sandboxedjs 0.1.31 → 0.1.33

package/dist/index.js

@@ -8841,7 +8841,7 @@ async function runShell(ctxName, ctx) {
   const args = ctx.args.slice();
   let command;
   let scriptPath;
-  let readStdin2 = false;
+  let readStdin = false;
   let interactive = false;
   let login = ctxName.startsWith("-");
   const options = {};
@@ -8854,7 +8854,7 @@ async function runShell(ctxName, ctx) {
       break;
     }
     if (arg === "-s") {
-      readStdin2 = true;
+      readStdin = true;
       continue;
     }
     if (arg === "-i") {
@@ -8891,7 +8891,7 @@ async function runShell(ctxName, ctx) {
     break;
   }
   const rest = args.slice(i);
-  if (command === void 0 && !readStdin2 && rest.length > 0) {
+  if (command === void 0 && !readStdin && rest.length > 0) {
     scriptPath = rest[0];
   }
   const positional = command !== void 0 ? rest.slice(1) : scriptPath !== void 0 ? rest.slice(1) : rest;
@@ -17786,6 +17786,693 @@ function mountContainerFs(FS, opts) {
   }
 }
 
+// src/runtime/python-syscalls.ts
+var EMPTY = new Uint8Array(0);
+function createStdinHost(ctx) {
+  let pending = EMPTY;
+  let eof = false;
+  const take = (size) => {
+    const n = Math.min(size, pending.length);
+    const out = pending.subarray(0, n);
+    pending = pending.subarray(n);
+    return out;
+  };
+  return {
+    /**
+     * Drain a non-interactive stdin up front.
+     *
+     * A pipe ends, so reading it eagerly costs nothing and leaves every read
+     * answerable without suspending — which is what keeps piped input working
+     * on hosts with no stack-switching. A terminal never ends, so priming one
+     * would hang before the program had printed its prompt.
+     */
+    async prime() {
+      if (ctx.stdin.isTTY || ctx.stdin.interactive) return;
+      try {
+        pending = await ctx.stdin.readAll();
+      } catch {
+        pending = EMPTY;
+      }
+      eof = true;
+    },
+    buffered(size) {
+      if (pending.length > 0) return take(size);
+      return eof ? EMPTY : void 0;
+    },
+    async read(size) {
+      if (pending.length > 0) return take(size);
+      if (eof) return EMPTY;
+      const chunk = await ctx.stdin.read(size);
+      if (chunk === null || chunk.length === 0) {
+        eof = true;
+        return EMPTY;
+      }
+      pending = chunk;
+      return take(size);
+    },
+    isatty() {
+      return Boolean(ctx.stdin.isTTY);
+    }
+  };
+}
+var BRIDGE_PY = `
+import builtins, io, sys
+import _sbx_host as _host
+from pyodide.ffi import can_run_sync, run_sync
+
+
+def _to_bytes(value):
+    if value is None:
+        return b""
+    to_bytes = getattr(value, "to_bytes", None)
+    if to_bytes is not None:
+        return to_bytes()
+    return bytes(value.to_py())
+
+
+class _SbxStdin(io.RawIOBase):
+    """The container's standard input, as a blocking raw stream."""
+
+    def readable(self):
+        return True
+
+    def fileno(self):
+        return 0
+
+    def isatty(self):
+        return bool(_host.isatty())
+
+    def readinto(self, target):
+        want = len(target)
+        if want == 0:
+            return 0
+        ready = _host.buffered(want)
+        if ready is None:
+            if not can_run_sync():
+                raise OSError(
+                    "this host cannot wait for interactive input: WebAssembly "
+                    "stack switching (JSPI) is unavailable. Pipe the input in, "
+                    "or use a browser or Node build that supports it."
+                )
+            ready = run_sync(_host.read(want))
+        data = _to_bytes(ready)
+        target[: len(data)] = data
+        return len(data)
+
+
+def _install():
+    stdin = io.TextIOWrapper(
+        io.BufferedReader(_SbxStdin()), encoding="utf-8", errors="replace", line_buffering=True
+    )
+    sys.stdin = stdin
+    sys.__stdin__ = stdin
+
+    def input(prompt=""):
+        # CPython writes the prompt to stdout and strips exactly one trailing
+        # newline; anything else changes what a program reads back.
