@earendil-works/chord 1.4.0 → 1.5.1

package/dist/node/tui/pipe.js

@@ -0,0 +1,134 @@
+// The launcher's end of the sandbox's pipes (slice 11 §4; fix round 2: the sandbox a child process): messages as
+// plain length-prefixed binary frames, not Node's IPC. A frame is a 4-byte big-endian length, then the payload: a
+// 4-byte big-endian header length, the header (the message as JSON, its body field left out), and the body (the raw
+// bytes of `bytes`, or the UTF-8 text of `data`). The sandbox's bootstrap has the same codec (`sandbox.ts`). What the
+// sandbox sends is untrusted: each frame is bounded, and each message checked here before the launcher acts on it.
+/** The largest frame either side takes: 17 MiB (an attached file of 16 MiB and its header). */
+export const MAX_PIPE_FRAME = 17 * 1024 * 1024;
+/** The largest header of a frame from the sandbox: 1 MiB (a request's text or URL; frames carry their text as body). */
+const MAX_HEADER = 1024 * 1024;
+/** `message` as one frame for the sandbox. */
+export function launcherFrame(message) {
+    if (message.kind === "input")
+        return frame({ kind: "input" }, Buffer.from(message.data));
+    if (message.kind === "socket_message")
+        return frame({ kind: message.kind, socket: message.socket }, message.bytes);
+    if (message.kind === "attached")
+        return frame({ kind: message.kind, id: message.id, name: message.name }, message.bytes);
+    return frame(message, undefined);
+}
+/** The first frame: the bridge's start and the base bundle's text as body. */
+export function startFrame(start, source) {
+    return frame({ kind: "start", start }, Buffer.from(source));
+}
+/** A frame of `header` and `body`. */
+function frame(header, body) {
+    const json = Buffer.from(JSON.stringify(header));
+    const prefix = Buffer.allocUnsafe(8);
+    prefix.writeUInt32BE(4 + json.length + (body?.length ?? 0), 0);
+    prefix.writeUInt32BE(json.length, 4);
+    return Buffer.concat(body === undefined ? [prefix, json] : [prefix, json, body]);
+}
+/**
+ * Cuts the sandbox's output into messages as chunks arrive; throws (the sandbox is ended) on a frame over
+ * `MAX_PIPE_FRAME`, a header over 1 MiB, or a message of no known shape. Each byte is copied in once, however small the
+ * chunks the sandbox writes.
+ */
+export class FrameReader {
+    #buffer = Buffer.alloc(64 * 1024);
+    #start = 0;
+    #end = 0;
+    /** The messages complete with `chunk`. */
+    push(chunk) {
+        this.#append(chunk);
+        const messages = [];
+        while (this.#end - this.#start >= 4) {
+            const length = this.#buffer.readUInt32BE(this.#start);
+            if (length < 4 || length > MAX_PIPE_FRAME)
+                throw new Error("terminal: the sandbox sent a malformed frame");
+            if (this.#end - this.#start < 4 + length)
+                break;
+            // The message copies what it keeps: the buffer is reused.
+            messages.push(sandboxMessage(this.#buffer.subarray(this.#start + 4, this.#start + 4 + length)));
+            this.#start += 4 + length;
+        }
+        if (this.#start === this.#end)
+            this.#start = this.#end = 0;
+        return messages;
+    }
+    /** Copies `chunk` in after the unread bytes, moving them to the front or growing the buffer when it is full. */
+    #append(chunk) {
+        const unread = this.#end - this.#start;
+        if (this.#end + chunk.length > this.#buffer.length) {
+            const needed = unread + chunk.length;
+            const target = needed <= this.#buffer.length
+                ? this.#buffer
+                : Buffer.alloc(Math.max(needed, Math.min(this.#buffer.length * 2, MAX_PIPE_FRAME + 4)));
+            this.#buffer.copy(target, 0, this.#start, this.#end);
+            this.#buffer = target;
+            this.#start = 0;
+            this.#end = unread;
+        }
+        chunk.copy(this.#buffer, this.#end);
+        this.#end += chunk.length;
+    }
+}
+/**
+ * The message in `payload` (a frame from the sandbox, without its length); throws for anything else. Trust boundary:
+ * the sandbox's pipe.
+ */
+function sandboxMessage(payload) {
+    const headerLength = payload.readUInt32BE(0);
+    if (headerLength > MAX_HEADER || 4 + headerLength > payload.length)
+        throw malformed();
+    const header = JSON.parse(payload.toString("utf8", 4, 4 + headerLength));
+    const body = payload.subarray(4 + headerLength);
+    if (typeof header !== "object" || header === null)
+        throw malformed();
+    const socket = header.socket;
+    switch (header.kind) {
+        case "write":
+            return { kind: "write", data: body.toString("utf8") };
+        case "socket_send":
+            if (!Number.isSafeInteger(socket))
+                throw malformed();
+            // A copy: the payload's memory is the reader's.
