code-playpad 0.8.0 → 0.9.0

package/README.md

@@ -9,7 +9,7 @@ entirely in the reader's browser. No backend, no iframe, no sign-up.
 **[Live demo →](https://code-playpad.swengr.com)**
 
 ```html
-<script type="module" src="https://cdn.jsdelivr.net/npm/code-playpad@0.8.0/dist/standalone.js"></script>
+<script type="module" src="https://cdn.jsdelivr.net/npm/code-playpad@0.9.0/dist/standalone.js"></script>
 
 <code-playpad height="auto">
   print("hello from a static page")
@@ -159,6 +159,20 @@ under a second. The engine stops a runaway program after 200 million steps
 the evidence behind it and every known difference from the JDK, is in
 [JAVA-COMPATIBILITY.md](https://cdn.jsdelivr.net/npm/code-playpad/JAVA-COMPATIBILITY.md), which ships in the package.
 
+## Experimental C/C++
+
+`language="c"` (C17) and `language="cpp"` (C++20) compile and run in a worker
+with a real Clang compiler, prefilled stdin and Stop. They are experimental:
+
+- **You host the compiler.** It is not in the npm package and there is no
+  hosted copy yet. Build the pinned toolchain from this repository, host it,
+  and call `configureCpp({ indexURL })`. Without that, Run explains what is
+  missing and downloads nothing.
+- **Not yet tested on physical phones.** Desktop Chromium, WebKit and Firefox
+  pass; iPhone Safari and Android Chrome have not been run.
+
+See [setup and limits](https://github.com/stancs/code-playpad/blob/main/docs/COMPILER-RUNTIMES.md).
+
 ## Download size
 
 What a page downloads once a reader presses Run, with the CDN build, as
@@ -173,7 +187,8 @@ actually sent.
 | TypeScript | **227.3 KB** (0.5.2: with the 46.9 KB transform) | nothing (before 0.5.2: Sucrase from esm.sh, 72 KB) | 179.9 KB |
 | Java | **288.1 KB** (0.8.0: engine 0.39) | nothing | 216.4 KB |
 | Java, with collections | **373.1 KB** (0.8.0) | nothing | 233.2 KB |
-| All four | 477.5 KB (0.8.0) | Pyodide | 273.9 KB |
+| C or C++ (experimental) | **187.0 KB** | the compiler, about **29.9 MB**, from the host you configure | — |
+| All five | 520.0 KB | Pyodide and the C/C++ compiler | 273.9 KB |
 
 - **Every row includes a 144.5 KB shared base:** the editor (CodeMirror) and
   the widget, the same as in 0.3.0.
@@ -188,11 +203,23 @@ actually sent.
     that uses them: `java.time` 16.8 KB, `java.math` 6.7 KB,
     `Pattern`/`Matcher` 2.7 KB and `BitSet` 2.3 KB. The rows above leave
     them out.
+  - C/C++: 42.5 KB (the 7.9 KB runtime plus 34.6 KB of C/C++ syntax
+    highlighting). See the C/C++ note below.
   - The Java figures for 0.8.0 are the 0.4.0 measurements plus what the
     engine's two chunks changed by in the build's gzip sizes (engines 0.28
     to 0.39 added the collection staples, library subclasses, the tutorial
     APIs, regex, java.time, javac's error recovery and messages, packages
     and more; 0.32 moved the rarely used classes out of the library).
+- **C and C++ (experimental)** were measured on 2026-10-29 as
+  the difference between pages with and without C/C++. Measured that day,
+  whole pages come out 4–8 KB larger than this table, with or without the
+  C/C++ code, so the C/C++ and All five rows add the measured 42.5 KB to this
+  table's figures. The compiler is the large part: Clang 15.2 MB, the linker 8.8 MB,
+  and headers and libraries 5.9 MB, gzipped as a host would typically send
+  them. It downloads on the first Run, from the address given to
+  `configureCpp` (you host it), and is cached after that. C and C++ share it, so a page
+  with both downloads it once. 0.3.0 had no C/C++, so its All five figure is
+  its four-language page.
 - **Java grew** from 0.3.0 because the subset did, from basic Java to most of
   what practice programs use (see the version history). The owner treats
   download size as secondary to coverage. The package's size checks still
@@ -217,7 +244,7 @@ actually sent.
 ### From a CDN — nothing to install
 
 ```html
-<script type="module" src="https://cdn.jsdelivr.net/npm/code-playpad@0.8.0/dist/standalone.js"></script>
+<script type="module" src="https://cdn.jsdelivr.net/npm/code-playpad@0.9.0/dist/standalone.js"></script>
 ```
 
 This is the `standalone` build: CodeMirror is bundled in, so a static blog post
@@ -848,6 +875,28 @@ warms every other page on the site.
