sandboxedjs 0.1.47 → 0.1.48

package/dist/index.d.cts

@@ -993,6 +993,10 @@ declare class MirroringVolume implements RuntimeVolume {
     readFileSync(path: string): Uint8Array;
     readdirSync(path: string): string[];
     lstatSync(path: string): VolumeStat;
+    /** The mirror's copy of a file, if it has one and we are allowed to look. */
+    private fromMirror;
+    /** The mirror's entries for a directory, for merging into a listing. */
+    private mirrorNames;
     readlinkSync(path: string): string;
     getStats(): VolumeStats;
     writeFileSync(path: string, data: string | Uint8Array): void;
@@ -1002,7 +1006,35 @@ declare class MirroringVolume implements RuntimeVolume {
     }): void;
     rmdirSync(path: string): void;
     unlinkSync(path: string): void;
+    /**
+     * Rename, carrying anything the mirrored engine put there.
+     *
+     * This is the operation the dependency optimizer is built on, and the one
+     * that used to destroy its output. Vite bundles into a temporary directory
+     * and renames it into place when it is complete — but only half of that
+     * directory is ever on this volume. Vite writes `_metadata.json` and
+     * `package.json` through here; Rolldown writes the actual bundles through
+     * WASI into the mirror. Renaming moved the half that was here and then
+     * `sync(from)` deleted the half that was not, because from this side the
+     * source directory had simply gone.
+     *
+     * What survived was a `deps` directory holding metadata that described five
+     * optimized dependencies and contained none of them — which Vite reports, on
+     * the failed read, as `504 Outdated Optimize Dep`. Nothing in that message is
+     * true, and following it leads to hashes rather than to a missing file.
+     *
+     * So the mirror's side of the move is collected first, and lands here as
+     * part of the rename.
+     */
     renameSync(from: string, to: string): void;
+    /**
+     * Copy whatever the mirror holds under `from` into this volume under `to`.
+     *
+     * Deliberately not filtered the way {@link absorb} is: this walks one
+     * directory that is being renamed, not the whole project, so the subtree is
+     * small and `node_modules` is exactly where the interesting case lives.
+     */
+    private collect;
     symlinkSync(target: string, path: string): void;
     linkSync(existing: string, path: string): void;
     truncateSync(path: string, length?: number): void;

package/dist/index.d.ts

@@ -993,6 +993,10 @@ declare class MirroringVolume implements RuntimeVolume {
     readFileSync(path: string): Uint8Array;
     readdirSync(path: string): string[];
     lstatSync(path: string): VolumeStat;
+    /** The mirror's copy of a file, if it has one and we are allowed to look. */
+    private fromMirror;
+    /** The mirror's entries for a directory, for merging into a listing. */
+    private mirrorNames;
     readlinkSync(path: string): string;
     getStats(): VolumeStats;
     writeFileSync(path: string, data: string | Uint8Array): void;
@@ -1002,7 +1006,35 @@ declare class MirroringVolume implements RuntimeVolume {
     }): void;
     rmdirSync(path: string): void;
     unlinkSync(path: string): void;
+    /**
+     * Rename, carrying anything the mirrored engine put there.
+     *
+     * This is the operation the dependency optimizer is built on, and the one
+     * that used to destroy its output. Vite bundles into a temporary directory
+     * and renames it into place when it is complete — but only half of that
+     * directory is ever on this volume. Vite writes `_metadata.json` and
+     * `package.json` through here; Rolldown writes the actual bundles through
+     * WASI into the mirror. Renaming moved the half that was here and then
+     * `sync(from)` deleted the half that was not, because from this side the
+     * source directory had simply gone.
+     *
+     * What survived was a `deps` directory holding metadata that described five
+     * optimized dependencies and contained none of them — which Vite reports, on
+     * the failed read, as `504 Outdated Optimize Dep`. Nothing in that message is
+     * true, and following it leads to hashes rather than to a missing file.
+     *
+     * So the mirror's side of the move is collected first, and lands here as
+     * part of the rename.
+     */
     renameSync(from: string, to: string): void;
+    /**
+     * Copy whatever the mirror holds under `from` into this volume under `to`.
+     *
+     * Deliberately not filtered the way {@link absorb} is: this walks one
+     * directory that is being renamed, not the whole project, so the subtree is
+     * small and `node_modules` is exactly where the interesting case lives.
+     */
+    private collect;
     symlinkSync(target: string, path: string): void;
     linkSync(existing: string, path: string): void;
     truncateSync(path: string, length?: number): void;

