePath !== 'string') {
+          throw new Error(`Metro module identity has an invalid path for ${moduleId}`)
+        }
+        return [moduleId, modulePath]
+      }),
+    )
+    return {
+      source: withoutMap.slice(0, footerStart),
+      version: RNX_METRO_MODULE_IDENTITY_VERSION,
+      identitySource: 'rnx-plugin',
+      modulePaths,
+      logicalSpecifiers: {},
+      sourceMappingUrl: detached.sourceMappingUrl,
+    }
+  }
   const identitySource = Reflect.get(parsed, 'identitySource')
   const parsedModulePaths = Reflect.get(parsed, 'modulePaths')
   const parsedLogicalSpecifiers = Reflect.get(parsed, 'logicalSpecifiers')
@@ -153,32 +176,34 @@ export function readRNXMetroModuleIdentity(
     throw new Error('Metro module identity footer is malformed')
   }
 
-  const modulePaths: RNXMetroModulePathMap = {}
-  for (const [moduleId, modulePath] of Object.entries(parsedModulePaths)) {
-    if (typeof modulePath !== 'string') {
-      throw new Error(`Metro module identity has an invalid path for ${moduleId}`)
-    }
-    modulePaths[moduleId] = modulePath
-  }
-  const logicalSpecifiers: RNXMetroLogicalSpecifierMap = {}
-  for (const [moduleId, specifiers] of Object.entries(parsedLogicalSpecifiers)) {
-    if (
-      !Array.isArray(specifiers) ||
-      specifiers.length === 0 ||
-      !specifiers.every(
-        (specifier) => typeof specifier === 'string' && specifier.length > 0,
+  const modulePaths: RNXMetroModulePathMap = Object.fromEntries(
+    Object.entries(parsedModulePaths).map(([moduleId, modulePath]) => {
+      if (typeof modulePath !== 'string') {
+        throw new Error(`Metro module identity has an invalid path for ${moduleId}`)
+      }
+      return [moduleId, modulePath]
+    }),
+  )
+  const logicalSpecifiers: RNXMetroLogicalSpecifierMap = Object.fromEntries(
+    Object.entries(parsedLogicalSpecifiers).map(([moduleId, specifiers]) => {
+      if (
+        !Array.isArray(specifiers) ||
+        specifiers.length === 0 ||
+        !specifiers.every(
+          (specifier) => typeof specifier === 'string' && specifier.length > 0,
+        )
+      ) {
+        throw new Error(`Metro module identity has invalid specifiers for ${moduleId}`)
+      }
+      const unique = [...new Set(specifiers)].sort((left, right) =>
+        left.localeCompare(right),
       )
-    ) {
-      throw new Error(`Metro module identity has invalid specifiers for ${moduleId}`)
-    }
-    const unique = [...new Set(specifiers)].sort((left, right) =>
-      left.localeCompare(right),
-    )
-    if (unique.length !== specifiers.length) {
-      throw new Error(`Metro module identity repeats a specifier for ${moduleId}`)
-    }
-    logicalSpecifiers[moduleId] = unique
-  }
+      if (unique.length !== specifiers.length) {
+        throw new Error(`Metro module identity repeats a specifier for ${moduleId}`)
+      }
+      return [moduleId, unique]
+    }),
+  )
   return {
     source: withoutMap.slice(0, footerStart),
     version,