sandboxedjs 0.1.95 → 0.1.99

package/dist/index.cjs

@@ -4273,7 +4273,8 @@ function md5Hex(input) {
 var isNode, zlibPromise, cryptoPromise, SUBTLE_NAMES, UnsupportedAlgorithmError;
 var init_binary = __esm({
   "src/util/binary.ts"() {
-    isNode = typeof process !== "undefined" && process.versions != null && process.versions.node != null;
+    isNode = typeof window === "undefined" && typeof document === "undefined" && typeof process !== "undefined" && process.versions != null && process.versions.node != null && /* A shim has no `release.name`, and Node's has said "node" since v3. */
+    process.release?.name === "node";
     zlibPromise = null;
     cryptoPromise = null;
     SUBTLE_NAMES = {
@@ -20958,7 +20959,7 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.1.95"};
+  version: "0.1.99"};
 
 // src/python/extension-abi.ts
 var EXTENSION_ABI = {
@@ -23933,9 +23934,7 @@ async function installRequirements(options) {
       continue;
     }
     options.progress.downloading(distribution.name, distribution.version);
-    const bytes2 = await options.client.bytes(distribution.url, { timeoutMs: 12e4 });
-    requireArchive(distribution, bytes2);
-    verifyDigest(distribution, bytes2);
+    const bytes2 = await download(options.client, distribution);
     const files = stageWheel(readZip(bytes2));
     staged.push(...distribution.kind === "substituted" ? substituteFiles(distribution.name, files, SITE_PACKAGES) : files);
     installed3.push({ name: distribution.name, version: distribution.version });
@@ -23951,18 +23950,41 @@ function requireArchive(distribution, bytes2) {
     `${distribution.filename} did not arrive as a wheel from ${distribution.url}: ` + (looksLikeMarkup ? "the server answered with an HTML page, which usually means the wheel is not published at that address and the server returned its index page instead" : `expected a zip archive, got ${bytes2.length} bytes beginning ${JSON.stringify(opening)}`)
   );
 }
-function verifyDigest(distribution, bytes2) {
+async function download(client, distribution) {
+  const bytes2 = await client.bytes(distribution.url, { timeoutMs: 12e4 });
+  requireArchive(distribution, bytes2);
+  const mismatch = digestMismatch(distribution, bytes2);
+  if (!mismatch) return bytes2;
+  const fresh = await refetch(client, distribution);
+  if (fresh && !digestMismatch(distribution, fresh)) {
+    requireArchive(distribution, fresh);
+    return fresh;
+  }
+  throw new Error(
+    `${mismatch} ${fresh ? "A retry past any cache returned the same bytes, so the index and the file it names disagree." : "A retry past any cache could not be made, so this may be a cached copy of an older build; clearing the cache, or asking the index's host to purge it, is worth trying before the index is blamed."}`
+  );
+}
+async function refetch(client, distribution) {
+  const separator = distribution.url.includes("?") ? "&" : "?";
+  try {
+    const bytes2 = await client.bytes(
+      `${distribution.url}${separator}sha256=${distribution.sha256}`,
+      { timeoutMs: 6e4 }
+    );
+    return bytes2.length > 1 && bytes2[0] === 80 && bytes2[1] === 75 ? bytes2 : null;
+  } catch {
+    return null;
+  }
+}
+function digestMismatch(distribution, bytes2) {
   if (!distribution.sha256) {
     throw new Error(
       `${distribution.filename} was published without a sha256 digest, so it cannot be verified`
     );
   }
   const actual = [...sha256.sha256(bytes2)].map((b) => b.toString(16).padStart(2, "0")).join("");
-  if (actual !== distribution.sha256) {
-    throw new Error(
-      `${distribution.filename} failed verification: the index published sha256 ${distribution.sha256} but the download hashes to ${actual}`
-    );
-  }
+  if (actual === distribution.sha256) return null;
+  return `${distribution.filename} failed verification: the index published sha256 ${distribution.sha256} but the download hashes to ${actual}.`;
 }
 function stageWheel(entries, resolved) {
   const staged = [];
@@ -28043,12 +28065,19 @@ async function installRelease(ctx, index, release, seen, options) {
   const base2 = registryBase(ctx).replace(/\/$/, "");
   const url = `${base2}/${release.filename}`;
   ctx.line(`Fetching ${release.name} ${release.version}`);
-  const archive = await download(url);
-  const digest2 = await digestHex("sha256", archive);
+  let archive = await download2(url);
+  let digest2 = await digestHex("sha256", archive);
   if (digest2 !== release.sha256) {
-    throw new AppRegistryError(
-      `${release.filename} failed verification: the registry publishes sha256 ${release.sha256} but the download hashes to ${digest2}`
-    );
+    const retried = await download2(`${url}${url.includes("?") ? "&" : "?"}sha256=${release.sha256}`).catch(() => null);
+    const retriedDigest = retried && await digestHex("sha256", retried);
+    if (retried && retriedDigest === release.sha256) {
+      archive = retried;
+      digest2 = retriedDigest;
+    } else {
+      throw new AppRegistryError(
+        `${release.filename} failed verification: the registry publishes sha256 ${release.sha256} but the download hashes to ${digest2}. ` + (retried ? "A retry past any cache returned the same bytes, so the registry and the file it names disagree." : "A retry past any cache could not be made; a cached copy of an older build would look like this, so clearing the cache is worth trying before the registry is blamed.")
+      );
+    }
   }
   const verified = await verify(ctx, archive, release, options);
   const root = `${APPS_ROOT}/${release.name}`;
@@ -28075,7 +28104,7 @@ async function installRelease(ctx, index, release, seen, options) {
   }
   if (manifest.docs) ctx.line(`  docs: ${root}/${manifest.docs}`);
 }
-async function download(url) {
+async function download2(url) {
   const response = await fetch(url);
   if (!response.ok) {
     throw new AppRegistryError(`${url} answered ${response.status} ${response.statusText}`);
@@ -38630,6 +38659,22 @@ var WS_DATA = "sandboxedjs:ws-data";
 var WS_CLOSE = "sandboxedjs:ws-close";
 var WS_ERROR = "sandboxedjs:ws-error";
 
