stillhunter 0.0.1 → 0.2.1

package/dist/relay.mjs

@@ -0,0 +1,235 @@
+// The browser relay. A probe's child process can reach Playwright's raw
+// protocol (`browser._channel`, `_connection`) and so ask the browser server
+// for anything the protocol offers: a CDP session, a context with its own
+// proxy, a file: page, a browser launched without the closed proxy, a fetch
+// made from the host's own process. None of that can be stopped inside the
+// child, so the child never sees the browser server's endpoint: it connects
+// here, and every message it sends is checked before it reaches the server.
+// The protocol is JSON, one {id, guid, method, params} message per frame; the
+// type of each guid comes from the server's own __create__ messages. Methods
+// are allowed by name per type, a few only with checked parameters, and
+// anything else is answered with an error and never forwarded.
+import { randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { createRequire } from 'node:module';
+export const REFUSED = 'refused by the browser relay';
+const MAX_PAYLOAD = 256 * 1024 * 1024;
+const MAX_KEPT = 20;
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
+// An http or https URL on a loopback host. A relative URL resolves against the
+// target, as the server resolves it against the context's baseURL, which is
+// itself held to a loopback http or https URL below.
+export function allowedUrl(url, target) {
+    if (typeof url !== 'string')
+        return false;
+    try {
+        const u = new URL(url, target);
+        if (u.protocol !== 'http:' && u.protocol !== 'https:')
+            return false;
+        return LOOPBACK.has(u.hostname) || u.hostname.endsWith('.localhost');
+    }
+    catch {
+        return false;
+    }
+}
+// Context options that change only what happens inside the browser. Left out
+// on purpose: proxy (its own way out), recordVideo (the server writes files on
+// the host) and clientCertificates.
+const CONTEXT_OPTIONS = new Set([
+    'noDefaultViewport', 'viewport', 'screen', 'ignoreHTTPSErrors', 'javaScriptEnabled', 'bypassCSP', 'userAgent', 'locale', 'timezoneId',
+    'geolocation', 'permissions', 'extraHTTPHeaders', 'offline', 'httpCredentials', 'deviceScaleFactor', 'isMobile', 'hasTouch', 'colorScheme',
+    'reducedMotion', 'forcedColors', 'acceptDownloads', 'contrast', 'baseURL', 'strictSelectors', 'serviceWorkers', 'selectorEngines',
+    'testIdAttributeName', 'storageState',
+]);
+// Permissions that reach nothing on the host: no clipboard, camera or microphone.
+const PERMISSIONS = new Set([
+    'geolocation', 'notifications', 'background-sync', 'background-fetch', 'payment-handler', 'accelerometer', 'gyroscope', 'magnetometer',
+    'ambient-light-sensor', 'accessibility-events', 'storage-access', 'screen-wake-lock',
+]);
+// Files for an input or a drop come from the probe as bytes, never as paths
+// or streams the server would read from the host's disk.
+const FILE_KEYS = new Set(['selector', 'strict', 'payloads', 'position', 'data', 'timeout']);
+const keysOutside = (params, allowed) => Object.keys(params).filter((k) => params[k] !== undefined && !allowed.has(k));
+// The server opens a page at each origin a storage state lists to restore
+// its storage, so every origin is held to the same rule as a navigation.
