sandboxedjs 0.1.28 → 0.1.29

package/dist/index.js

@@ -17942,22 +17942,22 @@ async function runCPythonProgram(ctx, source, argv, scriptDir, stdinText) {
     });
   } catch {
   }
-  const encoder7 = new TextEncoder();
-  const decoder7 = new TextDecoder();
+  const encoder8 = new TextEncoder();
+  const decoder8 = new TextDecoder();
   py.setStdout({
     write: (buffer) => {
-      ctx.write(decoder7.decode(buffer));
+      ctx.write(decoder8.decode(buffer));
       return buffer.length;
     }
   });
   py.setStderr({
     write: (buffer) => {
-      ctx.stderr.write(decoder7.decode(buffer));
+      ctx.stderr.write(decoder8.decode(buffer));
       return buffer.length;
     }
   });
   if (stdinText !== null) {
-    const bytes2 = encoder7.encode(stdinText);
+    const bytes2 = encoder8.encode(stdinText);
     let offset = 0;
     py.setStdin({
       read: (buffer) => {
@@ -18008,9 +18008,9 @@ async function runCPythonRepl(ctx) {
   }
   mountContainerDirs(py, ctx);
   bootstrap(py, ctx, [""], null);
-  const decoder7 = new TextDecoder();
-  py.setStdout({ write: (data) => (ctx.write(decoder7.decode(data)), data.length) });
-  py.setStderr({ write: (data) => (ctx.stderr.write(decoder7.decode(data)), data.length) });
+  const decoder8 = new TextDecoder();
+  py.setStdout({ write: (data) => (ctx.write(decoder8.decode(data)), data.length) });
+  py.setStderr({ write: (data) => (ctx.stderr.write(decoder8.decode(data)), data.length) });
   ctx.line(`Python ${String(py.runPython("import sys; sys.version.split()[0]"))} (Pyodide)`);
   ctx.line('Type "help()" for more information.');
   let source = "";
@@ -19621,15 +19621,15 @@ var Session = class {
   async run(command, opts = {}) {
     if (this.closed) throw new Error("session is closed");
     const combined = [];
-    const decoder7 = new TextDecoder();
+    const decoder8 = new TextDecoder();
     const stdout = new BufferSink((chunk) => {
-      const text2 = decoder7.decode(chunk, { stream: true });
+      const text2 = decoder8.decode(chunk, { stream: true });
       combined.push(text2);
       opts.onStdout?.(text2);
       this.hooks.onStdout?.(text2);
     });
     const stderr = new BufferSink((chunk) => {
-      const text2 = decoder7.decode(chunk, { stream: true });
+      const text2 = decoder8.decode(chunk, { stream: true });
       combined.push(text2);
       opts.onStderr?.(text2);
       this.hooks.onStderr?.(text2);
@@ -21815,7 +21815,7 @@ var VirtualClientRequest = class extends streamModule4.Writable {
     };
     let settled = false;
     try {
-      const response = this.router.activePortsIncludes(this.target.port) && isLoopback(this.target.hostname) ? await this.viaRouter(body) : await this.viaFetch(body);
+      const response = isLoopback(this.target.hostname) ? await this.viaRouter(body) : await this.viaFetch(body);
       if (this.destroyedByUser) return;
       clearTimeout(this.timer);
       settled = true;
@@ -21837,6 +21837,12 @@ var VirtualClientRequest = class extends streamModule4.Writable {
     }
   }
   async viaRouter(body) {
+    if (!this.router.activePortsIncludes(this.target.port)) {
+      throw Object.assign(
+        new Error(`connect ECONNREFUSED ${this.target.hostname}:${this.target.port}`),
+        { code: "ECONNREFUSED", errno: -61, syscall: "connect", address: this.target.hostname, port: this.target.port }
+      );
+    }
     const result = await this.router.request(this.target.port, {
       method: this.target.method,
       path: this.target.path,
@@ -22093,7 +22099,7 @@ var ChildProcess = class extends EventEmitter4 {
     queueMicrotask(() => this.emit("close", code, null));
   }
 };
-function createChildProcessModule(spawnChild, defaultCwd) {
+function createChildProcessModule(spawnChild, defaultCwd, syncSpawn) {
   const throughShell = (command, options) => {
     const shell = typeof options.shell === "string" ? options.shell : "/bin/sh";
     return { file: shell, args: ["-c", command] };
@@ -22150,20 +22156,79 @@ ${err.join("")}`),
     exec,
     execFile,
     fork: (modulePath, args = [], options = {}) => spawn("node", [modulePath, ...args], options),
-    execSync: unavailable("execSync"),
-    execFileSync: unavailable("execFileSync"),
-    spawnSync: unavailable("spawnSync"),
+    ...buildSyncFamily(syncSpawn, throughShell, defaultCwd),
     ChildProcess
   };
 }
+function buildSyncFamily(syncSpawn, throughShell, defaultCwd) {
+  if (!syncSpawn) {
+    return {
+      execSync: unavailable("execSync"),
+      execFileSync: unavailable("execFileSync"),
+      spawnSync: unavailable("spawnSync")
+    };
+  }
+  const run = (file3, args, options) => {
+    const resolved = options.shell ? throughShell([file3, ...args].join(" "), options) : { file: file3, args };
+    const input = options.input === void 0 ? void 0 : typeof options.input === "string" ? options.input : new TextDecoder().decode(options.input);
+    return syncSpawn({
+      command: resolved.file,
+      args: resolved.args,
+      cwd: options.cwd ?? defaultCwd(),
+      ...options.env ? { env: options.env } : {},
+      ...input === void 0 ? {} : { input }
+    });
+  };
+  const asOutput = (text2, options) => options.encoding === "buffer" || options.encoding === void 0 ? Buffer2.from(text2) : text2;
+  const orThrow = (result, command, options) => {
+    if (result.error) {
+      throw Object.assign(new Error(result.error.message), {
+        ...result.error.code ? { code: result.error.code } : {},
+        stdout: asOutput(result.stdout, options),
+        stderr: asOutput(result.stderr, options)
+      });
+    }
+    if (result.status !== 0) {
+      throw Object.assign(new Error(`Command failed: ${command}
+${result.stderr}`), {
+        status: result.status,
+        stdout: asOutput(result.stdout, options),
+        stderr: asOutput(result.stderr, options)
+      });
+    }
+    return asOutput(result.stdout, options);
+  };
+  const spawnSync = (file3, args = [], options = {}) => {
+    const [list, opts] = Array.isArray(args) ? [args, options] : [[], args];
+    const result = run(file3, list, opts);
+    return {
+      pid: 0,
+      status: result.status,
+      signal: result.signal,
+      stdout: asOutput(result.stdout, opts),
+      stderr: asOutput(result.stderr, opts),
+      output: [null, asOutput(result.stdout, opts), asOutput(result.stderr, opts)],