+// src/preview/router.ts
+var LOOPBACK_HOST = /^(?:localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[?::1\]?)$/i;
+function containerTarget(value) {
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  if (!LOOPBACK_HOST.test(url.hostname)) return null;
+  const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+  return { port, path: `${url.pathname}${url.search}` };
+}
+
 // src/preview/register.ts
 function serveContainerOn(port, box) {
   port.onmessage = async (event) => {
@@ -38664,20 +38709,6 @@ function serveContainerOn(port, box) {
   };
   port.start?.();
 }
-var LOOPBACK_HOST = /^(?:localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[?::1\]?)$/i;
-function containerTarget(value) {
-  let url;
-  try {
-    url = new URL(value.trim());
-  } catch {
-    return null;
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-  if (!LOOPBACK_HOST.test(url.hostname)) return null;
-  const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
-  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
-  return { port, path: `${url.pathname}${url.search}` };
-}
 async function createPreview(box, options = {}) {
   if (typeof navigator === "undefined" || !("serviceWorker" in navigator)) return null;
   const scriptUrl = options.scriptUrl ?? new URL("./service-worker.js?no-inline", (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href)));

package/dist/index.d.cts

@@ -1590,19 +1590,22 @@ declare function startRuntimeWorker(options?: {
 declare function syncChannelSupported(): boolean;
 