+const storageState = (state, target) => {
+    if (state === undefined || state === null)
+        return null;
+    const origins = typeof state === 'object' ? state.origins : undefined;
+    if (origins === undefined)
+        return null;
+    if (!Array.isArray(origins))
+        return 'a storage state\'s origins must be a list';
+    const bad = origins.map((o) => (o && typeof o === 'object' ? o.origin : o)).filter((o) => !allowedUrl(o, target));
+    return bad.length ? `a storage state may hold only loopback http or https origins, not ${bad.map((o) => String(o).slice(0, 120)).join(', ')}` : null;
+};
+const contextOptions = (p, target) => {
+    const extra = keysOutside(p, CONTEXT_OPTIONS);
+    if (extra.length)
+        return `a context may not set ${extra.join(', ')}; pages come from rr.newPage()`;
+    if (!allowedUrl(p.baseURL, target))
+        return 'a context needs a loopback http or https baseURL';
+    return storageState(p.storageState, target) ?? permissions(p, target);
+};
+const permissions = (p) => {
+    const list = Array.isArray(p.permissions) ? p.permissions : [];
+    const bad = list.filter((x) => !PERMISSIONS.has(String(x)));
+    return bad.length ? `the permission ${bad.join(', ')} reaches the host` : null;
+};
+const files = (p) => {
+    const extra = keysOutside(p, FILE_KEYS);
+    return extra.length ? `files must be given as bytes, not as ${extra.join(', ')} on the host` : null;
+};
+const url = (key, optional) => (p, target) => {
+    if (optional && p[key] === undefined)
+        return null;
+    return allowedUrl(p[key], target) ? null : `${String(p[key]).slice(0, 120)} is not an http or https URL on a loopback host`;
+};
+const fetchCheck = (p, target) => url('url', false)(p, target) ?? (p.maxRedirects === 0 ? null : 'a request from the host follows no redirects: use rr.request');
+const ALL = null;
+const names = (list, rules = {}) => ({ ...Object.fromEntries(list.trim().split(/\s+/).map((m) => [m, ALL])), ...rules });
+const JS_HANDLE = 'dispose evaluateExpression evaluateExpressionHandle getProperty getPropertyList jsonValue';
+// Everything the child may ask of each type, from playwright-core 1.64.1's
+// protocol. A type or method missing here is refused: the browser type and
+// its launch and connect calls, CDP sessions, tracing, local utils, Android,
+// Electron, the debug controller, the recorder, temp files on the host and
+// saving an artifact to a host path.
+export const ALLOWED = {
+    Root: names('initialize'),
+    Browser: names('close', { newContext: contextOptions }),
+    BrowserContext: names(`addCookies addInitScript clearCookies clearPermissions clockFastForward clockInstall clockPauseAt clockResume
+    clockRunFor clockSetFixedTime clockSetSystemTime close cookies exposeBinding newPage registerSelectorEngine setExtraHTTPHeaders
+    setGeolocation setHTTPCredentials setNetworkInterceptionPatterns setOffline setTestIdAttributeName
+    setWebSocketInterceptionPatterns storageState updateSubscription`, { grantPermissions: permissions, setStorageState: (p, target) => storageState(p.storageState, target) }),
+    Page: names(`addInitScript bringToFront clearConsoleMessages clearPageErrors close consoleMessages emulateMedia expectScreenshot
+    exposeBinding goBack goForward keyboardDown keyboardInsertText keyboardPress keyboardType keyboardUp mouseClick mouseDown mouseMove
+    mouseUp mouseWheel pageErrors pdf registerLocatorHandler reload requestGC requests resolveLocatorHandlerNoReply runBeforeUnload
+    screenshot setExtraHTTPHeaders setNetworkInterceptionPatterns setViewportSize setWebSocketInterceptionPatterns startCSSCoverage
+    startJSCoverage stopCSSCoverage stopJSCoverage touchscreenTap unregisterLocatorHandler updateSubscription webStorageClear
+    webStorageGetItem webStorageItems webStorageRemoveItem webStorageSetItem`),
+    Frame: names(`ariaSnapshot ariaSnapshotJSON blur check click content dblclick dispatchEvent dragAndDrop
+    evalOnSelector evalOnSelectorAll evaluateExpression evaluateExpressionHandle expect fill focus frameElement getAttribute hover innerHTML
+    innerText inputValue isChecked isDisabled isEditable isEnabled isHidden isVisible press queryCount querySelector querySelectorAll
+    resolveSelector selectOption setContent tap textContent title type uncheck waitForFunction waitForSelector waitForTimeout`, { goto: url('url', false), addScriptTag: url('url', true), addStyleTag: url('url', true), setInputFiles: files, drop: files }),
+    ElementHandle: names(`${JS_HANDLE} boundingBox check click contentFrame dblclick dispatchEvent evalOnSelector evalOnSelectorAll fill
+    focus getAttribute hover innerHTML innerText inputValue isChecked isDisabled isEditable isEnabled isHidden isVisible ownerFrame press
+    querySelector querySelectorAll screenshot scrollIntoViewIfNeeded selectOption selectText tap textContent type uncheck
+    waitForElementState waitForSelector`, { setInputFiles: files }),
+    JSHandle: names(JS_HANDLE),
+    Worker: names('evaluateExpression evaluateExpressionHandle updateSubscription'),
+    Request: names('rawRequestHeaders response'),
+    Response: names('body httpVersion rawResponseHeaders securityDetails serverAddr sizes'),
+    Route: names('abort fulfill', { continue: url('url', true), redirectNavigationRequest: url('url', false) }),
+    WebSocketRoute: names('closePage closeServer connect ensureOpened sendToPage sendToServer'),
+    APIRequestContext: names('addCookies clearCookies cookies dispose disposeAPIResponse fetchLog fetchResponseBody storageState', { fetch: fetchCheck }),
+    Dialog: names('accept dismiss'),
+    BindingCall: names('reject resolve'),
+    Artifact: names('cancel delete failure saveAsStream stream'),
+    Stream: names('close read'),
+    Disposable: names('dispose'),
+};
+const CONNECTION_METHODS = new Set(['__waitInfo__', '__abort__']);
+const unanswered = (method) => method.endsWith('NoReply') || CONNECTION_METHODS.has(method);
+// Why a message from the child is refused, or null when it may go on.
