@qvac/harness 0.3.0 → 0.3.2

package/dist-lib/index.d.ts

@@ -44,7 +44,7 @@ export { requiredSettings, settingEnvName, type SkillSettingEntry, type SkillSet
 export type { ToolCatalogEntry } from './lib/tools/catalog.ts';
 export { TOOLSETS, toolsetEnabled, type Toolset } from './lib/tools/toolsets.ts';
 export { markCredentialRejected, markCredentialValid, recordCredentialHealth, resetAllCredentialHealth, resetCredentialHealth } from './lib/tools/skills/credential-health.ts';
-export type { InstallStep, SkillOAuthConfig, SkillRequires, SkillSetup, SkillSetupField, SkillSetupRoute } from './lib/tools/skills/manifest.ts';
+export type { InstallStep, SkillOAuthConfig, SkillOAuthVerify, SkillOAuthVerifyRule, SkillRequires, SkillSetup, SkillSetupField, SkillSetupRoute } from './lib/tools/skills/manifest.ts';
 export { readSetup as normalizeSkillSetup } from './lib/tools/skills/manifest-parse.ts';
 export type { CredentialRecord, CredentialStoreValue } from './lib/tools/skills/auth-resolver.ts';
 export { isAvailableState, SKILL_STATE, type SkillState } from './lib/tools/skills/skill-state.ts';

package/dist-lib/lib/capabilities/completion.d.ts

@@ -139,6 +139,10 @@ export interface ToolExecuteContext {
     toolOps?: ReadonlyMap<string, readonly CliValidator[]> | undefined;
     runBudget?: RunBudget | undefined;
     reportBackend?: ((use: RunBackendUse) => void) | undefined;
+    uncappedResponse?: boolean | undefined;
+    sandboxMode?: boolean | undefined;
+    toolNames?: readonly string[] | undefined;
+    approval?: ToolDecision | undefined;
 }
 export interface RunBackendUse {
     tool: string;
@@ -178,7 +182,7 @@ export interface ToolDefinition {
     toolset: Toolset | null;
     validate?: (args: Record<string, unknown>, ctx?: ToolExecuteContext) => string | null;
     effect: (args: Record<string, unknown>, ctx?: ToolExecuteContext) => ToolEffect;
-    resource?: (args: Record<string, unknown>) => ResourceDescriptor | null;
+    resource?: (args: Record<string, unknown>, ctx?: ToolExecuteContext) => ResourceDescriptor | null;
     compiled?: true;
     execute: (args: Record<string, unknown>, ctx?: ToolExecuteContext) => Promise<unknown>;
 }