+      ...result.error ? { error: Object.assign(new Error(result.error.message), result.error.code ? { code: result.error.code } : {}) } : {}
+    };
+  };
+  const execFileSync = (file3, args = [], options = {}) => {
+    const [list, opts] = Array.isArray(args) ? [args, options] : [[], args];
+    return orThrow(run(file3, list, opts), [file3, ...list].join(" "), opts);
+  };
+  const execSync = (command, options = {}) => orThrow(run(command, [], { ...options, shell: options.shell ?? true }), command, options);
+  return { spawnSync, execFileSync, execSync };
+}
 function normalize2(options, callback) {
   if (typeof options === "function") return [{}, options];
   return [options ?? {}, callback];
 }
 function unavailable(name) {
-  return () => {
+  return (...args) => {
+    const file3 = typeof args[0] === "string" ? args[0] : void 0;
+    const list = Array.isArray(args[1]) ? args[1].map(String) : [];
+    const command = file3 ? [file3, ...list].join(" ") : void 0;
     const error = new Error(
-      `child_process.${name} is not supported in the sandboxed runtime: it would have to block the JavaScript thread. Use the asynchronous form instead.`
+      `child_process.${name} is not supported in the sandboxed runtime` + (command ? ` (tried to run: ${command})` : "") + `: the caller, the child and the event loop share one thread, so blocking the caller would also stop the child. Run it with the asynchronous form (spawn/exec/execFile), or run the command from the container shell.`
     );
     error.code = "ERR_FEATURE_UNAVAILABLE_ON_PLATFORM";
     throw error;
@@ -22227,7 +22292,11 @@ function parseKeys(input) {
         const name = CSI_KEYS[sequence];
         keys.push({
           sequence: `\x1B${sequence}`,
-          name: name ?? "undefined",
+          /* Node leaves this undefined for a sequence it does not recognise.
+           * The string "undefined" is not the same thing: a caller testing
+           * `key.name === undefined` would take an unknown key for a known
+           * one. */
+          name,
           ctrl: false,
           /* xterm reports modifiers as `;5` (control) and `;2` (shift) before
            * the final letter. */
@@ -22787,7 +22856,7 @@ function createCoreModules(options) {
   };
   const http = options.http ? createHttpModule(options.http.router, options.http.owner, httpOptions, "http:") : createUnsupportedModule("http");
   const https = options.http ? createHttpModule(options.http.router, options.http.owner, httpOptions, "https:") : createUnsupportedModule("https");
-  const childProcess = options.spawnChild ? createChildProcessModule(options.spawnChild, () => cwd) : createUnsupportedModule("child_process");
+  const childProcess = options.spawnChild ? createChildProcessModule(options.spawnChild, () => cwd, options.syncSpawn) : createUnsupportedModule("child_process");
   const readline = createReadlineModule(() => processObject.stdin, () => processObject.stdout);
   const dns = createDnsModule();
   const builtins = {
@@ -22848,6 +22917,7 @@ function createCoreModules(options) {
     pendingUnrefed: timers.pendingUnrefed,
     /** Client requests sent but not yet read to completion. */
     pendingRequests: () => inFlightRequests,
+    cancelTimers: timers.cancelAll,
     writeStdin: (data) => {
       if (options.interactiveStdin) stdin.write(data);
     },
@@ -23529,6 +23599,27 @@ function createTrackedTimers() {
     live.delete(handle);
     native(handle);
   };
+  const cancelAll = () => {
+    for (const handle of [...live, ...unrefed]) {
+      const state = states.get(handle);
+      if (!state) continue;
+      state.active = false;
+      try {
+        clearTimeout(state.native);
+      } catch {
+      }
+      try {
+        clearInterval(state.native);
+      } catch {
+      }
+      try {
+        (globalThis.clearImmediate ?? clearTimeout)(state.native);
+      } catch {
+      }
+    }
+    live.clear();
+    unrefed.clear();
+  };
   return {
     api: {
       setTimeout: setTimeoutTracked,
@@ -23539,7 +23630,8 @@ function createTrackedTimers() {
       clearImmediate: (handle) => clear2(handle, globalThis.clearImmediate ?? clearTimeout)
     },
     pending: () => live.size,
-    pendingUnrefed: () => unrefed.size
+    pendingUnrefed: () => unrefed.size,
+    cancelAll
   };
 }
 function createTimerPromises() {
@@ -23993,6 +24085,193 @@ var MemoryVolume = class {
   }
 };
 
+// src/runtime/mirroring-volume.ts
+init_path();
+var MirroringVolume = class {
+  constructor(inner = new MemoryVolume()) {
+    this.inner = inner;
+  }
+  inner;
+  mirror;
+  root = "/";
+  /**
+   * Start mirroring the tree under `root`, seeding it with what is there now.
+   *
+   * Called once the Rolldown binding is known to be in play; before that a
+   * container pays nothing for this.
+   */
+  attach(mirror, root) {
+    this.mirror = mirror;
+    this.root = clean(root);
+    this.seed();
+  }
+  detach() {
+    this.mirror = void 0;
+  }
+  /** Copy the whole subtree across. The only bulk operation that remains. */
+  seed() {
+    const mirror = this.mirror;
+    if (!mirror) return;
+    try {
+      mirror.rmSync?.(this.root, { recursive: true, force: true });
+    } catch {
+    }
+    const copy = (path) => {
+      let stat2;
+      try {
+        stat2 = this.inner.lstatSync(path);
+      } catch {
+        return;
+      }
+      if (stat2.isDirectory()) {
+        this.safely(() => mirror.mkdirSync(path, { recursive: true }));
+        for (const name of this.inner.readdirSync(path)) copy(join(path, name));
+      } else if (stat2.isSymbolicLink()) {
+        this.safely(() => {
+          mirror.mkdirSync(dirname(path), { recursive: true });
+          mirror.symlinkSync(this.inner.readlinkSync(path), path);
+        });
+      } else if (!path.endsWith(".node")) {
+        this.safely(() => {
+          mirror.mkdirSync(dirname(path), { recursive: true });
+          mirror.writeFileSync(path, this.inner.readFileSync(path));
+        });
+      }
+    };
+    copy(this.root);
+  }
+  /** Is this path inside the mirrored subtree? */
+  mirrored(path) {
+    if (!this.mirror) return false;
+    const clean2 = clean(path);
+    return this.root === "/" || clean2 === this.root || clean2.startsWith(`${this.root}/`);
+  }
+  /**
+   * Run a mirror update, swallowing failure.