+export function refusal(type, message, target) {
+    const method = String(message.method);
+    if (type === undefined)
+        return `${method} on an object the server never created`;
+    // The connection's own bookkeeping, sent for any object: what a pending call
+    // waits for, and cancelling one. Neither is answered.
+    if (CONNECTION_METHODS.has(method))
+        return null;
+    const rules = Object.hasOwn(ALLOWED, type) ? ALLOWED[type] : null;
+    if (!rules || !Object.hasOwn(rules, method))
+        return `${type}.${method} is not available to a probe`;
+    const check = rules[method];
+    const params = message.params && typeof message.params === 'object' ? message.params : {};
+    const why = check ? check(params, target) : null;
+    return why ? `${type}.${method}: ${why}` : null;
+}
+const require = createRequire(import.meta.url);
+const { ws: WebSocket, wsServer: WebSocketServer } = require('playwright-core/lib/utilsBundle');
+// Serves a WebSocket on loopback, at a path only the child is told, and relays
+// each connection to the browser server's endpoint, checking every message.
+export async function startRelay(upstream, target) {
+    const path = `/${randomBytes(16).toString('hex')}`;
+    const refused = [];
+    const sockets = new Set();
+    const wss = new WebSocketServer({ noServer: true, perMessageDeflate: false, maxPayload: MAX_PAYLOAD });
+    const http = createServer((_, res) => { res.statusCode = 404; res.end(); });
+    const relay = (client, req) => {
+        // Only the user agent goes on: the server checks the client's version in
+        // it. Proxy and launch-option headers never do.
+        const ua = req.headers['user-agent'];
+        const server = new WebSocket(upstream, { headers: typeof ua === 'string' ? { 'user-agent': ua } : {}, perMessageDeflate: false, maxPayload: MAX_PAYLOAD });
+        sockets.add(client).add(server);
+        const types = new Map([['', 'Root']]);
+        const queue = [];
+        const end = () => { client.terminate(); server.terminate(); };
+        server.on('open', () => { for (const m of queue.splice(0))
+            server.send(m); });
+        server.on('message', (data) => {
+            const text = data.toString('utf8');
+            if (text.includes('__create__') || text.includes('__dispose__')) {
+                try {
+                    const m = JSON.parse(text);
+                    if (m.method === '__create__' && typeof m.params?.guid === 'string' && typeof m.params.type === 'string')
+                        types.set(m.params.guid, m.params.type);
+                    if (m.method === '__dispose__' && typeof m.guid === 'string')
+                        types.delete(m.guid);
+                }
+                catch { }
+            }
+            client.send(text);
+        });
+        client.on('message', (data) => {
+            const text = data.toString('utf8');
+            let m;
+            try {
+                m = JSON.parse(text);
+            }
+            catch {
+                return end();
+            }
+            if (!m || typeof m !== 'object' || typeof m.guid !== 'string' || typeof m.method !== 'string')
+                return end();
+            const why = refusal(types.get(m.guid), m, target);
+            if (!why) {
+                if (server.readyState === WebSocket.OPEN)
+                    server.send(text);
+                else
+                    queue.push(text);
+                return;
+            }
+            if (refused.length < MAX_KEPT)
+                refused.push(why);
+            if ((typeof m.id === 'number' || typeof m.id === 'string') && !unanswered(m.method)) {
+                client.send(JSON.stringify({ id: m.id, error: { error: { name: 'Error', message: `${why} (${REFUSED})`, stack: '' } } }));
+            }
+        });
+        server.on('close', end);
+        client.on('close', end);
+        server.on('error', end);
+        client.on('error', end);
+    };
+    http.on('upgrade', (req, socket, head) => {
+        if (new URL(req.url ?? '/', 'http://127.0.0.1').pathname !== path)
+            return socket.destroy();
+        wss.handleUpgrade(req, socket, head, (ws) => relay(ws, req));
+    });
+    await new Promise((resolve, reject) => {
+        http.once('error', reject);
+        http.listen(0, '127.0.0.1', () => resolve());
+    });
+    const { port } = http.address();
+    return {
+        endpoint: `ws://127.0.0.1:${port}${path}`,
+        refused,
+        close: async () => {
+            for (const s of sockets)
+                s.terminate();
+            wss.close();
+            await new Promise((resolve) => http.close(() => resolve()));
+        },
+    };
+}

package/dist/reset.mjs

@@ -0,0 +1,87 @@
+// The state each probe starts from when the config has a reset, in the hunt
+// and in the proof alike: app data goes back to what the reset makes, which
+// may sign everyone out, and a sign-in probe then signs in again, unless the
+// probe about to run is that sign-in probe. Sharing it is what lets finish
+// prove a finding from the state the hunt found it in.