package/dist-lib/lib/capabilities/completion.js

@@ -19,6 +19,7 @@ import { annotateLastUserTime, skillsPromptSection, systemPromptParts } from '..
 import { isMetadataMethod } from '../tools/mcp/utils.js';
 import { unquoteArg } from '../tools/model-args.js';
 import { SKILL_TOOL_NAME, WEB_SEARCH_TOOL_NAME } from './tool-names.js';
+import { mainFileRequested, skillFileArg, skillFileStem } from '../tools/skill.js';
 import { promptUsageParts, usageBreakdown } from './usage-breakdown.js';
 import { collectToolGrants, enabledTools, isSelected, skillIsActive, skillsAreSelected } from './tool-selection.js';
 import { guardToolCall } from '../tools/outbound-guard.js';
@@ -272,7 +273,7 @@ async function executeCall(tool, args, ctx, { approve, signal, denied, sources =
             type: 'tool-activity',
             name: tool.name,
             args,
-            resource: tool.resource?.(args) ?? null,
+            resource: tool.resource?.(args, ctx) ?? null,
             effect: tool.effect(args, ctx),
             decision: 'blocked'
         });
@@ -284,7 +285,7 @@ async function executeCall(tool, args, ctx, { approve, signal, denied, sources =
         return deniedCall();
     }
     const effect = classified ?? tool.effect(args, ctx);
-    const resource = tool.resource?.(args) ?? null;
+    const resource = tool.resource?.(args, ctx) ?? null;
     const autoRun = effect === 'read' || tool.autoApprove === true || skipApprovals === true;
     hlog('tool decision', {
         tool: tool.name,
@@ -326,7 +327,7 @@ async function executeCall(tool, args, ctx, { approve, signal, denied, sources =
     let output;
     let outcome = { kind: 'success' };
     try {
-        output = await tool.execute(args, { ...ctx, signal });
+        output = await tool.execute(args, { ...ctx, signal, approval: decision });
         hlog('tool done', { tool: tool.name });
     }
     catch (err) {
@@ -709,6 +710,8 @@ export async function* completion(sdk, { modelId, acquireRound, model, agent, ct
             ? { ...resolvedGenerationParams, ...generationParamsOverride }
             : resolvedGenerationParams;
         const loadedThisTurn = new Set();
+        const loadedFilesThisTurn = new Set();
+        const fileKey = (skill, file) => `${skill}\0${skillFileStem(file)}`;
         let skillIcon = null;
         const skillEmoji = (name) => skillCatalog.find((entry) => entry.name === name)?.emoji ?? null;
         const nudgedSkills = new Set();
@@ -1004,13 +1007,20 @@ export async function* completion(sdk, { modelId, acquireRound, model, agent, ct
                     toolOps: grantedOps,
                     fsRoots,
                     fsWriteRoots: writableRoots,
-                    reportBackend: (use) => stats.backends.push(use)
+                    reportBackend: (use) => stats.backends.push(use),
+                    sandboxMode: agent?.sandboxMode === true,
+                    toolNames: enabled.map((tool) => tool.name)
                 };
                 const skillCall = call.name === SKILL_TOOL_NAME;
                 const effect = tool?.effect(args, callCtx) ?? (skillCall ? 'read' : undefined);
                 const resource = tool?.resource?.(args) ?? null;
                 const skillName = unquoteArg(args?.name ?? args?.skill_name ?? args?.skill);
-                const skillReloaded = tool?.name === SKILL_TOOL_NAME && !args?.file && loadedThisTurn.has(skillName);
+                const askedFile = skillFileArg(args);
+                const mainRequested = mainFileRequested(skillName, askedFile);
+                const skillReloaded = tool?.name === SKILL_TOOL_NAME &&
+                    (mainRequested
+                        ? loadedThisTurn.has(skillName)
+                        : loadedFilesThisTurn.has(fileKey(skillName, unquoteArg(askedFile))));
                 const silent = searchCapped || skillReloaded || priorFailure !== undefined;
                 const display = silent
                     ? undefined
@@ -1034,9 +1044,10 @@ export async function* completion(sdk, { modelId, acquireRound, model, agent, ct
                     execution = terminalCall(priorFailure.result, priorFailure.outcome, { executed: false });
                 }
                 else if (skillReloaded) {
+                    const loadedWhat = mainRequested ? skillName : `${skillName} ${unquoteArg(askedFile)}`;
                     execution = terminalCall({
                         name: skillName,
-                        content: `${skillName} is already loaded. Follow the instructions you were given and do not load it again.`
+                        content: `${loadedWhat} is already loaded. Follow the instructions you were given and do not load it again.`
                     }, { kind: 'guidance', message: `${skillName} is already loaded.` }, { executed: false });
                 }
                 else if (skillBlocked) {
@@ -1105,9 +1116,10 @@ export async function* completion(sdk, { modelId, acquireRound, model, agent, ct
                         files.add(output.file);
                         loadedSkillFiles.set(skillName, files);
                     }
-                    else {
+                    if (mainRequested)
                         loadedThisTurn.add(skillName);
-                    }
+                    else
+                        loadedFilesThisTurn.add(fileKey(skillName, unquoteArg(askedFile)));
                     skillIcon = skillEmoji(skillName) ?? skillIcon;
                 }
                 if (!activity &&

