sandboxedjs 0.1.0 → 0.1.1

package/dist/index.cjs

@@ -3,8 +3,6 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var headless = require('@scelar/nodepod/headless');
-var zlib = require('zlib');
-var crypto$1 = require('crypto');
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -15137,6 +15135,206 @@ var commands5 = [grep, find, xargs, diff, cmp];
 // src/bin/archive.ts
 init_mode();
 init_path();
+
+// src/util/binary.ts
+var isNode = typeof process !== "undefined" && process.versions != null && process.versions.node != null;
+async function nodeBuiltin(name) {
+  const specifier = `node:${name}`;
+  return await import(
+    /* @vite-ignore */
+    /* webpackIgnore: true */
+    specifier
+  );
+}
+var zlibPromise = null;
+function nodeZlib() {
+  zlibPromise ??= nodeBuiltin("zlib");
+  return zlibPromise;
+}
+async function throughStream(data, stream) {
+  const source = new Blob([data]).stream();
+  const piped = source.pipeThrough(stream);
+  return new Uint8Array(await new Response(piped).arrayBuffer());
+}
+async function gzip(data) {
+  if (isNode) return new Uint8Array((await nodeZlib()).gzipSync(data));
+  return throughStream(data, new CompressionStream("gzip"));
+}
+async function gunzip(data) {
+  if (isNode) return new Uint8Array((await nodeZlib()).gunzipSync(data));
+  return throughStream(data, new DecompressionStream("gzip"));
+}
+async function deflate(data) {
+  if (isNode) return new Uint8Array((await nodeZlib()).deflateSync(data));
+  return throughStream(data, new CompressionStream("deflate"));
+}
+async function inflate(data) {
+  if (isNode) return new Uint8Array((await nodeZlib()).inflateSync(data));
+  return throughStream(data, new DecompressionStream("deflate"));
+}
+async function inflateRaw(data) {
+  if (isNode) return new Uint8Array((await nodeZlib()).inflateRawSync(data));
+  return throughStream(data, new DecompressionStream("deflate-raw"));
+}
+var cryptoPromise = null;
+function nodeCrypto() {
+  cryptoPromise ??= nodeBuiltin("crypto");
+  return cryptoPromise;
+}
+var SUBTLE_NAMES = {
+  sha1: "SHA-1",
+  sha256: "SHA-256",
+  sha384: "SHA-384",
+  sha512: "SHA-512"
+};
+var UnsupportedAlgorithmError = class extends Error {
+  constructor(algorithm) {
+    super(`${algorithm} is not available in this environment`);
+    this.name = "UnsupportedAlgorithmError";
+  }
+};
+async function digestHex(algorithm, data) {
+  if (isNode) {
+    const { createHash } = await nodeCrypto();
+    return createHash(algorithm).update(data).digest("hex");
+  }
+  if (algorithm === "md5") return md5Hex(data);
+  const name = SUBTLE_NAMES[algorithm];
+  if (!name) throw new UnsupportedAlgorithmError(algorithm);
+  const buffer = await crypto.subtle.digest(name, data);
+  return toHex(new Uint8Array(buffer));
+}
+async function randomUuid() {
+  if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
+  const { randomUUID } = await nodeCrypto();
+  return randomUUID();
+}
+function toHex(bytes) {
+  let out = "";
+  for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
+  return out;
+}
+function md5Hex(input) {
+  const S = [
+    7,
+    12,
+    17,
+    22,
+    7,
+    12,
+    17,
+    22,
+    7,
+    12,
+    17,
+    22,
+    7,
+    12,
+    17,
+    22,
+    5,
+    9,
+    14,
+    20,
+    5,
+    9,
+    14,
+    20,
+    5,
+    9,
+    14,
+    20,
+    5,
+    9,
+    14,
+    20,
+    4,
+    11,
+    16,
+    23,
+    4,
