sandboxedjs 0.1.46 → 0.1.48

package/dist/index.d.cts

@@ -993,6 +993,10 @@ declare class MirroringVolume implements RuntimeVolume {
     readFileSync(path: string): Uint8Array;
     readdirSync(path: string): string[];
     lstatSync(path: string): VolumeStat;
+    /** The mirror's copy of a file, if it has one and we are allowed to look. */
+    private fromMirror;
+    /** The mirror's entries for a directory, for merging into a listing. */
+    private mirrorNames;
     readlinkSync(path: string): string;
     getStats(): VolumeStats;
     writeFileSync(path: string, data: string | Uint8Array): void;
@@ -1002,7 +1006,35 @@ declare class MirroringVolume implements RuntimeVolume {
     }): void;
     rmdirSync(path: string): void;
     unlinkSync(path: string): void;
+    /**
+     * Rename, carrying anything the mirrored engine put there.
+     *
+     * This is the operation the dependency optimizer is built on, and the one
+     * that used to destroy its output. Vite bundles into a temporary directory
+     * and renames it into place when it is complete — but only half of that
+     * directory is ever on this volume. Vite writes `_metadata.json` and
+     * `package.json` through here; Rolldown writes the actual bundles through
+     * WASI into the mirror. Renaming moved the half that was here and then
+     * `sync(from)` deleted the half that was not, because from this side the
+     * source directory had simply gone.
+     *
+     * What survived was a `deps` directory holding metadata that described five
+     * optimized dependencies and contained none of them — which Vite reports, on
+     * the failed read, as `504 Outdated Optimize Dep`. Nothing in that message is
+     * true, and following it leads to hashes rather than to a missing file.
+     *
+     * So the mirror's side of the move is collected first, and lands here as
+     * part of the rename.
+     */
     renameSync(from: string, to: string): void;
+    /**
+     * Copy whatever the mirror holds under `from` into this volume under `to`.
+     *
+     * Deliberately not filtered the way {@link absorb} is: this walks one
+     * directory that is being renamed, not the whole project, so the subtree is
+     * small and `node_modules` is exactly where the interesting case lives.
+     */
+    private collect;
     symlinkSync(target: string, path: string): void;
     linkSync(existing: string, path: string): void;
     truncateSync(path: string, length?: number): void;
@@ -1214,11 +1246,28 @@ declare class CleanPackageInstaller implements RuntimePackageInstaller {
     private readonly fetcher;
     private readonly metadata;
     private readonly tarballs;
+    /** Single-version manifests, for the fields the packument omits. */
+    private readonly details;
     constructor(volume: RuntimeVolume, options?: CleanInstallerOptions);
     forCwd(cwd: string): CleanPackageInstaller;
     install(name: string, version?: string, options?: InstallOptions): Promise<RegistryManifest>;
     installFromManifest(path: string, options?: InstallOptions): Promise<void>;
     private installAt;
+    /**
+     * The `libc` and `main` fields, which the abbreviated packument leaves out.
+     *
+     * Fetched per version rather than as a full packument: the single-version
+     * document is a few kilobytes, while the full one for a popular package runs
+     * to megabytes. Only packages that already declare `os` or `cpu` ask for it,
+     * so an ordinary install of pure-JavaScript dependencies makes no extra
+     * requests at all — it is the prebuilt binaries, a handful per project, that
+     * need the answer.
+     *
+     * A failure here is not fatal. Being unable to read `libc` puts the check
+     * back where it was before this existed, which is worth strictly less than
+     * being right and strictly more than refusing to install.
+     */
+    private platformDetail;
     private getMetadata;
     private getTarball;
     private createBinLinks;

package/dist/index.d.ts

@@ -993,6 +993,10 @@ declare class MirroringVolume implements RuntimeVolume {
     readFileSync(path: string): Uint8Array;
     readdirSync(path: string): string[];
     lstatSync(path: string): VolumeStat;
+    /** The mirror's copy of a file, if it has one and we are allowed to look. */
+    private fromMirror;
+    /** The mirror's entries for a directory, for merging into a listing. */
+    private mirrorNames;
     readlinkSync(path: string): string;
     getStats(): VolumeStats;
     writeFileSync(path: string, data: string | Uint8Array): void;
@@ -1002,7 +1006,35 @@ declare class MirroringVolume implements RuntimeVolume {
     }): void;
     rmdirSync(path: string): void;
     unlinkSync(path: string): void;
+    /**
+     * Rename, carrying anything the mirrored engine put there.