package/dist-lib/lib/helpers/tool-call-markup.js

@@ -1,7 +1,7 @@
 const FUNCTION_OPEN = '<function=';
 const FUNCTION_CLOSE = '</function>';
-const RESPONSE_OPEN = '<tool_response>';
-const RESPONSE_CLOSE = '</tool_response>';
+const TOOL_RESPONSE = { open: '<tool_response>', close: '</tool_response>' };
+const TOOL_CALL = { open: '<tool_call>', close: '</tool_call>' };
 const PARAMETER_OPEN = '<parameter=';
 const PARAMETER_CLOSE = '</parameter>';
 const MAX_NAME_LENGTH = 64;
@@ -66,26 +66,34 @@ export function stripToolCallMarkup(text) {
     out += text.slice(cursor);
     const dangling = danglingIndex(out);
     const withoutCalls = dangling === -1 ? out : out.slice(0, dangling);
-    return stripToolResponseBlocks(withoutCalls)
+    const withoutSpans = stripSpans(stripToolResponseBlocks(withoutCalls), TOOL_CALL);
+    return withoutSpans
         .replace(/<\/?(tool_call|tool_response)>/gi, '')
         .replace(/\n{3,}/g, '\n\n')
         .trim();
 }
-export function stripToolResponseBlocks(text) {
+function stripSpans(text, span) {
+    const hay = text.replace(/[A-Z]/g, lowerAscii);
     let out = '';
     let cursor = 0;
     for (;;) {
-        const start = text.indexOf(RESPONSE_OPEN, cursor);
+        const start = hay.indexOf(span.open, cursor);
         if (start === -1)
             break;
         out += text.slice(cursor, start);
-        const end = text.indexOf(RESPONSE_CLOSE, start + RESPONSE_OPEN.length);
+        const end = hay.indexOf(span.close, start + span.open.length);
         if (end === -1)
             return out;
-        cursor = end + RESPONSE_CLOSE.length;
+        cursor = end + span.close.length;
     }
     return out + text.slice(cursor);
 }
+function lowerAscii(char) {
+    return char.toLowerCase();
+}
+export function stripToolResponseBlocks(text) {
+    return stripSpans(text, TOOL_RESPONSE);
+}
 function danglingIndex(text) {
     let cursor = 0;
     for (;;) {

package/dist-lib/lib/no-redirect-fetch-impl.d.ts

@@ -1,6 +1,6 @@
 export interface FetchRequestLike {
     on(event: 'error', listener: (err: Error) => void): void;
-    write(chunk: string): void;
+    write(chunk: string | Uint8Array): void;
     end(): void;
     destroy(err?: Error): void;
 }
@@ -19,7 +19,7 @@ export type BareRequestFn<Response extends FetchResponseLike = FetchResponseLike
 export interface NoRedirectFetchInit {
     method?: string;
     headers?: Record<string, string>;
-    body?: string;
+    body?: string | Uint8Array;
     signal?: {
         readonly aborted: boolean;
         addEventListener(type: 'abort', listener: () => void): void;
@@ -32,6 +32,7 @@ export interface NoRedirectFetchResponse {
     status: number;
     headers: {
         get(name: string): string | null;
+        entries(): [string, string][];
     };
     text(): string;
     bytes(): Uint8Array;

package/dist-lib/lib/no-redirect-fetch-impl.js

@@ -29,7 +29,10 @@ export function runNoRedirectFetch(request, url, init = {}) {
                 }
                 resolve({
                     status: res.statusCode,
-                    headers: { get: (name) => responseHeaders[name.toLowerCase()] ?? null },
+                    headers: {
+                        get: (name) => responseHeaders[name.toLowerCase()] ?? null,
+                        entries: () => Object.entries(responseHeaders)
+                    },
                     text: () => b4a.toString(body, 'utf8'),
                     bytes: () => body
                 });

package/dist-lib/lib/tools/exec/adapters/adapter.d.ts

@@ -1,5 +1,5 @@
 import type { AbortSignal as BareAbortSignal } from 'bare-abort-controller';
-import type { AttachFn, FetchAttachmentFn, RunBudget } from '../../../capabilities/completion.ts';
+import type { AttachFn, FetchAttachmentFn, RunBudget, ToolDecision } from '../../../capabilities/completion.ts';
 import type { ExecResult } from '../runner.ts';
 export type ExecutionOptions = {
     readonly cwd?: string;
@@ -15,6 +15,10 @@ export type ExecutionContext = {
         path: string;
     }[];
     readonly runBudget?: RunBudget;
+    readonly sandboxMode?: boolean;
+    readonly toolNames?: readonly string[];
+    readonly approval?: ToolDecision;
+    readonly confirmConnect?: (host: string) => Promise<boolean>;
 };
 export type ExecutionPlan = {
     run(options: ExecutionOptions): Promise<ExecResult> | ExecResult;