+        if prompt != "":
+            sys.stdout.write(str(prompt))
+            sys.stdout.flush()
+        line = sys.stdin.readline()
+        if not line:
+            raise EOFError("EOF when reading a line")
+        if line.endswith("\\n"):
+            line = line[:-1]
+        if line.endswith("\\r"):
+            line = line[:-1]
+        return line
+
+    builtins.input = input
+
+
+_install()
+`;
+var PROCESS_PY = `
+import io, os, shlex, subprocess, sys
+import _sbx_host as _host
+from pyodide.ffi import can_run_sync, run_sync
+
+_PIPE = subprocess.PIPE
+_DEVNULL = subprocess.DEVNULL
+_STDOUT = subprocess.STDOUT
+
+
+def _argv_for(args, shell):
+    if shell:
+        line = args if isinstance(args, str) else " ".join(str(a) for a in args)
+        return ["sh", "-c", line]
+    if isinstance(args, (str, bytes)):
+        return shlex.split(args if isinstance(args, str) else args.decode())
+    return [str(a) for a in args]
+
+
+def _require_blocking(what):
+    if not can_run_sync():
+        raise OSError(
+            "cannot " + what + " on this host: WebAssembly stack switching "
+            "(JSPI) is unavailable."
+        )
+
+
+def _to_bytes_result(value):
+    if value is None:
+        return b""
+    to_bytes = getattr(value, "to_bytes", None)
+    return to_bytes() if to_bytes is not None else bytes(value.to_py())
+
+
+class _ChildReader(io.RawIOBase):
+    """One of a running child's output streams.
+
+    Reads suspend only for as long as the child takes to produce the next
+    bytes, so \`for line in p.stdout\` follows a child that is still running
+    instead of waiting for it to exit.
+    """
+
+    def __init__(self, child_id, which):
+        self._id = child_id
+        self._which = which
+
+    def readable(self):
+        return True
+
+    def readinto(self, target):
+        want = len(target)
+        if want == 0:
+            return 0
+        _require_blocking("read from a child process")
+        data = _to_bytes_result(run_sync(_host.proc_read(self._id, self._which, want)))
+        target[: len(data)] = data
+        return len(data)
+
+
+class _ChildWriter(io.RawIOBase):
+    """A running child's standard input."""
+
+    def __init__(self, child_id):
+        self._id = child_id
+
+    def writable(self):
+        return True
+
+    def write(self, data):
+        if isinstance(data, str):
+            text = data
+        else:
+            text = bytes(data).decode("utf-8", "replace")
+        _host.proc_write(self._id, text)
+        return len(data)
+
+    def close(self):
+        if not self.closed:
+            _host.proc_close_stdin(self._id)
+        super().close()
+
+
+class SbxPopen:
+    """A child process, run through the container's kernel.
+
+    The child is a real, live process: it starts when \`Popen\` is constructed
+    and runs on the host's event loop while Python carries on. The parent only
+    suspends when it actually reads, waits, or communicates \u2014 which is what
+    makes streaming from a long-running child work rather than deadlocking on
+    a single interpreter stack.
+    """
+
+    def __init__(self, args, bufsize=-1, executable=None, stdin=None, stdout=None,
+                 stderr=None, preexec_fn=None, close_fds=True, shell=False, cwd=None,
+                 env=None, universal_newlines=None, startupinfo=None, creationflags=0,
+                 restore_signals=True, start_new_session=False, pass_fds=(), *,
+                 text=None, encoding=None, errors=None, **kwargs):
+        self.args = args
+        self.returncode = None
+        self._text = bool(text or encoding or errors or universal_newlines)
+        self._encoding = encoding or "utf-8"
+        self._errors = errors or "replace"
+        self._merge_err = stderr == _STDOUT
+        self._closed = False
+
+        argv = _argv_for(args, shell)
+        env_map = None if env is None else {str(k): str(v) for k, v in dict(env).items()}
+        self._id = _host.proc_start(
+            argv, None if cwd is None else str(cwd), env_map, self._merge_err
+        )
+        self.pid = int(_host.proc_pid(self._id))
+
+        self.stdin = self._wrap_writer() if stdin == _PIPE else None
+        self.stdout = self._wrap_reader(1) if stdout == _PIPE else None
+        # When merged there is only one stream, and it is stream 1.