 /**
- * Wiring a container's HTTP servers up to real URLs in the page.
+ * The routing a preview service worker does, separated from the worker itself.
  *
- * The service worker does the routing; this is the half that lives in the page
- * and actually knows about the container.
+ * A service worker is awkward to test — it needs a browser, a registration and
+ * a secure context — but almost none of what makes this correct is about being
+ * a service worker. The interesting part is the bookkeeping: which client is
+ * previewing which port, which requests belong to a preview at all, and how a
+ * response is rebuilt on the way back. That lives here, where it can be
+ * exercised directly.
  *
- * **Read the origin note before using this.** A preview served this way runs on
- * *your* origin, so scripts inside it can reach `window.parent`, your cookies
- * and your `localStorage` — the sandbox contains the program's *filesystem and
- * process table*, not the page it serves. For code you did not write, either
- * host the preview on a separate origin, or use {@link renderInto}, which puts
- * the response in an iframe with no origin at all.
+ * The rule this implements, and the reason it exists: requests are routed by
+ * **who is asking**, not by what the path looks like. An iframe navigates once
+ * to `/__sbx__/<port>/`; every later request from that client — however
+ * absolute its path — is recognised by its client id. Nothing has to rewrite
+ * `/src/main.js` or `/@vite/client`, which is what makes a real dev server
+ * work rather than only a single page.
  */
-
 /** A container-local server, named by port rather than by an address. */
 interface ContainerTarget {
     port: number;
@@ -1618,10 +1621,31 @@ interface ContainerTarget {
  * is listening, so a frame pointed at it fails with "refused to connect"
  * rather than failing visibly as a routing mistake.
  *
- * Exported separately from {@link Preview.resolve} because it is pure, and a
- * translation table is worth testing without a service worker in the way.
+ * The same translation serves two callers. A host reading an address out of a
+ * build log needs it to point a frame somewhere (`Preview.resolve`), and the
+ * service worker needs it for the other direction: a page *inside* a preview
+ * asking its own backend for `http://localhost:8000/api` means the container's
+ * port 8000, not the reader's machine.
+ *
+ * Kept pure, and kept here rather than beside the host half, because the
+ * worker bundles this module and not that one.
  */
 declare function containerTarget(value: string): ContainerTarget | null;
+
+/**
+ * Wiring a container's HTTP servers up to real URLs in the page.
+ *
+ * The service worker does the routing; this is the half that lives in the page
+ * and actually knows about the container.
+ *
+ * **Read the origin note before using this.** A preview served this way runs on
+ * *your* origin, so scripts inside it can reach `window.parent`, your cookies
+ * and your `localStorage` — the sandbox contains the program's *filesystem and
+ * process table*, not the page it serves. For code you did not write, either
+ * host the preview on a separate origin, or use {@link renderInto}, which puts
+ * the response in an iframe with no origin at all.
+ */
+
 interface PreviewOptions {
     /** Where the worker script lives; defaults to the copy shipped beside the bundle. */
     scriptUrl?: string | URL;

package/dist/index.d.ts

@@ -1590,19 +1590,22 @@ declare function startRuntimeWorker(options?: {
 declare function syncChannelSupported(): boolean;
 
