sandboxedjs 0.1.26 → 0.1.28

package/dist/index.js

@@ -6806,7 +6806,7 @@ var NetworkStack = class {
     }
     return [...out.values()].sort((a, b) => a.port - b.port);
   }
-  /** Ports Nodepod's proxy has registered for this instance. */
+  /** Ports the pod's proxy has registered for this instance. */
   knownPodPorts() {
     try {
       return this.pod.proxy.activePorts(this.pod.instanceId) ?? [];
@@ -7332,15 +7332,15 @@ var Parser = class {
         if (this.isWord("-p")) this.next();
       }
     }
-    const commands11 = [this.parseCommand()];
+    const commands12 = [this.parseCommand()];
     const stderrToo = [];
     while (this.isOp("|") || this.isOp("|&")) {
       stderrToo.push(this.next().value === "|&");
       this.skipNewlines();
-      commands11.push(this.parseCommand());
+      commands12.push(this.parseCommand());
     }
-    if (commands11.length === 1 && !negated && !timed) return commands11[0];
-    return { type: "pipeline", commands: commands11, negated, stderrToo, timed };
+    if (commands12.length === 1 && !negated && !timed) return commands12[0];
+    return { type: "pipeline", commands: commands12, negated, stderrToo, timed };
   }
   // ── commands ─────────────────────────────────────────────────────────────
   parseCommand() {
@@ -16963,6 +16963,145 @@ var helpCmd = defineCommand({
 });
 var commands10 = [man, whatis, apropos, less, helpCmd];
 
+// src/bin/clipboard.ts
+init_path();
+var CLIPBOARD_DIR = "/run/clipboard";
+function selectionPath(selection) {
+  return join(CLIPBOARD_DIR, selection);
+}
+function readSelection(ctx, selection) {
+  try {
+    return ctx.vfs.readFile(selectionPath(selection), ctx.cred);
+  } catch {
+    return new Uint8Array();
+  }
+}
+function writeSelection(ctx, selection, bytes2) {
+  try {
+    ctx.vfs.mkdir(CLIPBOARD_DIR, { recursive: true, mode: 511 });
+  } catch {
+  }
+  ctx.vfs.writeFile(selectionPath(selection), bytes2, { privileged: true, mode: 438 });
+}
+var xsel = defineCommand({
+  name: "xsel",
+  summary: "access an X selection",
+  usage: "xsel [--clipboard|--primary|--secondary] [--input|--output|--clear]",
+  async run(ctx) {
+    let selection = "primary";
+    let mode = "output";
+    for (const arg of ctx.args) {
+      switch (arg) {
+        case "-b":
+        case "--clipboard":
+          selection = "clipboard";
+          break;
+        case "-p":
+        case "--primary":
+          selection = "primary";
+          break;
+        case "-s":
+        case "--secondary":
+          selection = "secondary";
+          break;
+        case "-i":
+        case "--input":
+        case "-a":
+        case "--append":
+          mode = "input";
+          break;
+        case "-o":
+        case "--output":
+          mode = "output";
+          break;
+        case "-c":
+        case "--clear":
+          mode = "clear";
+          break;
+      }
+    }
+    if (mode === "clear") {
+      writeSelection(ctx, selection, new Uint8Array());
+      return 0;
+    }
+    if (mode === "input") {
+      writeSelection(ctx, selection, await ctx.stdin.readAll());
+      return 0;
+    }
+    ctx.write(readSelection(ctx, selection));
+    return 0;
+  }
+});
+var xclip = defineCommand({
+  name: "xclip",
+  summary: "access an X selection",
+  usage: "xclip [-selection clipboard|primary|secondary] [-i|-o]",
+  async run(ctx) {
+    let selection = "primary";
+    let mode = "input";
+    const args = ctx.args;
+    for (let index = 0; index < args.length; index++) {
+      const arg = args[index];
+      if (arg === "-selection" || arg === "-sel" || arg === "--selection") {
+        const value = args[++index];
+        if (value === "clipboard" || value === "primary" || value === "secondary") selection = value;
+        continue;
+      }
+      if (arg === "-i" || arg === "-in") mode = "input";
+      else if (arg === "-o" || arg === "-out") mode = "output";
+    }
+    if (mode === "input") {
+      writeSelection(ctx, selection, await ctx.stdin.readAll());
+      return 0;
+    }
+    ctx.write(readSelection(ctx, selection));
+    return 0;
+  }
+});
+var pbcopy = defineCommand({
+  name: "pbcopy",
+  summary: "copy standard input to the clipboard",
+  usage: "pbcopy",
+  async run(ctx) {
+    writeSelection(ctx, "clipboard", await ctx.stdin.readAll());
+    return 0;
+  }
+});
+var pbpaste = defineCommand({
+  name: "pbpaste",
+  summary: "write the clipboard to standard output",
+  usage: "pbpaste",
+  run(ctx) {
+    ctx.write(readSelection(ctx, "clipboard"));
+    return 0;
+  }
+});
+var wlCopy = defineCommand({
+  name: "wl-copy",
+  summary: "copy standard input to the Wayland clipboard",
+  usage: "wl-copy [--primary] [text...]",
+  async run(ctx) {
+    const selection = ctx.args.includes("--primary") || ctx.args.includes("-p") ? "primary" : "clipboard";
+    const operands = ctx.args.filter((arg) => !arg.startsWith("-"));
+    const bytes2 = operands.length ? new TextEncoder().encode(operands.join(" ")) : await ctx.stdin.readAll();
+    writeSelection(ctx, selection, bytes2);
+    return 0;
+  }
+});
+var wlPaste = defineCommand({
+  name: "wl-paste",
+  summary: "write the Wayland clipboard to standard output",
+  usage: "wl-paste [--primary] [-n]",
+  run(ctx) {
+    const selection = ctx.args.includes("--primary") || ctx.args.includes("-p") ? "primary" : "clipboard";
+    const bytes2 = readSelection(ctx, selection);
+    ctx.write(bytes2);
+    if (!ctx.args.includes("-n") && !ctx.args.includes("--no-newline")) ctx.write("\n");
+    return 0;
+  }
+});
+var commands11 = [xsel, xclip, pbcopy, pbpaste, wlCopy, wlPaste];
+
 // src/runtime/node.ts
 init_path();
 var NODE_VERSION = "v22.12.0";
@@ -18163,7 +18302,33 @@ function ffmpegCommands() {
   return [ffmpeg, ffprobe];
 }
 var platformBuffer = globalThis.Buffer;
-var Buffer2 = platformBuffer ?? Buffer$1;
+var Buffer2 = platformBuffer ?? addBase64UrlSupport(Buffer$1);
+function addBase64UrlSupport(BufferClass) {
+  const target = BufferClass;
+  if (target.__sandboxedBase64Url) return BufferClass;
+  Object.defineProperty(target, "__sandboxedBase64Url", { value: true });
+  const from = target.from.bind(target);
