@poe-platform/safe-bash 0.1.683 → 0.1.684

package/dist/safe-bash/chunks/{chunk-6R7IR2MV.js → chunk-BONY6MX5.js}

@@ -6,8 +6,14 @@ import {
   PythonInvocationError,
   isPythonFailureCategory,
   parsePythonInvocation,
+  pythonDirectoryEntries,
+  pythonExecution,
+  pythonImportMetadata,
+  pythonRuntimeRelocation,
+  pythonStatProjection,
+  pythonTreeCleanup,
   reportPythonFailure
-} from "./chunk-3G3EZZ63.js";
+} from "./chunk-4MPK7VIM.js";
 import {
   createOutputOperation
 } from "./chunk-ZDYA3SLF.js";
@@ -44,21 +50,21 @@ function encodePythonReply(value, maxBytes) {
     used += bytes;
     if (used > maxBytes) throw new FsError("EFBIG", { syscall: "python reply" });
   };
-  const string = (text) => {
-    if (text.length + 2 > maxBytes - used) throw new FsError("EFBIG", { syscall: "python reply" });
+  const string = (text2) => {
+    if (text2.length + 2 > maxBytes - used) throw new FsError("EFBIG", { syscall: "python reply" });
     reserve(2);
-    for (let index = 0; index < text.length; index++) {
-      const code = text.charCodeAt(index);
+    for (let index = 0; index < text2.length; index++) {
+      const code = text2.charCodeAt(index);
       if (code < 32) reserve([8, 9, 10, 12, 13].includes(code) ? 2 : 6);
       else if (code === 34 || code === 92) reserve(2);
       else if (code < 128) reserve(1);
       else if (code < 2048) reserve(2);
-      else if (code >= 55296 && code <= 56319 && text.charCodeAt(index + 1) >= 56320 && text.charCodeAt(index + 1) <= 57343) {
+      else if (code >= 55296 && code <= 56319 && text2.charCodeAt(index + 1) >= 56320 && text2.charCodeAt(index + 1) <= 57343) {
         reserve(4);
         index++;
       } else reserve(code >= 55296 && code <= 57343 ? 6 : 3);
     }
-    return text;
+    return text2;
   };
   const own = (input, depth) => {
     if (depth > 64) throw new FsError("EFBIG", { syscall: "python reply" });
@@ -1131,10 +1137,10 @@ function createPythonPackageEnvironment(options = {}) {
       }
       for (const line of source.split("\n")) {
         const comment = line.split("").findIndex((character, index) => character === "#" && (index === 0 || line[index - 1].trim() === ""));
-        const text = (comment < 0 ? line : line.slice(0, comment)).trim();
-        if (!text) continue;
-        if (text.endsWith("\\") || text.startsWith("-")) throw failure(`Unsupported requirements option or continuation in ${path}: ${text}`);
-        requirements.push(normalizeRequirement(text, dirname(path)));
+        const text2 = (comment < 0 ? line : line.slice(0, comment)).trim();
+        if (!text2) continue;
+        if (text2.endsWith("\\") || text2.startsWith("-")) throw failure(`Unsupported requirements option or continuation in ${path}: ${text2}`);
+        requirements.push(normalizeRequirement(text2, dirname(path)));
       }
     }
     context.signal.throwIfAborted();
@@ -1424,6 +1430,706 @@ function createPythonExecutorPool(options) {
   };
 }
 
+// packages/safe-bash/src/commands/python/jspi.ts
+init_platform();
+import { createPythonNativeSyscalls } from "@poe-platform/safe-fs/core";
+
+// packages/safe-bash/src/commands/python/jspi-trampoline.ts
+init_platform();
+var pythonJspiSignatures = Object.freeze({
+  __syscall_chdir: "ip",
+  __syscall_chmod: "ipi",
+  __syscall_dup: "ii",
+  __syscall_faccessat: "iipii",
+  __syscall_fcntl64: "iiip",
+  __syscall_fdatasync: "ii",
+  __syscall_fstat64: "iip",
+  __syscall_ftruncate64: "iij",
+  __syscall_getcwd: "ipp",
+  __syscall_getdents64: "iipp",
+  __syscall_ioctl: "iiip",
+  __syscall_lstat64: "ipp",
+  __syscall_mkdirat: "iipi",
+  __syscall_newfstatat: "iippi",
+  __syscall_openat: "iipip",
+  __syscall_readlinkat: "iippp",
+  __syscall_renameat: "iipip",
+  __syscall_rmdir: "ip",