package/dist-lib/lib/tools/exec/adapters/python/distributions.d.ts

@@ -0,0 +1 @@
+export declare function moduleDistribution(module: string): string | null;

package/dist-lib/lib/tools/exec/adapters/python/distributions.js

@@ -0,0 +1,4 @@
+import { MODULE_DISTRIBUTIONS } from './module-distributions.js';
+export function moduleDistribution(module) {
+    return Object.hasOwn(MODULE_DISTRIBUTIONS, module) ? (MODULE_DISTRIBUTIONS[module] ?? null) : null;
+}

package/dist-lib/lib/tools/exec/adapters/python/guarded-fetch.d.ts

@@ -0,0 +1,72 @@
+import { type HostResolver } from '../../../url-guard.ts';
+import type { NoRedirectFetchInit, NoRedirectFetchResponse } from '../../../../no-redirect-fetch-impl.ts';
+export declare const MAX_RESPONSE_BYTES: number;
+type NoRedirectFetch = (url: URL, init?: NoRedirectFetchInit) => Promise<NoRedirectFetchResponse>;
+declare const GUARDED: unique symbol;
+export type ConnectPolicy = {
+    readonly named: readonly string[];
+    readonly ask: (host: string) => Promise<boolean>;
+};
+export declare function setConnectPolicy(next: ConnectPolicy | null): void;
+export declare function isGuardedFetch(fetch: unknown): boolean;
+type SignalLike = {
+    readonly aborted: boolean;
+    addEventListener(type: 'abort', listener: () => void): void;
+};
+type FetchInit = {
+    method?: string;
+    headers?: unknown;
+    body?: unknown;
+    signal?: SignalLike | null;
+    redirect?: string;
+};
+export type GuardedFetchOptions = {
+    readonly fetch?: NoRedirectFetch;
+    readonly resolveHost?: HostResolver;
+    readonly maxBytes?: number;
+    readonly timeoutMs?: number;
+};
+declare class GuardedHeaders {
+    #private;
+    constructor(entries: [string, string][]);
+    get(name: string): string | null;
+    has(name: string): boolean;
+    entries(): IterableIterator<[string, string]>;
+    keys(): IterableIterator<string>;
+    values(): IterableIterator<string>;
+    forEach(fn: (value: string, key: string) => void): void;
+    [Symbol.iterator](): IterableIterator<[string, string]>;
+}
+export declare class GuardedResponse {
+    #private;
+    readonly type = "basic";
+    readonly statusText = "";
+    readonly status: number;
+    readonly headers: GuardedHeaders;
+    readonly url: string;
+    readonly redirected: boolean;
+    constructor(status: number, headers: [string, string][], bytes: Uint8Array, url: string, redirected: boolean);
+    get ok(): boolean;
+    get bodyUsed(): boolean;
+    get body(): {
+        getReader(): {
+            read(): Promise<{
+                done: boolean;
+                value?: Uint8Array;
+            }>;
+            cancel(): Promise<void>;
+            releaseLock(): void;
+        };
+    };
+    arrayBuffer(): Promise<ArrayBuffer>;
+    bytes(): Promise<Uint8Array>;
+    text(): Promise<string>;
+    json(): Promise<unknown>;
+    clone(): GuardedResponse;
+}
+export declare function createGuardedFetch(options?: GuardedFetchOptions): ((input: string | URL | {
+    url: string;
+}, init?: FetchInit) => Promise<GuardedResponse>) & {
+    [GUARDED]: true;
+};
+export {};

