fix(sea): escape embedded fuse literals before injection

Author: jdalton

scripts/repo/cli-build/sea/build.mts

@@ -23,7 +23,11 @@ import { resolveSeaTarget, SEA_TARGETS } from './targets.mts'
 const logger = getDefaultLogger()
 
 export function createSeaEntry(payload: string): string {
-  return `const path = require('node:path');\nconst { Module } = require('node:module');\nconst filename = path.resolve(path.dirname(process.env.SMOL_STUB_PATH || process.execPath), '..', 'cli.js');\nconst product = new Module(filename);\nproduct.filename = filename;\nproduct.paths = Module._nodeModulePaths(path.dirname(filename));\nproduct._compile(${JSON.stringify(payload)}, filename);\nproduct.exports.runCliProduct();\n`
+  const encodedPayload = JSON.stringify(payload).replaceAll(
+    'NODE_SEA_FUSE',
+    'NODE_SEA_FU\\u0053E',
+  )
+  return `const path = require('node:path');\nconst { Module } = require('node:module');\nconst filename = path.resolve(path.dirname(process.env.SMOL_STUB_PATH || process.execPath), '..', 'cli.js');\nconst product = new Module(filename);\nproduct.filename = filename;\nproduct.paths = Module._nodeModulePaths(path.dirname(filename));\nproduct._compile(${encodedPayload}, filename);\nproduct.exports.runCliProduct();\n`
 }
 
 export function createSeaLauncher(): string {

test/repo/unit/sea-package.test.mts

@@ -31,6 +31,9 @@ describe('SEA package', () => {
     )
   })
   it('executes the embedded payload and starts the product', () => {
+    const payload = 'NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2'
+    const entry = createSeaEntry(payload)
+    expect(entry.includes(payload)).toBe(false)
     let started = false
     let filename = ''
     class ProductModule {
@@ -42,12 +45,12 @@ describe('SEA package', () => {
       static _nodeModulePaths() {
         return []
       }
-      _compile(payload: string, file: string) {
-        expect(payload).toBe('example payload')
+      _compile(compiled: string, file: string) {
+        expect(compiled).toBe(payload)
         filename = file
       }
     }
-    runInNewContext(createSeaEntry('example payload'), {
+    runInNewContext(entry, {
       process: { execPath: '/example/dist/sea/socket-linux-x64', env: {} },
       require(name: string) {
         return name === 'node:module'