+    11,
+    16,
+    23,
+    4,
+    11,
+    16,
+    23,
+    4,
+    11,
+    16,
+    23,
+    6,
+    10,
+    15,
+    21,
+    6,
+    10,
+    15,
+    21,
+    6,
+    10,
+    15,
+    21,
+    6,
+    10,
+    15,
+    21
+  ];
+  const K = new Uint32Array(64);
+  for (let i = 0; i < 64; i++) K[i] = Math.floor(Math.abs(Math.sin(i + 1)) * 2 ** 32);
+  const bitLength = input.length * 8;
+  const padded = new Uint8Array(((input.length + 8 >> 6) + 1) * 64);
+  padded.set(input);
+  padded[input.length] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(padded.length - 8, bitLength >>> 0, true);
+  view.setUint32(padded.length - 4, Math.floor(bitLength / 2 ** 32), true);
+  let a0 = 1732584193;
+  let b0 = 4023233417;
+  let c0 = 2562383102;
+  let d0 = 271733878;
+  for (let chunk = 0; chunk < padded.length; chunk += 64) {
+    const M = new Uint32Array(16);
+    for (let i = 0; i < 16; i++) M[i] = view.getUint32(chunk + i * 4, true);
+    let [a, b, c, d] = [a0, b0, c0, d0];
+    for (let i = 0; i < 64; i++) {
+      let f;
+      let g;
+      if (i < 16) {
+        f = b & c | ~b & d;
+        g = i;
+      } else if (i < 32) {
+        f = d & b | ~d & c;
+        g = (5 * i + 1) % 16;
+      } else if (i < 48) {
+        f = b ^ c ^ d;
+        g = (3 * i + 5) % 16;
+      } else {
+        f = c ^ (b | ~d);
+        g = 7 * i % 16;
+      }
+      const tmp = d;
+      d = c;
+      c = b;
+      const sum = a + f + K[i] + M[g] >>> 0;
+      b = b + (sum << S[i] | sum >>> 32 - S[i]) >>> 0;
+      a = tmp;
+    }
+    a0 = a0 + a >>> 0;
+    b0 = b0 + b >>> 0;
+    c0 = c0 + c >>> 0;
+    d0 = d0 + d >>> 0;
+  }
+  const out = new Uint8Array(16);
+  new DataView(out.buffer).setUint32(0, a0, true);
+  new DataView(out.buffer).setUint32(4, b0, true);
+  new DataView(out.buffer).setUint32(8, c0, true);
+  new DataView(out.buffer).setUint32(12, d0, true);
+  return toHex(out);
+}
+
+// src/bin/archive.ts
 var BLOCK = 512;
 var encoder4 = new TextEncoder();
 var decoder6 = new TextDecoder();
@@ -15294,7 +15492,7 @@ var tar = defineCommand({
       };
       for (const operand of args.positional) add(resolve(baseDir, operand), operand);
       let bytes2 = createTar(entries2);
-      if (compressed) bytes2 = new Uint8Array(zlib.gzipSync(bytes2));
+      if (compressed) bytes2 = await gzip(bytes2);
       if (archive === void 0 || archive === "-") ctx.write(bytes2);
       else ctx.vfs.writeFile(ctx.path(archive), bytes2, { cred: ctx.cred, mode: 420 });
       return 0;
@@ -15308,7 +15506,7 @@ var tar = defineCommand({
         return ctx.reportError(e, archive);
       }
     }
-    if (bytes[0] === 31 && bytes[1] === 139) bytes = new Uint8Array(zlib.gunzipSync(bytes));
+    if (bytes[0] === 31 && bytes[1] === 139) bytes = await gunzip(bytes);
     const entries = readTar(bytes);
     const strip = args.num("strip-components", 0);
     if (args.has("list")) {
@@ -15354,7 +15552,7 @@ var tar = defineCommand({
     return 2;
   }
 });
-var gzip = defineCommand({
+var gzip2 = defineCommand({
   name: "gzip",
   path: "/bin/gzip",
   summary: "compress files",
@@ -15377,28 +15575,28 @@ var gzip = defineCommand({
       toStdout,
       keep: args.has("keep") || ctx.name === "zcat",
       suffix: ".gz",
-      compress: (data) => new Uint8Array(zlib.gzipSync(data)),
-      expand: (data) => new Uint8Array(zlib.gunzipSync(data))
+      compress: (data) => gzip(data),