+  target.from = (value, encodingOrOffset, length) => from(value, normalizeEncoding(encodingOrOffset), length);
+  const byteLength = target.byteLength.bind(target);
+  target.byteLength = (value, encoding) => byteLength(value, normalizeEncoding(encoding));
+  const isEncoding = target.isEncoding?.bind(target);
+  if (isEncoding) target.isEncoding = (encoding) => encoding.toLowerCase() === "base64url" || isEncoding(encoding);
+  const toString = target.prototype.toString;
+  target.prototype.toString = function(encoding, start2, end) {
+    if (encoding?.toLowerCase() !== "base64url") return toString.call(this, encoding, start2, end);
+    return toString.call(this, "base64", start2, end).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  };
+  const write = target.prototype.write;
+  target.prototype.write = function(...args) {
+    const index = typeof args[1] === "string" ? 1 : typeof args[2] === "string" ? 2 : 3;
+    if (typeof args[index] === "string") args[index] = normalizeEncoding(args[index]);
+    return write.apply(this, args);
+  };
+  return BufferClass;
+}
+function normalizeEncoding(value) {
+  return typeof value === "string" && value.toLowerCase() === "base64url" ? "base64" : value;
+}
 
 // src/pkg/clean-installer.ts
 init_path();
@@ -18205,6 +18370,9 @@ var CleanPackageInstaller = class _CleanPackageInstaller {
     const version = resolveVersion(metadata, range);
     const manifest = metadata.versions[version];
     if (!manifest) throw new Error(`No matching version found for ${name}@${range}`);
+    if (!supportsPlatform(manifest)) {
+      throw new Error(`${name}@${version} is not compatible with linux/x64/glibc`);
+    }
     const identity = `${name}@${version}`;
     const target = join(modulesRoot, name);
     const installed2 = this.tryReadJson(join(target, "package.json"));
@@ -18299,6 +18467,15 @@ var CleanPackageInstaller = class _CleanPackageInstaller {
     }
   }
 };
+function supportsPlatform(manifest) {
+  return !manifest.main?.endsWith(".node") && platformListAllows(manifest.os, "linux") && platformListAllows(manifest.cpu, "x64") && platformListAllows(manifest.libc, "glibc");
+}
+function platformListAllows(values, current) {
+  if (!values?.length) return true;
+  if (values.includes(`!${current}`)) return false;
+  const positive = values.filter((value) => !value.startsWith("!"));
+  return positive.length === 0 || positive.includes(current) || positive.includes("any");
+}
 function resolveVersion(metadata, range) {
   const tag2 = metadata["dist-tags"]?.[range];
   if (tag2) return tag2;
@@ -19281,6 +19458,7 @@ function allCommands() {
     ...commands8,
     ...commands9,
     ...commands10,
+    ...commands11,
     ...nodeCommands(),
     ...pythonCommands(),
     ...ffmpegCommands(),
@@ -19577,6 +19755,13 @@ var KernelChildProcess = class {
     } catch {
     }
   }
+  /** Signal EOF, so a child reading stdin to the end can finish. */
+  endStdin() {
+    try {
+      this.stdin.end();
+    } catch {
+    }
+  }
   kill(signal = "SIGTERM") {
     if (this.process) {
       this.process.deliver(signal);
@@ -20488,6 +20673,55 @@ function splitSpecifier(specifier) {
   return { name: parts.slice(0, size).join("/"), subpath: parts.slice(size).join("/") };
 }
 
+// src/runtime/readable-from.ts
+function createReadableFrom(Readable) {
+  return function from(source, options = {}) {
+    if (source && typeof source.pipe === "function") return source;
+    const iterator = source && typeof source[Symbol.asyncIterator] === "function" ? source[Symbol.asyncIterator]() : source && typeof source[Symbol.iterator] === "function" ? source[Symbol.iterator]() : (function* () {
+      yield source;
+    })();
+    let reading = false;
+    const stream = new Readable({
+      ...options,
+      objectMode: options.objectMode ?? false,
+      read() {
+        if (reading) return;
+        reading = true;
+        void (async () => {
+          try {
+            for (; ; ) {
+              const next = await iterator.next();
+              if (next.done) {
+                stream.push(null);
+                return;
+              }
+              const value = next.value;
+              if (!stream.push(value === void 0 ? null : value)) return;
+            }
+          } catch (error) {
+            stream.destroy(error);
+          } finally {
+            reading = false;
+          }
+        })();
+      },
+      destroy(error, callback) {
+        void (async () => {
+          try {
+            await iterator.return?.();
+          } catch {
+          }
+          callback(error);
+        })();
+      }
+    });
+    return stream;
+  };
+}
+function installReadableFrom(streamModule5) {
+  streamModule5.Readable.from = createReadableFrom(streamModule5.Readable);
+}
+
 // src/runtime/util-module.ts
 var customInspect = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
 var promisifyCustom = /* @__PURE__ */ Symbol.for("nodejs.util.promisify.custom");
@@ -21375,6 +21609,10 @@ var VirtualHttpRouter = class {
   unregister(port, server) {
     if (this.servers.get(port)?.server === server) this.servers.delete(port);
   }
+  /** Whether anything in this container is listening on `port`. */
+  activePortsIncludes(port) {
+    return this.servers.has(port);
+  }
   activePorts(owner) {
     return [...this.servers].filter(([, item]) => owner === void 0 || item.owner === owner).map(([port]) => port).sort((a, b) => a - b);
   }
@@ -21398,13 +21636,269 @@ var VirtualHttpRouter = class {
     }
   }
 };
-function createHttpModule(router, owner) {
+var VirtualClientResponse = class extends streamModule4.Readable {
+  constructor(statusCode, statusMessage, headers, body) {
+    super();
+    this.statusCode = statusCode;
+    this.statusMessage = statusMessage;
+    this.headers = headers;
+    this.rawHeaders = Object.entries(headers).flatMap(([key, value]) => [key, value]);
+    if (body.length) this.push(Buffer2.from(body));
+    this.push(null);
+    this.complete = true;
+  }
+  statusCode;
+  statusMessage;
+  headers;
+  httpVersion = "1.1";
+  httpVersionMajor = 1;
+  httpVersionMinor = 1;
+  socket = socketStub();