+   *
+   * The mirror is a read-only cache for another engine. If it rejects
+   * something — an unsupported operation, a path it has not seen — the
+   * container's own write has still happened and must still succeed.
+   */
+  safely(update) {
+    try {
+      update();
+    } catch {
+    }
+  }
+  /** Push a path's current state across, whatever it is now. */
+  sync(path) {
+    const mirror = this.mirror;
+    if (!mirror || !this.mirrored(path)) return;
+    let stat2;
+    try {
+      stat2 = this.inner.lstatSync(path);
+    } catch {
+      this.safely(() => {
+        if (mirror.rmSync) mirror.rmSync(path, { recursive: true, force: true });
+        else mirror.unlinkSync?.(path);
+      });
+      return;
+    }
+    if (stat2.isDirectory()) {
+      this.safely(() => mirror.mkdirSync(path, { recursive: true }));
+      return;
+    }
+    if (stat2.isSymbolicLink()) {
+      this.safely(() => {
+        mirror.mkdirSync(dirname(path), { recursive: true });
+        mirror.symlinkSync(this.inner.readlinkSync(path), path);
+      });
+      return;
+    }
+    if (path.endsWith(".node")) return;
+    this.safely(() => {
+      mirror.mkdirSync(dirname(path), { recursive: true });
+      mirror.writeFileSync(path, this.inner.readFileSync(path));
+    });
+  }
+  // ── reads: straight through ───────────────────────────────────────────────
+  readFileSync(path) {
+    return this.inner.readFileSync(path);
+  }
+  readdirSync(path) {
+    return this.inner.readdirSync(path);
+  }
+  lstatSync(path) {
+    return this.inner.lstatSync(path);
+  }
+  readlinkSync(path) {
+    return this.inner.readlinkSync(path);
+  }
+  getStats() {
+    return this.inner.getStats();
+  }
+  // ── writes: applied, then mirrored ────────────────────────────────────────
+  writeFileSync(path, data) {
+    this.inner.writeFileSync(path, data);
+    this.sync(path);
+  }
+  appendFileSync(path, data) {
+    this.inner.appendFileSync(path, data);
+    this.sync(path);
+  }
+  mkdirSync(path, options) {
+    this.inner.mkdirSync(path, options);
+    this.sync(path);
+  }
+  rmdirSync(path) {
+    this.inner.rmdirSync(path);
+    this.sync(path);
+  }
+  unlinkSync(path) {
+    this.inner.unlinkSync(path);
+    this.sync(path);
+  }
+  renameSync(from, to) {
+    this.inner.renameSync(from, to);
+    this.sync(from);
+    this.sync(to);
+  }
+  symlinkSync(target, path) {
+    this.inner.symlinkSync(target, path);
+    this.sync(path);
+  }
+  linkSync(existing, path) {
+    this.inner.linkSync(existing, path);
+    this.sync(path);
+  }
+  truncateSync(path, length) {
+    this.inner.truncateSync(path, length);
+    this.sync(path);
+  }
+  /* Permissions and timestamps do not change what a bundler resolves, and
+   * `memfs` is stricter about them than this volume is. Applied here only. */
+  chmodSync(path, mode) {
+    this.inner.chmodSync(path, mode);
+  }
+  lchmodSync(path, mode) {
+    this.inner.lchmodSync(path, mode);
+  }
+  chownSync(path, uid, gid) {
+    this.inner.chownSync(path, uid, gid);
+  }
+  lchownSync(path, uid, gid) {
+    this.inner.lchownSync(path, uid, gid);
+  }
+  utimesSync(path, atime, mtime) {
+    this.inner.utimesSync(path, atime, mtime);
+  }
+  // ── snapshots ─────────────────────────────────────────────────────────────
+  snapshot() {
+    return this.inner.snapshot();
+  }
+  /** A restore replaces everything, so the mirror is rebuilt rather than patched. */
+  restore(entries) {
+    this.inner.restore(entries);
+    this.seed();
+  }
+};
+
 // src/runtime/host-esbuild.ts
 var ASYNC_API = ["transform", "build", "context", "formatMessages", "analyzeMetafile"];
 function createHostEsbuild() {
@@ -24062,6 +24341,7 @@ function ensureProcessGlobal() {
 }
 
 // src/runtime/host-rolldown.ts
+var BUNDLER_HINT = "If this is a bundler pre-bundling the worker away, exclude the binding from dependency optimisation \u2014 in Vite:\n\n  optimizeDeps: { exclude: ['@rolldown/binding-wasm32-wasi'] }";
 async function loadHostRolldownBinding() {
   if (typeof window !== "undefined" && globalThis.crossOriginIsolated !== true) {
     throw new Error(
@@ -24075,7 +24355,13 @@ async function loadHostRolldownBinding() {
     if (typeof process !== "undefined" && process.env?.SANDBOXEDJS_DEBUG) {
       console.error("[sandboxedjs] Rolldown WASI binding unavailable:", error);
     }
-    throw new Error("The optional Rolldown WASI binding could not be loaded.", { cause: error });
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new Error(
+      `The optional Rolldown WASI binding could not be loaded: ${reason}` + (typeof window === "undefined" ? "" : `
+
+${BUNDLER_HINT}`),
+      { cause: error }
+    );
   }
 }
 
@@ -24115,6 +24401,7 @@ var LocalProcess = class extends EventEmitter4 {
   inputEnded = false;
   pendingInput = [];
   resolveKilled;
+  cleanup;
   killedPromise = new Promise((resolve2) => {
     this.resolveKilled = resolve2;
   });
@@ -24153,13 +24440,32 @@ var LocalProcess = class extends EventEmitter4 {
     for (const chunk of this.pendingInput.splice(0)) input(chunk);
     if (this.inputEnded) end();
   }
+  /**
+   * End the process now.