+        self.stderr = self._wrap_reader(2) if stderr == _PIPE and not self._merge_err else None
+
+        # Output nobody captured belongs on the parent's own streams, or a
+        # program's diagnostics would vanish rather than being seen.
+        self._drain_out = stdout is None
+        self._drain_err = stderr is None and not self._merge_err
+
+    def _wrap_reader(self, which):
+        raw = io.BufferedReader(_ChildReader(self._id, which))
+        if self._text:
+            return io.TextIOWrapper(raw, encoding=self._encoding, errors=self._errors)
+        return raw
+
+    def _wrap_writer(self):
+        raw = io.BufferedWriter(_ChildWriter(self._id))
+        if self._text:
+            return io.TextIOWrapper(raw, encoding=self._encoding, errors=self._errors)
+        return raw
+
+    def _read_all(self, which):
+        _require_blocking("read from a child process")
+        parts = []
+        while True:
+            chunk = _to_bytes_result(run_sync(_host.proc_read(self._id, which, 65536)))
+            if not chunk:
+                break
+            parts.append(chunk)
+        return b"".join(parts)
+
+    def _decode(self, raw):
+        return raw.decode(self._encoding, self._errors) if self._text else raw
+
+    def communicate(self, input=None, timeout=None):
+        if input is not None and self.stdin is not None:
+            if isinstance(input, bytes):
+                input = input.decode(self._encoding, "replace")
+            self.stdin.write(input)
+        if self.stdin is not None:
+            try:
+                self.stdin.close()
+            except Exception:
+                pass
+
+        out = self.stdout.read() if self.stdout is not None else None
+        err = self.stderr.read() if self.stderr is not None else None
+        self.wait()
+        self._flush_uncaptured()
+        return out, err
+
+    def _flush_uncaptured(self):
+        if self._drain_out:
+            text = self._decode_raw(self._read_all(1))
+            if text:
+                sys.stdout.write(text)
+        if self._drain_err:
+            text = self._decode_raw(self._read_all(2))
+            if text:
+                sys.stderr.write(text)
+        self._drain_out = False
+        self._drain_err = False
+
+    def _decode_raw(self, raw):
+        return raw.decode(self._encoding, "replace")
+
+    def poll(self):
+        code = _host.proc_poll(self._id)
+        if code is not None:
+            self.returncode = int(code)
+        return self.returncode
+
+    def wait(self, timeout=None):
+        _require_blocking("wait for a child process")
+        self.returncode = int(run_sync(_host.proc_wait(self._id)))
+        return self.returncode
+
+    def kill(self):
+        self.send_signal("SIGKILL")
+
+    def terminate(self):
+        self.send_signal("SIGTERM")
+
+    def send_signal(self, sig):
+        _host.proc_kill(self._id, sig if isinstance(sig, str) else "SIGTERM")
+
+    def __del__(self):
+        try:
+            _host.proc_release(self._id)
+        except Exception:
+            pass
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        if self.stdin is not None:
+            try:
+                self.stdin.close()
+            except Exception:
+                pass
+        self.wait()
+        self._flush_uncaptured()
+        for stream in (self.stdout, self.stderr):
+            if stream is not None:
+                try:
+                    stream.close()
+                except Exception:
+                    pass
+        # The host holds the process and its pipes until it is told the child
+        # is finished with; a loop spawning children would otherwise keep every
+        # one of them alive. Safe here only because the child has been waited
+        # for and everything anyone wanted has been read.
+        _host.proc_release(self._id)
+        return False
+
+
+def _system(command):
+    with SbxPopen(command, shell=True) as child:
+        pass
+    # os.system returns a wait status, not an exit code.
