sandboxedjs 0.1.1 → 0.1.2

package/README.md

@@ -591,9 +591,11 @@ a tested claim.
 
 Honest list of what does not work:
 
-- **Vite's dev server** starts but fails resolving its own package metadata, because Nodepod's
-  ESM layer does not give bundled chunks a correct `import.meta.url`. Express, Koa, Fastify-style
-  apps and plain `http` servers work. See `examples/react-app` for a React setup that runs.
+- **Vite's dev server** loads and reads its config, then stops when esbuild starts: Nodepod
+  initialises esbuild by importing it from a CDN over `https:`, which the Node ESM loader
+  refuses. Anything that needs esbuild — Vite, and tools built on it — is therefore unavailable
+  under Node. Express, Koa, Fastify-style apps and plain `http` servers work. See
+  `examples/react-app` for a React setup that runs.
 - **Python is MicroPython**, so C extensions (`numpy`, `pandas`, `cryptography`) are unavailable.
 - **No real sockets.** HTTP servers work through the request proxy; raw TCP/UDP does not.
 - **No real processes.** Processes are cooperative async tasks: `kill -9` cannot interrupt a

package/dist/index.cjs

@@ -3,6 +3,7 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var headless = require('@scelar/nodepod/headless');
+var acorn = require('acorn');
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -17951,6 +17952,226 @@ async function readZip(data) {
 function pythonCommands() {
   return [python, pip];
 }
+var DECLARES_EXPORTS = /(?:^|[\s;{)])(?:var|let|const|function|class)\s+exports\b/;
+var NAME = "exports";
+function renameShadowedExports(source) {
+  if (!DECLARES_EXPORTS.test(source)) return null;
+  let ast;
+  try {
+    ast = acorn.parse(source, {
+      ecmaVersion: "latest",
+      sourceType: "module",
+      allowAwaitOutsideFunction: true,
+      allowHashBang: true
+    });
+  } catch {
+    return null;
+  }
+  const body = ast.body;
+  const isModule = body.some(
+    (node2) => node2.type.startsWith("Import") || node2.type.startsWith("Export")
+  );
+  if (!isModule) return null;
+  const programScope = { bindsExports: hoistedNames(body).has(NAME), parent: null };
+  if (!programScope.bindsExports) return null;
+  const targets = [];
+  let bail = false;
+  visit(ast, programScope);
+  if (bail || targets.length === 0) return null;
+  const replacement = freshName(source);
+  let out = source;
+  for (const target of [...targets].sort((a, b) => b.start - a.start)) {
+    const text = target.shorthand ? `${NAME}: ${replacement}` : replacement;
+    out = out.slice(0, target.start) + text + out.slice(target.end);
+  }
+  return out;
+  function visit(node2, scope) {
+    if (bail) return;
+    let childScope = scope;
+    let skip = NOTHING;
+    switch (node2.type) {
+      case "FunctionDeclaration":
+      case "FunctionExpression":
+      case "ArrowFunctionExpression": {
+        const names = /* @__PURE__ */ new Set();
+        for (const param of node2.params ?? []) collectPattern(param, names);
+        if (isExports(node2.id) && node2.type === "FunctionExpression") names.add(NAME);
+        const fnBody = node2.body;
+        if (fnBody?.type === "BlockStatement") {
+          for (const name of hoistedNames(fnBody.body)) names.add(name);
+        }
+        childScope = { bindsExports: names.has(NAME), parent: scope };
+        break;
+      }
+      case "CatchClause": {
+        const names = /* @__PURE__ */ new Set();
+        if (node2.param) collectPattern(node2.param, names);
+        childScope = { bindsExports: names.has(NAME), parent: scope };
+        break;
+      }
+      case "ClassDeclaration":
+      case "ClassExpression":
+        if (isExports(node2.id) && node2.type === "ClassExpression") {
+          childScope = { bindsExports: true, parent: scope };
+        }
+        break;
+      case "BlockStatement":
+      case "StaticBlock":
+        if (node2 !== ast.body) {
+          childScope = {
+            bindsExports: blockNames(node2.body).has(NAME),
+            parent: scope
+          };
+        }
+        break;
+      case "ForStatement":
+      case "ForInStatement":
+      case "ForOfStatement": {
+        const head2 = node2.init ?? node2.left;
+        if (head2?.type === "VariableDeclaration" && head2.kind !== "var") {
+          const names = /* @__PURE__ */ new Set();
+          for (const declarator of head2.declarations) {
+            collectPattern(declarator.id, names);
+          }
+          childScope = { bindsExports: names.has(NAME), parent: scope };
+        }
+        break;
+      }
+      /* `export { exports }` would have to become `exports as exports`, and
+       * `import { exports as x }` names someone else's binding. Neither is
+       * worth handling; refuse rather than rewrite them wrongly. */
+      case "ExportSpecifier":
+      case "ImportSpecifier":
+        if (isExports(node2.local) || isExports(node2.exported) || isExports(node2.imported)) {
+          bail = true;
+        }
+        return;
+      case "Identifier":
+        if (node2.name === NAME && resolvesToProgram(scope)) {