+            return { kind: "socket_send", socket: socket, bytes: new Uint8Array(body) };
+        case "socket_open":
+        case "socket_close":
+            if (!Number.isSafeInteger(socket))
+                throw malformed();
+            return { kind: header.kind, socket: socket };
+        case "request":
+            if (!Number.isSafeInteger(header.id))
+                throw malformed();
+            return { kind: "request", id: header.id, request: bridgeRequest(header.request) };
+        case "outdated":
+            return { kind: "outdated" };
+        case "failed":
+            return { kind: "failed", message: String(header.message) };
+        case "exit":
+            return { kind: "exit", code: Number.isSafeInteger(header.code) ? header.code : 1 };
+        default:
+            throw malformed();
+    }
+}
+/** The request `value` names; throws for anything else. */
+function bridgeRequest(value) {
+    const request = (typeof value === "object" && value !== null ? value : {});
+    if (request.kind === "base")
+        return { kind: "base" };
+    if (request.kind === "fetch" && typeof request.path === "string")
+        return { kind: "fetch", path: request.path };
+    if (request.kind === "copy" && typeof request.text === "string")
+        return { kind: "copy", text: request.text };
+    if (request.kind === "open" && typeof request.url === "string")
+        return { kind: "open", url: request.url };
+    if (request.kind === "attach" && typeof request.path === "string")
+        return { kind: "attach", path: request.path };
+    throw malformed();
+}
+function malformed() {
+    return new Error("terminal: the sandbox sent a malformed message");
+}
+//# sourceMappingURL=pipe.js.map

package/dist/node/tui/pipe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipe.js","sourceRoot":"","sources":["../../../src/node/tui/pipe.ts"],"names":[],"mappings":"AAAA,iHAAiH;AACjH,kHAAkH;AAClH,oHAAoH;AACpH,sHAAsH;AACtH,mHAAmH;AAInH,+FAA+F;AAC/F,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/C,wHAAwH;AACxH,MAAM,UAAU,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/B,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,OAAwB;IACrD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnH,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU;QAC9B,OAAO,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,MAAc;IACxD,OAAO,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,sCAAsC;AACtC,SAAS,KAAK,CAAC,MAAc,EAAE,IAA4B;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,WAAW;IACvB,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAClC,MAAM,GAAG,CAAC,CAAC;IACX,IAAI,GAAG,CAAC,CAAC;IAET,0CAA0C;IAC1C,IAAI,CAAC,KAAa;QACjB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtD,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,cAAc;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC3G,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM;gBAAE,MAAM;YAChD,0DAA0D;YAC1D,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YAChG,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC;QAC3B,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,gHAAgH;IAChH,OAAO,CAAC,KAAa;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YACrC,MAAM,MAAM,GACX,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM;gBAC5B,CAAC,CAAC,IAAI,CAAC,OAAO;gBACd,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;YACtB,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YAChB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;IAC3B,CAAC;CACD;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,OAAe;IACtC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7C,IAAI,YAAY,GAAG,UAAU,IAAI,CAAC,GAAG,YAAY,GAAG,OAAO,CAAC,MAAM;QAAE,MAAM,SAAS,EAAE,CAAC;IACtF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,CAAmC,CAAC;IAC3G,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC;IAChD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,SAAS,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,OAAO;YACX,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,KAAK,aAAa;YACjB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;gBAAE,MAAM,SAAS,EAAE,CAAC;YACrD,gDAAgD;YAChD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,MAAgB,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvF,KAAK,aAAa,CAAC;QACnB,KAAK,cAAc;YAClB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;gBAAE,MAAM,SAAS,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAgB,EAAE,CAAC;QACxD,KAAK,SAAS;YACb,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;gBAAE,MAAM,SAAS,EAAE,CAAC;YACxD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,EAAY,EAAE,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7F,KAAK,UAAU;YACd,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC7B,KAAK,QAAQ;YACZ,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,KAAK,MAAM;YACV,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,IAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG;YACC,MAAM,SAAS,EAAE,CAAC;IACpB,CAAC;AACF,CAAC;AAED,2DAA2D;AAC3D,SAAS,aAAa,CAAC,KAAc;IACpC,MAAM,OAAO,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IACtG,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACrD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/G,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7G,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1G,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACjH,MAAM,SAAS,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,SAAS;IACjB,OAAO,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;AACpE,CAAC","sourcesContent":["// The launcher's end of the sandbox's pipes (slice 11 §4; fix round 2: the sandbox a child process): messages as\n// plain length-prefixed binary frames, not Node's IPC. A frame is a 4-byte big-endian length, then the payload: a\n// 4-byte big-endian header length, the header (the message as JSON, its body field left out), and the body (the raw\n// bytes of `bytes`, or the UTF-8 text of `data`). The sandbox's bootstrap has the same codec (`sandbox.ts`). What the\n// sandbox sends is untrusted: each frame is bounded, and each message checked here before the launcher acts on it.