+     *
+     * This is the operation the dependency optimizer is built on, and the one
+     * that used to destroy its output. Vite bundles into a temporary directory
+     * and renames it into place when it is complete — but only half of that
+     * directory is ever on this volume. Vite writes `_metadata.json` and
+     * `package.json` through here; Rolldown writes the actual bundles through
+     * WASI into the mirror. Renaming moved the half that was here and then
+     * `sync(from)` deleted the half that was not, because from this side the
+     * source directory had simply gone.
+     *
+     * What survived was a `deps` directory holding metadata that described five
+     * optimized dependencies and contained none of them — which Vite reports, on
+     * the failed read, as `504 Outdated Optimize Dep`. Nothing in that message is
+     * true, and following it leads to hashes rather than to a missing file.
+     *
+     * So the mirror's side of the move is collected first, and lands here as
+     * part of the rename.
+     */
     renameSync(from: string, to: string): void;
+    /**
+     * Copy whatever the mirror holds under `from` into this volume under `to`.
+     *
+     * Deliberately not filtered the way {@link absorb} is: this walks one
+     * directory that is being renamed, not the whole project, so the subtree is
+     * small and `node_modules` is exactly where the interesting case lives.
+     */
+    private collect;
     symlinkSync(target: string, path: string): void;
     linkSync(existing: string, path: string): void;
     truncateSync(path: string, length?: number): void;
@@ -1214,11 +1246,28 @@ declare class CleanPackageInstaller implements RuntimePackageInstaller {
     private readonly fetcher;
     private readonly metadata;
     private readonly tarballs;
+    /** Single-version manifests, for the fields the packument omits. */
+    private readonly details;
     constructor(volume: RuntimeVolume, options?: CleanInstallerOptions);
     forCwd(cwd: string): CleanPackageInstaller;
     install(name: string, version?: string, options?: InstallOptions): Promise<RegistryManifest>;
     installFromManifest(path: string, options?: InstallOptions): Promise<void>;
     private installAt;
+    /**
+     * The `libc` and `main` fields, which the abbreviated packument leaves out.
+     *
+     * Fetched per version rather than as a full packument: the single-version
+     * document is a few kilobytes, while the full one for a popular package runs
+     * to megabytes. Only packages that already declare `os` or `cpu` ask for it,
+     * so an ordinary install of pure-JavaScript dependencies makes no extra
+     * requests at all — it is the prebuilt binaries, a handful per project, that
+     * need the answer.
+     *
+     * A failure here is not fatal. Being unable to read `libc` puts the check
+     * back where it was before this existed, which is worth strictly less than
+     * being right and strictly more than refusing to install.
+     */
+    private platformDetail;
     private getMetadata;
     private getTarball;
     private createBinLinks;

package/dist/index.js

@@ -20301,6 +20301,8 @@ var CleanPackageInstaller = class _CleanPackageInstaller {
   fetcher;
   metadata = /* @__PURE__ */ new Map();
   tarballs = /* @__PURE__ */ new Map();
+  /** Single-version manifests, for the fields the packument omits. */
+  details = /* @__PURE__ */ new Map();
   forCwd(cwd) {
     return new _CleanPackageInstaller(this.volume, { ...this.options, cwd });
   }
@@ -20326,10 +20328,17 @@ var CleanPackageInstaller = class _CleanPackageInstaller {
     const version = resolveVersion(metadata, range);
     const manifest = metadata.versions[version];
     if (!manifest) throw new Error(`No matching version found for ${name}@${range}`);
-    if (!supportsPlatform(manifest)) {
-      throw new Error(`${name}@${version} is not compatible with linux/x64/glibc`);
-    }
     const identity = `${name}@${version}`;
+    if (!supportsPlatform(manifest)) throw new IncompatiblePlatform(identity, "");
+    if (manifest.os?.length || manifest.cpu?.length) {
+      const detail = await this.platformDetail(name, version);
+      if (!platformListAllows(detail.libc, PLATFORM.libc)) {
+        throw new IncompatiblePlatform(identity, ` (needs ${detail.libc?.join(", ")})`);
+      }
+      if (detail.main?.endsWith(".node")) {
+        throw new IncompatiblePlatform(identity, " (native addon; this runtime cannot dlopen)");
+      }
+    }
     const target = join(modulesRoot, name);
     const installed2 = this.tryReadJson(join(target, "package.json"));
     if (installed2?.version === version) return installed2;
@@ -20351,11 +20360,44 @@ var CleanPackageInstaller = class _CleanPackageInstaller {
       try {
         await this.installAt(dependency, dependencyRange, childRoot, options, nextAncestry);
       } catch (error) {
+        if (error instanceof IncompatiblePlatform) continue;
         options.onProgress?.(`Skipped optional ${dependency}: ${error instanceof Error ? error.message : String(error)}`);
       }
     }
     return manifest;
   }
+  /**
+   * The `libc` and `main` fields, which the abbreviated packument leaves out.