+      expand: (data) => gunzip(data)
     });
   }
 });
-var gunzip = defineCommand({
+var gunzip2 = defineCommand({
   name: "gunzip",
   path: "/bin/gunzip",
   summary: "decompress files",
-  run: (ctx) => gzip.run(ctx)
+  run: (ctx) => gzip2.run(ctx)
 });
 var zcat = defineCommand({
   name: "zcat",
   path: "/bin/zcat",
   summary: "decompress files to standard output",
-  run: (ctx) => gzip.run(ctx)
+  run: (ctx) => gzip2.run(ctx)
 });
 async function runCompressor(ctx, operands, opts) {
   if (operands.length === 0) {
     const data = await ctx.stdin.readAll();
     try {
-      ctx.write(opts.decompress ? opts.expand(data) : opts.compress(data));
+      ctx.write(opts.decompress ? await opts.expand(data) : await opts.compress(data));
       return 0;
     } catch (e) {
       return ctx.fail(e instanceof Error ? e.message : String(e));
@@ -15415,7 +15613,7 @@ async function runCompressor(ctx, operands, opts) {
       continue;
     }
     try {
-      const result = opts.decompress ? opts.expand(data) : opts.compress(data);
+      const result = opts.decompress ? await opts.expand(data) : await opts.compress(data);
       if (opts.toStdout) {
         ctx.write(result);
         continue;
@@ -15441,12 +15639,14 @@ var zlibCompress = defineCommand({
       toStdout: args.has("stdout"),
       keep: false,
       suffix: ".Z",
-      compress: (data) => new Uint8Array(zlib.deflateSync(data)),
-      expand: (data) => new Uint8Array(zlib.inflateSync(data))
+      compress: (data) => deflate(data),
+      expand: (data) => inflate(data)
     });
   }
 });
-var commands6 = [tar, gzip, gunzip, zcat, zlibCompress];
+var commands6 = [tar, gzip2, gunzip2, zcat, zlibCompress];
+
+// src/bin/hash.ts
 function makeSum(name, algorithm, path) {
   return defineCommand({
     name,
@@ -15465,7 +15665,7 @@ function makeSum(name, algorithm, path) {
       if (args.has("check")) return checkSums(ctx, algorithm, args.positional, args.has("quiet") || args.has("status"));
       const { sources, ok } = await readInputs(ctx, args.positional, { stdinName: "-" });
       for (const source of sources) {
-        const digest = crypto$1.createHash(algorithm).update(source.bytes).digest("hex");
+        const digest = await digestHex(algorithm, source.bytes);
         if (args.has("tag")) ctx.line(`${algorithm.toUpperCase()} (${source.name}) = ${digest}`);
         else ctx.line(`${digest}  ${source.name}`);
       }
@@ -15486,7 +15686,7 @@ async function checkSums(ctx, algorithm, files, quiet) {
       const [, expected, name] = m;
       try {
         const bytes = ctx.vfs.readFile(ctx.path(name), ctx.cred);
-        const actual = crypto$1.createHash(algorithm).update(bytes).digest("hex");
+        const actual = await digestHex(algorithm, bytes);
         if (actual === expected.toLowerCase()) {
           if (!quiet) ctx.line(`${name}: OK`);
         } else {
@@ -15617,8 +15817,8 @@ var uuidgen = defineCommand({
   name: "uuidgen",
   path: "/usr/bin/uuidgen",
   summary: "create a new UUID value",
-  run(ctx) {
-    ctx.line(crypto$1.randomUUID());
+  async run(ctx) {
+    ctx.line(await randomUuid());
     return 0;
   }
 });
@@ -17692,7 +17892,7 @@ var pip = defineCommand({
         }
         const data = new Uint8Array(await (await fetch(wheel.url)).arrayBuffer());
         ctx.line(`  Downloading ${wheel.filename} (${Math.round(data.length / 1024)} kB)`);