+    return (child.returncode or 0) << 8
+
+
+def _popen(command, mode="r", buffering=-1):
+    if "w" in mode:
+        raise OSError("os.popen with mode 'w' is not supported in this container")
+    child = SbxPopen(command, shell=True, stdout=_PIPE, text=True)
+    stream = child.stdout
+    inner = stream.close
+
+    def close():
+        inner()
+        code = child.wait()
+        return None if code == 0 else code << 8
+
+    stream.close = close
+    return stream
+
+
+def _install_processes():
+    subprocess.Popen = SbxPopen
+    os.system = _system
+    os.popen = _popen
+
+
+_install_processes()
+`;
+var NETWORK_PY = `
+import builtins, email.message, io, sys, urllib.error, urllib.request, urllib.response
+import _sbx_host as _host
+from pyodide.ffi import can_run_sync, run_sync
+
+
+def _fetch(request):
+    if not can_run_sync():
+        raise urllib.error.URLError(
+            "cannot make a request on this host: WebAssembly stack switching "
+            "(JSPI) is unavailable."
+        )
+    body = request.data
+    if isinstance(body, str):
+        body = body.encode()
+    try:
+        result = run_sync(
+            _host.http(
+                request.full_url,
+                request.get_method(),
+                [[k, v] for k, v in request.header_items()],
+                body,
+            )
+        )
+    except Exception as error:
+        raise urllib.error.URLError(str(error)) from None
+
+    headers = email.message.Message()
+    for pair in result.headers.to_py():
+        headers[str(pair[0])] = str(pair[1])
+    payload = result.body.to_bytes()
+    response = urllib.response.addinfourl(
+        io.BytesIO(payload), headers, str(result.url), int(result.status)
+    )
+    response.msg = str(result.statusText)
+    return response
+
+
+class _SbxHTTPHandler(urllib.request.HTTPHandler):
+    """Both schemes, from one handler.
+
+    Pyodide builds urllib without \`ssl\`, so \`HTTPSHandler\` does not exist to
+    subclass \u2014 and https is the scheme most callers actually want. Serving
+    both from a subclass of the one handler that does exist keeps
+    \`build_opener\` treating this as a replacement rather than stacking it
+    alongside the original.
+    """
+
+    def http_open(self, request):
+        return _fetch(request)
+
+    def https_open(self, request):
+        return _fetch(request)
+
+    https_request = urllib.request.HTTPHandler.do_request_
+
+
+def _raw_fetch(url, method, headers, body):
+    """One request, through the container's network path."""
+    if not can_run_sync():
+        raise urllib.error.URLError(
+            "cannot make a request on this host: WebAssembly stack switching "
+            "(JSPI) is unavailable."
+        )
+    if isinstance(body, str):
+        body = body.encode()
+    result = run_sync(
+        _host.http(url, method, [[str(k), str(v)] for k, v in dict(headers).items()], body)
+    )
+    return {
+        "status": int(result.status),
+        "reason": str(result.statusText),
+        "headers": [(str(p[0]), str(p[1])) for p in result.headers.to_py()],
+        "body": result.body.to_bytes(),
+        "url": str(result.url),
+    }
+
+
+# \u2500\u2500 Routing third-party HTTP stacks \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+#
+# A library that brings its own transport does not go through urllib, and in
+# Pyodide several of them reach JavaScript's fetch directly \u2014 which leaves the
+# container's network policy behind entirely. They cannot all be patched at
+# boot either, because pip installs them later.
+#
+# So: adapters are registered by module name and applied the moment that module
+# is first imported, whenever that happens. Supporting another stack is a small
+# function registered here, not a change to the machinery.
+
+_ADAPTERS = {}
+
+
+def _register_adapter(name):
+    def decorate(fn):
+        _ADAPTERS[name] = fn
+        return fn
+
+    return decorate
+
+
+def _apply_adapter(name):
+    fn = _ADAPTERS.pop(name, None)
+    if fn is None:
+        return
+    try:
+        fn()
+    except Exception:
+        # A stack we cannot adapt must not stop the import that triggered it.
+        pass
+
+
+def _install_import_hook():
+    real_import = builtins.__import__
+
+    def hooked(name, globals=None, locals=None, fromlist=(), level=0):
+        module = real_import(name, globals, locals, fromlist, level)
+        root = name.split(".")[0] if level == 0 else None
+        if root in _ADAPTERS:
+            _apply_adapter(root)
+        return module
+
+    builtins.__import__ = hooked
+
+
+@_register_adapter("requests")
+def _adapt_requests():
+    """Replace the transport, not the API.