\n\nimport type { BridgeRequest, LauncherMessage, SandboxMessage } from \"../../tui/bridge.ts\";\n\n/** The largest frame either side takes: 17 MiB (an attached file of 16 MiB and its header). */\nexport const MAX_PIPE_FRAME = 17 * 1024 * 1024;\n\n/** The largest header of a frame from the sandbox: 1 MiB (a request's text or URL; frames carry their text as body). */\nconst MAX_HEADER = 1024 * 1024;\n\n/** `message` as one frame for the sandbox. */\nexport function launcherFrame(message: LauncherMessage): Buffer {\n\tif (message.kind === \"input\") return frame({ kind: \"input\" }, Buffer.from(message.data));\n\tif (message.kind === \"socket_message\") return frame({ kind: message.kind, socket: message.socket }, message.bytes);\n\tif (message.kind === \"attached\")\n\t\treturn frame({ kind: message.kind, id: message.id, name: message.name }, message.bytes);\n\treturn frame(message, undefined);\n}\n\n/** The first frame: the bridge's start and the base bundle's text as body. */\nexport function startFrame(start: unknown, source: string): Buffer {\n\treturn frame({ kind: \"start\", start }, Buffer.from(source));\n}\n\n/** A frame of `header` and `body`. */\nfunction frame(header: object, body: Uint8Array | undefined): Buffer {\n\tconst json = Buffer.from(JSON.stringify(header));\n\tconst prefix = Buffer.allocUnsafe(8);\n\tprefix.writeUInt32BE(4 + json.length + (body?.length ?? 0), 0);\n\tprefix.writeUInt32BE(json.length, 4);\n\treturn Buffer.concat(body === undefined ? [prefix, json] : [prefix, json, body]);\n}\n\n/**\n * Cuts the sandbox's output into messages as chunks arrive; throws (the sandbox is ended) on a frame over\n * `MAX_PIPE_FRAME`, a header over 1 MiB, or a message of no known shape. Each byte is copied in once, however small the\n * chunks the sandbox writes.\n */\nexport class FrameReader {\n\t#buffer = Buffer.alloc(64 * 1024);\n\t#start = 0;\n\t#end = 0;\n\n\t/** The messages complete with `chunk`. */\n\tpush(chunk: Buffer): SandboxMessage[] {\n\t\tthis.#append(chunk);\n\t\tconst messages: SandboxMessage[] = [];\n\t\twhile (this.#end - this.#start >= 4) {\n\t\t\tconst length = this.#buffer.readUInt32BE(this.#start);\n\t\t\tif (length < 4 || length > MAX_PIPE_FRAME) throw new Error(\"terminal: the sandbox sent a malformed frame\");\n\t\t\tif (this.#end - this.#start < 4 + length) break;\n\t\t\t// The message copies what it keeps: the buffer is reused.\n\t\t\tmessages.push(sandboxMessage(this.#buffer.subarray(this.#start + 4, this.#start + 4 + length)));\n\t\t\tthis.#start += 4 + length;\n\t\t}\n\t\tif (this.#start === this.#end) this.#start = this.#end = 0;\n\t\treturn messages;\n\t}\n\n\t/** Copies `chunk` in after the unread bytes, moving them to the front or growing the buffer when it is full. */\n\t#append(chunk: Buffer): void {\n\t\tconst unread = this.#end - this.#start;\n\t\tif (this.#end + chunk.length > this.#buffer.length) {\n\t\t\tconst needed = unread + chunk.length;\n\t\t\tconst target =\n\t\t\t\tneeded <= this.#buffer.length\n\t\t\t\t\t? this.#buffer\n\t\t\t\t\t: Buffer.alloc(Math.max(needed, Math.min(this.#buffer.length * 2, MAX_PIPE_FRAME + 4)));\n\t\t\tthis.#buffer.copy(target, 0, this.#start, this.#end);\n\t\t\tthis.#buffer = target;\n\t\t\tthis.#start = 0;\n\t\t\tthis.#end = unread;\n\t\t}\n\t\tchunk.copy(this.#buffer, this.#end);\n\t\tthis.#end += chunk.length;\n\t}\n}\n\n/**\n * The message in `payload` (a frame from the sandbox, without its length); throws for anything else. Trust boundary:\n * the sandbox's pipe.\n */\nfunction sandboxMessage(payload: Buffer): SandboxMessage {\n\tconst headerLength = payload.readUInt32BE(0);\n\tif (headerLength > MAX_HEADER || 4 + headerLength > payload.length) throw malformed();\n\tconst header = JSON.parse(payload.toString(\"utf8\", 4, 4 + headerLength)) as Record<string, unknown> | null;\n\tconst body = payload.subarray(4 + headerLength);\n\tif (typeof header !== \"object\" || header === null) throw malformed();\n\tconst socket = header.socket;\n\tswitch (header.kind) {\n\t\tcase \"write\":\n\t\t\treturn { kind: \"write\", data: body.toString(\"utf8\") };\n\t\tcase \"socket_send\":\n\t\t\tif (!Number.isSafeInteger(socket)) throw malformed();\n\t\t\t// A copy: the payload's memory is the reader's.\n\t\t\treturn { kind: \"socket_send\", socket: socket as number, bytes: new Uint8Array(body) };\n\t\tcase \"socket_open\":\n\t\tcase \"socket_close\":\n\t\t\tif (!Number.isSafeInteger(socket)) throw malformed();\n\t\t\treturn { kind: header.kind, socket: socket as number };\n\t\tcase \"request\":\n\t\t\tif (!Number.isSafeInteger(header.id)) throw malformed();\n\t\t\treturn { kind: \"request\", id: header.id as number, request: bridgeRequest(header.request) };\n\t\tcase \"outdated\":\n\t\t\treturn { kind: \"outdated\" };\n\t\tcase \"failed\":\n\t\t\treturn { kind: \"failed\", message: String(header.message) };\n\t\tcase \"exit\":\n\t\t\treturn { kind: \"exit\", code: Number.isSafeInteger(header.code) ? (header.code as number) : 1 };\n\t\tdefault:\n\t\t\tthrow malformed();\n\t}\n}\n\n/** The request `value` names; throws for anything else. */\nfunction bridgeRequest(value: unknown): BridgeRequest {\n\tconst request = (typeof value === \"object\" && value !== null ? value : {}) as Record<string, unknown>;\n\tif (request.kind === \"base\") return { kind: \"base\" };\n\tif (request.kind === \"fetch\" && typeof request.path === \"string\") return { kind: \"fetch\", path: request.path };\n\tif (request.kind === \"copy\" && typeof request.text === \"string\") return { kind: \"copy\", text: request.text };\n\tif (request.kind === \"open\" && typeof request.url === \"string\") return { kind: \"open\", url: request.url };\n\tif (request.kind === \"attach\" && typeof request.path === \"string\") return { kind: \"attach\", path: request.path };\n\tthrow malformed();\n}\n\nfunction malformed(): Error {\n\treturn new Error(\"terminal: the sandbox sent a malformed message\");\n}\n"]}