+  __syscall_stat64: "ipp",
+  __syscall_symlinkat: "ipip",
+  __syscall_truncate64: "ipj",
+  __syscall_unlinkat: "iipi",
+  __syscall_utimensat: "iippi",
+  fd_close: "ii",
+  fd_fdstat_get: "iip",
+  fd_pread: "iippjp",
+  fd_pwrite: "iippjp",
+  fd_read: "iippp",
+  fd_seek: "iijip",
+  fd_sync: "ii",
+  fd_write: "iippp"
+});
+var unsigned = (value) => {
+  const bytes = [];
+  do {
+    bytes.push(value & 127 | (value > 127 ? 128 : 0));
+    value >>>= 7;
+  } while (value);
+  return bytes;
+};
+var vector = (entries) => [...unsigned(entries.length), ...entries.flat()];
+var text = (value) => {
+  const bytes = new TextEncoder().encode(value);
+  return [...unsigned(bytes.length), ...bytes];
+};
+var section = (type, bytes) => [type, ...unsigned(bytes.length), ...bytes];
+var signature = (parameters, result) => [96, ...vector(parameters.map((type) => [type])), ...result === void 0 ? [0] : [1, result]];
+function createPythonJspiTrampoline() {
+  const entries = Object.entries(pythonJspiSignatures);
+  const types = entries.flatMap(([, value]) => {
+    const parameters = [...value.slice(1)].map((type) => type === "j" ? 126 : 127);
+    return [signature(parameters, 127), signature(parameters, 111)];
+  });
+  types.push(signature([111], 127));
+  const imports = entries.flatMap(([name], index) => [
+    [...text("original"), ...text(name), 0, ...unsigned(index * 2)],
+    [...text("request"), ...text(name), 0, ...unsigned(index * 2 + 1)],
+    [...text("shutdown"), ...text(name), 0, ...unsigned(index * 2)]
+  ]);
+  imports.push([...text("control"), ...text("syncify"), 1, 112, 0, 1]);
+  imports.push([...text("control"), ...text("active"), 3, 127, 1]);
+  const functions = entries.map(([, value], index) => {
+    const argumentsBytes = [...value.slice(1)].flatMap((_type, parameter) => [32, ...unsigned(parameter)]);
+    const code = [
+      0,
+      35,
+      0,
+      4,
+      127,
+      35,
+      0,
+      65,
+      2,
+      70,
+      4,
+      127,
+      ...argumentsBytes,
+      16,
+      ...unsigned(index * 3 + 2),
+      5,
+      ...argumentsBytes,
+      16,
+      ...unsigned(index * 3 + 1),
+      65,
+      0,
+      17,
+      ...unsigned(entries.length * 2),
+      0,
+      11,
+      5,
+      ...argumentsBytes,
+      16,
+      ...unsigned(index * 3),
+      11,
+      11
+    ];
+    return [...unsigned(code.length), ...code];
+  });
+  return new Uint8Array([
+    0,
+    97,
+    115,
+    109,
+    1,
+    0,
+    0,
+    0,
+    ...section(1, vector(types)),
+    ...section(2, vector(imports)),
+    ...section(3, vector(entries.map((_entry, index) => unsigned(index * 2)))),
+    ...section(7, vector(entries.map(([name], index) => [...text(name), 0, ...unsigned(entries.length * 3 + index)]))),
+    ...section(10, vector(functions))
+  ]);
+}
+function createPythonJspiNativeCall() {
+  const types = [
+    signature([127], 127),
+    signature([127]),
+    signature([127], 111),
+    signature([111], 127),
+    signature([127, 127], 127),
+    signature([], 127)
+  ];
+  const imports = [
+    ["python", "utf8", 0],
+    ["python", "unicode", 0],
+    ["python", "free", 1],
+    ["python", "noMemory", 5],
+    ["request", "send", 2],
+    ["shutdown", "send", 0]
+  ];
+  const code = [
+    1,
+    2,
+    127,
+    32,
+    1,
+    16,
+    0,
+    34,
+    2,
+    69,
+    4,
+    127,
+    65,
+    0,
+    5,
+    35,
+    0,
+    65,
+    2,
+    70,
+    4,
+    127,
+    32,
+    2,
+    16,
+    5,
+    5,
+    32,
+    2,
+    16,
+    4,
+    65,
+    0,
+    17,
+    3,
+    0,
+    11,
+    34,
+    2,
+    69,
+    4,
+    127,
+    16,
+    3,
+    5,
+    32,
+    2,
+    16,
+    1,
+    33,
+    3,
+    32,
+    2,
+    16,
+    2,
+    32,
+    3,
+    11,
+    11,