+  connection = this.socket;
+  rawHeaders;
+  complete = false;
+  _read() {
+  }
+  setTimeout(_milliseconds, callback) {
+    if (callback) this.once("timeout", callback);
+    return this;
+  }
+};
+function resolveTarget(input, overrides, defaultProtocol) {
+  const options = {};
+  if (typeof input === "string" || input instanceof URL) {
+    const url = new URL(String(input));
+    options.protocol = url.protocol;
+    options.hostname = url.hostname;
+    if (url.port) options.port = Number(url.port);
+    options.path = `${url.pathname}${url.search}`;
+    if (url.username || url.password) options.auth = `${url.username}:${url.password}`;
+  } else if (input && typeof input === "object") {
+    Object.assign(options, input);
+  }
+  if (overrides) Object.assign(options, overrides);
+  const protocol = String(options.protocol ?? defaultProtocol).replace(/:?$/, ":");
+  const headers = {};
+  for (const [name, value] of Object.entries(options.headers ?? {})) {
+    if (value === void 0 || value === null) continue;
+    headers[String(name)] = Array.isArray(value) ? value.join(", ") : String(value);
+  }
+  if (options.auth && headers.authorization === void 0) {
+    headers.authorization = `Basic ${Buffer2.from(String(options.auth)).toString("base64")}`;
+  }
+  const rawHost = String(options.hostname ?? options.host ?? "localhost");
+  const hostMatch = /^(\[[^\]]*\]|[^:]*)(?::(\d+))?$/.exec(rawHost);
+  const hostname = (hostMatch?.[1] ?? rawHost).replace(/^\[|\]$/g, "");
+  const explicitPort = options.port ?? hostMatch?.[2];
+  const port = explicitPort === void 0 || explicitPort === null || explicitPort === "" || Number.isNaN(Number(explicitPort)) ? protocol === "https:" ? 443 : 80 : Number(explicitPort);
+  return {
+    protocol,
+    hostname,
+    port,
+    path: String(options.path ?? "/"),
+    method: String(options.method ?? "GET").toUpperCase(),
+    headers
+  };
+}
+function isLoopback(hostname) {
+  return hostname === "localhost" || hostname === "0.0.0.0" || hostname === "::1" || hostname === "::" || hostname.startsWith("127.") || hostname.endsWith(".localhost");
+}
+var VirtualClientRequest = class extends streamModule4.Writable {
+  constructor(target, router, fetchImpl, trackRequest) {
+    super();
+    this.target = target;
+    this.router = router;
+    this.fetchImpl = fetchImpl;
+    this.trackRequest = trackRequest;
+    for (const [name, value] of Object.entries(target.headers)) this.setHeader(name, value);
+  }
+  target;
+  router;
+  fetchImpl;
+  trackRequest;
+  socket = socketStub();
+  connection = this.socket;
+  chunks = [];
+  headerMap = /* @__PURE__ */ new Map();
+  dispatched = false;
+  destroyedByUser = false;
+  timer;
+  aborted = false;
+  finished = false;
+  reusedSocket = false;
+  get method() {
+    return this.target.method;
+  }
+  get path() {
+    return this.target.path;
+  }
+  get host() {
+    return this.target.hostname;
+  }
+  get protocol() {
+    return this.target.protocol;
+  }
+  setHeader(name, value) {
+    validateHeaderName(name);
+    validateHeaderValue(name, value);
+    this.headerMap.set(name.toLowerCase(), { name, value: Array.isArray(value) ? [...value].map(String).join(", ") : String(value) });
+    return this;
+  }
+  getHeader(name) {
+    return this.headerMap.get(name.toLowerCase())?.value;
+  }
+  getHeaders() {
+    return Object.fromEntries([...this.headerMap].map(([key, entry]) => [key, entry.value]));
+  }
+  getHeaderNames() {
+    return [...this.headerMap.keys()];
+  }
+  hasHeader(name) {
+    return this.headerMap.has(name.toLowerCase());
+  }
+  removeHeader(name) {
+    this.headerMap.delete(name.toLowerCase());
+  }
+  flushHeaders() {
+  }
+  setNoDelay() {
+  }
+  setSocketKeepAlive() {
+  }
+  ref() {
+    return this;
+  }
+  unref() {
+    return this;
+  }
+  setTimeout(milliseconds, callback) {
+    if (callback) this.once("timeout", callback);
+    clearTimeout(this.timer);
+    this.timer = setTimeout(() => this.emit("timeout"), milliseconds);
+    return this;
+  }
+  abort() {
+    this.destroyRequest();
+  }
+  destroy(error) {
+    this.destroyRequest(error);
+    return this;
+  }
+  destroyRequest(error) {
+    if (this.destroyedByUser) return;
+    this.destroyedByUser = true;
+    this.aborted = true;
+    clearTimeout(this.timer);
+    this.emit("abort");
+    if (error) this.emit("error", error);
+    this.emit("close");
+  }
+  _write(chunk, encoding, callback) {
+    this.chunks.push(Buffer2.isBuffer(chunk) ? chunk : Buffer2.from(chunk, encoding));
+    callback();
+  }
+  _final(callback) {
+    this.finished = true;
+    callback();
+    void this.dispatch();
+  }
+  async dispatch() {
+    if (this.dispatched || this.destroyedByUser) return;
+    this.dispatched = true;
+    const body = Buffer2.concat(this.chunks);
+    const release = this.trackRequest?.();
+    let released = false;
+    const untrack = () => {
+      if (released || !release) return;
+      released = true;
+      release();
+    };
+    let settled = false;
+    try {
+      const response = this.router.activePortsIncludes(this.target.port) && isLoopback(this.target.hostname) ? await this.viaRouter(body) : await this.viaFetch(body);
+      if (this.destroyedByUser) return;
+      clearTimeout(this.timer);
+      settled = true;
+      response.once("end", untrack);
+      response.once("close", untrack);
+      response.once("error", untrack);
+      this.emit("response", response);
+      queueMicrotask(() => {
+        if (this.listenerCount("response") === 0) response.resume();
+      });
+    } catch (error) {
+      clearTimeout(this.timer);
+      if (this.destroyedByUser) return;
+      const failure = error instanceof Error ? error : new Error(String(error));
+      if (!("code" in failure)) Object.assign(failure, { code: "ECONNREFUSED" });
+      this.emit("error", failure);
+    } finally {
+      if (!settled) untrack();
+    }
+  }
+  async viaRouter(body) {
+    const result = await this.router.request(this.target.port, {
+      method: this.target.method,
+      path: this.target.path,
+      headers: this.getHeaders(),
+      body: body.length ? new Uint8Array(body) : null
