sandboxedjs 0.2.5 → 0.2.7

package/dist/index.js

@@ -605,32 +605,32 @@ var init_variables = __esm({
         return this.find(name) !== void 0;
       }
       get(name) {
-        const found = this.find(name);
-        if (!found) return void 0;
-        if (found.entry.array) return found.entry.array[0] ?? "";
-        return found.entry.value;
+        const found2 = this.find(name);
+        if (!found2) return void 0;
+        if (found2.entry.array) return found2.entry.array[0] ?? "";
+        return found2.entry.value;
       }
       entry(name) {
         return this.find(name)?.entry;
       }
       getArray(name) {
-        const found = this.find(name);
-        if (!found) return void 0;
-        return found.entry.array ?? [found.entry.value];
+        const found2 = this.find(name);
+        if (!found2) return void 0;
+        return found2.entry.array ?? [found2.entry.value];
       }
       isArray(name) {
         return this.find(name)?.entry.array !== void 0;
       }
       set(name, value, attrs = {}) {
-        const found = this.find(name);
-        if (found?.entry.readonly) throw new ReadonlyVariableError(name);
+        const found2 = this.find(name);
+        if (found2?.entry.readonly) throw new ReadonlyVariableError(name);
         let next = value;
-        if (found?.entry.upper || attrs.upper) next = next.toUpperCase();
-        if (found?.entry.lower || attrs.lower) next = next.toLowerCase();
-        if (found) {
-          found.entry.value = next;
-          delete found.entry.array;
-          Object.assign(found.entry, attrs);
+        if (found2?.entry.upper || attrs.upper) next = next.toUpperCase();
+        if (found2?.entry.lower || attrs.lower) next = next.toLowerCase();
+        if (found2) {
+          found2.entry.value = next;
+          delete found2.entry.array;
+          Object.assign(found2.entry, attrs);
         } else {
           this.scopes[this.scopes.length - 1].set(name, { value: next, ...attrs });
         }
@@ -640,28 +640,28 @@ var init_variables = __esm({
         this.scopes[this.scopes.length - 1].set(name, { value, ...attrs });
       }
       setArray(name, values, attrs = {}) {
-        const found = this.find(name);
-        if (found?.entry.readonly) throw new ReadonlyVariableError(name);
-        if (found) {
-          found.entry.array = values.slice();
-          found.entry.value = values[0] ?? "";
-          Object.assign(found.entry, attrs);
+        const found2 = this.find(name);
+        if (found2?.entry.readonly) throw new ReadonlyVariableError(name);
+        if (found2) {
+          found2.entry.array = values.slice();
+          found2.entry.value = values[0] ?? "";
+          Object.assign(found2.entry, attrs);
         } else {
           this.scopes[this.scopes.length - 1].set(name, { value: values[0] ?? "", array: values.slice(), ...attrs });
         }
       }
       setIndex(name, index, value) {
-        const found = this.find(name);
-        if (found?.entry.readonly) throw new ReadonlyVariableError(name);
-        const arr = found?.entry.array ?? (found ? [found.entry.value] : []);
+        const found2 = this.find(name);
+        if (found2?.entry.readonly) throw new ReadonlyVariableError(name);
+        const arr = found2?.entry.array ?? (found2 ? [found2.entry.value] : []);
         while (arr.length < index) arr.push("");
         arr[index] = value;
         this.setArray(name, arr);
       }
       append(name, value) {
-        const found = this.find(name);
-        if (found?.entry.array) {
-          this.setArray(name, [...found.entry.array, value]);
+        const found2 = this.find(name);
+        if (found2?.entry.array) {
+          this.setArray(name, [...found2.entry.array, value]);
           return;
         }
         this.set(name, (this.get(name) ?? "") + value);
@@ -678,13 +678,13 @@ var init_variables = __esm({
         return false;
       }
       export(name, exported = true) {
-        const found = this.find(name);
-        if (found) found.entry.exported = exported;
+        const found2 = this.find(name);
+        if (found2) found2.entry.exported = exported;
         else this.scopes[this.scopes.length - 1].set(name, { value: "", exported });