+   *
+   * Killing has to settle `completion`, not merely record the intent. A
+   * program with an interval outstanding has work pending forever, so the
+   * runtime's own idle check will never end it — before this, killing such a
+   * process left the caller awaiting a promise that could not resolve.
+   */
   kill(_signal = "SIGTERM") {
+    if (this.killed) return;
     this.killed = true;
     this.resolveKilled();
+    this.cleanup?.();
+    this.finish(137);
   }
   waitForKill() {
     return this.killedPromise;
   }
+  isKilled() {
+    return this.killed;
+  }
+  /** Registered by the task so a kill can release what the program still holds. */
+  onKill(cleanup) {
+    this.cleanup = cleanup;
+    if (this.killed) cleanup();
+  }
   /** End the process now, for an asynchronous `process.exit`. */
   exitNow(code) {
     this.finish(code);
@@ -24321,7 +24627,10 @@ function removeEscapedErrorReporting() {
 }
 var DRAIN_TURNS = 4;
 var LocalRuntimePod = class _LocalRuntimePod {
-  volume = new MemoryVolume();
+  /* Wrapped so that a foreign filesystem — Rolldown's WebAssembly memfs — can
+   * be kept in step as writes happen, rather than deep-copied once per spawn.
+   * With nothing attached this is a straight pass-through. */
+  volume = new MirroringVolume(new MemoryVolume());
   packages;
   instanceId = `sbx-${Math.random().toString(36).slice(2)}`;
   router = new VirtualHttpRouter();
@@ -24412,6 +24721,10 @@ var LocalRuntimePod = class _LocalRuntimePod {
         onRawMode: (enabled) => proc.emit("rawmode", enabled)
       });
       proc.acceptInput((data) => core.writeStdin(data), () => core.endStdin());
+      proc.onKill(() => {
+        core.cancelTimers();
+        this.router.closeOwner(owner);
+      });
       engine = new CommonJsEngine(this.volume, {
         cwd,
         builtins: core.builtins,
@@ -24421,7 +24734,7 @@ var LocalRuntimePod = class _LocalRuntimePod {
       });
       try {
         await engine.run(script);
-        await this.settle(owner, core.pendingHandles, core.pendingUnrefed, core.readingStdin, core.pendingRequests);
+        await this.settle(owner, core.pendingHandles, core.pendingUnrefed, core.readingStdin, core.pendingRequests, () => proc.isKilled());
         if (this.router.activePorts(owner).length) {
           await proc.waitForKill();
           return 137;
@@ -24442,13 +24755,13 @@ var LocalRuntimePod = class _LocalRuntimePod {
    */
   async prepareRolldown(cwd, env2) {
     const specifier = "@rolldown/binding-wasm32-wasi";
-    if (!this.modules[specifier] && packageInstalled(this.volume, cwd, "rolldown")) {
+    if (!this.modules[specifier] && packageIsInstalled(this.volume, cwd, "rolldown")) {
       this.rolldownBinding ??= loadHostRolldownBinding();
       const binding = await this.rolldownBinding;
       if (binding) this.modules[specifier] = binding;
     }
     if (this.modules[specifier]) {
-      syncRolldownFileSystem(this.modules[specifier], this.volume, cwd);
+      attachRolldownMirror(this.modules[specifier], this.volume, cwd);
       env2.NAPI_RS_FORCE_WASI ??= "true";
     }
   }
@@ -24467,18 +24780,18 @@ var LocalRuntimePod = class _LocalRuntimePod {
    * A plain script that has genuinely finished falls straight through both,
    * costing a handful of empty turns.
    */
-  async settle(owner, pendingHandles, pendingUnrefed, readingStdin, pendingRequests) {
+  async settle(owner, pendingHandles, pendingUnrefed, readingStdin, pendingRequests, killed) {
     for (let turn = 0; turn < DRAIN_TURNS; turn++) {
-      if (this.router.activePorts(owner).length) return;
+      if (this.router.activePorts(owner).length || killed()) return;
       await new Promise((resolve2) => setTimeout(resolve2, 0));
     }
     if (pendingHandles() === 0 && pendingRequests() === 0 && pendingUnrefed() > 0 && !readingStdin()) {
       const deadline = Date.now() + 1e3;
-      while (!this.router.activePorts(owner).length && Date.now() < deadline) {
+      while (!this.router.activePorts(owner).length && !killed() && Date.now() < deadline) {
         await new Promise((resolve2) => setTimeout(resolve2, 5));
       }
     }
-    while (!this.router.activePorts(owner).length && (pendingHandles() > 0 || pendingRequests() > 0 || readingStdin())) {
+    while (!this.router.activePorts(owner).length && !killed() && (pendingHandles() > 0 || pendingRequests() > 0 || readingStdin())) {
       await new Promise((resolve2) => setTimeout(resolve2, 5));
     }
   }
@@ -24530,7 +24843,7 @@ function formatError(error) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function packageInstalled(volume, cwd, wanted) {
+function packageIsInstalled(volume, cwd, wanted) {
   for (let dir3 = clean(cwd); ; dir3 = dirname(dir3)) {
     if (packageTreeContains(volume, join(dir3, "node_modules"), wanted, /* @__PURE__ */ new Set())) return true;
     if (dir3 === "/") return false;
@@ -24559,30 +24872,565 @@ function directory(volume, path) {
     return false;
   }
 }
-function syncRolldownFileSystem(binding, volume, root) {
+function attachRolldownMirror(binding, volume, root) {
   const fs = binding?.__fs;
   if (!fs?.mkdirSync || !fs?.writeFileSync) return;
-  try {
-    fs.rmSync?.(root, { recursive: true, force: true });
-  } catch {
+  volume.attach(fs, root);
+}
+
+// src/runtime/sync-channel.ts
+var STATE = 0;
+var LENGTH = 1;
+var MORE = 2;
+var CONTROL_WORDS = 4;
+var STATE_REQUEST = 1;
+var STATE_RESPONSE = 2;
+var STATE_CONTINUE = 3;
+var STATE_CLOSED = 4;
+function createSyncChannelBuffers(capacityBytes = 1 << 20) {
+  return {
+    control: new SharedArrayBuffer(CONTROL_WORDS * Int32Array.BYTES_PER_ELEMENT),