 
 ## Version history
 
+### 0.9.0
+
+Adds experimental C and C++. Nothing else changed: Python, JavaScript,
+TypeScript and Java behave as in 0.8.0, and existing pages grow by about
+0.5 KB.
+
+- **`language="c"` and `language="cpp"`** (C17 and C++20) compile with Clang 20
+  and link with LLD, compiled to WebAssembly, in a worker. Multiple files,
+  prefilled stdin, Stop, a wall-clock limit and streamed output all work.
+  Programs get stdin, stdout and stderr only; exceptions and threads are not
+  supported, and live interactive stdin is not implemented.
+- **`configureCpp({ indexURL })` is required.** The compiler (about 29.9 MB
+  gzipped) is not in this package and has no hosted copy yet, so you build and
+  host it yourself. Its files are checked by SHA-256 and cached after the first
+  Run. Without the setting, Run explains what is missing and downloads nothing.
+- **Tested on desktop only:** Chromium, WebKit and Firefox. Physical iPhone and
+  Android runs have not been done.
+- **`RunOptions`** gains `onProgress` and `timeoutMs`, and `Result` gains
+  `memory`.
+- **New optional peer dependency:** `@codemirror/lang-cpp`, for highlighting
+  with a bundler.
+
 ### 0.8.0
 
 Java engine 0.34.1 → 0.39.0, each change checked against JDK 25. Nothing
@@ -883,7 +932,7 @@ class of that folder's package, as on the JDK.
   first loads, as the JDK's launcher does, so its errors appear at that
   point in the run.
 
-Markup and API written against 0.1.3 still work on 0.8.0, with one exception, in
+Markup and API written against 0.1.3 still work on 0.9.0, with one exception, in
 0.5.1: an `entry` that names none of a widget's files is now an error.
 
 ### 0.7.0
@@ -1183,6 +1232,12 @@ their own MIT licences, reproduced in full in `dist/THIRD-PARTY-NOTICES.txt`.
 Pyodide (MPL-2.0) is fetched from a CDN at runtime and is not redistributed by
 this package.
 
+Experimental C/C++ downloads separate compiler assets with additional
+third-party terms; those assets are not MIT-only. Their notices ship in
+`dist/COMPILER-NOTICES.txt`. The pinned C/C++ rebuild passes its scoped license
+inventory gate; see the [compiler license audit](docs/COMPILER-LICENSE-AUDIT.md)
+and [rebuild and remaining gates](docs/CPP-REBUILD.md).
+
 The Java engine is original code under the same MIT licence. Java is a trademark
 of Oracle and/or its affiliates; code-playpad is not affiliated with, endorsed
 by, or certified by Oracle, and its Java support is a documented subset, not a

package/dist/COMPILER-LICENSE-AUDIT.md

@@ -0,0 +1,104 @@
+# Compiler license audit — 2026-10-27
+
+**Disposition: the project's own code remains MIT. The license inventory gate
+passes for the pinned rebuilt C/C++ artifact set and its notice companions.**
+Release still needs the owner's approval. The old browsercc
+binary set is superseded, not retroactively cleared. See [CPP-REBUILD.md](CPP-REBUILD.md)
+for exact scope, build evidence and remaining non-license release gates.
+
+
+## What is cleared and what was added
+
+The bundled integration uses `@bjorn3/browser_wasi_shim` 0.4.2 under its MIT option
+and adapts the MIT Weblings worker protocol/sysroot format at
+`d0cd7a9f3af7d8249b3948ac0e19d2afc0d01633`. Their full notices already reside in
+`dist/THIRD-PARTY-NOTICES.txt`; the distribution check now verifies both the names
+and complete text. The CodeMirror C++ grammar retains its MIT notice too.
+The project's LICENSE is unchanged. No compiler binaries are committed or packed.
+
+Added a separate `third-party/compiler/manifest.json` and source notice corpus.
+Each snapshot records its immutable source URL and SHA-256. The build emits
+`dist/COMPILER-NOTICES.txt`, this audit, and `compiler-license-manifest.json` so
+npm consumers receive the findings and available external notices. The local
+asset-preparation script also copies these companions beside each toolchain.
+The rebuilt C/C++ additions resolve its scoped inventory gaps.
+
+`npm run check:compiler-licenses` verifies notice hashes. Adding `-- --release`
+fails until the owner sets `releaseApproved`. Use `-- --release --toolchain=cpp`
+for the rebuilt C/C++ license gate, which passes. This is an explicit
+compiler release gate, not a claim that a normal build is approved for release.