+   *
+   * Fetched per version rather than as a full packument: the single-version
+   * document is a few kilobytes, while the full one for a popular package runs
+   * to megabytes. Only packages that already declare `os` or `cpu` ask for it,
+   * so an ordinary install of pure-JavaScript dependencies makes no extra
+   * requests at all — it is the prebuilt binaries, a handful per project, that
+   * need the answer.
+   *
+   * A failure here is not fatal. Being unable to read `libc` puts the check
+   * back where it was before this existed, which is worth strictly less than
+   * being right and strictly more than refusing to install.
+   */
+  async platformDetail(name, version) {
+    const key = `${name}@${version}`;
+    let request = this.details.get(key);
+    if (!request) {
+      request = (async () => {
+        try {
+          const encoded = name.startsWith("@") ? name.replace("/", "%2F") : encodeURIComponent(name);
+          const response = await this.fetcher(`${this.registry}/${encoded}/${version}`);
+          if (!response.ok) return {};
+          return await response.json();
+        } catch {
+          return {};
+        }
+      })();
+      this.details.set(key, request);
+    }
+    return request;
+  }
   async getMetadata(name) {
     let request = this.metadata.get(name);
     if (!request) {
@@ -20423,8 +20465,15 @@ var CleanPackageInstaller = class _CleanPackageInstaller {
     }
   }
 };
+var PLATFORM = { os: "linux", cpu: "x64", libc: "glibc" };
+var IncompatiblePlatform = class extends Error {
+  constructor(identity, detail) {
+    super(`${identity} is not compatible with ${PLATFORM.os}/${PLATFORM.cpu}/${PLATFORM.libc}${detail}`);
+    this.name = "IncompatiblePlatform";
+  }
+};
 function supportsPlatform(manifest) {
-  return !manifest.main?.endsWith(".node") && platformListAllows(manifest.os, "linux") && platformListAllows(manifest.cpu, "x64") && platformListAllows(manifest.libc, "glibc");
+  return platformListAllows(manifest.os, PLATFORM.os) && platformListAllows(manifest.cpu, PLATFORM.cpu) && platformListAllows(manifest.libc, PLATFORM.libc);
 }
 function platformListAllows(values, current) {
   if (!values?.length) return true;
@@ -20516,7 +20565,9 @@ function safeTarget(destination, name) {
   return join(destination, clean2);
 }
 function stripPackageRoot(name) {
-  return name.replace(/^\.\//, "").replace(/^package\//, "").replace(/\/$/, "");
+  const clean2 = name.replace(/^\.\//, "").replace(/\/$/, "");
+  const slash = clean2.indexOf("/");
+  return slash === -1 ? "" : clean2.slice(slash + 1);
 }
 function text(bytes2, start2, length) {
   return new TextDecoder().decode(bytes2.subarray(start2, start2 + length)).replace(/\0.*$/, "").trim();
@@ -26562,15 +26613,91 @@ var MirroringVolume = class {
       mirror.writeFileSync(path, this.inner.readFileSync(path));
     });
   }
-  // ── reads: straight through ───────────────────────────────────────────────
+  // ── reads: straight through, then the mirror ──────────────────────────────
+  /*
+   * A file the bundler produced exists only in the mirror until something
+   * asks for it here.
+   *
+   * {@link absorb} was the original answer and is not enough on its own. It
+   * runs when a process ends — a dev server never ends — and it skips
+   * `node_modules`, where Vite keeps the one output that a dev server depends
+   * on: `node_modules/.vite/deps`. Between those two, the entire pre-bundled
+   * dependency set stayed invisible to the container that had to serve it.
+   *
+   * The symptom was almost perfectly disguised. Vite writes `_metadata.json`
+   * itself, through this volume, so the directory looked half-populated and
+   * the metadata listed every dependency as optimized. Rolldown wrote the
+   * actual bundles through WASI into the mirror, where nothing brought them
+   * back. Vite then read a file that was not there — and reports a failed read
+   * of an optimized dependency as `504 Outdated Optimize Dep`, which describes
+   * a stale hash and sends everyone looking at hashes. The hash was never
+   * wrong. The file was missing.
+   *
+   * Falling back on read fixes it wherever it happens, for any path, without
+   * polling and without depending on how the engine chose to write.