+    data: new SharedArrayBuffer(capacityBytes)
+  };
+}
+function syncChannelSupported() {
+  if (typeof SharedArrayBuffer !== "function") return false;
+  if (typeof Atomics !== "object" || typeof Atomics.wait !== "function") return false;
+  if (typeof window !== "undefined" && globalThis.crossOriginIsolated !== true) return false;
+  return true;
+}
+var SyncChannelServer = class {
+  constructor(buffers, handle) {
+    this.handle = handle;
+    this.control = new Int32Array(buffers.control);
+    this.data = new Uint8Array(buffers.data);
+    this.capacity = this.data.length;
   }
-  const copy = (path) => {
-    const stat2 = volume.lstatSync(path);
-    if (stat2.isDirectory()) {
-      fs.mkdirSync(path, { recursive: true });
-      for (const name of volume.readdirSync(path)) copy(join(path, name));
-    } else if (stat2.isSymbolicLink()) {
-      fs.mkdirSync(dirname(path), { recursive: true });
+  handle;
+  control;
+  data;
+  capacity;
+  /** Request chunks gathered so far, and the response still to be sent. */
+  incoming = [];
+  outgoing = null;
+  sent = 0;
+  closed = false;
+  /** Call from the wake message the client sends after each chunk. */
+  async pump() {
+    if (this.closed) return;
+    const state = Atomics.load(this.control, STATE);
+    if (state === STATE_REQUEST) {
+      const size = Atomics.load(this.control, LENGTH);
+      this.incoming.push(this.data.slice(0, size));
+      if (Atomics.load(this.control, MORE) === 1) {
+        this.publish(STATE_CONTINUE);
+        return;
+      }
+      const request = concat3(this.incoming);
+      this.incoming = [];
+      let response;
       try {
-        fs.symlinkSync(volume.readlinkSync(path), path);
+        response = await this.handle(request);
       } catch {
+        response = new Uint8Array();
       }
-    } else if (!path.endsWith(".node")) {
-      fs.mkdirSync(dirname(path), { recursive: true });
-      fs.writeFileSync(path, volume.readFileSync(path));
+      if (this.closed) return;
+      this.outgoing = response;
+      this.sent = 0;
+      this.sendChunk();
+      return;
     }
+    if (state === STATE_CONTINUE) this.sendChunk();
+  }
+  /** Release a blocked client, e.g. when the container is torn down. */
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    Atomics.store(this.control, STATE, STATE_CLOSED);
+    Atomics.notify(this.control, STATE);
+  }
+  sendChunk() {
+    const payload = this.outgoing ?? new Uint8Array();
+    const size = Math.min(this.capacity, payload.length - this.sent);
+    this.data.set(payload.subarray(this.sent, this.sent + size), 0);
+    this.sent += size;
+    Atomics.store(this.control, LENGTH, size);
+    Atomics.store(this.control, MORE, this.sent < payload.length ? 1 : 0);
+    this.publish(STATE_RESPONSE);
+  }
+  publish(state) {
+    Atomics.store(this.control, STATE, state);
+    Atomics.notify(this.control, STATE);
+  }
+};
+function concat3(parts) {
+  if (parts.length === 1) return parts[0];
+  const total = parts.reduce((sum, part) => sum + part.length, 0);
+  const joined = new Uint8Array(total);
+  let at = 0;
+  for (const part of parts) {
+    joined.set(part, at);
+    at += part.length;
+  }
+  return joined;
+}
+
+// src/runtime/remote-volume.ts
+var encoder7 = new TextEncoder();
+var decoder7 = new TextDecoder();
+function encodeFrame(header, body) {
+  const json = encoder7.encode(JSON.stringify(header));
+  const frame = new Uint8Array(4 + json.length + (body?.length ?? 0));
+  new DataView(frame.buffer).setUint32(0, json.length, true);
+  frame.set(json, 4);
+  if (body?.length) frame.set(body, 4 + json.length);
+  return frame;
+}
+function decodeFrame(frame) {
+  const view = new DataView(frame.buffer, frame.byteOffset, frame.byteLength);
+  const headerLength = view.getUint32(0, true);
+  const header = JSON.parse(decoder7.decode(frame.subarray(4, 4 + headerLength)));
+  return { header, body: frame.subarray(4 + headerLength) };
+}
+function flattenStat(stat2) {
+  return {
+    kind: stat2.isDirectory() ? "directory" : stat2.isSymbolicLink() ? "symlink" : "file",
+    mode: stat2.mode,
+    size: stat2.size,
+    uid: stat2.uid,
+    gid: stat2.gid,
+    ino: stat2.ino,
+    nlink: stat2.nlink,
+    atimeMs: stat2.atimeMs,
+    mtimeMs: stat2.mtimeMs,
+    ctimeMs: stat2.ctimeMs,
+    birthtimeMs: stat2.birthtimeMs
   };
-  copy(clean(root));
+}
+var BINARY_RESULTS = /* @__PURE__ */ new Set(["readFileSync"]);
+var BINARY_ARGUMENTS = /* @__PURE__ */ new Set(["writeFileSync", "appendFileSync"]);
+function serveVolume(volume) {
+  return (request) => {
+    const { header, body } = decodeFrame(request);
+    const target = volume;
+    try {
+      const method = target[header.op];
+      if (typeof method !== "function") {
+        return encodeFrame({ ok: false, error: { message: `unknown volume operation: ${header.op}` } });
+      }
+      const plain = header.args.map((value) => value === null ? void 0 : value);
+      const args = BINARY_ARGUMENTS.has(header.op) ? [plain[0], body] : header.op === "utimesSync" ? [plain[0], new Date(plain[1]), new Date(plain[2])] : plain;
+      const result = method.apply(volume, args);
+      if (BINARY_RESULTS.has(header.op)) {
+        return encodeFrame({ ok: true }, result);
+      }
+      if (header.op === "lstatSync") {
+        return encodeFrame({ ok: true, value: flattenStat(result) });
+      }
+      return encodeFrame({ ok: true, value: result });
+    } catch (error) {
+      const failure = error;
+      return encodeFrame({
+        ok: false,
+        error: { ...failure.code ? { code: failure.code } : {}, message: failure.message ?? String(error) }