+import { spawn, spawnSync } from 'node:child_process';
+import { rmSync } from 'node:fs';
+import { PROBE_TIMEOUT_MS } from './probe-host.mjs';
+export const RESET_TIMEOUT_MS = 120_000;
+// How long a reset stopped at its time limit may take to close its output.
+const STOP_GRACE_MS = 5_000;
+export const seconds = (ms) => Math.round(ms / 100) / 10;
+// Stops a process and everything it started. On POSIX the reset leads its own
+// process group; on Windows, taskkill follows the tree.
+function stopAll(pid) {
+    if (pid === undefined)
+        return;
+    try {
+        if (process.platform === 'win32')
+            spawnSync('taskkill', ['/pid', String(pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true });
+        else
+            process.kill(-pid, 'SIGKILL');
+    }
+    catch { }
+}
+// Runs the configured reset in the repository root: null when it worked,
+// otherwise the command, how it ended and the end of what it printed. A reset
+// that runs past its time is stopped with every process it started, so none
+// of them goes on changing app data once the next probe has begun.
+export function resetApp(root, config, timeoutMs = RESET_TIMEOUT_MS) {
+    const command = config.reset;
+    if (!command)
+        return Promise.resolve(null);
+    return new Promise((resolve) => {
+        const child = spawn(command, { cwd: root, shell: true, detached: process.platform !== 'win32', stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.on('data', (d) => { stdout = (stdout + d.toString('utf8')).slice(-4000); });
+        child.stderr.on('data', (d) => { stderr = (stderr + d.toString('utf8')).slice(-4000); });
+        let timedOut = false;
+        let grace;
+        const done = (why) => {
+            clearTimeout(timer);
+            clearTimeout(grace);
+            if (why === null)
+                return resolve(null);
+            const printed = stderr.trim() || stdout.trim();
+            resolve(`reset ("${command}") failed: ${why}${printed ? `: ${printed.slice(-300)}` : ''}`);
+        };
+        const timer = setTimeout(() => {
+            timedOut = true;
+            stopAll(child.pid);
+            // A process that left the group may still hold the output open.
+            grace = setTimeout(() => {
+                child.stdout.destroy();
+                child.stderr.destroy();
+                done(`timed out after ${seconds(timeoutMs)} s`);
+            }, STOP_GRACE_MS);
+        }, timeoutMs);
+        child.on('error', (e) => done(e.message));
+        child.on('close', (code, signal) => done(timedOut ? `timed out after ${seconds(timeoutMs)} s` : code === 0 ? null : `exit ${code ?? signal}`));
+    });
+}
+// Resets app data, then signs in again. A failed reset or sign-in is
+// reported, not fatal: the probe still runs, and its result says so. null
+// when a time limit left no room for the sign-in or cut it short, so the probe
+// would start signed out for no reason of the app's.
+export async function resetAndSignIn(job) {
+    const t0 = Date.now();
+    const resetError = await resetApp(job.root, job.config, job.resetTimeoutMs);
+    const resetSeconds = seconds(Date.now() - t0);
+    rmSync(job.sessionFile, { force: true });
+    if (!job.signIn || job.signIn === job.probe)
+        return { resetSeconds, resetError, signIn: null };
+    const timeoutMs = job.signInTimeoutMs ? job.signInTimeoutMs() : PROBE_TIMEOUT_MS;
+    if (timeoutMs === null)
+        return null;
+    const t1 = Date.now();
+    const s = await job.runSignIn(job.signIn, timeoutMs);
+    if (s.hostError === 'timeout' && timeoutMs < PROBE_TIMEOUT_MS)
+        return null;
+    const error = s.error ?? (s.savedSession ? null : 'it saved no session');
+    return { resetSeconds, resetError, signIn: { probe: job.signIn, seconds: seconds(Date.now() - t1), error, savedSession: s.savedSession } };
+}
+// A probe ran signed out when the sign-in before it failed without saving a
+// session. One that saved a session and then failed left that session in place.