 /**
- * Wiring a container's HTTP servers up to real URLs in the page.
+ * The routing a preview service worker does, separated from the worker itself.
  *
- * The service worker does the routing; this is the half that lives in the page
- * and actually knows about the container.
+ * A service worker is awkward to test — it needs a browser, a registration and
+ * a secure context — but almost none of what makes this correct is about being
+ * a service worker. The interesting part is the bookkeeping: which client is
+ * previewing which port, which requests belong to a preview at all, and how a
+ * response is rebuilt on the way back. That lives here, where it can be
+ * exercised directly.
  *
- * **Read the origin note before using this.** A preview served this way runs on
- * *your* origin, so scripts inside it can reach `window.parent`, your cookies
- * and your `localStorage` — the sandbox contains the program's *filesystem and
- * process table*, not the page it serves. For code you did not write, either
- * host the preview on a separate origin, or use {@link renderInto}, which puts
- * the response in an iframe with no origin at all.
+ * The rule this implements, and the reason it exists: requests are routed by
+ * **who is asking**, not by what the path looks like. An iframe navigates once
+ * to `/__sbx__/<port>/`; every later request from that client — however
+ * absolute its path — is recognised by its client id. Nothing has to rewrite
+ * `/src/main.js` or `/@vite/client`, which is what makes a real dev server
+ * work rather than only a single page.
  */
-
 /** A container-local server, named by port rather than by an address. */
 interface ContainerTarget {
     port: number;
@@ -1618,10 +1621,31 @@ interface ContainerTarget {
  * is listening, so a frame pointed at it fails with "refused to connect"
  * rather than failing visibly as a routing mistake.
  *
- * Exported separately from {@link Preview.resolve} because it is pure, and a
- * translation table is worth testing without a service worker in the way.
+ * The same translation serves two callers. A host reading an address out of a
+ * build log needs it to point a frame somewhere (`Preview.resolve`), and the
+ * service worker needs it for the other direction: a page *inside* a preview
+ * asking its own backend for `http://localhost:8000/api` means the container's
+ * port 8000, not the reader's machine.
+ *
+ * Kept pure, and kept here rather than beside the host half, because the
+ * worker bundles this module and not that one.
  */
 declare function containerTarget(value: string): ContainerTarget | null;
+
+/**
+ * Wiring a container's HTTP servers up to real URLs in the page.
+ *
+ * The service worker does the routing; this is the half that lives in the page
+ * and actually knows about the container.
+ *
+ * **Read the origin note before using this.** A preview served this way runs on
+ * *your* origin, so scripts inside it can reach `window.parent`, your cookies
+ * and your `localStorage` — the sandbox contains the program's *filesystem and
+ * process table*, not the page it serves. For code you did not write, either
+ * host the preview on a separate origin, or use {@link renderInto}, which puts
+ * the response in an iframe with no origin at all.
+ */
+
 interface PreviewOptions {
     /** Where the worker script lives; defaults to the copy shipped beside the bundle. */
     scriptUrl?: string | URL;

package/dist/index.js

@@ -4256,7 +4256,8 @@ function md5Hex(input) {
 var isNode, zlibPromise, cryptoPromise, SUBTLE_NAMES, UnsupportedAlgorithmError;
 var init_binary = __esm({
   "src/util/binary.ts"() {
-    isNode = typeof process !== "undefined" && process.versions != null && process.versions.node != null;
+    isNode = typeof window === "undefined" && typeof document === "undefined" && typeof process !== "undefined" && process.versions != null && process.versions.node != null && /* A shim has no `release.name`, and Node's has said "node" since v3. */
+    process.release?.name === "node";
     zlibPromise = null;
     cryptoPromise = null;
     SUBTLE_NAMES = {
@@ -20941,7 +20942,7 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.1.95"};
+  version: "0.1.99"};
 