+    });
+    const body_ = result.body;
+    const bytes2 = typeof body_ === "string" ? new TextEncoder().encode(body_) : body_ instanceof ArrayBuffer ? new Uint8Array(body_) : body_ ?? new Uint8Array();
+    const status = result.statusCode ?? 200;
+    return new VirtualClientResponse(status, result.statusMessage ?? STATUS_CODES[status] ?? "", lowercaseHeaders(result.headers), bytes2);
+  }
+  async viaFetch(body) {
+    const fetchImpl = this.fetchImpl ?? globalThis.fetch;
+    if (typeof fetchImpl !== "function") {
+      throw Object.assign(new Error(`getaddrinfo ENOTFOUND ${this.target.hostname}`), { code: "ENOTFOUND" });
+    }
+    const portSuffix = this.target.protocol === "https:" && this.target.port === 443 || this.target.protocol === "http:" && this.target.port === 80 ? "" : `:${this.target.port}`;
+    const url = `${this.target.protocol}//${this.target.hostname}${portSuffix}${this.target.path}`;
+    const bodyless = this.target.method === "GET" || this.target.method === "HEAD";
+    const headers = this.getHeaders();
+    delete headers.host;
+    delete headers.connection;
+    delete headers["content-length"];
+    const response = await fetchImpl(url, {
+      method: this.target.method,
+      headers,
+      ...bodyless || body.length === 0 ? {} : { body: new Uint8Array(body) },
+      redirect: "follow"
+    });
+    const received = {};
+    response.headers.forEach((value, key) => {
+      received[key.toLowerCase()] = value;
+    });
+    const bytes2 = new Uint8Array(await response.arrayBuffer());
+    return new VirtualClientResponse(response.status, response.statusText, received, bytes2);
+  }
+};
+function lowercaseHeaders(headers) {
+  return Object.fromEntries(Object.entries(headers ?? {}).map(([key, value]) => [key.toLowerCase(), String(value)]));
+}
+function createHttpModule(router, owner, options = {}, defaultProtocol = "http:") {
   const createServer = (listener) => new VirtualHttpServer(router, owner, listener);
-  const module = {
+  const request = (input, second, third) => {
+    const overrides = second && typeof second === "object" && !(second instanceof Function) ? second : void 0;
+    const callback = [second, third].find((value) => typeof value === "function");
+    const req = new VirtualClientRequest(resolveTarget(input, overrides, defaultProtocol), router, options.fetch, options.trackRequest);
+    if (callback) req.on("response", callback);
+    return req;
+  };
+  const get = (input, second, third) => {
+    const req = request(input, second, third);
+    req.end();
+    return req;
+  };
+  return {
     createServer,
+    request,
+    get,
     Server: VirtualHttpServer,
     ServerResponse: VirtualServerResponse,
     IncomingMessage: VirtualIncomingMessage,
+    ClientRequest: VirtualClientRequest,
     METHODS,
     STATUS_CODES,
     maxHeaderSize: 16 * 1024,
@@ -21414,10 +21908,6 @@ function createHttpModule(router, owner) {
     Agent: class Agent {
     }
   };
-  return { ...module, request: unsupportedClient, get: unsupportedClient };
-}
-function unsupportedClient() {
-  throw Object.assign(new Error("http client requests are not implemented yet"), { code: "ERR_NOT_IMPLEMENTED" });
 }
 function validateHeaderName(name) {
   if (!/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name)) throw Object.assign(new TypeError(`Header name must be a valid HTTP token [${name}]`), { code: "ERR_INVALID_HTTP_TOKEN" });
@@ -21557,6 +22047,13 @@ var ChildProcess = class extends EventEmitter4 {
         } catch {
         }
         done();
+      },
+      final: (done) => {
+        try {
+          handle.endStdin?.();
+        } catch {
+        }
+        done();
       }
     });
     this.stdio = [this.stdin, this.stdout, this.stderr];
@@ -21795,7 +22292,7 @@ function emitKeypressEvents(stream) {
     }
   });
 }
-function createReadlineModule(defaultInput) {
+function createReadlineModule(defaultInput, defaultOutput = () => void 0) {
   class Interface extends EventEmitter4 {
     constructor(input, output, terminal = false) {
       super();
@@ -21806,6 +22303,14 @@ function createReadlineModule(defaultInput) {
       if (terminal) {
         emitKeypressEvents(input);
         input?.on?.("keypress", this.onTerminalKeypress);
+        if (typeof input?.setRawMode === "function") {
+          try {
+            input.setRawMode(true);
+            this.ownsRawMode = true;
+          } catch {
+          }
+        }
+        input?.resume?.();
       } else {
         input?.on?.("data", (chunk) => this.receive(String(chunk)));
       }
@@ -21817,6 +22322,10 @@ function createReadlineModule(defaultInput) {
     buffer = "";
     pending = [];
     lines = [];
+    /** Set while `question` is waiting, so the echoed line carries the query. */
+    questionPrompt = null;
+    /** Raw mode is only ours to restore if we were the one to enable it. */
+    ownsRawMode = false;
     line = "";
     cursor = 0;
     terminal;
@@ -21824,20 +22333,31 @@ function createReadlineModule(defaultInput) {
     /** Split incoming data into lines, answering any waiting `question`. */
     receive(text2) {
       this.buffer += text2;
-      let newline = this.buffer.indexOf("\n");
-      while (newline >= 0) {
-        const line = this.buffer.slice(0, newline).replace(/\r$/, "");
-        this.buffer = this.buffer.slice(newline + 1);
-        const waiting = this.pending.shift();
-        if (waiting) waiting(line);
-        else {
-          this.lines.push(line);
-          this.emit("line", line);
-        }
-        newline = this.buffer.indexOf("\n");
+      let match2 = /\r\n|\r|\n/.exec(this.buffer);
+      while (match2) {
+        const line = this.buffer.slice(0, match2.index);
+        this.buffer = this.buffer.slice(match2.index + match2[0].length);
+        this.deliver(line);
+        match2 = /\r\n|\r|\n/.exec(this.buffer);
+      }
+    }
+    /** Hand a completed line to whoever is waiting for it. */
+    deliver(line) {
+      const waiting = this.pending.shift();
+      if (waiting) {
+        this.questionPrompt = null;
+        waiting(line);
+        return;
       }
+      this.lines.push(line);