+export const signedOut = (b) => Boolean(b?.signIn?.error && !b.signIn.savedSession);

package/dist/results.mjs

@@ -0,0 +1,87 @@
+// The result a probe run leaves behind, and the questions the runner asks of
+// it: did a named check fail, which checks failed, which run is the latest.
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+export function emptyResult(probe, error, hostError) {
+    return { probe, checks: [], notes: [], error, hostError, blocked: [], savedSession: false, shots: [], requests: [], faults: [], pages: [], final: null, output: '' };
+}
+// A check fails in a run when any expectation of that name failed.
+export function outcome(result, check) {
+    const named = (result.checks ?? []).filter((c) => c.name === check);
+    if (named.length === 0)
+        return { state: 'missing' };
+    const failed = named.find((c) => !c.pass);
+    return failed ? { state: 'failed', detail: failed.detail } : { state: 'held' };
+}
+export function failedChecks(result) {
+    return [...new Set((result.checks ?? []).filter((c) => !c.pass).map((c) => c.name))];
+}
+export const probesDir = (runDir) => path.join(runDir, 'probes');
+export const latestFile = (runDir, name) => path.join(probesDir(runDir), `${name}.result.json`);
+export const numberedFile = (runDir, name, n) => path.join(probesDir(runDir), `${name}.${n}.result.json`);
+export function readResult(file) {
+    try {
+        return JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function probeNames(runDir) {
+    const dir = probesDir(runDir);
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir).filter((f) => /^[a-z0-9][a-z0-9-]*\.mjs$/.test(f)).map((f) => f.slice(0, -4)).sort();
+}
+export function latestResults(runDir) {
+    const out = new Map();
+    for (const name of probeNames(runDir)) {
+        const r = readResult(latestFile(runDir, name));
+        if (r)
+            out.set(name, r);
+    }
+    return out;
+}
+export function nextRunNumber(runDir, name) {
+    const dir = probesDir(runDir);
+    if (!existsSync(dir))
+        return 1;
+    const pattern = new RegExp(`^${name}\\.(\\d+)\\.result\\.json$`);
+    let max = 0;
+    for (const f of readdirSync(dir)) {
+        const m = pattern.exec(f);
+        if (m)
+            max = Math.max(max, Number(m[1]));
+    }
+    return max + 1;
+}
+// Every run of every probe in the hunt, for coverage: a fault applied in an
+// earlier run of a probe was still applied.
+export function allResults(runDir) {
+    const dir = probesDir(runDir);
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir).filter((f) => /^[a-z0-9][a-z0-9-]*\.\d+\.result\.json$/.test(f)).sort()
+        .map((f) => readResult(path.join(dir, f))).filter((r) => r !== null);
+}
+// The probe that signed in: the latest one whose run saved the session.
+export function signInProbe(runDir) {
+    // The latest probe whose run saved a session and ended without an error;
+    // failing that, the latest that saved a session and failed after it. Its
+    // session is still good, and every run of it says that it failed, so a
+    // sign-in probe with a broken last step never leaves the hunt signed out.
+    let clean = null;
+    let saved = null;
+    for (const [name, r] of latestResults(runDir)) {
+        if (!r.savedSession)
+            continue;
+        const at = r.finishedAt ?? 0;
+        if (!r.error) {
+            if (!clean || at > clean.at)
+                clean = { name, at };
+        }
+        else if (!saved || at > saved.at)
+            saved = { name, at };
+    }
+    return (clean ?? saved)?.name ?? null;
+}

package/dist/target.mjs

@@ -0,0 +1,121 @@
+// Finding the app to hunt: target.url from .stillhunter/config.json, or a Nuxt
+// dev server proven to be this repository's own. The proof: the server that
+// answers for localhost:<port> serves the bytes of this checkout's
+// .nuxt/nuxt.lock, so another app on the same port can't pass for it.
+import { spawnSync } from 'node:child_process';
+import { lookup } from 'node:dns/promises';
+import { readFileSync, realpathSync } from 'node:fs';
+import { request } from 'node:http';
+import path from 'node:path';
+const DROPPED = new Set([
+    'node_modules', '.venv', 'venv', '__pycache__', '.nuxt', '.output', '.next', '.svelte-kit', 'dist', 'build',
+    'coverage', '.turbo', '.vercel', '.pytest_cache', '.mypy_cache', '.ruff_cache', '.stillhunter',
+]);
+// nuxt.config.* files git can see, whose folder's package.json depends on nuxt.