package/dist-lib/lib/tools/exec/adapters/python/guarded-fetch.js

@@ -0,0 +1,222 @@
+import { AbortController } from 'bare-abort-controller';
+import b4a from 'b4a';
+import defaultFetch from '#no-redirect-fetch';
+import { lookupHost } from '../../../../dns-lookup.js';
+import { hostIsNamed } from './named-hosts.js';
+import { checkOutboundHost, resolveOutboundUrl } from '../../../url-guard.js';
+export const MAX_RESPONSE_BYTES = 100 * 1024 * 1024;
+const MAX_REDIRECTS = 10;
+const TIMEOUT_MS = 120_000;
+const CHUNK_BYTES = 1024 * 1024;
+const GUARDED = Symbol.for('qvac.harness.guardedFetch');
+let policy = null;
+const granted = new Set();
+export function setConnectPolicy(next) {
+    policy = next;
+    granted.clear();
+}
+async function mayConnect(host) {
+    if (!policy || granted.has(host) || hostIsNamed(host, policy.named))
+        return true;
+    const allowed = await policy.ask(host);
+    if (allowed)
+        granted.add(host);
+    return allowed;
+}
+export function isGuardedFetch(fetch) {
+    return typeof fetch === 'function' && fetch[GUARDED] === true;
+}
+function isRedirect(status) {
+    return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function headerRecord(headers) {
+    const out = {};
+    if (!headers || typeof headers !== 'object')
+        return out;
+    const pairs = Array.isArray(headers)
+        ? headers
+        : typeof headers.entries === 'function'
+            ? headers.entries()
+            : Object.entries(headers);
+    for (const pair of pairs) {
+        if (!Array.isArray(pair) || pair.length < 2)
+            continue;
+        out[String(pair[0])] = String(pair[1]);
+    }
+    return out;
+}
+function bodyBytes(body) {
+    if (body === undefined || body === null)
+        return undefined;
+    if (typeof body === 'string')
+        return body;
+    if (body instanceof ArrayBuffer)
+        return new Uint8Array(body);
+    if (ArrayBuffer.isView(body))
+        return new Uint8Array(body.buffer, body.byteOffset, body.byteLength);
+    return String(body);
+}
+function plain(bytes) {
+    return new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+}
+class GuardedHeaders {
+    #map;
+    constructor(entries) {
+        this.#map = new Map(entries.map(([k, v]) => [k.toLowerCase(), v]));
+    }
+    get(name) {
+        return this.#map.get(name.toLowerCase()) ?? null;
+    }
+    has(name) {
+        return this.#map.has(name.toLowerCase());
+    }
+    entries() {
+        return this.#map.entries();
+    }
+    keys() {
+        return this.#map.keys();
+    }
+    values() {
+        return this.#map.values();
+    }
+    forEach(fn) {
+        this.#map.forEach((value, key) => fn(value, key));
+    }
+    [Symbol.iterator]() {
+        return this.#map.entries();
+    }
+}
+export class GuardedResponse {
+    type = 'basic';
+    statusText = '';
+    status;
+    headers;
+    url;
+    redirected;
+    #bytes;
+    #used = false;
+    constructor(status, headers, bytes, url, redirected) {
+        this.status = status;
+        this.headers = new GuardedHeaders(headers);
+        this.#bytes = bytes;
+        this.url = url;
+        this.redirected = redirected;
+    }
+    get ok() {
+        return this.status >= 200 && this.status < 300;
+    }
+    get bodyUsed() {
+        return this.#used;
+    }
+    get body() {
+        let offset = 0;
+        const bytes = this.#bytes;
+        return {
+            getReader: () => {
+                this.#used = true;
+                return {
+                    read: async () => {
+                        if (offset >= bytes.byteLength)
+                            return { done: true };
+                        const value = plain(bytes.subarray(offset, offset + CHUNK_BYTES));
+                        offset += value.byteLength;
+                        return { done: false, value };
+                    },
+                    cancel: async () => {
+                        offset = bytes.byteLength;
+                    },
+                    releaseLock: () => { }
+                };
+            }
+        };
+    }
+    async arrayBuffer() {
+        this.#used = true;
+        const { buffer, byteOffset, byteLength } = this.#bytes;
+        return buffer.slice(byteOffset, byteOffset + byteLength);
+    }
+    async bytes() {
+        return new Uint8Array(await this.arrayBuffer());
+    }
+    async text() {
+        this.#used = true;
+        return b4a.toString(this.#bytes, 'utf8');
+    }
+    async json() {
+        return JSON.parse(await this.text());
+    }
+    clone() {
+        return new GuardedResponse(this.status, [...this.headers.entries()], this.#bytes, this.url, this.redirected);
+    }
+}
+export function createGuardedFetch(options = {}) {
+    const send = options.fetch ?? defaultFetch;
+    const resolveHost = options.resolveHost ?? lookupHost;
+    const maxBytes = options.maxBytes ?? MAX_RESPONSE_BYTES;
+    const timeoutMs = options.timeoutMs ?? TIMEOUT_MS;
+    const guardedFetch = async function (input, init = {}) {
+        let url = new URL(typeof input === 'string' || input instanceof URL ? input : input.url);
+        let method = (init.method ?? 'GET').toUpperCase();
+        let body = bodyBytes(init.body);
+        const headers = headerRecord(init.headers);
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(undefined), timeoutMs);
+        if (init.signal?.aborted)
+            controller.abort(undefined);
+        init.signal?.addEventListener('abort', () => controller.abort(undefined));
+        try {
+            for (let hops = 0;; hops++) {
+                if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+                    throw new TypeError(`fetch refused: unsupported protocol ${url.protocol}`);
+                }
+                const literal = checkOutboundHost(url);
+                if (literal)
+                    throw new TypeError(`fetch refused: ${literal}`);
+                if (!(await mayConnect(url.hostname))) {
+                    throw new TypeError(`fetch refused: ${url.hostname} was not approved for this run`);
+                }
+                const check = await resolveOutboundUrl(url, resolveHost, controller.signal);
+                if (check.blocked)
+                    throw new TypeError(`fetch refused: ${check.blocked}`);
+                const response = await send(url, {
+                    method,
+                    headers,
+                    body,
+                    signal: controller.signal,
+                    validatedAddresses: check.addresses,
+                    maxBytes
+                });
+                const location = response.headers.get('location');
+                if (!isRedirect(response.status) || !location || init.redirect === 'manual') {
+                    return new GuardedResponse(response.status, response.headers.entries(), plain(response.bytes()), url.href, hops > 0);
+                }
+                if (init.redirect === 'error')
+                    throw new TypeError('fetch refused: redirect not allowed');
+                if (hops >= MAX_REDIRECTS)
+                    throw new TypeError('fetch refused: too many redirects');
+                const next = new URL(location, url);
+                if (next.protocol !== url.protocol || next.host !== url.host) {
+                    for (const name of Object.keys(headers)) {
+                        if (/^(authorization|cookie)$/i.test(name))
+                            delete headers[name];
+                    }
+                }
+                if (response.status === 303 ||
+                    ((response.status === 301 || response.status === 302) && method === 'POST')) {
+                    method = 'GET';
+                    body = undefined;
+                }
+                url = next;
+            }
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+    const fetch = (input, init) => {
+        const response = guardedFetch(input, init);
+        response.catch(() => { });
+        return response;
+    };
+    return Object.assign(fetch, { [GUARDED]: true });
+}