+      });
+    }
+  };
+}
+
+// src/runtime/sync-syscalls.ts
+var SPAWN_OP = "spawnSync";
+function serveSyncSyscalls(options) {
+  const volumeHandler = serveVolume(options.volume);
+  return async (request) => {
+    const { header } = decodeFrame(request);
+    if (header.op !== SPAWN_OP) return volumeHandler(request);
+    try {
+      const result = await options.spawnChild(header.args[0]);
+      return encodeFrame({ ok: true, value: result });
+    } catch (error) {
+      const failure = error;
+      return encodeFrame({
+        ok: true,
+        value: {
+          status: null,
+          stdout: "",
+          stderr: "",
+          signal: null,
+          error: { ...failure.code ? { code: failure.code } : {}, message: failure.message ?? String(error) }
+        }
+      });
+    }
+  };
+}
+
+// src/runtime/worker-host.ts
+function defaultWorkerUrl() {
+  return new URL("./worker-entry.js", import.meta.url);
+}
+function hasDomWorker() {
+  return typeof Worker === "function" && typeof document !== "undefined";
+}
+async function startRuntimeWorker(options = {}) {
+  const url = options.url ?? defaultWorkerUrl();
+  const worker = hasDomWorker() ? await startDomWorker(url) : await startNodeWorker(url, options.workerData ?? {});
+  await new Promise((resolve2, reject) => {
+    const timer = setTimeout(() => reject(new Error("the runtime worker did not start in time")), options.timeoutMs ?? 1e4);
+    worker.onMessage((message) => {
+      if (message?.type === "sandboxedjs:ready") {
+        clearTimeout(timer);
+        resolve2();
+      }
+    });
+    worker.onError((error) => {
+      clearTimeout(timer);
+      reject(error instanceof Error ? error : new Error(String(error)));
+    });
+  });
+  return worker;
+}
+async function startDomWorker(url) {
+  const worker = new Worker(url, { type: "module" });
+  const listeners = [];
+  const errors = [];
+  worker.addEventListener("message", (event) => {
+    for (const listener of listeners) listener(event.data);
+  });
+  worker.addEventListener("error", (event) => {
+    const detail = event.message || "the runtime worker failed to load";
+    for (const listener of errors) listener(new Error(detail));
+  });
+  return {
+    postMessage: (message) => worker.postMessage(message),
+    onMessage: (listener) => {
+      listeners.push(listener);
+    },
+    onError: (listener) => {
+      errors.push(listener);
+    },
+    terminate: () => worker.terminate()
+  };
+}
+async function startNodeWorker(url, workerData) {
+  const specifier = ["node", "worker_threads"].join(":");
+  const { Worker: NodeWorker } = await import(
+    /* @vite-ignore */
+    /* webpackIgnore: true */
+    specifier
+  );
+  const worker = new NodeWorker(url, { workerData });
+  return {
+    postMessage: (message) => worker.postMessage(message),
+    onMessage: (listener) => worker.on("message", listener),
+    onError: (listener) => worker.on("error", listener),
+    terminate: () => worker.terminate()
+  };
+}
+var WorkerProcess = class extends EventEmitter4 {
+  constructor(worker, release) {
+    super();
+    this.worker = worker;
+    this.release = release;
+    super.on("error", () => {
+    });
+    this.completion = new Promise((resolve2) => {
+      this.resolveCompletion = resolve2;
+    });
+  }
+  worker;
+  release;
+  completion;
+  resolveCompletion;
+  settled = false;
+  out = [];
+  err = [];
+  started = false;
+  pendingInput = [];
+  inputEnded = false;
+  on(event, listener) {
+    return super.on(event, listener);
+  }
+  /** Called once the guest has been told to start; releases anything buffered. */
+  begin() {
+    this.started = true;
+    for (const chunk of this.pendingInput.splice(0)) this.worker.postMessage({ type: "stdin", data: chunk });
+    if (this.inputEnded) this.worker.postMessage({ type: "stdin-end" });
+  }
+  output(text2) {
+    this.out.push(text2);
+    this.emit("output", text2);
+  }
+  error(text2) {
+    this.err.push(text2);
+    this.emit("error", text2);
+  }
+  /**
+   * Deliver input to the running program.
+   *
+   * Held until the guest has been started, for the same reason the in-realm
+   * pod holds it: an interactive session's first keystrokes arrive while the
+   * program is still loading, and dropping them loses the answer to a prompt.
+   */
+  write(data) {
+    if (this.started) this.worker.postMessage({ type: "stdin", data });
+    else this.pendingInput.push(data);
+  }
+  endInput() {
+    this.inputEnded = true;
+    if (this.started) this.worker.postMessage({ type: "stdin-end" });
+  }
+  kill(_signal = "SIGTERM") {
+    this.worker.postMessage({ type: "kill" });
+    this.finish(137);
+  }
+  finish(exitCode) {
+    if (this.settled) return;
+    this.settled = true;
+    this.emit("exit", exitCode);
+    this.resolveCompletion({ exitCode, stdout: this.out.join(""), stderr: this.err.join("") });
+    this.release();
+  }
+};
+var WorkerRuntimePod = class _WorkerRuntimePod extends LocalRuntimePod {
+  workerUrl;
+  /** Live workers, so teardown can stop them all. */
+  live = /* @__PURE__ */ new Set();
+  constructor(options) {
+    super(options);
+    this.workerUrl = options.workerUrl;
+  }
+  /**
+   * Boot a Worker-backed pod, or return null when this host cannot support one.
+   *
+   * Declining is a first-class outcome. `SharedArrayBuffer` needs cross-origin
+   * isolation, a bundler may have made the guest script unreachable, and a host
+   * that supplied its own module objects has handed over things no thread
+   * boundary can carry. In every case the caller falls back to the in-realm pod
+   * and keeps working.