+export function nuxtCandidates(root) {
+    const listed = spawnSync('git', ['ls-files', '-z', '--cached', '--others', '--exclude-standard', '--', ':(glob)**/nuxt.config.*'], { cwd: root, encoding: 'utf8' });
+    const found = [];
+    for (const file of (listed.stdout ?? '').split('\0').filter(Boolean)) {
+        const segments = file.split('/');
+        if (!/^nuxt\.config\.[a-z]+$/.test(segments.at(-1) ?? ''))
+            continue;
+        if (segments.slice(0, -1).some((s) => DROPPED.has(s)))
+            continue;
+        const dir = path.join(root, ...segments.slice(0, -1));
+        if (dependsOnNuxt(dir) && !found.some((c) => c.dir === dir))
+            found.push({ dir });
+    }
+    return found.sort((a, b) => a.dir.localeCompare(b.dir));
+}
+function dependsOnNuxt(dir) {
+    try {
+        const pkg = JSON.parse(readFileSync(path.join(dir, 'package.json'), 'utf8'));
+        return ['dependencies', 'devDependencies'].some((key) => pkg[key]?.nuxt !== undefined);
+    }
+    catch {
+        return false;
+    }
+}
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+// A lock left by a dev server that was killed hard counts as no lock.
+function readLock(candidate) {
+    try {
+        const raw = readFileSync(path.join(candidate.dir, '.nuxt', 'nuxt.lock'));
+        const parsed = JSON.parse(raw.toString('utf8'));
+        if (typeof parsed.cwd !== 'string')
+            return null;
+        if (typeof parsed.pid === 'number' && parsed.pid > 0 && !processAlive(parsed.pid))
+            return null;
+        return { raw, cwd: parsed.cwd, port: typeof parsed.port === 'number' ? parsed.port : null };
+    }
+    catch {
+        return null;
+    }
+}
+export function samePath(a, b) {
+    try {
+        return realpathSync.native(a) === realpathSync.native(b);
+    }
+    catch {
+        return path.resolve(a) === path.resolve(b);
+    }
+}
+// `/_nuxt/@fs<cwd>/.nuxt/nuxt.lock`; a Windows drive path gains the leading slash Vite expects.
+export function lockUrlPath(cwd) {
+    const forward = cwd.replace(/\\/g, '/');
+    return `/_nuxt/@fs${forward.startsWith('/') ? '' : '/'}${encodeURI(forward)}/.nuxt/nuxt.lock`;
+}
+function fetchBytes(address, port, urlPath) {
+    return new Promise((resolve) => {
+        const req = request({ host: address, port, path: urlPath, headers: { host: `localhost:${port}` }, timeout: 3000 }, (res) => {
+            const chunks = [];
+            res.on('data', (c) => chunks.push(c));
+            res.on('end', () => resolve(res.statusCode === 200 ? Buffer.concat(chunks) : null));
+            res.on('error', () => resolve(null));
+        });
+        req.on('timeout', () => req.destroy());
+        req.on('error', () => resolve(null));
+        req.end();
+    });
+}
+// Nuxt dev may bind ::1 only while 127.0.0.1 is another process, so every
+// address localhost resolves to is tried.
+export async function proveLock(candidate) {
+    const lock = readLock(candidate);
+    if (lock === null || lock.port === null || !samePath(lock.cwd, candidate.dir))
+        return null;
+    const addresses = await lookup('localhost', { all: true }).catch(() => [{ address: '::1' }, { address: '127.0.0.1' }]);
+    for (const { address } of addresses) {
+        const served = await fetchBytes(address, lock.port, lockUrlPath(lock.cwd));
+        if (served !== null && served.equals(lock.raw))
+            return `http://localhost:${lock.port}`;
+    }
+    return null;
+}
+// The status of any HTTP response at all, or null when nothing answers.
+export function answers(url) {
+    return new Promise((resolve) => {
+        let req;
+        try {
+            req = request(url, { method: 'GET', timeout: 3000 }, (res) => {
+                res.resume();
+                resolve(res.statusCode ?? null);
+            });
+        }
+        catch {
+            resolve(null);
+            return;
+        }
+        req.on('timeout', () => req.destroy());
+        req.on('error', () => resolve(null));
+        req.end();
+    });
+}