+    11
+  ];
+  return new Uint8Array([
+    0,
+    97,
+    115,
+    109,
+    1,
+    0,
+    0,
+    0,
+    ...section(1, vector(types)),
+    ...section(2, vector([
+      ...imports.map(([namespace, name, type]) => [...text(namespace), ...text(name), 0, type]),
+      [...text("control"), ...text("syncify"), 1, 112, 0, 1],
+      [...text("control"), ...text("active"), 3, 127, 1]
+    ])),
+    ...section(3, vector([[4]])),
+    ...section(7, vector([[...text("call"), 0, 6]])),
+    ...section(10, vector([[...unsigned(code.length), ...code]]))
+  ]);
+}
+function createPythonJspiStatResult() {
+  const types = [
+    signature([127], 127),
+    signature([127]),
+    signature([127, 127], 127),
+    signature([127, 127, 127]),
+    signature([], 127)
+  ];
+  const imports = [["create", 0], ["size", 0], ["item", 2], ["retain", 1], ["set", 3], ["invalid", 4]];
+  const code = [
+    1,
+    3,
+    127,
+    32,
+    1,
+    16,
+    1,
+    35,
+    0,
+    71,
+    4,
+    64,
+    16,
+    5,
+    15,
+    11,
+    32,
+    0,
+    16,
+    0,
+    34,
+    2,
+    69,
+    4,
+    127,
+    65,
+    0,
+    5,
+    2,
+    64,
+    3,
+    64,
+    32,
+    3,
+    35,
+    0,
+    79,
+    13,
+    1,
+    32,
+    1,
+    32,
+    3,
+    16,
+    2,
+    34,
+    4,
+    16,
+    3,
+    32,
+    2,
+    32,
+    3,
+    32,
+    4,
+    16,
+    4,
+    32,
+    3,
+    65,
+    1,
+    106,
+    33,
+    3,
+    12,
+    0,
+    11,
+    11,
+    32,
+    2,
+    11,
+    11
+  ];
+  return new Uint8Array([
+    0,
+    97,
+    115,
+    109,
+    1,
+    0,
+    0,
+    0,
+    ...section(1, vector(types)),
+    ...section(2, vector([
+      ...imports.map(([name, type]) => [...text("python"), ...text(name), 0, type]),
+      [...text("python"), ...text("fields"), 3, 127, 0]
+    ])),
+    ...section(3, vector([[2]])),
+    ...section(7, vector([[...text("construct"), 0, 6]])),
+    ...section(10, vector([[...unsigned(code.length), ...code]]))
+  ]);
+}
+
+// packages/safe-bash/src/commands/python/jspi-scheduler.ts
+init_platform();
+function createPythonJspiScheduler() {
+  const queued = /* @__PURE__ */ new Map();
+  const active = /* @__PURE__ */ new Set();
+  const failures = [];
+  let closed = false;
+  let retirement;
+  return {
+    scheduleCallback(callback, delay = 0) {
+      if (closed) {
+        callback.destroy?.();
+        throw new Error("Python scheduler is closed");
+      }
+      const timer = setTimeout(() => {
+        queued.delete(timer);
+        const work = Promise.resolve().then(() => callback()).then(() => {
+        }, (error) => {
+          failures.push(error);
+        }).finally(() => {
+          active.delete(work);
+        });
+        active.add(work);
+      }, delay);
+      queued.set(timer, callback);
+    },
+    close() {
+      if (retirement) return retirement;
+      if (!active.size) closed = true;
+      retirement = Promise.resolve().then(async () => {
+        while (active.size) await Promise.all(active);
+        closed = true;
+        for (const [timer, callback] of queued) {
+          clearTimeout(timer);
+          try {
+            callback.destroy?.();
+          } catch (error) {
+            failures.push(error);
+          }
+        }
+        queued.clear();
+        if (failures.length === 1) throw failures[0];
+        if (failures.length) throw new AggregateError(failures, "Python callback retirement failed");
+      });
+      return retirement;
+    }
+  };
+}
+
+// packages/safe-bash/src/commands/python/jspi.ts
+function createPythonJspiExecutor(options) {
+  const engine = globalThis.WebAssembly;
+  const active = new engine.Global({ value: "i32", mutable: true }, 0);
+  const syncify = new engine.Table({ element: "anyfunc", initial: 1 });