+   */
+  static async tryBoot(options = {}) {
+    if (!syncChannelSupported()) return null;
+    if (options.modules && Object.keys(options.modules).length > 0) return null;
+    const pod = new _WorkerRuntimePod(options);
+    try {
+      const probe = await startRuntimeWorker({ ...options.workerUrl ? { url: options.workerUrl } : {}, timeoutMs: 1e4 });
+      await probe.terminate();
+      return pod;
+    } catch {
+      pod.teardown();
+      return null;
+    }
+  }
+  async spawn(command, args = [], options = {}) {
+    if (command !== "node" && command !== "nodejs") return super.spawn(command, args, options);
+    const script = args[0];
+    if (!script) return super.spawn(command, args, options);
+    const cwd = typeof options.cwd === "string" ? options.cwd : this.workdir;
+    if (this.needsHostModules(cwd)) return super.spawn(command, args, options);
+    return await this.spawnInWorker(script, args, cwd, options);
+  }
+  async spawnInWorker(script, args, cwd, options) {
+    const env2 = { ...this.env, ...isRecord2(options.env) ? options.env : {} };
+    const owner = `${this.instanceId}:${Math.random().toString(36).slice(2)}`;
+    const buffers = createSyncChannelBuffers();
+    const worker = await startRuntimeWorker({
+      ...this.workerUrl ? { url: this.workerUrl } : {},
+      timeoutMs: 15e3
+    });
+    const server = new SyncChannelServer(buffers, serveSyncSyscalls({
+      volume: this.volume,
+      spawnChild: (request) => this.runChildToCompletion(request)
+    }));
+    const entry = { worker, server };
+    this.live.add(entry);
+    const process2 = new WorkerProcess(worker, () => {
+      this.live.delete(entry);
+      server.close();
+      this.closeProxies(owner);
+      void worker.terminate();
+    });
+    const children = /* @__PURE__ */ new Map();
+    worker.onMessage((raw) => {
+      const message = raw;
+      switch (message?.type) {
+        case "wake":
+          void server.pump();
+          return;
+        case "output":
+          process2.output(String(message.text));
+          return;
+        case "error":
+          process2.error(String(message.text));
+          return;
+        case "rawmode":
+          process2.emit("rawmode", Boolean(message.enabled));
+          return;
+        case "exit":
+          process2.finish(Number(message.code));
+          return;
+        case "listen":
+          this.proxyPort(Number(message.port), owner, worker);
+          return;
+        case "http-response":
+          this.settleProxied(Number(message.id), message.response);
+          return;
+        case "child-start":
+          this.startChild(worker, children, message);
+          return;
+        case "child-stdin":
+          children.get(message.id)?.sendStdin?.(String(message.data));
+          return;
+        case "child-stdin-end":
+          children.get(message.id)?.endStdin?.();
+          return;
+        case "child-kill":
+          children.get(message.id)?.kill(String(message.signal));
+          return;
+        default:
+          return;
+      }
+    });
+    worker.postMessage({
+      type: "start",
+      buffers,
+      script,
+      cwd,
+      env: env2,
+      argv: Array.isArray(options.argv) ? options.argv : ["/usr/bin/node", script, ...args.slice(1)],
+      aliases: this.aliases,
+      ...typeof options.stdinPath === "string" ? { stdinPath: options.stdinPath } : {},
+      ...options.interactiveStdin ? { interactiveStdin: true } : {},
+      ...options.tty ? { tty: true } : {}
+    });
+    process2.begin();
+    return process2;
+  }
+  /** Start an asynchronous child on the host's behalf and relay its events. */
+  startChild(worker, children, message) {
+    const handle = this.processManager.spawn(message.config);
+    children.set(message.id, handle);
+    for (const event of ["stdout", "stderr", "exit"]) {
+      handle.on(event, (value) => worker.postMessage({ type: "child-event", id: message.id, event, value }));
+    }
+    handle.exec();
+  }
+  /** Run a child to completion and collect it, for the guest's `spawnSync`. */
+  runChildToCompletion(request) {
+    return new Promise((resolve2) => {
+      let handle;
+      try {
+        handle = this.processManager.spawn({
+          command: request.command,
+          args: request.args,
+          cwd: request.cwd,
+          ...request.env ? { env: request.env } : {}
+        });
+      } catch (error) {
+        const failure = error;
+        resolve2({ status: null, stdout: "", stderr: "", signal: null, error: { ...failure.code ? { code: failure.code } : {}, message: failure.message } });
+        return;
+      }
+      let stdout = "";
+      let stderr = "";
+      handle.on("stdout", (text2) => {
+        stdout += text2;
+      });
+      handle.on("stderr", (text2) => {
+        stderr += text2;
+      });
+      handle.on("exit", (code) => resolve2({ status: code, stdout, stderr, signal: null }));
+      handle.exec();
+      if (request.input !== void 0) {
+        handle.sendStdin?.(request.input);
+      }
+      handle.endStdin?.();
+    });
+  }
+  // ── HTTP servers living on another thread ─────────────────────────────────
+  proxies = /* @__PURE__ */ new Map();
+  waiting = /* @__PURE__ */ new Map();
+  nextRequestId = 1;
+  /**
+   * Register a stand-in for a server that is actually running in the Worker.
+   *
+   * The router only knows how to reach servers on this thread, so each bound
+   * port gets a local server whose whole job is to forward and wait.