package/dist/index.js

@@ -20565,7 +20565,9 @@ function safeTarget(destination, name) {
   return join(destination, clean2);
 }
 function stripPackageRoot(name) {
-  return name.replace(/^\.\//, "").replace(/^package\//, "").replace(/\/$/, "");
+  const clean2 = name.replace(/^\.\//, "").replace(/\/$/, "");
+  const slash = clean2.indexOf("/");
+  return slash === -1 ? "" : clean2.slice(slash + 1);
 }
 function text(bytes2, start2, length) {
   return new TextDecoder().decode(bytes2.subarray(start2, start2 + length)).replace(/\0.*$/, "").trim();
@@ -26611,15 +26613,91 @@ var MirroringVolume = class {
       mirror.writeFileSync(path, this.inner.readFileSync(path));
     });
   }
-  // ── reads: straight through ───────────────────────────────────────────────
+  // ── reads: straight through, then the mirror ──────────────────────────────
+  /*
+   * A file the bundler produced exists only in the mirror until something
+   * asks for it here.
+   *
+   * {@link absorb} was the original answer and is not enough on its own. It
+   * runs when a process ends — a dev server never ends — and it skips
+   * `node_modules`, where Vite keeps the one output that a dev server depends
+   * on: `node_modules/.vite/deps`. Between those two, the entire pre-bundled
+   * dependency set stayed invisible to the container that had to serve it.
+   *
+   * The symptom was almost perfectly disguised. Vite writes `_metadata.json`
+   * itself, through this volume, so the directory looked half-populated and
+   * the metadata listed every dependency as optimized. Rolldown wrote the
+   * actual bundles through WASI into the mirror, where nothing brought them
+   * back. Vite then read a file that was not there — and reports a failed read
+   * of an optimized dependency as `504 Outdated Optimize Dep`, which describes
+   * a stale hash and sends everyone looking at hashes. The hash was never
+   * wrong. The file was missing.
+   *
+   * Falling back on read fixes it wherever it happens, for any path, without
+   * polling and without depending on how the engine chose to write.
+   */
   readFileSync(path) {
-    return this.inner.readFileSync(path);
+    try {
+      return this.inner.readFileSync(path);
+    } catch (error) {
+      const produced = this.fromMirror(path);
+      if (!produced) throw error;
+      try {
+        this.ensureDirectory(dirname(path));
+        this.inner.writeFileSync(path, produced);
+      } catch {
+      }
+      return produced;
+    }
   }
   readdirSync(path) {
-    return this.inner.readdirSync(path);
+    let here = [];
+    let missing;
+    try {
+      here = this.inner.readdirSync(path);
+    } catch (error) {
+      missing = error;
+    }
+    const mirrored = this.mirrorNames(path);
+    if (!mirrored) {
+      if (missing) throw missing;
+      return here;
+    }
+    return [.../* @__PURE__ */ new Set([...here, ...mirrored])].sort();
   }
   lstatSync(path) {
-    return this.inner.lstatSync(path);
+    try {
+      return this.inner.lstatSync(path);
+    } catch (error) {
+      if (this.fromMirror(path)) {
+        try {
+          this.readFileSync(path);
+          return this.inner.lstatSync(path);
+        } catch {
+        }
+      }
+      throw error;
+    }
+  }
+  /** The mirror's copy of a file, if it has one and we are allowed to look. */
+  fromMirror(path) {
+    const mirror = this.mirror;
+    if (!mirror?.readFileSync || !mirror.lstatSync || !this.mirrored(path)) return void 0;
+    try {
+      if (!mirror.lstatSync(path).isDirectory()) return mirror.readFileSync(path);
+    } catch {
+    }
+    return void 0;
+  }
+  /** The mirror's entries for a directory, for merging into a listing. */
+  mirrorNames(path) {
+    const mirror = this.mirror;
+    if (!mirror?.readdirSync || !this.mirrored(path)) return void 0;
+    try {
+      return mirror.readdirSync(path);
+    } catch {
+      return void 0;
+    }
   }
   readlinkSync(path) {
     return this.inner.readlinkSync(path);
@@ -26648,11 +26726,76 @@ var MirroringVolume = class {
     this.inner.unlinkSync(path);
     this.sync(path);
   }
+  /**
+   * Rename, carrying anything the mirrored engine put there.
+   *
+   * This is the operation the dependency optimizer is built on, and the one
+   * that used to destroy its output. Vite bundles into a temporary directory
+   * and renames it into place when it is complete — but only half of that
+   * directory is ever on this volume. Vite writes `_metadata.json` and
+   * `package.json` through here; Rolldown writes the actual bundles through
+   * WASI into the mirror. Renaming moved the half that was here and then
+   * `sync(from)` deleted the half that was not, because from this side the
+   * source directory had simply gone.
+   *
+   * What survived was a `deps` directory holding metadata that described five
+   * optimized dependencies and contained none of them — which Vite reports, on
+   * the failed read, as `504 Outdated Optimize Dep`. Nothing in that message is
+   * true, and following it leads to hashes rather than to a missing file.
+   *
+   * So the mirror's side of the move is collected first, and lands here as
+   * part of the rename.
+   */
   renameSync(from, to) {
     this.inner.renameSync(from, to);
+    this.collect(from, to);
     this.sync(from);
     this.sync(to);
   }
+  /**
+   * Copy whatever the mirror holds under `from` into this volume under `to`.
+   *
+   * Deliberately not filtered the way {@link absorb} is: this walks one
+   * directory that is being renamed, not the whole project, so the subtree is
+   * small and `node_modules` is exactly where the interesting case lives.
+   */
+  collect(from, to) {
+    const mirror = this.mirror;
+    if (!mirror?.readdirSync || !mirror.readFileSync || !mirror.lstatSync) return;
+    if (!this.mirrored(from)) return;
+    const walk = (source, destination) => {
+      let stat2;
+      try {
+        stat2 = mirror.lstatSync(source);
+      } catch {
+        return;
+      }
+      if (stat2.isSymbolicLink()) return;
+      if (stat2.isDirectory()) {
+        let names;
+        try {
+          names = mirror.readdirSync(source);
+        } catch {
+          return;
+        }
+        this.ensureDirectory(destination);
+        for (const name of names) walk(join(source, name), join(destination, name));
+        return;
+      }
+      try {
+        this.inner.lstatSync(destination);
+        return;
+      } catch {
+      }
+      try {
+        const bytes2 = mirror.readFileSync(source);
+        this.ensureDirectory(dirname(destination));
+        this.inner.writeFileSync(destination, bytes2);
+      } catch {
+      }
+    };
+    this.safely(() => walk(from, to));
+  }
   symlinkSync(target, path) {
     this.inner.symlinkSync(target, path);
     this.sync(path);