package/dist/node/tui/sandbox.d.ts

@@ -0,0 +1,54 @@
+import type { BridgeStart, LauncherMessage, SandboxMessage } from "../../tui/bridge.ts";
+/** The largest base bundle a sandbox runs: 8 MiB. */
+export declare const MAX_BUNDLE: number;
+/**
+ * The builtins code in the sandbox may `require`, each computation in memory without I/O, descriptors or machine
+ * details: bytes and text (`buffer`, `string_decoder`, `punycode`, `querystring`), events and streams in memory
+ * (`events`, `stream` and its submodules), formatting and type checks (`util`, `util/types`), URL and path strings
+ * (`url`, `path`), timers, assertions, hashing and randomness (`crypto`: no keys from files, no network) and compression
+ * in memory (`zlib`). Not `fs`, `tty`, `net`, `dgram`, `dns`, `http`, `https`, `http2`, `tls`, `child_process`,
+ * `cluster`, `worker_threads`, `sqlite`, `inspector`, `vm`, `v8`, `os`, `module`, `process`, `perf_hooks`, `wasi`,
+ * `repl`, `readline`, `trace_events` or anything else.
+ */
+export declare const SANDBOX_BUILTINS: readonly string[];
+/**
+ * The sandbox's `process`: a frozen plain object in place of Node's (no event emitter, so no prototype shared with
+ * Node's internals leads back to the real one). Its properties, each harmless: which Node it is (`arch`, `platform`,
+ * `version`, `versions`, `release`), time (`nextTick`, `hrtime`, `uptime`), ending the sandbox (`exit`), the permission
+ * checks (`permission`), the allowed builtins (`getBuiltinModule`), fixed values (`env` empty, `argv`, `argv0`,
+ * `execArgv`, `execPath`, `title`, `cwd` `/`), `stdout` (to the terminal through the bridge) and `stderr` (dropped),
+ * and listener calls that keep nothing (`on`, `once`, `off`, `addListener`, `removeListener`, `removeAllListeners`,
+ * `emit`, `emitWarning`, `listenerCount`, `listeners`). Not `binding`, `_linkedBinding`, `dlopen`, `_rawDebug`, `kill`,
+ * `execve`, `chdir`, `abort`, `reallyExit`, `stdin`, `openStdin`, `report`, `pid`, `ppid`, `config`, the user and group
+ * calls, `loadEnvFile`, `moduleLoadList`, resource and handle listings or any other.
+ */
+export declare const SANDBOX_PROCESS: readonly string[];
+/**
+ * The child's Node flags for its script `script`: the permission model allowing only reading that file, no SQLite, a
+ * 96 MiB heap. Exported for the tests of the operating system's layer alone.
+ */
+export declare function sandboxFlags(script: string): string[];
+/** The bootstrap's file in the sandbox's directory: a script, not `-e`, which puts every builtin on `globalThis`. */
+export declare const BOOTSTRAP_FILE = "bootstrap.cjs";
+/** Throws unless this Node is 26.5.1 or later, the Node the sandbox's permissions were checked on. */
+export declare function requireSandboxNode(version?: string): void;
+/**
+ * The child's environment: empty, but for `LD_LIBRARY_PATH` when the launcher has one: the launcher needed it to run
+ * this same binary (a Node built against libraries outside the system's paths), and the server cannot influence it.
+ */
+export declare function sandboxEnvironment(): Record<string, string>;
+/** A running sandbox: messages both ways, and its end. */
+export declare class Sandbox {
+    #private;
+    /**
+     * Starts a sandbox running the base bundle `source` (a CommonJS script) with `start` on its bridge; `onMessage` gets
+     * what it sends, `onEnd` its end (an exit, a crash, its memory limit, a malformed frame), once.
+     */
+    static start(source: string, start: BridgeStart, onMessage: (message: SandboxMessage) => void, onEnd: (reason: string) => void): Promise<Sandbox>;
+    private constructor();
+    /** Sends `message` to the sandbox; a sandbox not reading what it was sent is ended. */
+    post(message: LauncherMessage): void;
+    /** Ends the sandbox and waits for its exit. */
+    terminate(): Promise<void>;
+}
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/node/tui/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/node/tui/sandbox.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGxF,qDAAqD;AACrD,eAAO,MAAM,UAAU,QAAkB,CAAC;AAE1C;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAsB7C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EA+B5C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAErD;AAED,qHAAqH;AACrH,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAK9C,sGAAsG;AACtG,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,MAA8B,GAAG,IAAI,CAIhF;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAG3D;AAED,0DAA0D;AAC1D,qBAAa,OAAO;;IAWnB;;;OAGG;IACH,OAAa,KAAK,CACjB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,EAC5C,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAC7B,OAAO,CAAC,OAAO,CAAC,CASlB;IAED,OAAO,eAyBN;IAED,uFAAuF;IACvF,IAAI,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAEnC;IAED,+CAA+C;IACzC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAI/B;CAsCD"}

package/dist/node/tui/sandbox.js

@@ -0,0 +1,431 @@
+// The terminal's sandbox (slice 11 §4, decision "Slice 11, P8"; fix round 2: a child process, as the owner decided
+// after the worker thread was escaped through its shared realm): a Node child process of the launcher's binary.