+   */
+  proxyPort(port, owner, worker) {
+    if (this.proxies.has(port)) return;
+    const server = new VirtualHttpServer(this.router, owner, (request, response) => {
+      void this.forward(worker, port, request, response);
+    });
+    try {
+      server.listen(port);
+      this.proxies.set(port, server);
+    } catch {
+    }
+  }
+  async forward(worker, port, request, response) {
+    const chunks = [];
+    for await (const chunk of request) chunks.push(chunk);
+    const body = concat4(chunks);
+    const id = this.nextRequestId++;
+    const answered = new Promise((resolve2) => this.waiting.set(id, resolve2));
+    worker.postMessage({
+      type: "http-request",
+      id,
+      port,
+      init: { method: request.method, path: request.url, headers: request.headers, body }
+    });
+    let result;
+    try {
+      result = await answered;
+    } catch (error) {
+      this.waiting.delete(id);
+      response.writeHead(500, "Internal Server Error", {});
+      response.end(new TextEncoder().encode(error instanceof Error ? error.message : String(error)));
+      return;
+    }
+    response.writeHead(Number(result.statusCode ?? 200), String(result.statusMessage ?? ""), result.headers ?? {});
+    response.end(result.body ?? new Uint8Array());
+  }
+  settleProxied(id, response) {
+    const resolve2 = this.waiting.get(id);
+    if (!resolve2) return;
+    this.waiting.delete(id);
+    resolve2(response);
+  }
+  closeProxies(owner) {
+    for (const [port, server] of [...this.proxies]) {
+      if (server.owner !== owner) continue;
+      server.close();
+      this.proxies.delete(port);
+    }
+  }
+  teardown() {
+    for (const { worker, server } of [...this.live]) {
+      server.close();
+      void worker.terminate();
+    }
+    this.live.clear();
+    super.teardown();
+  }
+  /** Does anything under `cwd` need a module only the host can supply? */
+  needsHostModules(cwd) {
+    return packageIsInstalled(this.volume, cwd, "rolldown");
+  }
+};
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function concat4(parts) {
+  if (parts.length === 0) return new Uint8Array();
+  if (parts.length === 1) return parts[0];
+  const total = parts.reduce((sum, part) => sum + part.length, 0);
+  const joined = new Uint8Array(total);
+  let at = 0;
+  for (const part of parts) {
+    joined.set(part, at);
+    at += part.length;
+  }
+  return joined;
 }
 
 // src/container/container.ts
@@ -24629,11 +25477,13 @@ var Container = class _Container {
   // ── boot ──────────────────────────────────────────────────────────────────
   static async create(opts = {}) {
     if (opts.python) configurePython(opts.python);
-    const pod = opts.pod ?? await LocalRuntimePod.boot({
+    const podOptions = {
       workdir: opts.cwd ?? "/",
       env: opts.env ?? {},
       ...opts.onServerReady ? { onServerReady: opts.onServerReady } : {}
-    });
+    };
+    const workerOptions = { ...podOptions, ...opts.workerUrl ? { workerUrl: opts.workerUrl } : {} };
+    const pod = opts.pod ?? (opts.isolation === "realm" ? null : await WorkerRuntimePod.tryBoot(workerOptions)) ?? await LocalRuntimePod.boot(podOptions);
     const kernel = new Kernel({
       pod,
       hostname: opts.hostname ?? "sandbox",
@@ -24875,15 +25725,15 @@ var Container = class _Container {
   }
   makeStdio(opts) {
     const combined = [];
-    const decoder7 = new TextDecoder();
+    const decoder8 = new TextDecoder();
     const stdout = new BufferSink((chunk) => {
-      const text2 = decoder7.decode(chunk, { stream: true });
+      const text2 = decoder8.decode(chunk, { stream: true });
       combined.push(text2);
       opts.onStdout?.(text2);
       this.hooks.onStdout?.(text2);
     });
     const stderr = new BufferSink((chunk) => {
-      const text2 = decoder7.decode(chunk, { stream: true });
+      const text2 = decoder8.decode(chunk, { stream: true });
       combined.push(text2);
       opts.onStderr?.(text2);
       this.hooks.onStderr?.(text2);
@@ -25496,6 +26346,6 @@ init_expand();
 init_builtins();
 var src_default = createContainer;
 
-export { ArithError, BufferSink, CallbackSink, CleanPackageInstaller, CommandRegistry, CommonJsEngine, Container, ContainerFs, ERRNO, FileInput, FileOutput, IncompleteInputError, KERNEL_NAME, KERNEL_RELEASE, Kernel, LocalRuntimePod, MemoryVolume, NODE_VERSION, NPM_VERSION, NetworkStack, NullInput, NullOutput, OS_RELEASE, PYTHON_VERSION, Pipe, Process, ProcessTable, ROOT_CRED, SIGNALS, SIGNAL_NAMES, Session, Shell, ShellExit, Lexer as ShellLexer, ShellSyntaxError, Stats, SysError, TeeOutput, Terminal, UserDatabase, Variables, Vfs, VirtualHttpRouter, VirtualHttpServer, VirtualIncomingMessage, VirtualServerResponse, WASM_ALIASES, allCommands, applyChmod, braceExpand, buildRootfs, builtinNames, captureStdio, configureCPython, configurePython, createChildProcessModule, createContainer, createContext, createCoreModules, src_default as default, defineCommand, evalArith, exitCodeForSignal, expandPrompt, expandWord, expandWords, extractNpmTarball, fnmatch, formatMode, getBuiltin, glob, globToRegex, hasMagic, installUserland, isBuiltinName, isCPythonAvailable, isPythonAvailable, isSysError, looksLikeEsm, makeCred, normalizeSignal, octalMode, parse as parseShell, parseUmask, path_exports as posixPath, resetPidCounter, shellQuote, strerror, transformEsm, unameInfo };
+export { ArithError, BufferSink, CallbackSink, CleanPackageInstaller, CommandRegistry, CommonJsEngine, Container, ContainerFs, ERRNO, FileInput, FileOutput, IncompleteInputError, KERNEL_NAME, KERNEL_RELEASE, Kernel, LocalRuntimePod, MemoryVolume, NODE_VERSION, NPM_VERSION, NetworkStack, NullInput, NullOutput, OS_RELEASE, PYTHON_VERSION, Pipe, Process, ProcessTable, ROOT_CRED, SIGNALS, SIGNAL_NAMES, Session, Shell, ShellExit, Lexer as ShellLexer, ShellSyntaxError, Stats, SysError, TeeOutput, Terminal, UserDatabase, Variables, Vfs, VirtualHttpRouter, VirtualHttpServer, VirtualIncomingMessage, VirtualServerResponse, WASM_ALIASES, allCommands, applyChmod, braceExpand, buildRootfs, builtinNames, captureStdio, configureCPython, configurePython, createChildProcessModule, createContainer, createContext, createCoreModules, src_default as default, defineCommand, evalArith, exitCodeForSignal, expandPrompt, expandWord, expandWords, extractNpmTarball, fnmatch, formatMode, getBuiltin, glob, globToRegex, hasMagic, installUserland, isBuiltinName, isCPythonAvailable, isPythonAvailable, isSysError, looksLikeEsm, makeCred, normalizeSignal, octalMode, parse as parseShell, parseUmask, path_exports as posixPath, resetPidCounter, shellQuote, startRuntimeWorker, strerror, syncChannelSupported, transformEsm, unameInfo };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map