+
+## Historical browsercc C/C++ findings (superseded by the pinned rebuild)
+
+The reviewed npm archive is browsercc 0.1.1, source
+`86168bacf0fe7c662e3e65a2e3006ceb159cd0dc`; exact asset hashes are recorded in
+`src/runtime/cpp/assets.ts` and the audit manifest. The wrapper's MIT LICENSE
+has no explicit copyright-holder line; it is preserved verbatim. Package metadata
+names Daniel Bertalan as author; no invented copyright line was added.
+
+The recipe builds Clang/LLD from LLVM 20.1.2 (`58df0ef89dd64126512e4ee27b4ac3fd8ddf6247`).
+It obtains libc++, libc++abi and compiler builtins from WASI SDK 25's LLVM revision
+`ab4b5a2db582958af1ee308a790cfdb42bd24720`, and wasi-libc revision
+`574b88da481569b65a237cb80daf9a2d5aeaf82d`. These are distinct LLVM inputs.
+Their primary license texts are retained, including LLVM exceptions and legacy
+NCSA terms. wasi-libc's umbrella references Apache/LLVM, Apache, MIT, cloudlibc
+BSD-2-Clause, musl MIT, musl-fts BSD-3-Clause and allocator notices; these referenced
+texts and allocator attribution headers are included.
+
+The recipe explicitly removes sysroot `share/` and VERSION (share/ was later
+confirmed to contain symbol/configuration data, not a standalone license bundle),
+and the distributed
+sysroot contains no standalone license/copyright files. It also selects Emscripten
+`latest`, with no immutable SDK revision or complete linked-host-library list.
+The compiler Wasm files contain no producer/custom metadata that resolves that
+version. Root LLVM notices explicitly defer to component/file-level third-party
+terms; copying only the root license is not a complete compiler notice bundle.
+
+**Historical C/C++ blockers (resolved by replacement):** obtain upstream provenance plus a complete notice/SBOM bundle,
+or rebuild from pinned LLVM, Emscripten and WASI inputs while preserving notices.
+Account for Emscripten glue, linked libc/libc++/allocator code, and LLVM's included
+third-party code. Compare any replacement hashes and rerun browser/size tests.
+The current CDN pointer does not make the missing attribution irrelevant.
+
+## Rust (removed 2026-10-29)
+
+An experimental Rust runtime was removed before release. Its compiler came
+from a fork whose custom backend commits carry no license of their own, so no
+license review could clear it. The owner chose not to seek one; any future Rust
+runtime would replace those commits with project-authored code. Its audit, notice
+corpus and evidence remain in git history on branch `codex/c-cpp-runtime`.
+
+## Distribution and generated user programs
+
+Retain upstream copyright/license texts and applicable NOTICE files; identify
+modified upstream files where required by their licenses. Our separately authored
+integration remains MIT. Upstream recipe modifications (sysroot rearrangement,
+added bits/stdc++.h and stripped sections) are not our original authorship and need provenance in any replacement distribution.
+
+Compiling a user's program does not by itself relicense its original source.
+Linked libc/libc++ and other runtime code have their own terms. LLVM's
+exception is relevant to embedded object code, not a blanket exemption for
+redistributing the compiler, unrelated libraries or all generated programs.
+Don't tell downstream users that every output is automatically MIT or obligation-free.
+
+## Release checklist / owner actions
+
+1. Keep C/C++ scoped to the rebuilt, verified hashes and notice companions.
+2. Publish complete, immutable compiler distributions with companion notices;
+   test the actual CDN compression, CORS and notice URLs. Current transfers are
+   measured with a local gzip mirror, not verified production hosting.
+3. Complete physical iPhone Safari and Android Chrome memory/lifecycle/cache
+   testing. Desktop Chromium, WebKit and Firefox pass 22 checks each.
+4. Run the packed React/bundler/CSP checks, and decide interactive-input scope.
+   See compiler-validation.md for the detailed non-license gates.
+
+Sources: immutable URLs for every retained text are in the manifest; the build
+recipe is [browsercc](https://github.com/BertalanD/browsercc/blob/86168bacf0fe7c662e3e65a2e3006ceb159cd0dc/build.sh),
+superseded by the pinned rebuild in `toolchains/cpp/`.
+
+Validation: notice hashes, 77 tests, typecheck, build and distribution checks pass.
+The npm dry-run (2026-10-29, after Rust's removal) contains all three audit
+companions (932,733 bytes compressed, 77 files). Local asset preparation copies
+them beside the toolchain. The combined release check fails until the owner
+approves release; the rebuilt C/C++ check passes; successful packaging is not
+release clearance.