-        installWheel(ctx, siteDir, data, name, chosen);
+        await installWheel(ctx, siteDir, data, name, chosen);
         ctx.line(`Successfully installed ${name}-${chosen}`);
       } catch (e) {
         ctx.warn(`ERROR: Could not install ${spec}: ${e instanceof Error ? e.message : String(e)}`);
@@ -17702,8 +17902,8 @@ var pip = defineCommand({
     return status;
   }
 });
-function installWheel(ctx, siteDir, data, name, version) {
-  const entries = readZip(data);
+async function installWheel(ctx, siteDir, data, name, version) {
+  const entries = await readZip(data);
   for (const entry of entries) {
     if (entry.name.endsWith("/")) continue;
     const target = join(siteDir, entry.name);
@@ -17717,7 +17917,7 @@ function installWheel(ctx, siteDir, data, name, version) {
 Version: ${version}
 `, { cred: ctx.cred });
 }
-function readZip(data) {
+async function readZip(data) {
   const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
   const entries = [];
   let eocd = -1;
@@ -17743,7 +17943,7 @@ function readZip(data) {
     const localExtraLength = view.getUint16(localOffset + 28, true);
     const dataStart = localOffset + 30 + localNameLength + localExtraLength;
     const raw = data.subarray(dataStart, dataStart + compressedSize);
-    entries.push({ name, data: method === 0 ? raw.slice() : new Uint8Array(zlib.inflateRawSync(raw)) });
+    entries.push({ name, data: method === 0 ? raw.slice() : await inflateRaw(raw) });
     offset += 46 + nameLength + extraLength + commentLength;
   }
   return entries;
@@ -17774,9 +17974,17 @@ function findProjectRoot(ctx) {
 function writeManifest(ctx, path, manifest) {
   ctx.vfs.writeFile(path, JSON.stringify(manifest, null, 2) + "\n", { cred: ctx.cred, mode: 420 });
 }
+function splitPackageSpec(spec) {
+  const at = spec.lastIndexOf("@");
+  if (at <= 0) return { name: spec };
+  return { name: spec.slice(0, at), version: spec.slice(at + 1) };
+}
 async function installPackages(ctx, specs, opts) {
   const installer = opts.cwd === "/" ? ctx.kernel.pod.packages : new headless.DependencyInstaller(ctx.vfs.volume, { cwd: opts.cwd });
-  const onProgress = (message) => ctx.stderr.write(message.endsWith("\n") ? message : message + "\n");
+  const onProgress = (message) => {
+    if (!opts.quiet) ctx.stderr.write(message.endsWith("\n") ? message : message + "\n");
+  };
+  const note = (text) => opts.quiet ? ctx.stderr.write(text + "\n") : ctx.line(text);
   if (!ctx.kernel.net.options.allowOutbound) {
     ctx.warn("npm error code ENOTFOUND");
     ctx.warn("npm error network request to https://registry.npmjs.org failed");
@@ -17786,7 +17994,7 @@ async function installPackages(ctx, specs, opts) {
   }
   try {
     if (specs.length === 0) {
-      ctx.line(`npm install (project at ${opts.cwd})`);
+      note(`npm install (project at ${opts.cwd})`);
       await installer.installFromManifest(join(opts.cwd, "package.json"), {
         withDevDeps: true,
         onProgress,
@@ -17794,11 +18002,8 @@ async function installPackages(ctx, specs, opts) {
       });
     } else {
       for (const spec of specs) {
-        const at = spec.lastIndexOf("@");
-        const scoped = spec.startsWith("@");
-        const name = at > 0 && !(scoped && at === 0) ? spec.slice(0, at) : spec;
-        const version = at > 0 && !(scoped && at === 0) ? spec.slice(at + 1) : void 0;
-        ctx.line(`added ${name}${version ? `@${version}` : ""}`);