+      this.emit("line", line);
     }
     question(query, callback) {
+      if (this.terminal) {
+        this.questionPrompt = query;
+        this.line = "";
+        this.cursor = 0;
+      }
       this.output?.write?.(query);
       if (callback) {
         this.pending.push(callback);
@@ -21852,6 +22372,9 @@ function createReadlineModule(defaultInput) {
     setPrompt(text2) {
       this.promptText = text2;
     }
+    getPrompt() {
+      return this.promptText;
+    }
     pause() {
       this.input?.pause?.();
       return this;
@@ -21879,21 +22402,48 @@ function createReadlineModule(defaultInput) {
       if (text2) {
         this.line = this.line.slice(0, this.cursor) + text2 + this.line.slice(this.cursor);
         this.cursor += text2.length;
+        this.refresh();
       }
     }
     getCursorPos() {
-      return { rows: 0, cols: this.cursor + this.promptText.length };
+      return { rows: 0, cols: this.cursor + this.currentPrompt().length };
     }
     close() {
       if (this.closed) return;
       this.closed = true;
       if (this.terminal) {
         this.input?.off?.("keypress", this.onTerminalKeypress);
+        if (this.ownsRawMode) {
+          this.ownsRawMode = false;
+          try {
+            this.input?.setRawMode?.(false);
+          } catch {
+          }
+        }
         this.input?.pause?.();
       }
       for (const waiting of this.pending.splice(0)) waiting("");
       this.emit("close");
     }
+    /** The text shown to the left of the edited line. */
+    currentPrompt() {
+      return this.questionPrompt ?? this.promptText;
+    }
+    /**
+     * Repaint the edited line.
+     *
+     * In raw mode nothing echoes on its own, so an Interface that does not do
+     * this leaves the user typing blind. Libraries that draw their own frame
+     * (clack, inquirer) simply overwrite this, exactly as they do on Node.
+     */
+    refresh() {
+      if (!this.terminal) return;
+      const prompt = this.currentPrompt();
+      let text2 = `\r\x1B[0K${prompt}${this.line}`;
+      const back = this.line.length - this.cursor;
+      if (back > 0) text2 += `\x1B[${back}D`;
+      this.output?.write?.(text2);
+    }
     edit(sequence, key) {
       if (this.closed) return;
       const name = key.name;
@@ -21901,48 +22451,62 @@ function createReadlineModule(defaultInput) {
         const value = this.line;
         this.line = "";
         this.cursor = 0;
-        this.emit("line", value);
+        this.output?.write?.("\r\n");
+        this.deliver(value);
         return;
       }
       if (name === "left") {
         this.cursor = Math.max(0, this.cursor - 1);
+        this.refresh();
         return;
       }
       if (name === "right") {
         this.cursor = Math.min(this.line.length, this.cursor + 1);
+        this.refresh();
         return;
       }
       if (name === "home" || key.ctrl && name === "a") {
         this.cursor = 0;
+        this.refresh();
         return;
       }
       if (name === "end" || key.ctrl && name === "e") {
         this.cursor = this.line.length;
+        this.refresh();
         return;
       }
       if (name === "backspace" || key.ctrl && name === "h") {
         if (this.cursor > 0) {
           this.line = this.line.slice(0, this.cursor - 1) + this.line.slice(this.cursor);
           this.cursor--;
+          this.refresh();
         }
         return;
       }
       if (name === "delete") {
-        if (this.cursor < this.line.length) this.line = this.line.slice(0, this.cursor) + this.line.slice(this.cursor + 1);
+        if (this.cursor < this.line.length) {
+          this.line = this.line.slice(0, this.cursor) + this.line.slice(this.cursor + 1);
+          this.refresh();
+        }
         return;
       }
       if (key.ctrl && name === "u") {
         this.line = this.line.slice(this.cursor);
         this.cursor = 0;
+        this.refresh();
         return;
       }
       if (key.ctrl && name === "k") {
         this.line = this.line.slice(0, this.cursor);
+        this.refresh();
         return;
       }
       if (key.ctrl || key.meta || sequence.length !== 1 || sequence < " ") return;
+      const atEnd = this.cursor === this.line.length;
       this.line = this.line.slice(0, this.cursor) + sequence + this.line.slice(this.cursor);
       this.cursor += sequence.length;
+      if (atEnd) this.output?.write?.(sequence);
+      else this.refresh();
     }
     async *[Symbol.asyncIterator]() {
       while (!this.closed || this.lines.length) {
@@ -21972,13 +22536,23 @@ function createReadlineModule(defaultInput) {
       }
     }
   }
+  const isTerminal = (options, output) => {
+    if (typeof options?.terminal === "boolean") return options.terminal;
+    return Boolean(output?.isTTY);
+  };
   const createInterface = (options, output) => {
     if (options && typeof options === "object" && !options.on) {
-      const instance = new Interface(options.input ?? defaultInput(), options.output, options.terminal === true);
+      const resolvedOutput2 = options.output ?? defaultOutput();
+      const instance = new Interface(
+        options.input ?? defaultInput(),
+        resolvedOutput2,
+        isTerminal(options, resolvedOutput2)
+      );
       if (typeof options.prompt === "string") instance.setPrompt(options.prompt);
       return instance;
     }
-    return new Interface(options ?? defaultInput(), output, Boolean(output));
+    const resolvedOutput = output ?? defaultOutput();
+    return new Interface(options ?? defaultInput(), resolvedOutput, isTerminal(void 0, resolvedOutput));
   };
   const noop = () => {
   };
@@ -21995,6 +22569,7 @@ function createReadlineModule(defaultInput) {
 }
 
 // src/runtime/core-modules.ts
+installReadableFrom(streamModule4);
 var Dirent = class {
   /** Node 20+ exposes the containing directory, and `fs.glob` consumers read it. */
   constructor(name, stat2, parentPath = "") {
@@ -22200,9 +22775,20 @@ function createCoreModules(options) {
       throw new Error("createRequire is only available inside a loaded module");
     }
   };
-  const http = options.http ? createHttpModule(options.http.router, options.http.owner) : createUnsupportedModule("http");