+// - The operating system's side: its stdin, stdout and stderr are pipes to the launcher (never the terminal: no
+//   descriptor of the child is a TTY), its environment empty, its directory a private one holding only the bootstrap;
+//   Node's permission model with nothing allowed but reading the bootstrap (no other file read, no write, no network,
+//   no child processes, no workers, no addons, no inspector, no WASI) and `node:sqlite` removed
+//   (`--no-experimental-sqlite`: SQLite opens files past the permission model). An escape from the JavaScript layer
+//   reaches no terminal, no file, no socket, no launcher memory or token.
+// - The JavaScript side, a second layer: downloaded code (the base bundle, a CommonJS script; the plugins' registered
+//   scripts) is only evaluated by the bootstrap (`vm.Script` with no dynamic import callback, so `import()` throws),
+//   with a `require` answering the allowed builtins only (`SANDBOX_BUILTINS`); `process` is a substitute with
+//   `SANDBOX_PROCESS` only. The bootstrap keeps its own references to what it uses before any downloaded code runs.
+// Messages go both ways as length-prefixed binary frames (`pipe.ts`). Known gaps, each needing the JavaScript layer
+// broken first unless noted: the child may signal processes of the same user (Node has no permission for signals; the
+// launcher ignores SIGUSR1, which would open its inspector), read machine details (`os`), learn whether any path exists
+// (`require.resolve` fails one way for a file that exists, another for one that does not: Opus E13), and allocate
+// memory outside its heap (no limit without a shell's `ulimit`; only the child dies). Needs Node 26.5.1 or later.
+import { spawn } from "node:child_process";
+import { mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { FrameReader, launcherFrame, MAX_PIPE_FRAME, startFrame } from "./pipe.js";
+/** The largest base bundle a sandbox runs: 8 MiB. */
+export const MAX_BUNDLE = 8 * 1024 * 1024;
+/**
+ * The builtins code in the sandbox may `require`, each computation in memory without I/O, descriptors or machine
+ * details: bytes and text (`buffer`, `string_decoder`, `punycode`, `querystring`), events and streams in memory
+ * (`events`, `stream` and its submodules), formatting and type checks (`util`, `util/types`), URL and path strings
+ * (`url`, `path`), timers, assertions, hashing and randomness (`crypto`: no keys from files, no network) and compression
+ * in memory (`zlib`). Not `fs`, `tty`, `net`, `dgram`, `dns`, `http`, `https`, `http2`, `tls`, `child_process`,
+ * `cluster`, `worker_threads`, `sqlite`, `inspector`, `vm`, `v8`, `os`, `module`, `process`, `perf_hooks`, `wasi`,
+ * `repl`, `readline`, `trace_events` or anything else.
+ */
+export const SANDBOX_BUILTINS = [
+    "assert",
+    "assert/strict",
+    "buffer",
+    "crypto",
+    "events",
+    "path",
+    "path/posix",
+    "path/win32",
+    "punycode",
+    "querystring",
+    "stream",
+    "stream/consumers",
+    "stream/promises",
+    "stream/web",
+    "string_decoder",
+    "timers",
+    "timers/promises",
+    "url",
+    "util",
+    "util/types",
+    "zlib",
+];
+/**
+ * The sandbox's `process`: a frozen plain object in place of Node's (no event emitter, so no prototype shared with
+ * Node's internals leads back to the real one). Its properties, each harmless: which Node it is (`arch`, `platform`,
+ * `version`, `versions`, `release`), time (`nextTick`, `hrtime`, `uptime`), ending the sandbox (`exit`), the permission
+ * checks (`permission`), the allowed builtins (`getBuiltinModule`), fixed values (`env` empty, `argv`, `argv0`,
+ * `execArgv`, `execPath`, `title`, `cwd` `/`), `stdout` (to the terminal through the bridge) and `stderr` (dropped),
+ * and listener calls that keep nothing (`on`, `once`, `off`, `addListener`, `removeListener`, `removeAllListeners`,
+ * `emit`, `emitWarning`, `listenerCount`, `listeners`). Not `binding`, `_linkedBinding`, `dlopen`, `_rawDebug`, `kill`,
+ * `execve`, `chdir`, `abort`, `reallyExit`, `stdin`, `openStdin`, `report`, `pid`, `ppid`, `config`, the user and group
+ * calls, `loadEnvFile`, `moduleLoadList`, resource and handle listings or any other.