+  const controller = new AbortController();
+  const scheduler = createPythonJspiScheduler();
+  let admitted = false;
+  let running;
+  let retirement;
+  let cleanup;
+  let runtime;
+  let native;
+  let instanceBound = false;
+  let importsBound = false;
+  let schedulerBound = false;
+  let methodDefinition = 0;
+  let methodPointer;
+  let statPointer;
+  const originals = {};
+  const execute = async (start) => {
+    const signal = AbortSignal.any([start.signal, controller.signal]);
+    const configuration = parsePythonInvocation(start.invocation.args, start.invocation.env);
+    let qualified = false;
+    let exitCode = 0;
+    let finalized = 0;
+    try {
+      signal.throwIfAborted();
+      if (start.packages?.requirements.length || start.installOnly) throw new PythonFailure("runtime-assets", { cause: new Error("JSPI runtime requires statically qualified packages") });
+      runtime = await options.loadRuntime({
+        jsglobals: /* @__PURE__ */ Object.create(null),
+        args: configuration.startupArgs,
+        env: configuration.env,
+        bindImports(imports) {
+          if (importsBound) throw new PythonFailure("runtime-abi");
+          const namespaces = [...new Set(Object.values(imports))];
+          for (const namespace of namespaces) {
+            for (const [name, value] of Object.entries(namespace)) {
+              if (typeof value !== "function") continue;
+              if (name in pythonJspiSignatures) originals[name] = value;
+              else if (name.startsWith("__syscall_") || name === "_maybe_connect_async") namespace[name] = () => -52;
+              else if (name === "_emscripten_system") namespace[name] = (command) => command === 0 ? 0 : -52;
+            }
+          }
+          if (!originals.fd_read || !originals.fd_write || !originals.__syscall_openat) throw new PythonFailure("runtime-abi");
+          const original = Object.fromEntries(Object.keys(pythonJspiSignatures).map((name) => [name, originals[name] ?? (() => -52)]));
+          const request = Object.fromEntries(Object.keys(pythonJspiSignatures).map((name) => [
+            name,
+            (...args) => native.invoke(name, args)
+          ]));
+          const shutdown = Object.fromEntries(Object.entries(request).map(([name, dispatch]) => [name, new engine.Suspending(dispatch)]));
+          const bridge = new engine.Instance(options.trampoline, { original, request, shutdown, control: { active, syncify } });
+          for (const namespace of namespaces) for (const name of Object.keys(originals)) {
+            if (typeof namespace[name] === "function") namespace[name] = bridge.exports[name];
+          }
+          importsBound = true;
+        },
+        bindInstance(instance) {
+          if (instanceBound || !importsBound || typeof instance.exports.syscall_syncify !== "function") throw new PythonFailure("runtime-abi");
+          syncify.set(0, instance.exports.syscall_syncify);
+          instanceBound = true;
+        },
+        bindScheduler(api) {
+          if (schedulerBound) throw new PythonFailure("runtime-abi");
+          api.scheduleCallback = scheduler.scheduleCallback;
+          schedulerBound = true;
+        }
+      });
+      if (!importsBound || !instanceBound || !schedulerBound || runtime.version !== "314.0.6" || !runtime._module.jspiSupported) throw new PythonFailure("runtime-abi");
+      qualified = true;
+      signal.throwIfAborted();
+      runtime.runPython("import sys, os, json, runpy, traceback, types, warnings, textwrap, io, struct, linecache, importlib.machinery, shutil, stat, pyodide.ffi");
+      runtime.globals.set("_safe_runtime_mount", start.runtimeMount);
+      const filesystem = runtime.FS;
+      const bootstrap = filesystem.root;