package/dist-lib/lib/tools/exec/adapters/python/interrupt-timer.d.ts

@@ -0,0 +1,5 @@
+export type InterruptTimer = {
+    readonly interrupt: Uint8Array;
+    disarm(): boolean;
+};
+export declare function startInterruptTimer(ms: number): InterruptTimer;

package/dist-lib/lib/tools/exec/adapters/python/interrupt-timer.js

@@ -0,0 +1,29 @@
+import { spawnInlineThread } from '#pyodide-worker-spawn';
+const ARMED = 0;
+const DISARMED = 1;
+const FIRED = 2;
+const SIGINT = 2;
+const RESEND_MS = 100;
+const SOURCE = `
+const state = new Int32Array(data.state)
+const interrupt = new Uint8Array(data.interrupt)
+Atomics.wait(state, 0, ${ARMED}, data.ms)
+if (Atomics.compareExchange(state, 0, ${ARMED}, ${FIRED}) === ${ARMED}) {
+  do Atomics.store(interrupt, 0, ${SIGINT})
+  while (Atomics.wait(state, 0, ${FIRED}, ${RESEND_MS}) === 'timed-out')
+}
+`;
+export function startInterruptTimer(ms) {
+    const state = new Int32Array(new SharedArrayBuffer(4));
+    const interrupt = new Uint8Array(new SharedArrayBuffer(1));
+    const reap = spawnInlineThread(SOURCE, { state: state.buffer, interrupt: interrupt.buffer, ms });
+    return {
+        interrupt,
+        disarm() {
+            const fired = Atomics.exchange(state, 0, DISARMED) === FIRED;
+            Atomics.notify(state, 0);
+            reap();
+            return fired;
+        }
+    };
+}