+ */
+export const SANDBOX_PROCESS = [
+    "addListener",
+    "arch",
+    "argv",
+    "argv0",
+    "cwd",
+    "emit",
+    "emitWarning",
+    "env",
+    "execArgv",
+    "execPath",
+    "exit",
+    "getBuiltinModule",
+    "hrtime",
+    "listenerCount",
+    "listeners",
+    "nextTick",
+    "off",
+    "on",
+    "once",
+    "permission",
+    "platform",
+    "release",
+    "removeAllListeners",
+    "removeListener",
+    "stderr",
+    "stdout",
+    "title",
+    "uptime",
+    "version",
+    "versions",
+];
+/**
+ * The child's Node flags for its script `script`: the permission model allowing only reading that file, no SQLite, a
+ * 96 MiB heap. Exported for the tests of the operating system's layer alone.
+ */
+export function sandboxFlags(script) {
+    return ["--permission", `--allow-fs-read=${script}`, "--no-experimental-sqlite", "--max-old-space-size=96", script];
+}
+/** The bootstrap's file in the sandbox's directory: a script, not `-e`, which puts every builtin on `globalThis`. */
+export const BOOTSTRAP_FILE = "bootstrap.cjs";
+/** The most bytes waiting for the sandbox to read them before it counts as stuck: 64 MiB. */
+const MAX_UNREAD = 64 * 1024 * 1024;
+/** Throws unless this Node is 26.5.1 or later, the Node the sandbox's permissions were checked on. */
+export function requireSandboxNode(version = process.versions.node) {
+    const [major = 0, minor = 0, patch = 0] = version.split(".").map(Number);
+    if (major > 26 || (major === 26 && (minor > 5 || (minor === 5 && patch >= 1))))
+        return;
+    throw new Error(`the terminal client needs Node 26.5.1 or later for its sandbox (this is Node ${version})`);
+}
+/**
+ * The child's environment: empty, but for `LD_LIBRARY_PATH` when the launcher has one: the launcher needed it to run
+ * this same binary (a Node built against libraries outside the system's paths), and the server cannot influence it.
+ */
+export function sandboxEnvironment() {
+    const libraries = process.env.LD_LIBRARY_PATH;
+    return libraries === undefined ? {} : { LD_LIBRARY_PATH: libraries };
+}
+/** A running sandbox: messages both ways, and its end. */
+export class Sandbox {
+    #child;
+    #directory;
+    #onMessage;
+    #onEnd;
+    #reader = new FrameReader();
+    #exited;
+    #ended = false;
+    /** Whether the child has sent anything: its bootstrap was read, so the file goes. */
+    #running = false;
+    /**
+     * Starts a sandbox running the base bundle `source` (a CommonJS script) with `start` on its bridge; `onMessage` gets
+     * what it sends, `onEnd` its end (an exit, a crash, its memory limit, a malformed frame), once.
+     */
+    static async start(source, start, onMessage, onEnd) {
+        requireSandboxNode();
+        if (Buffer.byteLength(source) > MAX_BUNDLE)
+            throw new Error("terminal: the base bundle exceeds 8 MiB");
+        // Node resolves its entry before reading it; a symlinked ancestor would need a broader file grant.
+        const directory = await realpath(await mkdtemp(join(tmpdir(), "chord-tui-")));
+        await writeFile(join(directory, BOOTSTRAP_FILE), BOOTSTRAP);
+        const sandbox = new Sandbox(directory, onMessage, onEnd);
+        sandbox.#write(startFrame(start, source));
+        return sandbox;
+    }
+    constructor(directory, onMessage, onEnd) {
+        this.#directory = directory;
+        this.#onMessage = onMessage;
+        this.#onEnd = onEnd;
+        this.#child = spawn(process.execPath, sandboxFlags(join(directory, BOOTSTRAP_FILE)), {
+            stdio: ["pipe", "pipe", "pipe"],
+            env: sandboxEnvironment(),
+            cwd: directory,
+            windowsHide: true,
+        });
+        this.#exited = new Promise((resolve) => this.#child.once("close", () => resolve()));
+        this.#child.stdout.on("data", (chunk) => this.#read(chunk));
+        // Dropped: the sandbox writes only through the bridge, and the terminal is the launcher's.
+        this.#child.stderr.resume();
+        // A write after the child ended fails here; its end is reported by `close`.
+        this.#child.stdin.on("error", () => { });
+        this.#child.on("error", (error) => this.#end(`the terminal client failed: ${error.message}`));
+        this.#child.on("close", () => {
+            this.#end("the terminal client exited");
+            void rm(this.#directory, { recursive: true, force: true });
+        });
+    }
+    /** Sends `message` to the sandbox; a sandbox not reading what it was sent is ended. */
+    post(message) {
+        if (!this.#ended)
+            this.#write(launcherFrame(message));
+    }
+    /** Ends the sandbox and waits for its exit. */
+    async terminate() {
+        this.#ended = true;
+        this.#child.kill("SIGKILL");
+        await this.#exited;
+    }
+    #write(frame) {
+        if (this.#child.stdin.writableLength + frame.length > MAX_UNREAD + MAX_PIPE_FRAME) {
+            this.#fail("the terminal client stopped reading");
+            return;
+        }
+        this.#child.stdin.write(frame);
+    }
+    /** The sandbox's output: its messages, each passed on; a malformed one ends the sandbox. */
+    #read(chunk) {
+        if (this.#ended)
+            return;
+        if (!this.#running) {
+            this.#running = true;
+            // Read once at the start; a launcher killed later leaves at most an empty directory.