+      filesystem.root = null;
+      filesystem.mount(filesystem.filesystems.MEMFS, {}, "/");
+      filesystem.mkdir(start.runtimeMount);
+      filesystem.mount({ mount: () => bootstrap }, {}, start.runtimeMount);
+      runtime.runPython(pythonRuntimeRelocation);
+      filesystem.currentPath = start.invocation.cwd;
+      native = createPythonNativeSyscalls({
+        runtime: runtime._module,
+        cwd: start.invocation.cwd,
+        runtimeMount: start.runtimeMount,
+        maxTransferBytes: start.maxTransferBytes,
+        signal,
+        dispatch: start.dispatch,
+        original: (name, args) => originals[name](...args)
+      });
+      const errno = JSON.parse(runtime.runPython("__import__('json').dumps({name:value for name,value in vars(__import__('errno')).items() if name.startswith('E') and isinstance(value,int)})"));
+      const encode = async (operation) => {
+        try {
+          return JSON.stringify(await operation());
+        } catch (error) {
+          return JSON.stringify({ errno: signal.aborted ? errno.EINTR : error.errno ?? errno[error.code ?? ""] ?? errno.EIO });
+        }
+      };
+      const absolute = (path) => path.startsWith("/") ? path : filesystem.cwd() + "/" + path;
+      const bootstrapPath = (path) => path === start.runtimeMount || path.startsWith(start.runtimeMount + "/");
+      const module = runtime._module;
+      const send = async (pointer) => {
+        let response = await encode(async () => {
+          signal.throwIfAborted();
+          const [operation, path, follow] = JSON.parse(module.UTF8ToString(pointer, 16384));
+          if (operation === "stat") return native.metadata(path, follow);
+          if (typeof path !== "string") throw Object.assign(new Error("Invalid native Python path"), { code: "EINVAL" });
+          const target = absolute(path);
+          if (operation === "directory") {
+            const entries = bootstrapPath(target) ? filesystem.readdir(target).filter((name) => name !== "." && name !== "..") : (await start.dispatch({ op: "readdir", args: [target] })).map((entry) => entry.name);
+            return { entries };
+          }
+          if (operation === "tree") {
+            if (bootstrapPath(target) || !await start.dispatch({ op: "rmtreeSupported", args: [target] })) return { supported: false };
+            try {
+              await start.dispatch({ op: "rmtree", args: [target] });
+              return { supported: true };
+            } catch (error) {
+              return { supported: true, errno: errno[error.code ?? ""] ?? errno.EIO };
+            }
+          }
+          throw Object.assign(new Error("Invalid native Python operation"), { code: "EINVAL" });
+        });
+        if (response.length > 1048576) response = JSON.stringify({ errno: errno.EFBIG });
+        let bytes = new TextEncoder().encode(response);
+        if (bytes.length > 1048576) bytes = new TextEncoder().encode(JSON.stringify({ errno: errno.EFBIG }));
+        const output = module._malloc(bytes.length + 1);
+        if (!output) return 0;
+        module.HEAPU8.set(bytes, output);
+        module.HEAPU8[output + bytes.length] = 0;
+        return output;
+      };
+      const nativeCall = new engine.Instance(options.nativeCall, {
+        python: {
+          utf8: module._PyUnicode_AsUTF8,
+          unicode: module._PyUnicode_FromString,
+          free: module._free,
+          noMemory: module._PyErr_NoMemory
+        },
+        request: { send },
+        shutdown: { send: new engine.Suspending(send) },
+        control: { active, syncify }
+      });
+      methodPointer = module.addFunction(nativeCall.exports.call, "iii");
+      methodDefinition = module._malloc(128);
+      if (!methodDefinition) throw new PythonFailure("runtime-assets");