+
+    \`HTTPAdapter.send\` is the single seam every requests call passes through,
+    below sessions, redirects, cookies and retries and above the urllib3
+    transport that would otherwise reach the network on its own. Replacing it
+    leaves everything callers actually use intact.
+    """
+    import requests
+    from requests.adapters import HTTPAdapter
+    from requests.structures import CaseInsensitiveDict
+
+    native_send = HTTPAdapter.send
+
+    def send(self, request, stream=False, timeout=None, verify=True, cert=None, proxies=None):
+        if not can_run_sync():
+            # Without stack switching this transport cannot run at all. Falling
+            # back to the library's own is better than breaking requests on
+            # such a host \u2014 but the container's network policy is not the part
+            # that degrades, so a forbidden host is still refused.
+            if not _host.policy_allows(request.url):
+                raise requests.exceptions.ConnectionError(
+                    "outbound network access is disabled for this container "
+                    "(enable with network: { allowOutbound: true })"
+                )
+            return native_send(self, request, stream, timeout, verify, cert, proxies)
+        try:
+            result = _raw_fetch(request.url, request.method, request.headers, request.body)
+        except Exception as error:
+            raise requests.exceptions.ConnectionError(str(error)) from None
+        response = requests.Response()
+        response.status_code = result["status"]
+        response.reason = result["reason"]
+        response.headers = CaseInsensitiveDict(result["headers"])
+        response.url = result["url"]
+        response.request = request
+        response.raw = io.BytesIO(result["body"])
+        response.encoding = requests.utils.get_encoding_from_headers(response.headers)
+        return response
+
+    HTTPAdapter.send = send
+
+
+def _install_network():
+    urllib.request.HTTPHandler = _SbxHTTPHandler
+    urllib.request.HTTPSHandler = _SbxHTTPHandler
+    urllib.request.install_opener(urllib.request.build_opener(_SbxHTTPHandler))
+    _install_import_hook()
+    for already_imported in [n for n in _ADAPTERS if n in sys.modules]:
+        _apply_adapter(already_imported)
+
+
+_install_network()
+`;
+async function httpForPython(slot, url, method, headers, body) {
+  const current = slot.current;
+  if (!current) throw new Error("no program is bound");
+  const result = await performRequest(current.ctx, new URL(url), {
+    method,
+    headers: Object.fromEntries(headers),
+    ...body ? { body } : {}
+  });
+  return {
+    status: result.status,
+    statusText: result.statusText,
+    headers: Object.entries(result.headers),
+    body: result.body,
+    url: result.url
+  };
+}
+async function resuming(py, slot, work) {
+  const parent = slot.current;
+  try {
+    return await work();
+  } finally {
+    if (parent && slot.current !== parent) bindProgram(py, parent);
+  }
+}
+function installSyscallBridge(py) {
+  const slot = py.__sbxSlot ??= { current: null };
+  const children = /* @__PURE__ */ new Map();
+  let lastChildId = 0;
+  py.registerJsModule("_sbx_host", {
+    /* Not `?.` and `??`: `buffered` returns undefined to mean "you will have
+     * to wait", and a nullish default would quietly turn that into end-of-file —
+     * which is exactly the silent EOF this bridge exists to remove. */
+    buffered: (size) => slot.current ? slot.current.stdin.buffered(size) : EMPTY,
+    read: (size) => slot.current ? slot.current.stdin.read(size) : Promise.resolve(EMPTY),
+    isatty: () => slot.current?.stdin.isatty() ?? false,
+    proc_start: (argv, cwd, env2, merge) => {
+      const current = slot.current;
+      if (!current) throw new Error("no program is bound");
+      const { ctx } = current;
+      const stdin = new Pipe();
+      stdin.interactive = true;