+  let inFlightRequests = 0;
+  const httpOptions = {
+    ...options.http?.fetch ? { fetch: options.http.fetch } : {},
+    trackRequest: () => {
+      inFlightRequests++;
+      return () => {
+        inFlightRequests--;
+      };
+    }
+  };
+  const http = options.http ? createHttpModule(options.http.router, options.http.owner, httpOptions, "http:") : createUnsupportedModule("http");
+  const https = options.http ? createHttpModule(options.http.router, options.http.owner, httpOptions, "https:") : createUnsupportedModule("https");
   const childProcess = options.spawnChild ? createChildProcessModule(options.spawnChild, () => cwd) : createUnsupportedModule("child_process");
-  const readline = createReadlineModule(() => processObject.stdin);
+  const readline = createReadlineModule(() => processObject.stdin, () => processObject.stdout);
   const dns = createDnsModule();
   const builtins = {
     assert: assert_module_default,
@@ -22220,7 +22806,7 @@ function createCoreModules(options) {
     "fs/promises": fs.promises,
     module: moduleBuiltin,
     http,
-    https: http,
+    https,
     os,
     path,
     "path/posix": path,
@@ -22259,6 +22845,9 @@ function createCoreModules(options) {
     globals,
     process: processObject,
     pendingHandles: timers.pending,
+    pendingUnrefed: timers.pendingUnrefed,
+    /** Client requests sent but not yet read to completion. */
+    pendingRequests: () => inFlightRequests,
     writeStdin: (data) => {
       if (options.interactiveStdin) stdin.write(data);
     },
@@ -22486,9 +23075,20 @@ function createFsModule(volume, cwd, stdinPath) {
       if (position == null) file3.position = start2 + chunk.length;
       return chunk.length;
     },
-    createReadStream: (path) => {
-      const data = Buffer2.from(volume.readFileSync(resolveLinks(volume, abs(path))));
-      return streamModule4.Readable.from([data]);
+    createReadStream: (path, options) => {
+      const target = abs(path);
+      const settings = typeof options === "string" ? { encoding: options } : options ?? {};
+      const whole = Buffer2.from(volume.readFileSync(resolveLinks(volume, target)));
+      const start2 = settings.start ?? 0;
+      const end = settings.end === void 0 ? whole.length : Math.min(settings.end + 1, whole.length);
+      const slice = whole.subarray(start2, Math.max(start2, end));
+      const stream = streamModule4.Readable.from([settings.encoding ? slice.toString(settings.encoding) : slice]);
+      Object.assign(stream, { path: target, bytesRead: slice.length, close: () => stream.destroy() });
+      queueMicrotask(() => {
+        stream.emit("open", 0);
+        stream.emit("ready");
+      });
+      return stream;
     },
     createWriteStream: (path, options) => {
       const target = abs(path);
@@ -22854,33 +23454,78 @@ var ERRNO_CONSTANTS = {
 };
 function createTrackedTimers() {
   const live = /* @__PURE__ */ new Set();
-  const track = (handle, repeating) => {
+  const unrefed = /* @__PURE__ */ new Set();
+  const states = /* @__PURE__ */ new WeakMap();
+  const track = (native) => {
+    const state = { native, active: true, referenced: true };
+    const handle = {
+      ref() {
+        state.referenced = true;
+        unrefed.delete(handle);
+        if (state.active) live.add(handle);
+        state.native?.ref?.();
+        return handle;
+      },
+      unref() {
+        state.referenced = false;
+        live.delete(handle);
+        if (state.active) unrefed.add(handle);
+        state.native?.unref?.();
+        return handle;
+      },
+      hasRef: () => state.referenced,
+      refresh() {
+        state.native?.refresh?.();
+        return handle;
+      },
+      [Symbol.toPrimitive]: () => Number(state.native)
+    };
+    states.set(handle, state);
     live.add(handle);
     return handle;
   };
+  const complete = (handle) => {
+    const state = states.get(handle);
+    if (state) state.active = false;
+    live.delete(handle);
+    unrefed.delete(handle);
+  };
   const setTimeoutTracked = (fn, delay, ...args) => {
-    const handle = setTimeout(
+    let handle;
+    const native = setTimeout(
       (...inner) => {
-        live.delete(handle);
+        complete(handle);
         fn(...inner);
       },
       delay,
       ...args
     );
-    live.add(handle);
+    handle = track(native);
     return handle;
   };
   const setIntervalTracked = (fn, delay, ...args) => track(setInterval(fn, delay, ...args));
   const hostSetImmediate = globalThis.setImmediate;
   const setImmediateTracked = (fn, ...args) => {
-    const handle = hostSetImmediate ? hostSetImmediate((...inner) => {
-      live.delete(handle);
+    if (!hostSetImmediate) return setTimeoutTracked(fn, 0, ...args);
+    let handle;
+    const native = hostSetImmediate((...inner) => {
+      complete(handle);
       fn(...inner);
-    }, ...args) : setTimeoutTracked(fn, 0, ...args);
-    live.add(handle);
+    }, ...args);
+    handle = track(native);
     return handle;
   };
   const clear2 = (handle, native) => {
+    if (typeof handle === "object" && handle !== null) {
+      const state = states.get(handle);
+      if (state) {
+        state.active = false;
+        live.delete(handle);
+        unrefed.delete(handle);
+        native(state.native);
+        return;
+      }
+    }
     live.delete(handle);
     native(handle);
   };
@@ -22893,7 +23538,8 @@ function createTrackedTimers() {
       clearInterval: (handle) => clear2(handle, clearInterval),
       clearImmediate: (handle) => clear2(handle, globalThis.clearImmediate ?? clearTimeout)
     },
-    pending: () => live.size
+    pending: () => live.size,
+    pendingUnrefed: () => unrefed.size
   };
 }
 function createTimerPromises() {
@@ -23415,7 +24061,26 @@ function ensureProcessGlobal() {
   });
 }
 
+// src/runtime/host-rolldown.ts
+async function loadHostRolldownBinding() {
+  if (typeof window !== "undefined" && globalThis.crossOriginIsolated !== true) {
+    throw new Error(
+      "Vite 8/Rolldown requires cross-origin isolation. Serve the app with Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp headers."