+            void rm(join(this.#directory, BOOTSTRAP_FILE), { force: true });
+        }
+        let messages;
+        try {
+            messages = this.#reader.push(chunk);
+        }
+        catch (error) {
+            this.#fail(error.message);
+            return;
+        }
+        for (const message of messages)
+            if (!this.#ended)
+                this.#onMessage(message);
+    }
+    #fail(reason) {
+        this.#child.kill("SIGKILL");
+        this.#end(reason);
+    }
+    #end(reason) {
+        if (this.#ended)
+            return;
+        this.#ended = true;
+        this.#onEnd(reason);
+    }
+}
+/**
+ * The trusted bootstrap (strict CommonJS, the child's main script). Before any downloaded code runs it keeps its own
+ * references to what it uses (so code that changes shared prototypes later cannot steer it), closes the file system's
+ * functions, shadows the real `process`'s listener calls, puts the substitute `process` in place, removes the module
+ * globals and leaves the bridge on `globalThis`; then it waits for the launcher's start frame and evaluates the base
+ * bundle through its own `require`. Frames as in `pipe.ts`.
+ */
+const BOOTSTRAP = `"use strict";
+const real = process;
+const getBuiltin = real.getBuiltinModule;
+const apply = Reflect.apply;
+const uncurry = Function.prototype.call.bind(Function.prototype.bind, Function.prototype.call);
+const parse = JSON.parse;
+const stringify = JSON.stringify;
+const freeze = Object.freeze;
+const define = Object.defineProperty;
+const BufferFrom = Buffer.from;
+const BufferAlloc = Buffer.allocUnsafe;
+const BufferConcat = Buffer.concat;
+const readUInt32BE = uncurry(Buffer.prototype.readUInt32BE);
+const writeUInt32BE = uncurry(Buffer.prototype.writeUInt32BE);
+const bufferText = uncurry(Buffer.prototype.toString);
+const subarray = uncurry(Buffer.prototype.subarray);
+const copyBytes = uncurry(Buffer.prototype.copy);
+const isUint8Array = (value) => value instanceof Uint8Array;
+const builtin0 = (id) => apply(getBuiltin, real, [id]);
+const Script = builtin0("node:vm").Script;
+const runInThisContext = uncurry(Script.prototype.runInThisContext);
+const nextTick = real.nextTick;
+const hrtime = real.hrtime;
+const hrtimeBigint = real.hrtime.bigint;
+const uptime = real.uptime;
+const exit = real.exit;
+const input = real.stdin;
+const output = real.stdout;
+const writeOutput = uncurry(output.write);
+const onInput = uncurry(input.on);
+const MAX_FRAME = ${MAX_PIPE_FRAME};
+const deny = () => {
+	throw new Error("unavailable in the terminal's sandbox");
+};
+
+// The file system's functions closed: the permission model guards paths, not the pipes' descriptors.
+for (const facade of [builtin0("node:fs"), builtin0("node:fs/promises")]) {
+	for (const name of Object.keys(facade)) {
+		if (typeof facade[name] === "function") define(facade, name, { value: deny, writable: false, configurable: false, enumerable: true });
+	}
+}
+const v8 = builtin0("node:v8");
+for (const name of ["writeHeapSnapshot", "getHeapSnapshot", "queryObjects", "setFlagsFromString", "takeCoverage", "startCpuProfile", "startHeapProfile"]) {
+	if (typeof v8[name] === "function") v8[name] = deny;
+}
+builtin0("node:module").syncBuiltinESMExports();
+// Node emits on its own process (warnings among them): its listener calls are its own properties, not the shared
+// prototype's, which downloaded code may change.
+const emitter = builtin0("node:events").EventEmitter.prototype;
+for (const name of Object.getOwnPropertyNames(emitter)) {
+	if (name !== "constructor" && typeof emitter[name] === "function") define(real, name, { value: emitter[name], writable: false, configurable: false });
+}
+// Node reads properties its process does not have (noDeprecation, throwDeprecation, traceDeprecation,
+// traceProcessWarnings, channel, connected, …): such a read goes up the prototype chain, where a getter would get the
+// real process as its this (Opus E7: Buffer(1) warns, and the warning reads process.noDeprecation). Every prototype of
+// the chain, Object.prototype included, takes no new property and keeps its own ones, so no getter and no other
+// prototype gets in. Not frozen: Node assigns over prototype fields (\`this._events ??= {}\`).
+for (let prototype = Object.getPrototypeOf(real); prototype !== null; prototype = Object.getPrototypeOf(prototype)) {
+	for (const key of Reflect.ownKeys(prototype)) define(prototype, key, { configurable: false });
+	Object.preventExtensions(prototype);
+}
+
+// The allowed builtins, by name with or without "node:"; looked up in an object of no prototype.
+const allowed = Object.create(null);
+for (const name of ${JSON.stringify(SANDBOX_BUILTINS)}) allowed[name] = true;
+const builtin = (id) => {
+	if (typeof id !== "string") throw new Error("unavailable in the terminal's sandbox");
+	const name = id.length > 5 && id[0] === "n" && id[1] === "o" && id[2] === "d" && id[3] === "e" && id[4] === ":" ? id.slice(5) : id;
+	if (typeof name !== "string" || allowed[name] !== true) throw new Error(id + ": unavailable in the terminal's sandbox");
+	return builtin0("node:" + name);
+};
+
+// Frames out: the message's header as JSON, its write text or socket bytes as the body.
