fix(platform): stop wrapping the runtime adapter in a Proxy

src/platform/adapters/fs/integration.test.ts

@@ -9,13 +9,19 @@ import {
 import { describe, it } from "#veryfront/testing/bdd.ts";
 import { withMockFetch } from "#veryfront/testing/mock-fetch.ts";
 import {
+  createEnhancedAdapter,
   createFSAdapterFromConfig,
   enhanceAdapterWithFS,
   getFSAdapterType,
   isFSAdapterConfigured,
 } from "./integration.ts";
 import { denoAdapter } from "../deno.ts";
 import { VeryfrontError } from "#veryfront/errors/types.ts";
+import { isProxyWithoutHooks } from "#veryfront/platform/compat/error-introspection.ts";
+import type { RuntimeAdapter } from "../base.ts";
+import type { FSAdapter } from "./veryfront/types.ts";
+import { wrapFSAdapter } from "./wrapper.ts";
+import { createSecureFs } from "#veryfront/security/secure-fs.ts";
 
 describe("integration.ts", () => {
   it("should export enhanceAdapterWithFS function", () => {
@@ -101,6 +107,61 @@ describe("integration.ts", () => {
     assertEquals(getFSAdapterType({ fs: {} }), "local");
   });
 
+  describe("remote filesystem reaches SecureFs", () => {
+    // Two gates broke hosted preview in sequence: SecureFs rejected the Proxy
+    // adapter, then rejected the wrapped fs because an unimplemented optional
+    // capability was published as an own `undefined`.
+    function bareRemoteFs(): FSAdapter {
+      return {
+        readFile: () => Promise.resolve(""),
+        writeFile: () => Promise.resolve(),
+        exists: () => Promise.resolve(true),
+        mkdir: () => Promise.resolve(),
+        remove: () => Promise.resolve(),
+        stat: () =>
+          Promise.resolve({
+            isSymlink: false,
+            isDirectory: false,
+            isFile: true,
+            size: 0,
+            mtime: null,
+          }),
+        // deno-lint-ignore require-yield
+        async *readDir() {},
+      } as unknown as FSAdapter;
+    }
+
+    it("produces an adapter SecureFs accepts", () => {
+      const adapter = createEnhancedAdapter(
+        denoAdapter,
+        wrapFSAdapter(bareRemoteFs()) as unknown as RuntimeAdapter["fs"],
+      );
+
+      assertExists(createSecureFs({ baseDir: "/project", adapter }));
+    });
+  });
+
+  describe("createEnhancedAdapter", () => {
+    // SecureFs rejects Proxy adapters, so returning one here took hosted preview
+    // rendering down with a 400 on every request.
+    const stubFs = { symlinkSemantics: "none" } as unknown as RuntimeAdapter["fs"];
+
+    it("returns a non-Proxy adapter so SecureFs can accept it", () => {
+      const adapter = createEnhancedAdapter(denoAdapter, stubFs);
+
+      assertEquals(isProxyWithoutHooks(adapter), false);
+      assertExists(Object.getOwnPropertyDescriptor(adapter, "fs"));
+    });
+
+    it("overrides fs and keeps the rest of the adapter usable", () => {
+      const adapter = createEnhancedAdapter(denoAdapter, stubFs);
+
+      assertStrictEquals(adapter.fs, stubFs);
+      assertEquals(typeof adapter.shutdown, "function");
+      assertStrictEquals(adapter.capabilities, denoAdapter.capabilities);
+    });
+  });
+
   describe("enhanceAdapterWithFS error propagation", () => {
     it("should preserve invalid retry configuration instead of changing filesystems", async () => {
       let rejection: unknown;

src/platform/adapters/fs/integration.ts

@@ -19,6 +19,26 @@ function isLocalFS(config: FSIntegrationConfig): boolean {
   return !config.fs?.type || config.fs.type === "local";
 }
 
+/**
+ * Override `fs` without a Proxy. SecureFs rejects Proxy adapters because their
+ * traps can run arbitrary code. Inheriting from the adapter keeps its methods,
+ * accessors and identity live, while `fs` is the one own data property SecureFs
+ * requires.
+ */
+export function createEnhancedAdapter(
+  adapter: RuntimeAdapter,
+  fs: RuntimeAdapter["fs"],
+): RuntimeAdapter {
+  const enhanced = Object.create(adapter) as RuntimeAdapter;
+  Object.defineProperty(enhanced, "fs", {
+    value: fs,
+    writable: false,
+    enumerable: true,
+    configurable: false,
+  });
+  return enhanced;
+}
+
 export function enhanceAdapterWithFS(
   adapter: RuntimeAdapter,
   config: FSIntegrationConfig,
@@ -50,14 +70,7 @@ export function enhanceAdapterWithFS(
       const fsAdapter = await createFSAdapter(fsAdapterConfig);
       const wrappedFS = wrapFSAdapter(fsAdapter);
 
-      const enhancedAdapter: RuntimeAdapter = new Proxy(adapter, {
-        get(target, prop, receiver) {
-          if (prop === "fs") return wrappedFS;
-
-          const value = Reflect.get(target, prop, receiver);
-          return typeof value === "function" ? value.bind(target) : value;
-        },
-      });
+      const enhancedAdapter = createEnhancedAdapter(adapter, wrappedFS);
 
       logger.debug("FSAdapter initialized successfully", {
         type: fsType,

src/security/secure-fs.ts

@@ -707,6 +707,10 @@ export class SecureFs {
       snapshotReader = captureSnapshotReadCapability(
         suppliedFileSystem,
         "SecureFs filesystem",
+        // FSAdapterWrapper freezes every optional capability slot, publishing
+        // `undefined` for the ones no adapter implements. Treat that as absent,
+        // as the wrapper itself does, instead of rejecting the filesystem.
+        true,
       );
     } catch (_) {
       invalidSecureFsOption("SecureFs filesystem snapshot capability is invalid");