+    );
+  }
+  try {
+    const loaded = await import('@rolldown/binding-wasm32-wasi');
+    return "__fs" in loaded ? { ...loaded } : loaded.default ?? loaded;
+  } catch (error) {
+    if (typeof process !== "undefined" && process.env?.SANDBOXEDJS_DEBUG) {
+      console.error("[sandboxedjs] Rolldown WASI binding unavailable:", error);
+    }
+    throw new Error("The optional Rolldown WASI binding could not be loaded.", { cause: error });
+  }
+}
+
 // src/runtime/local-runtime-pod.ts
+init_path();
 var WASM_ALIASES = {
   esbuild: "esbuild-wasm",
   rollup: "@rollup/wasm-node"
@@ -23540,6 +24205,11 @@ var PodChildProcess = class {
   started = false;
   cancelled = false;
   child;
+  /* The child is launched asynchronously, but a parent may write and close
+   * its input synchronously right after spawning. Holding both until the
+   * child exists is what keeps `echo hi | child` from losing the `hi`. */
+  pendingInput = "";
+  inputEnded = false;
   on(event, listener) {
     let set = this.listeners.get(event);
     if (!set) this.listeners.set(event, set = /* @__PURE__ */ new Set());
@@ -23562,6 +24232,11 @@ var PodChildProcess = class {
         (child) => {
           this.child = child;
           if (this.cancelled) child.kill();
+          if (this.pendingInput !== "") {
+            child.write(this.pendingInput);
+            this.pendingInput = "";
+          }
+          if (this.inputEnded) child.endInput?.();
           child.on("output", (text2) => {
             this.stdout += text2;
             this.emit("stdout", text2);
@@ -23584,7 +24259,13 @@ var PodChildProcess = class {
     });
   }
   sendStdin(data) {
-    this.child?.write(data);
+    if (this.child) this.child.write(data);
+    else this.pendingInput += data;
+  }
+  /** Signal EOF, so a child reading stdin to the end can finish. */
+  endStdin() {
+    if (this.child) this.child.endInput?.();
+    else this.inputEnded = true;
   }
   kill(signal = "SIGTERM") {
     if (this.child) this.child.kill(signal);
@@ -23666,6 +24347,9 @@ var LocalRuntimePod = class _LocalRuntimePod {
   aliases;
   modules;
   esbuild;
+  rolldownBinding;
+  /** Backs outbound `http`/`https` client requests from inside the sandbox. */
+  fetch;
   constructor(options) {
     ensureProcessGlobal();
     this.workdir = options.workdir ?? "/";
@@ -23680,6 +24364,7 @@ var LocalRuntimePod = class _LocalRuntimePod {
       const notify = options.onServerReady;
       this.router.onListen = (port) => notify(port, `http://localhost:${port}`);
     }
+    if (options.fetch) this.fetch = options.fetch;
     this.packages = new CleanPackageInstaller(this.volume, {
       cwd: this.workdir,
       ...options.registry ? { registry: options.registry } : {},
@@ -23699,6 +24384,7 @@ var LocalRuntimePod = class _LocalRuntimePod {
     const env2 = { ...this.env, ...isRecord(options.env) ? options.env : {} };
     const owner = `${this.instanceId}:${Math.random().toString(36).slice(2)}`;
     return new LocalProcess(async (proc) => {
+      await this.prepareRolldown(cwd, env2);
       const untrack = trackProcess(proc);
       let requestedExit = 0;
       let engine;
@@ -23718,7 +24404,7 @@ var LocalRuntimePod = class _LocalRuntimePod {
           proc.exitNow(code);
           if (engine?.isEvaluating) throw new ProcessExit(code);
         },
-        http: { router: this.router, owner },
+        http: { router: this.router, owner, ...this.fetch ? { fetch: this.fetch } : {} },
         spawnChild: (config) => this.processManager.spawn(config),
         ...typeof options.stdinPath === "string" ? { stdinPath: options.stdinPath } : {},
         ...options.interactiveStdin ? { interactiveStdin: true } : {},
@@ -23735,7 +24421,7 @@ var LocalRuntimePod = class _LocalRuntimePod {
       });
       try {
         await engine.run(script);
-        await this.settle(owner, core.pendingHandles, core.readingStdin);
+        await this.settle(owner, core.pendingHandles, core.pendingUnrefed, core.readingStdin, core.pendingRequests);
         if (this.router.activePorts(owner).length) {
           await proc.waitForKill();
           return 137;
@@ -23747,6 +24433,25 @@ var LocalRuntimePod = class _LocalRuntimePod {
       }
     });
   }
+  /**
+   * Rolldown's JavaScript API synchronously requires its compiled binding.