+      module.HEAPU8.fill(0, methodDefinition, methodDefinition + 128);
+      module.HEAPU8.set(new TextEncoder().encode("request\0_safe_native_fs\0"), methodDefinition + 16);
+      module.HEAPU32.set([methodDefinition + 16, methodPointer, 8, 0], methodDefinition / 4);
+      const extension = module._PyImport_AddModule(methodDefinition + 24);
+      const callable = module._PyCFunction_NewEx(methodDefinition, 0, 0);
+      if (!extension || !callable || module._PyModule_AddObject(extension, methodDefinition + 16, callable) < 0) throw new PythonFailure("runtime-abi");
+      const fields = Number(runtime.runPython("os.stat_result.n_fields"));
+      const statResult = new engine.Instance(options.statResult, { python: {
+        fields: new engine.Global({ value: "i32" }, fields),
+        create: module._PyStructSequence_New,
+        size: module._PyTuple_Size,
+        item: module._PyTuple_GetItem,
+        retain: module._Py_IncRef,
+        set: module._PyStructSequence_SetItem,
+        invalid: module._PyErr_BadArgument
+      } });
+      statPointer = module.addFunction(statResult.exports.construct, "iii");
+      module.HEAPU8.set(new TextEncoder().encode("stat_result\0os\0"), methodDefinition + 80);
+      module.HEAPU32.set([methodDefinition + 80, statPointer, 8, 0], (methodDefinition + 64) / 4);
+      const osModule = module._PyImport_AddModule(methodDefinition + 92);
+      const statType = module._PyObject_GetAttrString(osModule, methodDefinition + 80);
+      const constructStat = module._PyCFunction_NewEx(methodDefinition + 64, statType, 0);
+      module._Py_DecRef(statType);
+      if (!constructStat || module._PyModule_AddObject(extension, methodDefinition + 80, constructStat) < 0) throw new PythonFailure("runtime-abi");
+      runtime.runPython(`
+from _safe_native_fs import request as _safe_native_request
+def _safe_stat_projection(path, follow):
+ return _safe_native_request(json.dumps(['stat', path, follow]))
+def _safe_import_stat(path):
+ return _safe_stat_projection(path, True)
+def _safe_directory_entries(path):
+ return _safe_native_request(json.dumps(['directory', path]))
+def _safe_tree_cleanup(path):
+ return _safe_native_request(json.dumps(['tree', path]))
+`);
+      for (const script of [pythonImportMetadata, pythonDirectoryEntries, pythonStatProjection, pythonTreeCleanup]) runtime.runPython(script);
+      runtime.runPython(`
+from _safe_native_fs import stat_result as _safe_construct_stat
+_safe_stat_fields = os.stat_result.n_fields
+_safe_stat_probe = os.stat_result(tuple(range(_safe_stat_fields)))
+_safe_stat_indexes = {name: getattr(_safe_stat_probe, name) for name in dir(_safe_stat_probe) if name.startswith('st_')}
+def _safe_native_stat_type(values, extras):
+ fields = list(values) + [None] * (_safe_stat_fields - len(values))
+ for name, value in extras.items():
+  if name in _safe_stat_indexes:
+   fields[_safe_stat_indexes[name]] = value
+ return _safe_construct_stat(tuple(fields))
+_safe_stat_type = _safe_native_stat_type
+`);
+      runtime.globals.set("_safe_invocation_json", JSON.stringify(start.invocation));
+      runtime.globals.set("_safe_execution_code", pythonExecution);
+      runtime.globals.set("_safe_is_cancelled", () => signal.aborted);
+      active.value = 1;
+      start.onReady();
+      exitCode = Number(await runtime.runPythonAsync(`
+try:
+ exec(_safe_execution_code)
+except BaseException:
+ if not _safe_is_cancelled():
+  raise
+ _safe_exit = 130
+_safe_exit
+`)) & 255;
+    } finally {
+      try {
+        if (qualified) {
+          try {
+            await runtime.runPythonAsync(`
+import asyncio as _safe_asyncio
+async def _safe_quiesce_tasks():
+ current = _safe_asyncio.current_task()
+ while True:
+  pending = [task for task in _safe_asyncio.all_tasks() if task is not current]
+  if not pending:
+   break
+  for task in pending:
+   task.cancel()
+  await _safe_asyncio.gather(*pending, return_exceptions=True)
+ loop = _safe_asyncio.get_running_loop()
+ await loop.shutdown_asyncgens()
+ await loop.shutdown_default_executor()
+await _safe_quiesce_tasks()
+`);
+          } finally {
+            try {
+              await scheduler.close();
+            } finally {
+              active.value = native ? 2 : 0;
+              finalized = Number(await engine.promising(runtime._module._Py_FinalizeEx)());
+            }
+          }
+        }
+      } finally {
+        active.value = 0;
+        cleanup = scheduler.close().finally(() => native?.close());
+        try {
+          await cleanup;
+        } finally {
+          if (methodDefinition) runtime?._module._free(methodDefinition);
+          if (methodPointer !== void 0) runtime?._module.removeFunction(methodPointer);
+          if (statPointer !== void 0) runtime?._module.removeFunction(statPointer);
+          runtime = void 0;
+          native = void 0;
+          syncify.set(0, null);
+          for (const name of Object.keys(originals)) delete originals[name];
+        }
+      }
+    }
+    signal.throwIfAborted();
+    return finalized < 0 ? 120 : exitCode;
+  };
+  return {
+    run(start) {
+      if (admitted || retirement) return Promise.reject(new PythonFailure("executor-unavailable"));
+      admitted = true;
+      running = execute(start);
+      return running;
+    },
+    terminate() {
+      retirement ??= (async () => {
+        controller.abort();
+        await running?.catch(() => {
+        });
+        await cleanup;
+      })();
+      return retirement;
+    }
+  };
+}
+
+// packages/safe-bash/src/commands/python/jspi-assets.ts
+init_platform();
+function createPythonJspiAssets(options) {
+  const engine = globalThis.WebAssembly;
+  const main = options.main;
+  const registry = options.modules.map((entry) => ({ module: entry.module, bytes: Uint8Array.from(entry.bytes) }));
+  if (![main, ...registry.map((entry) => entry.module)].every((module) => module instanceof engine.Module)) throw new TypeError("Expected precompiled Python Wasm modules");
+  const stdlib = Uint8Array.from(options.stdlib);
+  const responses = /* @__PURE__ */ new WeakMap();
+  const approved = /* @__PURE__ */ new Set([main, ...registry.map((entry) => entry.module)]);
+  const select = (source) => {
+    const bytes = ArrayBuffer.isView(source) ? new Uint8Array(source.buffer, source.byteOffset, source.byteLength) : new Uint8Array(source);
+    const entry = registry.find((candidate) => candidate.bytes.length === bytes.length && candidate.bytes.every((byte, index) => byte === bytes[index]));
+    if (!entry) throw new engine.CompileError("Unapproved Python runtime Wasm bytes");
+    return entry.module;
+  };
+  const WebAssembly = Object.create(engine);
+  WebAssembly.Module = function(source) {
+    return select(source);
+  };
+  Object.setPrototypeOf(WebAssembly.Module, engine.Module);
+  WebAssembly.Module.prototype = engine.Module.prototype;
+  WebAssembly.compile = async (source) => select(source);
+  WebAssembly.compileStreaming = async () => {
+    throw new engine.CompileError("Unapproved Python streaming compilation");
+  };
+  WebAssembly.instantiate = async (source, imports) => {
+    if (source instanceof engine.Module) {
+      if (!approved.has(source)) throw new engine.CompileError("Unapproved Python Wasm module");
+      return new engine.Instance(source, imports);
+    }
+    const module = select(source);
+    return { module, instance: new engine.Instance(module, imports) };
+  };
+  WebAssembly.instantiateStreaming = async (response, imports) => {