+      const stdout = new Pipe();
+      const stderr = merge ? stdout : new Pipe();
+      const proc = ctx.kernel.spawn(argv, {
+        cwd: cwd ?? ctx.cwd,
+        env: env2 ?? ctx.env,
+        cred: ctx.cred,
+        stdin,
+        stdout,
+        stderr
+      });
+      void proc.wait().then(() => {
+        stdout.end();
+        if (stderr !== stdout) stderr.end();
+      });
+      const id = ++lastChildId;
+      children.set(id, { proc, stdin, stdout, stderr });
+      return id;
+    },
+    proc_read: (id, which2, size) => {
+      const child = children.get(id);
+      if (!child) return Promise.resolve(EMPTY);
+      const pipe = which2 === 2 ? child.stderr : child.stdout;
+      return resuming(py, slot, async () => await pipe.read(size) ?? EMPTY);
+    },
+    proc_write: (id, text2) => {
+      children.get(id)?.stdin.write(text2);
+    },
+    proc_close_stdin: (id) => {
+      children.get(id)?.stdin.end();
+    },
+    /* Non-blocking on purpose: `poll()` must be able to say "still running". */
+    proc_poll: (id) => children.get(id)?.proc.exitCode ?? void 0,
+    proc_pid: (id) => children.get(id)?.proc.pid ?? 0,
+    proc_wait: (id) => {
+      const child = children.get(id);
+      if (!child) return Promise.resolve(0);
+      return resuming(py, slot, () => child.proc.wait());
+    },
+    proc_kill: (id, signal) => {
+      const child = children.get(id);
+      if (!child) return;
+      const current = slot.current;
+      current?.ctx.kernel.procs.signal(child.proc.pid, signal);
+    },
+    proc_release: (id) => {
+      children.delete(id);
+    },
+    http: (url, method, headers, body) => resuming(py, slot, () => httpForPython(slot, url, method, headers, body)),
+    /* So Python can enforce the container's policy even on a host where it
+     * cannot route the request itself. */
+    policy_allows: (url) => {
+      const current = slot.current;
+      if (!current) return false;
+      const net = current.ctx.kernel.net;
+      try {
+        return net.isLocal(new URL(url).hostname) || net.outboundAllowed(url);
+      } catch {
+        return false;
+      }
+    }
+  });
+  py.runPython(BRIDGE_PY);
+  py.runPython(PROCESS_PY);
+  py.runPython(NETWORK_PY);
+}
+function bindProgram(py, binding) {
+  py.__sbxSlot.current = binding;
+  const { ctx, stdin } = binding;
+  const decoder8 = new TextDecoder();
+  py.setStdout({
+    write: (buffer) => (ctx.write(decoder8.decode(buffer)), buffer.length)
+  });
+  py.setStderr({
+    write: (buffer) => (ctx.stderr.write(decoder8.decode(buffer)), buffer.length)
+  });
+  py.setStdin({
+    read: (buffer) => {
+      const ready = stdin.buffered(buffer.length);
+      if (!ready || ready.length === 0) return 0;
+      buffer.set(ready);
+      return ready.length;
+    }
+  });
+}
+
 // src/runtime/cpython.ts
 var RESERVED_FOR_INTERPRETER = /* @__PURE__ */ new Set(["lib", "dev", "proc"]);
 var pyodideModule = null;
@@ -17858,6 +18545,7 @@ async function interpreterFor(ctx) {
     });
     mountContainerDirs(py, ctx);
     installRunner(py);
+    installSyscallBridge(py);
     return py;
   })();
   interpreters.set(ctx.vfs, starting);
@@ -17952,7 +18640,7 @@ function reportError(ctx, error) {
 `);
   return 1;
 }
-async function runCPythonProgram(ctx, source, argv, scriptDir, stdinText) {
+async function runCPythonProgram(ctx, source, argv, scriptDir = null) {
   let py;
   try {
     py = await interpreterFor(ctx);
@@ -17973,34 +18661,9 @@ async function runCPythonProgram(ctx, source, argv, scriptDir, stdinText) {
     });
   } catch {
   }
-  const encoder8 = new TextEncoder();
-  const decoder8 = new TextDecoder();
-  py.setStdout({
-    write: (buffer) => {
-      ctx.write(decoder8.decode(buffer));
-      return buffer.length;
-    }
-  });
-  py.setStderr({
-    write: (buffer) => {
-      ctx.stderr.write(decoder8.decode(buffer));
-      return buffer.length;
-    }
-  });