 // src/python/extension-abi.ts
 var EXTENSION_ABI = {
@@ -23916,9 +23917,7 @@ async function installRequirements(options) {
       continue;
     }
     options.progress.downloading(distribution.name, distribution.version);
-    const bytes2 = await options.client.bytes(distribution.url, { timeoutMs: 12e4 });
-    requireArchive(distribution, bytes2);
-    verifyDigest(distribution, bytes2);
+    const bytes2 = await download(options.client, distribution);
     const files = stageWheel(readZip(bytes2));
     staged.push(...distribution.kind === "substituted" ? substituteFiles(distribution.name, files, SITE_PACKAGES) : files);
     installed3.push({ name: distribution.name, version: distribution.version });
@@ -23934,18 +23933,41 @@ function requireArchive(distribution, bytes2) {
     `${distribution.filename} did not arrive as a wheel from ${distribution.url}: ` + (looksLikeMarkup ? "the server answered with an HTML page, which usually means the wheel is not published at that address and the server returned its index page instead" : `expected a zip archive, got ${bytes2.length} bytes beginning ${JSON.stringify(opening)}`)
   );
 }
-function verifyDigest(distribution, bytes2) {
+async function download(client, distribution) {
+  const bytes2 = await client.bytes(distribution.url, { timeoutMs: 12e4 });
+  requireArchive(distribution, bytes2);
+  const mismatch = digestMismatch(distribution, bytes2);
+  if (!mismatch) return bytes2;
+  const fresh = await refetch(client, distribution);
+  if (fresh && !digestMismatch(distribution, fresh)) {
+    requireArchive(distribution, fresh);
+    return fresh;
+  }
+  throw new Error(
+    `${mismatch} ${fresh ? "A retry past any cache returned the same bytes, so the index and the file it names disagree." : "A retry past any cache could not be made, so this may be a cached copy of an older build; clearing the cache, or asking the index's host to purge it, is worth trying before the index is blamed."}`
+  );
+}
+async function refetch(client, distribution) {
+  const separator = distribution.url.includes("?") ? "&" : "?";
+  try {
+    const bytes2 = await client.bytes(
+      `${distribution.url}${separator}sha256=${distribution.sha256}`,
+      { timeoutMs: 6e4 }
+    );
+    return bytes2.length > 1 && bytes2[0] === 80 && bytes2[1] === 75 ? bytes2 : null;
+  } catch {
+    return null;
+  }
+}
+function digestMismatch(distribution, bytes2) {
   if (!distribution.sha256) {
     throw new Error(
       `${distribution.filename} was published without a sha256 digest, so it cannot be verified`
     );
   }
   const actual = [...sha256(bytes2)].map((b) => b.toString(16).padStart(2, "0")).join("");
-  if (actual !== distribution.sha256) {
-    throw new Error(
-      `${distribution.filename} failed verification: the index published sha256 ${distribution.sha256} but the download hashes to ${actual}`
-    );
-  }
+  if (actual === distribution.sha256) return null;
+  return `${distribution.filename} failed verification: the index published sha256 ${distribution.sha256} but the download hashes to ${actual}.`;
 }
 function stageWheel(entries, resolved) {
   const staged = [];
@@ -28026,12 +28048,19 @@ async function installRelease(ctx, index, release, seen, options) {
   const base2 = registryBase(ctx).replace(/\/$/, "");
   const url = `${base2}/${release.filename}`;
   ctx.line(`Fetching ${release.name} ${release.version}`);
-  const archive = await download(url);
-  const digest2 = await digestHex("sha256", archive);
+  let archive = await download2(url);
+  let digest2 = await digestHex("sha256", archive);
   if (digest2 !== release.sha256) {
-    throw new AppRegistryError(
-      `${release.filename} failed verification: the registry publishes sha256 ${release.sha256} but the download hashes to ${digest2}`
-    );
+    const retried = await download2(`${url}${url.includes("?") ? "&" : "?"}sha256=${release.sha256}`).catch(() => null);
+    const retriedDigest = retried && await digestHex("sha256", retried);
+    if (retried && retriedDigest === release.sha256) {
+      archive = retried;
+      digest2 = retriedDigest;
+    } else {
+      throw new AppRegistryError(
+        `${release.filename} failed verification: the registry publishes sha256 ${release.sha256} but the download hashes to ${digest2}. ` + (retried ? "A retry past any cache returned the same bytes, so the registry and the file it names disagree." : "A retry past any cache could not be made; a cached copy of an older build would look like this, so clearing the cache is worth trying before the registry is blamed.")
+      );
+    }
   }
   const verified = await verify(ctx, archive, release, options);
   const root = `${APPS_ROOT}/${release.name}`;
@@ -28058,7 +28087,7 @@ async function installRelease(ctx, index, release, seen, options) {
   }
   if (manifest.docs) ctx.line(`  docs: ${root}/${manifest.docs}`);
 }
-async function download(url) {
+async function download2(url) {
   const response = await fetch(url);
   if (!response.ok) {
     throw new AppRegistryError(`${url} answered ${response.status} ${response.statusText}`);
@@ -38613,6 +38642,22 @@ var WS_DATA = "sandboxedjs:ws-data";
 var WS_CLOSE = "sandboxedjs:ws-close";
 var WS_ERROR = "sandboxedjs:ws-error";
 