+        const { name, version } = splitPackageSpec(spec);
+        note(`added ${name}${version ? `@${version}` : ""}`);
         await installer.install(name, version, {
           onProgress,
           persist: opts.save !== false,
@@ -18042,33 +18247,127 @@ function printNpmHelp(ctx) {
   ctx.line("");
   ctx.line(`npm@${NPM_VERSION} /usr/lib/node_modules/npm`);
 }
+function packageBinaries(ctx, root, packageName) {
+  const manifestPath = join(root, "node_modules", packageName, "package.json");
+  try {
+    const manifest = JSON.parse(ctx.vfs.readText(manifestPath, ctx.cred));
+    if (typeof manifest.bin === "string") return [basename(packageName)];
+    if (manifest.bin && typeof manifest.bin === "object") return Object.keys(manifest.bin);
+  } catch {
+  }
+  return [];
+}
+function findLocalBin(ctx, name) {
+  let dir3 = ctx.cwd;
+  for (let i = 0; i < 64; i++) {
+    const candidate = join(dir3, "node_modules", ".bin", name);
+    if (ctx.vfs.lexists(candidate)) return candidate;
+    const parent = dirname(dir3);
+    if (parent === dir3) break;
+    dir3 = parent;
+  }
+  return null;
+}
 var npx = defineCommand({
   name: "npx",
   path: "/usr/bin/npx",
   summary: "run a command from a local or remote npm package",
+  usage: "npx [-y] [-p package] <command> [args]",
+  manual: `Runs a package binary, installing the package first if it is not
+already present. Installation needs outbound network access, which is off
+unless the container was created with network: { allowOutbound: true }.`,
   async run(ctx) {
-    const args = parseArgs(ctx.args, [{ short: "y", long: "yes" }, { long: "no-install" }, { short: "p", long: "package", arg: true }], {
-      stopAtFirstPositional: true
-    });
-    if (args.positional.length === 0) return ctx.fail("npx: a command is required", 1);
+    const args = parseArgs(
+      ctx.args,
+      [
+        { short: "y", long: "yes" },
+        { long: "no-install" },
+        { short: "p", long: "package", arg: true, multiple: true },
+        { short: "q", long: "quiet" },
+        { short: "c", long: "call", arg: true },
+        { long: "version" },
+        { long: "help" }
+      ],
+      { stopAtFirstPositional: true, allowUnknown: true }
+    );
+    if (args.has("version")) {
+      ctx.line(NPM_VERSION);
+      return 0;
+    }
+    if (args.has("help")) {
+      ctx.line("Usage: npx [options] <command>[@version] [command-arg]...");
+      ctx.line("");
+      ctx.line("Options:");
+      ctx.line("  -y, --yes            skip the install confirmation (always implied here)");
+      ctx.line("  -p, --package <pkg>  package providing the command (repeatable)");
+      ctx.line("      --no-install     fail instead of installing a missing package");
+      ctx.line("  -q, --quiet          suppress install progress");
+      return 0;
+    }
+    const call = args.str("call");
+    const operands = call ? call.split(/\s+/).filter(Boolean) : args.positional;
+    if (operands.length === 0) {
+      ctx.warn("a command is required");
+      ctx.warn("usage: npx [options] <command>[@version] [command-arg]...");
+      return 1;
+    }
     const root = findProjectRoot(ctx);
-    const [name, ...rest] = args.positional;
-    const binPath = join(root, "node_modules", ".bin", name);
-    if (!ctx.vfs.lexists(binPath) && ctx.kernel.net.options.allowOutbound) {
-      ctx.stderr.write(`npx: installing ${name}...