-  if (stdinText !== null) {
-    const bytes2 = encoder8.encode(stdinText);
-    let offset = 0;
-    py.setStdin({
-      read: (buffer) => {
-        const take = Math.min(buffer.length, bytes2.length - offset);
-        buffer.set(bytes2.subarray(offset, offset + take));
-        offset += take;
-        return take;
-      }
-    });
-  } else {
-    py.setStdin({ read: () => 0 });
-  }
+  const stdinHost = createStdinHost(ctx);
+  await stdinHost.prime();
+  bindProgram(py, { ctx, stdin: stdinHost });
   try {
     bootstrap(py, ctx, argv, scriptDir);
   } catch (error) {
@@ -18039,9 +18702,7 @@ async function runCPythonRepl(ctx) {
   }
   mountContainerDirs(py, ctx);
   bootstrap(py, ctx, [""], null);
-  const decoder8 = new TextDecoder();
-  py.setStdout({ write: (data) => (ctx.write(decoder8.decode(data)), data.length) });
-  py.setStderr({ write: (data) => (ctx.stderr.write(decoder8.decode(data)), data.length) });
+  bindProgram(py, { ctx, stdin: createStdinHost(ctx) });
   ctx.line(`Python ${String(py.runPython("import sys; sys.version.split()[0]"))} (Pyodide)`);
   ctx.line('Type "help()" for more information.');
   let source = "";
@@ -18101,6 +18762,13 @@ var micropip = defineCommand({
       ctx.stderr.write("pip: no packages specified\n");
       return 1;
     }
+    const index = "https://pypi.org";
+    if (!ctx.kernel.net.outboundAllowed(index)) {
+      ctx.stderr.write(
+        "pip: outbound network access is disabled for this container (enable with network: { allowOutbound: true })\n"
+      );
+      return 1;
+    }
     let py;
     try {
       py = await interpreterFor(ctx);
@@ -18133,11 +18801,6 @@ function configurePython(options = {}) {
   configureCPython({ indexURL: options.indexURL, moduleURL: options.pyodideURL });
 }
 var isPythonAvailable = isCPythonAvailable;
-async function readStdin(ctx) {
-  if (ctx.stdin.isTTY || ctx.stdin.interactive) return null;
-  const bytes2 = await ctx.stdin.readAll();
-  return bytes2.length ? new TextDecoder().decode(bytes2) : null;
-}
 var python = defineCommand({
   name: "python3",
   path: "/usr/bin/python3",
@@ -18186,7 +18849,7 @@ compatible packages can be installed with pip (micropip).`,
     }
     const rest = argv.slice(i);
     if (command !== void 0) {
-      return (await runCPythonProgram(ctx, command, ["-c", ...rest], null, await readStdin(ctx))).exitCode;
+      return (await runCPythonProgram(ctx, command, ["-c", ...rest], null)).exitCode;
     }
     if (moduleName !== void 0) {
       const program = `
@@ -18198,16 +18861,16 @@ except ImportError:
     print("/usr/bin/python3: No module named " + ${JSON.stringify(moduleName)}, file=sys.stderr)
     raise SystemExit(1)
 `;
-      return (await runCPythonProgram(ctx, program, [moduleName, ...rest], null, await readStdin(ctx))).exitCode;
+      return (await runCPythonProgram(ctx, program, [moduleName, ...rest], null)).exitCode;
     }
     if (script === void 0) {
       if (ctx.stdin.isTTY) return runCPythonRepl(ctx);
       const source2 = new TextDecoder().decode(await ctx.stdin.readAll());
-      return source2.trim() ? (await runCPythonProgram(ctx, source2, ["", ...rest], null, null)).exitCode : 0;
+      return source2.trim() ? (await runCPythonProgram(ctx, source2, ["", ...rest])).exitCode : 0;
     }
     if (script === "-") {
       const source2 = new TextDecoder().decode(await ctx.stdin.readAll());
-      return (await runCPythonProgram(ctx, source2, ["-", ...rest], null, null)).exitCode;
+      return (await runCPythonProgram(ctx, source2, ["-", ...rest])).exitCode;
     }
     const abs = ctx.path(script);
     let source;
@@ -18218,7 +18881,7 @@ except ImportError:
 `);
       return 2;
     }
-    return (await runCPythonProgram(ctx, source, [abs, ...rest], dirname(abs), await readStdin(ctx))).exitCode;
+    return (await runCPythonProgram(ctx, source, [abs, ...rest], dirname(abs))).exitCode;
   }
 });
 function printHelp2(ctx) {