       }
       markReadonly(name) {
-        const found = this.find(name);
-        if (found) found.entry.readonly = true;
+        const found2 = this.find(name);
+        if (found2) found2.entry.readonly = true;
         else this.scopes[this.scopes.length - 1].set(name, { value: "", readonly: true });
       }
       names() {
@@ -2930,8 +2930,8 @@ async function builtinSource({ shell, argv, io }) {
   }
   let path = resolve(shell.cwd, target);
   if (!target.includes("/")) {
-    const found = shell.kernel.which(target, shell.cwd, shell.vars.environment(), shell.cred);
-    if (found) path = found;
+    const found2 = shell.kernel.which(target, shell.cwd, shell.vars.environment(), shell.cred);
+    if (found2) path = found2;
   }
   let text2;
   try {
@@ -3565,32 +3565,32 @@ function builtinType({ shell, argv, io }) {
   const names = args.filter((a) => !a.startsWith("-"));
   let status = 0;
   for (const name of names) {
-    const found = [];
+    const found2 = [];
     if (shell.aliases.has(name)) {
-      if (typeOnly) found.push("alias");
-      else if (!pathOnly) found.push(`${name} is aliased to \`${shell.aliases.get(name)}'`);
+      if (typeOnly) found2.push("alias");
+      else if (!pathOnly) found2.push(`${name} is aliased to \`${shell.aliases.get(name)}'`);
     }
     if (shell.functions.has(name)) {
-      if (typeOnly) found.push("function");
-      else if (!pathOnly) found.push(`${name} is a function`);
+      if (typeOnly) found2.push("function");
+      else if (!pathOnly) found2.push(`${name} is a function`);
     }
     if (isBuiltinName(name)) {
-      if (typeOnly) found.push("builtin");
-      else if (!pathOnly) found.push(`${name} is a shell builtin`);
+      if (typeOnly) found2.push("builtin");
+      else if (!pathOnly) found2.push(`${name} is a shell builtin`);
     }
     const path = shell.kernel.which(name, shell.cwd, shell.vars.environment(), shell.cred);
     if (path) {
-      if (typeOnly) found.push("file");
-      else if (pathOnly) found.push(path);
-      else found.push(`${name} is ${path}`);
+      if (typeOnly) found2.push("file");
+      else if (pathOnly) found2.push(path);
+      else found2.push(`${name} is ${path}`);
     }
-    if (found.length === 0) {
+    if (found2.length === 0) {
       if (!pathOnly && !typeOnly) io.stderr.write(`type: ${name}: not found
 `);
       status = 1;
       continue;
     }
-    for (const line of all ? found : [found[0]]) io.stdout.write(line + "\n");
+    for (const line of all ? found2 : [found2[0]]) io.stdout.write(line + "\n");
   }
   return status;
 }
@@ -5947,9 +5947,9 @@ function parseArgs(argv, specs, opts = {}) {
   const resolveLong = (name) => {
     const exact = byLong.get(name);
     if (exact) return exact;
-    const candidates = [...byLong.keys()].filter((k) => k.startsWith(name));
-    if (candidates.length === 1) return byLong.get(candidates[0]);
-    if (candidates.length > 1) throw new UsageError(`option '--${name}' is ambiguous`);
+    const candidates2 = [...byLong.keys()].filter((k) => k.startsWith(name));
+    if (candidates2.length === 1) return byLong.get(candidates2[0]);
+    if (candidates2.length > 1) throw new UsageError(`option '--${name}' is ambiguous`);
     return void 0;
   };
   for (; i < argv.length; i++) {
@@ -6468,19 +6468,19 @@ var WasiHost = class {
   }
   // ── descriptors ──────────────────────────────────────────────────────────
   get(fd) {
-    const found = this.fds.get(fd);
-    if (!found) throw new WasiError(WASI_EBADF);
-    return found;
+    const found2 = this.fds.get(fd);
+    if (!found2) throw new WasiError(WASI_EBADF);
+    return found2;
   }
   dir(fd) {
-    const found = this.get(fd);
-    if (found.kind !== "dir") throw new WasiError(WASI_ENOTDIR);
-    return found;
+    const found2 = this.get(fd);
+    if (found2.kind !== "dir") throw new WasiError(WASI_ENOTDIR);
+    return found2;
   }
   file(fd) {
-    const found = this.get(fd);
-    if (found.kind !== "file") throw new WasiError(WASI_EBADF);
-    return found;
+    const found2 = this.get(fd);
+    if (found2.kind !== "file") throw new WasiError(WASI_EBADF);
+    return found2;
   }
   /**
    * Resolve a guest path against a directory descriptor.