+          targets.push({ start: node2.start, end: node2.end, shorthand: false });
+        }
+        return;
+      // Property positions are names, not references to the binding.
+      case "MemberExpression":
+      case "MethodDefinition":
+      case "PropertyDefinition":
+        skip = node2.computed ? NOTHING : PROPERTY;
+        break;
+      case "Property":
+        if (node2.computed) break;
+        if (node2.shorthand) {
+          const value = node2.value;
+          if (isExports(value) && resolvesToProgram(scope)) {
+            targets.push({ start: value.start, end: value.end, shorthand: true });
+          }
+          return;
+        }
+        skip = PROPERTY;
+        break;
+      case "LabeledStatement":
+      case "BreakStatement":
+      case "ContinueStatement":
+        skip = LABEL;
+        break;
+    }
+    for (const [key, value] of Object.entries(node2)) {
+      if (key === "type" || key === "start" || key === "end" || skip.includes(key)) continue;
+      if (Array.isArray(value)) {
+        for (const item of value) if (isNode2(item)) visit(item, childScope);
+      } else if (isNode2(value)) {
+        visit(value, childScope);
+      }
+    }
+  }
+}
+function resolvesToProgram(scope) {
+  for (let current = scope; current; current = current.parent) {
+    if (current.bindsExports) return current.parent === null;
+  }
+  return false;
+}
+function hoistedNames(body) {
+  const names = blockNames(body);
+  collectVars(body, names);
+  return names;
+}
+function blockNames(body) {
+  const names = /* @__PURE__ */ new Set();
+  for (const node2 of body ?? []) {
+    if (node2.type === "VariableDeclaration" && node2.kind !== "var") {
+      for (const declarator of node2.declarations) {
+        collectPattern(declarator.id, names);
+      }
+    } else if (node2.type === "ClassDeclaration" && isNode2(node2.id)) {
+      names.add(node2.id.name);
+    } else if (node2.type === "FunctionDeclaration" && isNode2(node2.id)) {
+      names.add(node2.id.name);
+    }
+  }
+  return names;
+}
+function collectVars(nodes, names) {
+  if (Array.isArray(nodes)) {
+    for (const item of nodes) collectVars(item, names);
+    return;
+  }
+  if (!isNode2(nodes)) return;
+  const node2 = nodes;
+  if (node2.type === "FunctionDeclaration" || node2.type === "FunctionExpression" || node2.type === "ArrowFunctionExpression") {
+    if (isNode2(node2.id)) names.add(node2.id.name);
+    return;
+  }
+  if (node2.type === "VariableDeclaration" && node2.kind === "var") {
+    for (const declarator of node2.declarations) {
+      collectPattern(declarator.id, names);
+    }
+  }
+  for (const [key, value] of Object.entries(node2)) {
+    if (key === "type" || key === "start" || key === "end") continue;
+    collectVars(value, names);
+  }
+}
+function collectPattern(node2, names) {
+  if (!isNode2(node2)) return;
+  switch (node2.type) {
+    case "Identifier":
+      names.add(node2.name);
+      return;
+    case "ObjectPattern":
+      for (const property of node2.properties) {
+        collectPattern(property.value ?? property.argument, names);
+      }
+      return;
+    case "ArrayPattern":
+      for (const element of node2.elements) collectPattern(element, names);
+      return;
+    case "AssignmentPattern":
+      collectPattern(node2.left, names);
+      return;
+    case "RestElement":
+      collectPattern(node2.argument, names);
+      return;
+    default:
+      return;
+  }
+}
+function isExports(value) {
+  return isNode2(value) && value.type === "Identifier" && value.name === NAME;
+}
+function freshName(source) {
+  let name = "__sandboxedjs_exports";
+  let suffix = 0;
+  while (source.includes(name)) name = `__sandboxedjs_exports${++suffix}`;
+  return name;
+}
+function isNode2(value) {
+  return typeof value === "object" && value !== null && typeof value.type === "string";
+}
+var NOTHING = [];
+var PROPERTY = ["property", "key"];
+var LABEL = ["label"];
+
+// src/pkg/index.ts
 init_path();
 var NPM_VERSION = "10.9.0";
 function readManifest(ctx, dir3) {
@@ -18012,6 +18233,7 @@ async function installPackages(ctx, specs, opts) {
       }
     }
     normalizeBinDirectories(ctx, opts.cwd);
+    normalizeEsmExports(ctx, opts.cwd);
     return 0;
   } catch (e) {
     ctx.warn(`npm error ${e instanceof Error ? e.message : String(e)}`);
@@ -18235,6 +18457,20 @@ function normalizeBinDirectories(ctx, root) {
     if (basename(path) === ".bin" && path !== join(modules, ".bin")) visit(path);
   }
 }
+function normalizeEsmExports(ctx, root) {
+  const modules = join(root, "node_modules");
+  if (!ctx.vfs.lexists(modules)) return;
+  for (const path of ctx.vfs.walk(modules, { cred: ctx.cred })) {
+    if (!/\.(?:js|mjs)$/.test(path)) continue;
+    try {
+      if (!ctx.vfs.lstat(path).isFile()) continue;
+      const source = ctx.vfs.readText(path, ctx.cred);
+      const repaired = renameShadowedExports(source);
+      if (repaired !== null) ctx.vfs.writeFile(path, repaired, { privileged: true });
+    } catch {
+    }
+  }
+}
 function printNpmHelp(ctx) {
   ctx.line(`npm <command>`);
   ctx.line("");