+   */
   readFileSync(path) {
-    return this.inner.readFileSync(path);
+    try {
+      return this.inner.readFileSync(path);
+    } catch (error) {
+      const produced = this.fromMirror(path);
+      if (!produced) throw error;
+      try {
+        this.ensureDirectory(dirname(path));
+        this.inner.writeFileSync(path, produced);
+      } catch {
+      }
+      return produced;
+    }
   }
   readdirSync(path) {
-    return this.inner.readdirSync(path);
+    let here = [];
+    let missing;
+    try {
+      here = this.inner.readdirSync(path);
+    } catch (error) {
+      missing = error;
+    }
+    const mirrored = this.mirrorNames(path);
+    if (!mirrored) {
+      if (missing) throw missing;
+      return here;
+    }
+    return [.../* @__PURE__ */ new Set([...here, ...mirrored])].sort();
   }
   lstatSync(path) {
-    return this.inner.lstatSync(path);
+    try {
+      return this.inner.lstatSync(path);
+    } catch (error) {
+      if (this.fromMirror(path)) {
+        try {
+          this.readFileSync(path);
+          return this.inner.lstatSync(path);
+        } catch {
+        }
+      }
+      throw error;
+    }
+  }
+  /** The mirror's copy of a file, if it has one and we are allowed to look. */
+  fromMirror(path) {
+    const mirror = this.mirror;
+    if (!mirror?.readFileSync || !mirror.lstatSync || !this.mirrored(path)) return void 0;
+    try {
+      if (!mirror.lstatSync(path).isDirectory()) return mirror.readFileSync(path);
+    } catch {
+    }
+    return void 0;
+  }
+  /** The mirror's entries for a directory, for merging into a listing. */
+  mirrorNames(path) {
+    const mirror = this.mirror;
+    if (!mirror?.readdirSync || !this.mirrored(path)) return void 0;
+    try {
+      return mirror.readdirSync(path);
+    } catch {
+      return void 0;
+    }
   }
   readlinkSync(path) {
     return this.inner.readlinkSync(path);
@@ -26599,11 +26726,76 @@ var MirroringVolume = class {
     this.inner.unlinkSync(path);
     this.sync(path);
   }
+  /**
+   * Rename, carrying anything the mirrored engine put there.
+   *
+   * This is the operation the dependency optimizer is built on, and the one
+   * that used to destroy its output. Vite bundles into a temporary directory
+   * and renames it into place when it is complete — but only half of that
+   * directory is ever on this volume. Vite writes `_metadata.json` and
+   * `package.json` through here; Rolldown writes the actual bundles through
+   * WASI into the mirror. Renaming moved the half that was here and then
+   * `sync(from)` deleted the half that was not, because from this side the
+   * source directory had simply gone.
+   *
+   * What survived was a `deps` directory holding metadata that described five
+   * optimized dependencies and contained none of them — which Vite reports, on
+   * the failed read, as `504 Outdated Optimize Dep`. Nothing in that message is
+   * true, and following it leads to hashes rather than to a missing file.
+   *
+   * So the mirror's side of the move is collected first, and lands here as
+   * part of the rename.
+   */
   renameSync(from, to) {
     this.inner.renameSync(from, to);
+    this.collect(from, to);
     this.sync(from);
     this.sync(to);
   }
+  /**
+   * Copy whatever the mirror holds under `from` into this volume under `to`.
+   *
+   * Deliberately not filtered the way {@link absorb} is: this walks one
+   * directory that is being renamed, not the whole project, so the subtree is
+   * small and `node_modules` is exactly where the interesting case lives.
+   */
+  collect(from, to) {
+    const mirror = this.mirror;
+    if (!mirror?.readdirSync || !mirror.readFileSync || !mirror.lstatSync) return;
+    if (!this.mirrored(from)) return;
+    const walk = (source, destination) => {
+      let stat2;
+      try {
+        stat2 = mirror.lstatSync(source);
+      } catch {
+        return;
+      }
+      if (stat2.isSymbolicLink()) return;
+      if (stat2.isDirectory()) {
+        let names;
+        try {
+          names = mirror.readdirSync(source);
+        } catch {
+          return;
+        }
+        this.ensureDirectory(destination);
+        for (const name of names) walk(join(source, name), join(destination, name));
+        return;
+      }
+      try {
+        this.inner.lstatSync(destination);
+        return;
+      } catch {
+      }
+      try {
+        const bytes2 = mirror.readFileSync(source);
+        this.ensureDirectory(dirname(destination));
+        this.inner.writeFileSync(destination, bytes2);
+      } catch {
+      }
+    };
+    this.safely(() => walk(from, to));
+  }
   symlinkSync(target, path) {
     this.inner.symlinkSync(target, path);
     this.sync(path);