+   * When a project contains Rolldown, preload the official WASI build in the
+   * host and expose it through the module override table before evaluation.
+   * Keeping this demand-driven avoids adding WASM startup cost to ordinary
+   * shells and Node programs.
+   */
+  async prepareRolldown(cwd, env2) {
+    const specifier = "@rolldown/binding-wasm32-wasi";
+    if (!this.modules[specifier] && packageInstalled(this.volume, cwd, "rolldown")) {
+      this.rolldownBinding ??= loadHostRolldownBinding();
+      const binding = await this.rolldownBinding;
+      if (binding) this.modules[specifier] = binding;
+    }
+    if (this.modules[specifier]) {
+      syncRolldownFileSystem(this.modules[specifier], this.volume, cwd);
+      env2.NAPI_RS_FORCE_WASI ??= "true";
+    }
+  }
   /**
    * Wait until the process has either started serving or genuinely run out of
    * work.
@@ -23762,12 +24467,18 @@ var LocalRuntimePod = class _LocalRuntimePod {
    * A plain script that has genuinely finished falls straight through both,
    * costing a handful of empty turns.
    */
-  async settle(owner, pendingHandles, readingStdin) {
+  async settle(owner, pendingHandles, pendingUnrefed, readingStdin, pendingRequests) {
     for (let turn = 0; turn < DRAIN_TURNS; turn++) {
       if (this.router.activePorts(owner).length) return;
       await new Promise((resolve2) => setTimeout(resolve2, 0));
     }
-    while (!this.router.activePorts(owner).length && (pendingHandles() > 0 || readingStdin())) {
+    if (pendingHandles() === 0 && pendingRequests() === 0 && pendingUnrefed() > 0 && !readingStdin()) {
+      const deadline = Date.now() + 1e3;
+      while (!this.router.activePorts(owner).length && Date.now() < deadline) {
+        await new Promise((resolve2) => setTimeout(resolve2, 5));
+      }
+    }
+    while (!this.router.activePorts(owner).length && (pendingHandles() > 0 || pendingRequests() > 0 || readingStdin())) {
       await new Promise((resolve2) => setTimeout(resolve2, 5));
     }
   }
@@ -23819,6 +24530,60 @@ function formatError(error) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function packageInstalled(volume, cwd, wanted) {
+  for (let dir3 = clean(cwd); ; dir3 = dirname(dir3)) {
+    if (packageTreeContains(volume, join(dir3, "node_modules"), wanted, /* @__PURE__ */ new Set())) return true;
+    if (dir3 === "/") return false;
+  }
+}
+function packageTreeContains(volume, modulesRoot, wanted, visited) {
+  if (visited.has(modulesRoot) || !directory(volume, modulesRoot)) return false;
+  visited.add(modulesRoot);
+  if (directory(volume, join(modulesRoot, wanted))) return true;
+  for (const entry of volume.readdirSync(modulesRoot)) {
+    if (entry === ".bin") continue;
+    const first = join(modulesRoot, entry);
+    const packages = entry.startsWith("@") && directory(volume, first) ? volume.readdirSync(first).map((name) => join(first, name)) : [first];
+    for (const root of packages) {
+      if (directory(volume, root) && packageTreeContains(volume, join(root, "node_modules"), wanted, visited)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function directory(volume, path) {
+  try {
+    return volume.lstatSync(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function syncRolldownFileSystem(binding, volume, root) {
+  const fs = binding?.__fs;
+  if (!fs?.mkdirSync || !fs?.writeFileSync) return;
+  try {
+    fs.rmSync?.(root, { recursive: true, force: true });
+  } catch {
+  }
+  const copy = (path) => {
+    const stat2 = volume.lstatSync(path);
+    if (stat2.isDirectory()) {
+      fs.mkdirSync(path, { recursive: true });
+      for (const name of volume.readdirSync(path)) copy(join(path, name));
+    } else if (stat2.isSymbolicLink()) {
+      fs.mkdirSync(dirname(path), { recursive: true });
+      try {
+        fs.symlinkSync(volume.readlinkSync(path), path);
+      } catch {
+      }
+    } else if (!path.endsWith(".node")) {
+      fs.mkdirSync(dirname(path), { recursive: true });
+      fs.writeFileSync(path, volume.readFileSync(path));
+    }
+  };
+  copy(clean(root));
+}
 
 // src/container/container.ts
 var Container = class _Container {
@@ -24162,7 +24927,7 @@ var Container = class _Container {
   /**
    * Deliver a request whose body is bytes, without letting them become text.
    *
-   * Nodepod's public `request()` runs the body through `toString("utf8")` on
+   * A RuntimePod's public `request()` may run the body through `toString("utf8")` on
    * its way in, so anything above `0x7f` is replaced: a five-byte payload
    * containing `0x89` and `0xff` arrives as nine. That silently destroys every
    * upload — an image or a video reaches the server the wrong size and no
@@ -24264,7 +25029,7 @@ var Container = class _Container {
   assertActive() {
     if (this.disposed) throw new Error("container has been disposed");
   }
-  /** Tear down every process and release the Nodepod instance. */
+  /** Tear down every process and release the runtime pod. */
   dispose() {
     if (this.disposed) return;
     this.disposed = true;
@@ -24374,17 +25139,18 @@ var Terminal = class {
   // ── key handling ──────────────────────────────────────────────────────────
   key(ch) {
     if (this.running) {
-      if (ch === CTRL_C) {
+      const raw = this.currentStdin?.rawMode === true;
+      if (ch === CTRL_C && !raw) {
         this.session.proc.deliver("SIGINT");
         this.write("^C\r\n");
         return;
       }
-      if (ch === CTRL_D) {
+      if (ch === CTRL_D && !raw) {
         this.currentStdin?.end();
         return;
       }
-      if (!this.currentStdin?.rawMode) this.write(ch === "\r" ? "\r\n" : ch);
-      this.currentStdin?.write(ch === "\r" ? "\n" : ch);
+      if (!raw) this.write(ch === "\r" ? "\r\n" : ch);
+      this.currentStdin?.write(!raw && ch === "\r" ? "\n" : ch);
       return;
     }
     if (this.escapeBuffer !== "") {