@@ -7425,13 +7425,13 @@ var Kernel = class {
    * Find `name` the way `execvp` does. Returns null when nothing matches.
    */
   resolveExecutable(name, cwd, env2, cred = ROOT_CRED) {
-    const candidates = [];
+    const candidates2 = [];
     if (name.includes("/")) {
-      candidates.push(resolve(cwd, name));
+      candidates2.push(resolve(cwd, name));
     } else {
-      for (const dir3 of this.pathDirs(env2)) candidates.push(join(dir3, name));
+      for (const dir3 of this.pathDirs(env2)) candidates2.push(join(dir3, name));
     }
-    for (const candidate of candidates) {
+    for (const candidate of candidates2) {
       let real;
       try {
         real = this.vfs.realpath(candidate, cred);
@@ -8407,10 +8407,50 @@ function isBrowser() {
 }
 function browserBlocked(hostname, message) {
   return new Error(
-    `${message} \u2014 the request to ${hostname} was blocked by the browser. A page can only read a response from a host that sends CORS headers, and most APIs send none. Give the container a proxy that makes the request for it \u2014 network: { proxy }, and \`npx sandboxedjs-egress\` is one \u2014 or run the container on a server.`
+    `${message} \u2014 the request to ${hostname} was blocked by the browser. A page can only read a response from a host that sends CORS headers, and most APIs send none. The container looks for a proxy to make the request for it and found none: mount \`handleEgressRequest\` from "sandboxedjs/egress" at /__sandboxedjs__/egress on this origin, or run \`npx sandboxedjs-egress\`, and it is used without further configuration (network: { proxy } names one somewhere else) \u2014 or run the container on a server.`
   );
 }
 
+// src/net/discover-egress.ts
+var EGRESS_PATH = "/__sandboxedjs__/egress";
+var EGRESS_MARKER = { sandboxedjs: "egress", protocol: 1 };
+var CLI_PORT = 4181;
+var found = null;
+var PROBE_TIMEOUT_MS = 1500;
+async function isEgress(url, fetchImpl) {
+  const control = new AbortController();
+  const timer = setTimeout(() => control.abort(), PROBE_TIMEOUT_MS);
+  try {
+    const answer = await fetchImpl(url, { method: "GET", signal: control.signal });
+    if (!answer.ok) return false;
+    const payload = await answer.json();
+    return payload?.sandboxedjs === EGRESS_MARKER.sandboxedjs;
+  } catch {
+    return false;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function candidates() {
+  const origin = globalThis.location?.origin;
+  const list = [];
+  if (origin && /^https?:/.test(origin)) list.push(`${origin}${EGRESS_PATH}`);
+  list.push(`http://127.0.0.1:${CLI_PORT}/`);
+  return list;
+}
+async function discoverEgress(fetchImpl = fetch) {
+  if (!isBrowser()) return null;
+  if (!found) {
+    found = (async () => {
+      for (const candidate of candidates()) {
+        if (await isEgress(candidate, fetchImpl)) return candidate;
+      }
+      return null;
+    })();
+  }
+  return await found;
+}
+
 // src/net/policy.ts
 function isLoopbackHostname(hostname) {
   const host2 = hostname.replace(/^\[|\]$/g, "").toLowerCase();
@@ -8453,7 +8493,8 @@ function policedFetch(policy, fetchImpl) {
     if (!outboundAllowed(policy, url)) {
       throw Object.assign(new TypeError("fetch failed"), { cause: outboundBlockedError(url) });
     }
-    if (policy.proxy) return await fetchThroughProxy(policy.proxy, fetchImpl, input, init);
+    const proxy = policy.proxy ?? await discoverEgress(fetchImpl);
+    if (proxy) return await fetchThroughProxy(proxy, fetchImpl, input, init);
     try {
       return await fetchImpl(input, init);
     } catch (error) {
@@ -8989,7 +9030,7 @@ var Lexer = class _Lexer {
       const quoted = /['"\\]/.test(rawTag);
       const tag2 = rawTag.replace(/['"\\]/g, "");
       const lines = [];
-      let found = false;
+      let found2 = false;