+    const module = responses.get(await response);
+    if (!module) throw new engine.CompileError("Unapproved Python Wasm response");
+    return { module, instance: new engine.Instance(module, imports) };
+  };
+  const location = "https://safe-python.invalid/";
+  return { WebAssembly, location, async fetch(url) {
+    const target = new URL(url, location).href;
+    if (target === location + "python_stdlib.zip") return new Response(stdlib);
+    if (target === location + "pyodide.asm.wasm") {
+      const response = new Response(null, { headers: { "Content-Type": "application/wasm" } });
+      responses.set(response, main);
+      return response;
+    }
+    throw new Error("Unapproved Python runtime asset");
+  } };
+}
+
 // packages/safe-bash/src/commands/python/index.ts
 var PythonInputChunkError = class extends RangeError {
 };
@@ -1503,7 +2209,8 @@ function createPythonCommands(options) {
         signal.removeEventListener("abort", aborted);
         const subscription = Promise.resolve().then(() => unsubscribe?.());
         const termination = Promise.resolve().then(() => executor ? executor.terminate() : endpoint?.terminate());
-        const results = await Promise.allSettled([subscription, termination, service.close(), stdoutOperation?.close(), stderrOperation?.close(), ...pending]);
+        const filesystemRetirement = termination.finally(() => service.close());
+        const results = await Promise.allSettled([subscription, termination, filesystemRetirement, stdoutOperation?.close(), stderrOperation?.close(), ...pending]);
         await input.return?.(void 0);
         fragment = void 0;
         if (packages) environment.finish(packages);
@@ -1544,6 +2251,7 @@ function createPythonCommands(options) {
         }
       };
       const dispatch = async (request) => {
+        if (request.op === "close") return service.dispatch(request);
         signal.throwIfAborted();
         if (request.op.startsWith("package-")) return environment.dispatch(request.op, request.args, { fs: context.fs, cwd: context.cwd, signal });
         if (request.op === "stdin") {
@@ -1620,10 +2328,13 @@ function createPythonCommands(options) {
             }
           },
           async dispatch(request) {
-            signal.throwIfAborted();
-            if (closed || !running || requesting || !request || typeof request.op !== "string" || !Array.isArray(request.args)) throw reportPythonFailure("transport-unavailable", void 0, options.onDiagnostic);
+            if (!request || typeof request.op !== "string" || !Array.isArray(request.args)) throw reportPythonFailure("transport-unavailable", void 0, options.onDiagnostic);
+            const releasing = request.op === "close";
+            if (!releasing) signal.throwIfAborted();
+            if (closed && !releasing || !running || requesting) throw reportPythonFailure("transport-unavailable", void 0, options.onDiagnostic);
             requesting = true;
             const operation = Promise.resolve().then(() => dispatch(request)).catch(async (error) => {
+              if (releasing) throw error;
               signal.throwIfAborted();
               if (error instanceof PythonInputChunkError) rejectRun?.(error);
               if (request.op.startsWith("package-")) throw Object.assign(reportPythonFailure("runtime-assets", error, options.onDiagnostic), { code: "EPACKAGE" });
@@ -1863,7 +2574,12 @@ export {
   pythonDocumentPackages,
   createPythonPackageEnvironment,
   createPythonExecutorPool,
+  createPythonJspiTrampoline,
+  createPythonJspiNativeCall,
+  createPythonJspiStatResult,
+  createPythonJspiExecutor,
+  createPythonJspiAssets,
   createPythonCommands,
   pythonCommands
 };
-//# sourceMappingURL=chunk-6R7IR2MV.js.map
+//# sourceMappingURL=chunk-BONY6MX5.js.map