+// src/preview/router.ts
+var LOOPBACK_HOST = /^(?:localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[?::1\]?)$/i;
+function containerTarget(value) {
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  if (!LOOPBACK_HOST.test(url.hostname)) return null;
+  const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+  return { port, path: `${url.pathname}${url.search}` };
+}
+
 // src/preview/register.ts
 function serveContainerOn(port, box) {
   port.onmessage = async (event) => {
@@ -38647,20 +38692,6 @@ function serveContainerOn(port, box) {
   };
   port.start?.();
 }
-var LOOPBACK_HOST = /^(?:localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[?::1\]?)$/i;
-function containerTarget(value) {
-  let url;
-  try {
-    url = new URL(value.trim());
-  } catch {
-    return null;
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-  if (!LOOPBACK_HOST.test(url.hostname)) return null;
-  const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
-  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
-  return { port, path: `${url.pathname}${url.search}` };
-}
 async function createPreview(box, options = {}) {
   if (typeof navigator === "undefined" || !("serviceWorker" in navigator)) return null;
   const scriptUrl = options.scriptUrl ?? new URL("./service-worker.js?no-inline", import.meta.url);

package/dist/python-worker.js

@@ -772,7 +772,8 @@ function createSbxFs(FS, client, errnoCodes) {
 }
 
 // src/util/binary.ts
-typeof process !== "undefined" && process.versions != null && process.versions.node != null;
+typeof window === "undefined" && typeof document === "undefined" && typeof process !== "undefined" && process.versions != null && process.versions.node != null && /* A shim has no `release.name`, and Node's has said "node" since v3. */
+process.release?.name === "node";
 async function nodeBuiltin(name) {
   const specifier = `node:${name}`;
   return await import(

package/dist/service-worker.js

@@ -349,6 +349,20 @@ function previewSocketSource() {
 
 // src/preview/router.ts
 var CLAIM = /(?:^|\/)__sbx__\/(\d+)(?:\/|$)/;
+var LOOPBACK_HOST = /^(?:localhost|127(?:\.\d{1,3}){3}|0\.0\.0\.0|\[?::1\]?)$/i;
+function containerTarget(value) {
+  let url;
+  try {
+    url = new URL(value.trim());
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  if (!LOOPBACK_HOST.test(url.hostname)) return null;
+  const port = Number(url.port || (url.protocol === "https:" ? 443 : 80));
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+  return { port, path: `${url.pathname}${url.search}` };
+}
 var OUTDATED = /outdated optimize dep/i;
 var NOT_CONNECTED = 503;
 var PreviewRouter = class {
@@ -549,7 +563,13 @@ worker.addEventListener("message", (event) => {
 });
 worker.addEventListener("fetch", (event) => {
   const url = new URL(event.request.url);
-  if (url.origin !== worker.location.origin) return;
+  if (url.origin !== worker.location.origin) {
+    const port2 = router.portFor(event.clientId);
+    const target = port2 === void 0 ? null : containerTarget(url.href);
+    if (!target) return;
+    event.respondWith(router.fetch(target.port, target.path, event.request, event.clientId));
+    return;
+  }
   const claimed = router.claimedPort(url.pathname);
   if (claimed !== null && event.request.mode === "navigate") {
     router.bind(event.resultingClientId || event.clientId, claimed);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sandboxedjs",
-  "version": "0.1.95",
+  "version": "0.1.99",
   "description": "A Linux-like container that runs entirely inside Node.js — POSIX shell, ~140 coreutils, Node.js and Python runtimes, virtual filesystem and networking. No Docker, no VM, no native modules.",
   "type": "module",
   "license": "MIT",