       while (this.pos < this.src.length) {
         let eol = this.src.indexOf("\n", this.pos);
         if (eol < 0) eol = this.src.length;
@@ -8997,13 +9038,13 @@ var Lexer = class _Lexer {
         this.pos = eol + 1;
         const compare = stripTabs ? rawLine.replace(/^\t+/, "") : rawLine;
         if (compare === tag2) {
-          found = true;
+          found2 = true;
           break;
         }
         lines.push(stripTabs ? rawLine.replace(/^\t+/, "") : rawLine);
         if (eol >= this.src.length) break;
       }
-      if (!found) {
+      if (!found2) {
         throw new IncompleteInputError(`here-document delimited by end-of-file (wanted \`${tag2}')`, opToken.pos);
       }
       opToken.heredoc = { tag: tag2, stripTabs, quoted, body: lines.length ? lines.join("\n") + "\n" : "" };
@@ -14458,8 +14499,8 @@ var Interpreter = class {
     for (let i = this.locals.length - 1; i >= 0; i--) {
       const scope = this.locals[i];
       if (scope.has(name)) {
-        const found = scope.get(name);
-        return found instanceof Map ? Value.uninitialized : found;
+        const found2 = scope.get(name);
+        return found2 instanceof Map ? Value.uninitialized : found2;
       }
     }
     if (name === "NF") {
@@ -14491,8 +14532,8 @@ var Interpreter = class {
     for (let i = this.locals.length - 1; i >= 0; i--) {
       const scope = this.locals[i];
       if (scope.has(name)) {
-        const found = scope.get(name);
-        if (found instanceof Map) return found;
+        const found2 = scope.get(name);
+        if (found2 instanceof Map) return found2;
         const created = /* @__PURE__ */ new Map();
         scope.set(name, created);
         return created;
@@ -17570,7 +17611,7 @@ async function performRequest(ctx, url, init) {
       `outbound network access to ${url.hostname} is disabled for this container (enable with network: { allowOutbound: true })`
     );
   }
-  const proxy = ctx.kernel.net.proxy;
+  const proxy = ctx.kernel.net.proxy ?? await discoverEgress();
   if (proxy) {
     const result = await proxyExchange(proxy, {
       url: url.toString(),
@@ -18541,14 +18582,14 @@ var apropos = defineCommand({
       return 1;
     }
     const patterns = ctx.args.map((a) => new RegExp(a, "i"));
-    let found = 0;
+    let found2 = 0;
     for (const command of ctx.kernel.commands.all()) {
       const haystack = `${command.name} ${command.summary ?? ""}`;
       if (!patterns.some((p) => p.test(haystack))) continue;
-      found++;
+      found2++;
       ctx.line(`${command.name} (1)${" ".repeat(Math.max(1, 16 - command.name.length))}- ${command.summary ?? ""}`);
     }
-    if (found === 0) {
+    if (found2 === 0) {
       ctx.line(`${ctx.args.join(" ")}: nothing appropriate.`);
       return 1;
     }
@@ -19572,8 +19613,8 @@ ${prelude}${preloadRequires(preloads)}${source}
 }
 function resolveScript(ctx, operand) {
   const base2 = ctx.path(operand);
-  const candidates = [base2, `${base2}.js`, `${base2}.mjs`, `${base2}.cjs`, `${base2}.json`];
-  for (const candidate of candidates) {
+  const candidates2 = [base2, `${base2}.js`, `${base2}.mjs`, `${base2}.cjs`, `${base2}.json`];
+  for (const candidate of candidates2) {
     try {
       const st = ctx.vfs.stat(candidate, { cred: ctx.cred });
       if (st.isFile()) return ctx.vfs.realpath(candidate, ctx.cred);
@@ -21040,7 +21081,7 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.2.5"};
+  version: "0.2.7"};
 
 // src/python/extension-abi.ts
 var EXTENSION_ABI = {
@@ -22705,8 +22746,12 @@ function createHostAbiServer(proc) {
       }
       case Op.resolve: {
         const sockets = proc.sockets;
+        const name = r.string();
+        if (/^(\d{1,3}\.){3}\d{1,3}$/.test(name)) {
+          return { status: 0, payload: new Writer().string(name).finish() };
+        }