package/dist-lib/lib/tools/exec/adapters/python/loader.js

@@ -9,6 +9,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import b4a from 'b4a';
 import { constants as fsConstants } from 'fs';
 import process from 'process';
+import { createGuardedFetch } from './guarded-fetch.js';
 import { seedPackageCache } from './wheels.js';
 class B4aTextDecoder {
     encoding;
@@ -53,7 +54,7 @@ async function shapeBareGlobals() {
     const g = globalThis;
     if (!g.fetch) {
         const bareFetch = await import('bare-fetch');
-        g.fetch = bareFetch.default;
+        g.fetch = createGuardedFetch();
         g.Request = bareFetch.Request;
         g.Response = bareFetch.Response;
         g.Headers = bareFetch.Headers;

package/dist-lib/lib/tools/exec/adapters/python/module-distributions.d.ts

@@ -0,0 +1 @@
+export declare const MODULE_DISTRIBUTIONS: Readonly<Record<string, string>>;

package/dist-lib/lib/tools/exec/adapters/python/module-distributions.js

@@ -0,0 +1,52 @@
+export const MODULE_DISTRIBUTIONS = {
+    Bio: 'biopython',
+    BioSQL: 'biopython',
+    Crypto: 'pycryptodome',
+    PIL: 'Pillow',
+    PhiSpyModules: 'phispy',
+    PhiSpyRepeatFinder: 'phispy',
+    _argon2_cffi_bindings: 'argon2-cffi-bindings',
+    _distutils_hack: 'setuptools',
+    _pyrsistent_version: 'pyrsistent',
+    _pytest: 'pytest',
+    _yaml: 'pyyaml',
+    _zengl: 'zengl',
+    argon2: 'argon2-cffi',
+    attr: 'attrs',
+    audioop: 'audioop-lts',
+    bigtests: 'screed',
+    bs4: 'beautifulsoup4',
+    cv2: 'opencv-python',
+    cvxpy: 'cvxpy-base',
+    dateutil: 'python-dateutil',
+    dns: 'dnspython',
+    docx: 'python-docx',
+    erfa: 'pyerfa',
+    fitz: 'PyMuPDF',
+    flint: 'python-flint',
+    flirt: 'python-flirt',
+    fpdf: 'fpdf2',
+    google: 'protobuf',
+    gridfs: 'pymongo',
+    isympy: 'sympy',
+    lakers: 'lakers-python',
+    mpl_toolkits: 'matplotlib',
+    mypyc: 'mypy',
+    nacl: 'pynacl',
+    pptx: 'python-pptx',
+    pygame: 'pygame-ce',
+    pylab: 'matplotlib',
+    pysat: 'python-sat',
+    pywt: 'pywavelets',
+    rpds: 'rpds-py',
+    ruamel: 'ruamel.yaml',
+    shapefile: 'pyshp',
+    sisl_toolbox: 'sisl',
+    skimage: 'scikit-image',
+    sklearn: 'scikit-learn',
+    taglib: 'pytaglib',
+    tiktoken_ext: 'tiktoken',
+    tlz: 'toolz',
+    unix_timezones: 'pyodide-unix-timezones',
+    yaml: 'pyyaml'
+};

package/dist-lib/lib/tools/exec/adapters/python/named-hosts.d.ts

@@ -0,0 +1,2 @@
+export declare function namedHosts(source: string): string[];
+export declare function hostIsNamed(host: string, named: readonly string[]): boolean;

package/dist-lib/lib/tools/exec/adapters/python/named-hosts.js

@@ -0,0 +1,15 @@
+const URL_LITERAL = /https?:\/\/[^\s'"`\\<>(){}[\]]+/gi;
+export function namedHosts(source) {
+    const hosts = new Set();
+    for (const [match] of source.matchAll(URL_LITERAL)) {
+        try {
+            hosts.add(new URL(match).hostname.toLowerCase());
+        }
+        catch { }
+    }
+    return [...hosts];
+}
+export function hostIsNamed(host, named) {
+    const bare = (value) => value.toLowerCase().replace(/^www\./, '');
+    return named.some((name) => bare(name) === bare(host));
+}