+const send = (message) => {
+	const kind = message.kind;
+	let header;
+	let body;
+	if (kind === "write") {
+		const data = String(message.data);
+		// Refused before it is copied: a huge string costs no buffer of its size.
+		if (data.length > MAX_FRAME) throw new RangeError("the terminal's bridge takes frames of at most 17 MiB");
+		header = { kind };
+		body = BufferFrom(data);
+	} else if (kind === "socket_send") {
+		if (!isUint8Array(message.bytes)) throw new TypeError("socket_send: bytes expected");
+		header = { kind, socket: message.socket };
+		body = message.bytes;
+	} else {
+		header = message;
+	}
+	const json = BufferFrom(stringify(header));
+	const length = 4 + json.length + (body === undefined ? 0 : body.length);
+	if (length > MAX_FRAME) throw new RangeError("the terminal's bridge takes frames of at most 17 MiB");
+	const prefix = BufferAlloc(8);
+	writeUInt32BE(prefix, length, 0);
+	writeUInt32BE(prefix, json.length, 4);
+	writeOutput(output, BufferConcat(body === undefined ? [prefix, json] : [prefix, json, body]));
+};
+
+// The substitute process.
+const stdout = freeze({ isTTY: false, write: (data) => (send({ kind: "write", data: String(data) }), true) });
+const listening = (name) => [name, function () { return fake; }];
+const fake = freeze({
+	arch: real.arch,
+	platform: real.platform,
+	version: real.version,
+	versions: freeze({ ...real.versions }),
+	release: freeze({ ...real.release }),
+	nextTick: (...args) => apply(nextTick, real, args),
+	hrtime: Object.assign((...args) => apply(hrtime, real, args), { bigint: () => apply(hrtimeBigint, real, []) }),
+	uptime: () => apply(uptime, real, []),
+	exit: (code) => apply(exit, real, [code]),
+	permission: real.permission,
+	env: freeze({}),
+	argv: freeze(["node"]),
+	argv0: "node",
+	execArgv: freeze([]),
+	execPath: "node",
+	title: "node",
+	cwd: () => "/",
+	getBuiltinModule: builtin,
+	stdout,
+	stderr: freeze({ isTTY: false, write: () => true }),
+	...Object.fromEntries(["on", "once", "off", "addListener", "removeListener", "removeAllListeners"].map(listening)),
+	emit: () => false,
+	emitWarning: () => {},
+	listenerCount: () => 0,
+	listeners: () => [],
+});
+define(globalThis, "process", { value: fake, writable: false, configurable: false, enumerable: false });
+for (const name of ["BroadcastChannel", "localStorage", "sessionStorage"]) delete globalThis[name];
+
+// Downloaded code runs only through here, with options of no prototype (nothing read from Object.prototype).
+const evaluate = (text, filename) => {
+	const options = Object.create(null);
+	options.filename = String(filename);
+	return runInThisContext(new Script(String(text), options));
+};
+
+// Frames in: the first is the start (the bridge's start and the base bundle), the rest the launcher's messages.
+let listener;
+let started = false;
+// Unread bytes: one buffer, grown by doubling, each byte copied in once.
+let pending = BufferAlloc(64 * 1024);
+let start = 0;
+let end = 0;
+const received = (payload) => {
+	const headerLength = readUInt32BE(payload, 0);
+	const header = parse(bufferText(payload, "utf8", 4, 4 + headerLength));
+	const body = subarray(payload, 4 + headerLength);
+	if (!started) {
+		started = true;
+		run(header.start, bufferText(body, "utf8"));
+		return;
+	}
+	if (header.kind === "input") header.data = bufferText(body, "utf8");
+	else if (header.kind === "socket_message" || header.kind === "attached") header.bytes = new Uint8Array(body);
+	if (listener !== undefined) listener(header);
+};
+onInput(input, "data", (chunk) => {
+	if (end + chunk.length > pending.length) {
+		const unread = end - start;
+		const target = unread + chunk.length <= pending.length ? pending : BufferAlloc(Math.max(unread + chunk.length, pending.length * 2));
+		copyBytes(pending, target, 0, start, end);
+		pending = target;
+		start = 0;
+		end = unread;
+	}
+	copyBytes(chunk, pending, end);
+	end += chunk.length;
+	while (end - start >= 4) {
+		const length = readUInt32BE(pending, start);
+		if (length > MAX_FRAME) apply(exit, real, [70]);
+		if (end - start < 4 + length) break;
+		// A copy: the buffer is reused, and what the frame carries is kept by the sandbox.
+		const payload = BufferAlloc(length);
+		copyBytes(pending, payload, 0, start + 4, start + 4 + length);
+		start += 4 + length;
+		received(payload);
+	}
+	if (start === end) start = end = 0;
+});
+onInput(input, "end", () => apply(exit, real, [0]));
+const run = (start, source) => {
+	globalThis.chordBridge = freeze({
+		start: freeze(start),
+		send,
+		onMessage: (next) => {
+			listener = next;
+		},
+		evaluate,
+	});
+	try {
+		const base = { exports: {} };
+		evaluate("(function (require, module, exports) {" + source + "\\n})", "chord-base.js")(builtin, base, base.exports);
+	} catch (error) {
+		send({ kind: "failed", message: String(error && error.message) });
+	}
+};
+`;
+//# sourceMappingURL=sandbox.js.map