         if (!sockets?.outbound) throw new PosixError(Errno.ENOSYS);
-        const address = sockets.outbound.resolve(r.string());
+        const address = sockets.outbound.resolve(name);
         return { status: 0, payload: new Writer().string(address).finish() };
       }
       case Op.send: {
@@ -23908,7 +23953,7 @@ function explain(name, constraints, chosenVersion, available2 = []) {
   return lines;
 }
 async function fetchCandidates(client, name, allowSourceBuilds, prebuilt, rejected = { versions: /* @__PURE__ */ new Set(), sourceAvailable: false }) {
-  const candidates = [];
+  const candidates2 = [];
   if (prebuilt) assertIndexUsable(prebuilt);
   for (const wheel of prebuilt?.wheels ?? []) {
     if (normalize2(wheel.name) !== normalize2(name)) continue;
@@ -23917,7 +23962,7 @@ async function fetchCandidates(client, name, allowSourceBuilds, prebuilt, reject
         `${wheel.filename} in the wheel index was built for ABI ${wheel.abiId}, but this runtime implements ${EXTENSION_ABI.abiId}; rebuild it`
       );
     }
-    candidates.push({
+    candidates2.push({
       name: normalize2(wheel.name),
       version: wheel.version,
       kind: "sbx-wasm",
@@ -23928,13 +23973,13 @@ async function fetchCandidates(client, name, allowSourceBuilds, prebuilt, reject
       indexedRequires: wheel.requires
     });
   }
-  candidates.push(...builtinCandidates(normalize2(name)));
-  if (isBuiltinOnly(normalize2(name))) return candidates;
+  candidates2.push(...builtinCandidates(normalize2(name)));
+  if (isBuiltinOnly(normalize2(name))) return candidates2;
   let index;
   try {
     index = await client.json(`https://pypi.org/pypi/${name}/json`, { timeoutMs: 3e4 });
   } catch (error) {
-    if (candidates.length > 0) return candidates;
+    if (candidates2.length > 0) return candidates2;
     throw error;
   }
   for (const [version, files] of Object.entries(index.releases ?? {})) {
@@ -23947,7 +23992,7 @@ async function fetchCandidates(client, name, allowSourceBuilds, prebuilt, reject
         rejected.versions.add(version);
         continue;
       }
-      candidates.push({
+      candidates2.push({
         name: normalize2(name),
         version,
         kind,
@@ -23958,7 +24003,7 @@ async function fetchCandidates(client, name, allowSourceBuilds, prebuilt, reject
       });
     }
   }
-  return candidates;
+  return candidates2;
 }
 function newest(versions) {
   return versions.reduce((a, b) => compareVersions(b, a, ">") ? b : a);
@@ -24255,17 +24300,17 @@ function createProcessService(ctx) {
       return proc.pid;
     },
     async wait(pid, options) {
-      const candidates = pid > 0 ? [children.get(pid)].filter((p) => p !== void 0) : [...children.values()];
-      if (candidates.length === 0) throw new PosixError(Errno.ECHILD);
+      const candidates2 = pid > 0 ? [children.get(pid)].filter((p) => p !== void 0) : [...children.values()];
+      if (candidates2.length === 0) throw new PosixError(Errno.ECHILD);
       const reap = (proc) => {
         children.delete(proc.pid);
         return { pid: proc.pid, status: waitStatus(proc) };
       };
-      const done = candidates.find(exited);
+      const done = candidates2.find(exited);
       if (done) return reap(done);
       if (options & WNOHANG) return { pid: 0, status: 0 };
-      await Promise.race(candidates.map((proc) => proc.wait()));
-      const finished = candidates.find(exited);
+      await Promise.race(candidates2.map((proc) => proc.wait()));
+      const finished = candidates2.find(exited);
       if (!finished) throw new PosixError(Errno.ECHILD);
       return reap(finished);
     },
@@ -24833,6 +24878,77 @@ if os.environ.get("SBX_OUTBOUND_SOCKETS") == "1":
     sys.meta_path.insert(0, _SbxTruststoreHook())
 
 
+# Literal addresses are answered here rather than through the host.