+    const binDir = join(root, "node_modules", ".bin");
+    const [spec, ...rest] = operands;
+    const { name: specName, version } = splitPackageSpec(spec);
+    const packages = args.list("package");
+    const packageSpec = packages[0] ?? spec;
+    const packageName = packages[0] ? splitPackageSpec(packages[0]).name : specName;
+    let command = packages.length > 0 ? spec : basename(specName);
+    const run = async (binary) => {
+      const env2 = {
+        ...ctx.env,
+        PATH: `${binDir}:${ctx.env.PATH ?? ""}`,
+        npm_config_user_agent: `npm/${NPM_VERSION} node/${NODE_VERSION} linux x64`
+      };
+      return await ctx.kernel.spawn([binary, ...rest], {
+        cwd: ctx.cwd,
+        env: env2,
+        cred: ctx.cred,
+        ppid: ctx.proc.pid,
+        stdin: ctx.stdin,
+        stdout: ctx.stdout,
+        stderr: ctx.stderr
+      }).wait();
+    };
+    if (!version) {
+      if (findLocalBin(ctx, command)) return run(command);
+      if (ctx.kernel.which(command, ctx.cwd, ctx.env, ctx.cred)) return run(command);
+    }
+    if (args.has("no-install")) {
+      ctx.warn(`command not found: ${command}`);
+      return 127;
+    }
+    if (!ctx.kernel.net.options.allowOutbound) {
+      ctx.warn(`could not determine executable to run: ${command}`);
+      ctx.warn(`'${packageName}' is not installed, and installing it needs network access.`);
+      ctx.warn("Outbound network access is disabled for this container.");
+      ctx.warn("Enable it with createContainer({ network: { allowOutbound: true } }).");
+      return 127;
+    }
+    ctx.stderr.write(`npx: installing ${packageSpec}...
 `);
-      await installPackages(ctx, [name], { cwd: root, save: false });
+    const installed = await installPackages(ctx, [packageSpec], {
+      cwd: root,
+      save: false,
+      quiet: true
+    });
+    if (installed !== 0) return installed;
+    if (!findLocalBin(ctx, command)) {
+      const binaries = packageBinaries(ctx, root, packageName);
+      const chosen = binaries.includes(command) ? command : binaries[0];
+      if (chosen === void 0) {
+        ctx.warn(`could not determine executable to run: ${packageName} provides no binary`);
+        return 127;
+      }
+      command = chosen;
     }
-    const env2 = { ...ctx.env, PATH: `${join(root, "node_modules", ".bin")}:${ctx.env.PATH ?? ""}` };
-    return await ctx.kernel.spawn([name, ...rest], {
-      cwd: ctx.cwd,
-      env: env2,
-      cred: ctx.cred,
-      ppid: ctx.proc.pid,
-      stdin: ctx.stdin,
-      stdout: ctx.stdout,
-      stderr: ctx.stderr
-    }).wait();
+    return run(command);
   }
 });
 function makeNpmAlias(name, path) {
@@ -18487,7 +18786,7 @@ var Container = class _Container {
   }
   // ── boot ──────────────────────────────────────────────────────────────────
   static async create(opts = {}) {
-    const pod = await headless.Nodepod.boot({
+    const pod = opts.pod ?? await headless.Nodepod.boot({
       headless: true,
       serviceWorker: false,
       env: opts.env ?? {},
@@ -18538,8 +18837,8 @@ var Container = class _Container {
   /** Copy a directory tree from the host filesystem into the container. */
   async copyIn(hostPath, containerPath) {
     this.assertActive();
-    const { readdir, readFile, stat: stat2 } = await import('fs/promises');
-    const nodePath = await import('path');
+    const { readdir, readFile, stat: stat2 } = await nodeBuiltin("fs/promises");
+    const nodePath = await nodeBuiltin("path");
     const walk = async (src, dest) => {
       const st = await stat2(src);
       if (st.isDirectory()) {
@@ -18566,8 +18865,8 @@ var Container = class _Container {
   /** Copy a file or directory out of the container onto the host. */
   async copyOut(containerPath, hostPath) {
     this.assertActive();
-    const { mkdir: mkdir2, writeFile } = await import('fs/promises');
-    const nodePath = await import('path');
+    const { mkdir: mkdir2, writeFile } = await nodeBuiltin("fs/promises");
+    const nodePath = await nodeBuiltin("path");
     const src = resolve(this.defaults.cwd, containerPath);
     const walk = async (from, to) => {
       const st = this.kernel.vfs.lstat(from);
@@ -18791,7 +19090,7 @@ var Container = class _Container {
    */
   async expose(port, opts = {}) {
     this.assertActive();
-    const http = await import('http');
+    const http = await nodeBuiltin("http");
     const container = this;
     const server = http.createServer((req, res) => {
       const chunks = [];