+#
+# The container's resolver is a host call, and a container with no outbound
+# sockets configured has no resolver to call: it answers ENOSYS. That is the
+# right answer for a name, but the egress hop below dials 127.0.0.1, and
+# http.client calls getaddrinfo even for an address that needs no resolving --
+# so every request through the egress died with "Function not implemented"
+# before it reached the endpoint. A numeric address (and loopback by its usual
+# names) is now formed here, which is what a resolver would have returned.
+def _sbx_local_addresses():
+    import socket as _socket_module
+    import _socket as _socket_native
+
+    # The native entry point, not socket.getaddrinfo: the stdlib wrapper
+    # delegates to _socket, so wrapping the wrapper and replacing _socket with
+    # the wrapper makes the two call each other forever.
+    _real_getaddrinfo = _socket_native.getaddrinfo
+
+    _literals = {"localhost": "127.0.0.1", "localhost.localdomain": "127.0.0.1",
+                 "ip6-localhost": "127.0.0.1"}
+
+    def _literal(host):
+        """The address host already is, or None when it needs a resolver."""
+        if isinstance(host, (bytes, bytearray)):
+            host = bytes(host).decode("ascii", "replace")
+        if host is None:
+            return None
+        host = _literals.get(host.lower(), host)
+        parts = host.split(".")
+        if len(parts) != 4:
+            return None
+        for part in parts:
+            if not part.isdigit() or len(part) > 3 or int(part) > 255:
+                return None
+        return host
+
+    def getaddrinfo(host, port, family=0, type=0, proto=0, flags=0):
+        address = _literal(host)
+        if address is None:
+            return _real_getaddrinfo(host, port, family, type, proto, flags)
+        if isinstance(port, (bytes, bytearray)):
+            port = bytes(port).decode("ascii", "replace")
+        if isinstance(port, str):
+            port = int(port) if port.isdigit() else _socket_module.getservbyname(port)
+        if port is None:
+            port = 0
+        if family not in (0, _socket_module.AF_UNSPEC, _socket_module.AF_INET):
+            raise _socket_module.gaierror(
+                _socket_module.EAI_FAMILY, "only AF_INET is supported in this container"
+            )
+        kind = type or _socket_module.SOCK_STREAM
+        protocol = proto or (_socket_module.IPPROTO_TCP
+                             if kind == _socket_module.SOCK_STREAM else 0)
+        return [(_socket_module.AF_INET, kind, protocol, "", (address, int(port)))]
+
+    def gethostbyname(host):
+        return getaddrinfo(host, 0)[0][4][0]
+
+    def gethostbyname_ex(host):
+        return (host, [], [gethostbyname(host)])
+
+    _socket_module.getaddrinfo = getaddrinfo
+    _socket_module.gethostbyname = gethostbyname
+    _socket_module.gethostbyname_ex = gethostbyname_ex
+    _socket_native.getaddrinfo = getaddrinfo
+    _socket_native.gethostbyname = gethostbyname
+    _socket_native.gethostbyname_ex = gethostbyname_ex
+
+
+_sbx_local_addresses()
+
 _egress = None if os.environ.get("SBX_OUTBOUND_SOCKETS") == "1" else os.environ.get("SBX_HTTP_EGRESS")
 if _egress:
     import http.client
@@ -26422,9 +26538,9 @@ function resolveVersion(metadata, range) {
   const tag2 = metadata["dist-tags"]?.[range];
   if (tag2) return tag2;
   if (valid(range) && metadata.versions[range]) return range;
-  const found = maxSatisfying(Object.keys(metadata.versions), range === "latest" ? "*" : range, { includePrerelease: false });
-  if (!found) throw new Error(`No matching version found for ${metadata.name}@${range}`);
-  return found;
+  const found2 = maxSatisfying(Object.keys(metadata.versions), range === "latest" ? "*" : range, { includePrerelease: false });
+  if (!found2) throw new Error(`No matching version found for ${metadata.name}@${range}`);
+  return found2;
 }
 function verifyIntegrity(data, integrity, shasum, identity) {
   if (integrity) {
@@ -26886,23 +27002,23 @@ var npm = defineCommand({
       case "uninstall":
       case "remove":
       case "rm": {
-        const found = readManifest(ctx, root);
+        const found2 = readManifest(ctx, root);
         for (const name of rest.filter((a) => !a.startsWith("-"))) {
           const target = join(root, "node_modules", name);
           if (ctx.vfs.lexists(target)) ctx.vfs.rmrf(target, ctx.cred);
-          if (found) {
-            delete found.manifest.dependencies?.[name];
-            delete found.manifest.devDependencies?.[name];
+          if (found2) {
+            delete found2.manifest.dependencies?.[name];
+            delete found2.manifest.devDependencies?.[name];
           }
           ctx.line(`removed ${name}`);
         }
-        if (found) writeManifest(ctx, found.path, found.manifest);
+        if (found2) writeManifest(ctx, found2.path, found2.manifest);
         return 0;
       }
       case "ls":
       case "list": {
-        const found = readManifest(ctx, root);
-        ctx.line(`${found?.manifest.name ?? basename(root)}@${found?.manifest.version ?? "1.0.0"} ${root}`);
+        const found2 = readManifest(ctx, root);
+        ctx.line(`${found2?.manifest.name ?? basename(root)}@${found2?.manifest.version ?? "1.0.0"} ${root}`);
         const modules = join(root, "node_modules");
         if (!ctx.vfs.lexists(modules)) return 0;
         const names = ctx.vfs.readdir(modules, ctx.cred).filter((n) => !n.startsWith("."));
@@ -26924,29 +27040,29 @@ var npm = defineCommand({
       case "build": {
         const scriptName = subcommand === "run" || subcommand === "run-script" ? rest[0] : subcommand;
         const scriptArgs = subcommand === "run" || subcommand === "run-script" ? rest.slice(1) : rest;
-        const found = readManifest(ctx, root);
-        if (!found) return ctx.fail("could not read package.json", 1);
+        const found2 = readManifest(ctx, root);
+        if (!found2) return ctx.fail("could not read package.json", 1);
         if (scriptName === void 0) {
-          ctx.line("Lifecycle scripts included in " + (found.manifest.name ?? "app") + ":");
-          for (const [name, body] of Object.entries(found.manifest.scripts ?? {})) {
+          ctx.line("Lifecycle scripts included in " + (found2.manifest.name ?? "app") + ":");
+          for (const [name, body] of Object.entries(found2.manifest.scripts ?? {})) {
             ctx.line(`  ${name}`);
             ctx.line(`    ${body}`);
           }
           return 0;
         }
-        const script = found.manifest.scripts?.[scriptName];
+        const script = found2.manifest.scripts?.[scriptName];
         if (script === void 0) {
-          if (scriptName === "start" && found.manifest.main) {
-            return await runScript(ctx, root, `node ${found.manifest.main}`, scriptArgs, found.manifest);
+          if (scriptName === "start" && found2.manifest.main) {
+            return await runScript(ctx, root, `node ${found2.manifest.main}`, scriptArgs, found2.manifest);
           }
           ctx.warn(`Missing script: "${scriptName}"`);
           return 1;
         }
         ctx.line("");
-        ctx.line(`> ${found.manifest.name ?? "app"}@${found.manifest.version ?? "1.0.0"} ${scriptName}`);
+        ctx.line(`> ${found2.manifest.name ?? "app"}@${found2.manifest.version ?? "1.0.0"} ${scriptName}`);
         ctx.line(`> ${script}`);
         ctx.line("");
-        return await runScript(ctx, root, script, scriptArgs, found.manifest);
+        return await runScript(ctx, root, script, scriptArgs, found2.manifest);
       }
       case "exec":
         return await runScript(ctx, root, rest.join(" "), [], readManifest(ctx, root)?.manifest ?? {});
@@ -29382,23 +29498,23 @@ var CommonJsEngine = class {
     const builtin = this.builtin(specifier);
     if (builtin.found) return specifier;
     if (specifier.startsWith("#")) {
-      const found = this.resolveImports(specifier, importer, kind);
-      if (found) return found;
+      const found2 = this.resolveImports(specifier, importer, kind);
+      if (found2) return found2;
       throw this.moduleNotFound(specifier, importer);
     }
     const baseDir = dirname(importer);
     if (specifier.startsWith("/") || specifier.startsWith("./") || specifier.startsWith("../")) {
       const resolved = specifier.startsWith("/") ? clean(specifier) : resolve(baseDir, specifier);
-      const found = this.resolvePath(resolved, kind);
-      if (found) return found;
+      const found2 = this.resolvePath(resolved, kind);
+      if (found2) return found2;
     } else {
       const aliased = this.aliasFor(specifier);
       if (aliased) {
         const substituted = this.resolvePackage(aliased, baseDir, kind);
         if (substituted) return substituted;
       }
-      const found = this.resolvePackage(specifier, baseDir, kind);
-      if (found) return found;
+      const found2 = this.resolvePackage(specifier, baseDir, kind);
+      if (found2) return found2;
     }
     throw this.moduleNotFound(specifier, importer);
   }
@@ -29564,8 +29680,8 @@ ${code}
           continue;
         }
         for (const target of targets ?? []) {
-          const found = this.resolvePath(resolve(root, target), kind);
-          if (found) return found;
+          const found2 = this.resolvePath(resolve(root, target), kind);
+          if (found2) return found2;
         }
       }
       return null;
@@ -29574,8 +29690,8 @@ ${code}
     for (const field of ENTRY_FIELDS[kind]) {
       const value = manifest?.[field];
       if (typeof value === "string") {
-        const found = this.resolvePath(resolve(root, value), kind);
-        if (found) return found;
+        const found2 = this.resolvePath(resolve(root, value), kind);
+        if (found2) return found2;
       }
     }
     return this.resolveIndex(root);
@@ -29598,8 +29714,8 @@ ${code}
         continue;
       }
       for (const target of targets ?? []) {
-        const found = target.startsWith(".") ? this.resolvePath(resolve(root, target), kind) : this.resolvePackage(target, root, kind);
-        if (found) return found;
+        const found2 = target.startsWith(".") ? this.resolvePath(resolve(root, target), kind) : this.resolvePackage(target, root, kind);
+        if (found2) return found2;
       }
     }
     return null;
@@ -36233,12 +36349,12 @@ async function loadNodeRolldownMemfsBinding() {
 function resolveWorkerPath(node2) {
   const { dirname: dirname3, existsSync, fileURLToPath: fileURLToPath2, join: join3 } = node2;
   const here = dirname3(fileURLToPath2(import.meta.url));
-  const candidates = [
+  const candidates2 = [
     join3(here, WORKER_FILE),
     /* src/tools → dist, for a checkout that has been built. */
     join3(here, "..", "..", "dist", WORKER_FILE)
   ];
-  return candidates.find((candidate) => existsSync(candidate)) ?? null;
+  return candidates2.find((candidate) => existsSync(candidate)) ?? null;
 }
 function resolveSubpath(node2, require2, packageName, subpath) {
   const { dirname: dirname3, join: join3, pathToFileURL: pathToFileURL2, readFileSync } = node2;
@@ -38592,17 +38708,17 @@ var Terminal = class {
     const match2 = /(\S*)$/.exec(left);
     const word = match2?.[1] ?? "";
     const isFirstWord = left.slice(0, left.length - word.length).trim() === "";
-    const candidates = isFirstWord && !word.includes("/") ? this.completeCommand(word) : this.completePath(word);
-    if (candidates.length === 0) return;
-    if (candidates.length === 1) {
-      const completion = candidates[0];
+    const candidates2 = isFirstWord && !word.includes("/") ? this.completeCommand(word) : this.completePath(word);
+    if (candidates2.length === 0) return;
+    if (candidates2.length === 1) {
+      const completion = candidates2[0];
       const suffix = completion.slice(word.length);
       this.buffer = this.buffer.slice(0, this.cursor) + suffix + this.buffer.slice(this.cursor);
       this.cursor += suffix.length;
       this.redraw();
       return;
     }
-    const common = longestCommonPrefix(candidates);
+    const common = longestCommonPrefix(candidates2);
     if (common.length > word.length) {
       const suffix = common.slice(word.length);
       this.buffer = this.buffer.slice(0, this.cursor) + suffix + this.buffer.slice(this.cursor);
@@ -38610,7 +38726,7 @@ var Terminal = class {
       this.redraw();
       return;
     }
-    this.write("\r\n" + formatColumns(candidates, this.columns) + "\r\n");
+    this.write("\r\n" + formatColumns(candidates2, this.columns) + "\r\n");
     this.redraw();
   }
   completeCommand(word) {