sandboxedjs 0.1.32 → 0.1.34

package/dist/index.cjs

@@ -17924,20 +17924,620 @@ def _install():
 
 _install()
 `;
+var PROCESS_PY = `
+import io, os, shlex, subprocess, sys
+import _sbx_host as _host
+from pyodide.ffi import can_run_sync, run_sync
+
+_PIPE = subprocess.PIPE
+_DEVNULL = subprocess.DEVNULL
+_STDOUT = subprocess.STDOUT
+
+
+def _argv_for(args, shell):
+    if shell:
+        line = args if isinstance(args, str) else " ".join(str(a) for a in args)
+        return ["sh", "-c", line]
+    if isinstance(args, (str, bytes)):
+        return shlex.split(args if isinstance(args, str) else args.decode())
+    return [str(a) for a in args]
+
+
+def _require_blocking(what):
+    if not can_run_sync():
+        raise OSError(
+            "cannot " + what + " on this host: WebAssembly stack switching "
+            "(JSPI) is unavailable."
+        )
+
+
+def _to_bytes_result(value):
+    if value is None:
+        return b""
+    to_bytes = getattr(value, "to_bytes", None)
+    return to_bytes() if to_bytes is not None else bytes(value.to_py())
+
+
+class _ChildReader(io.RawIOBase):
+    """One of a running child's output streams.
+
+    Reads suspend only for as long as the child takes to produce the next
+    bytes, so \`for line in p.stdout\` follows a child that is still running
+    instead of waiting for it to exit.
+    """
+
+    def __init__(self, child_id, which):
+        self._id = child_id
+        self._which = which
+
+    def readable(self):
+        return True
+
+    def readinto(self, target):
+        want = len(target)
+        if want == 0:
+            return 0
+        _require_blocking("read from a child process")
+        data = _to_bytes_result(run_sync(_host.proc_read(self._id, self._which, want)))
+        target[: len(data)] = data
+        return len(data)
+
+
+class _ChildWriter(io.RawIOBase):
+    """A running child's standard input."""
+
+    def __init__(self, child_id):
+        self._id = child_id
+
+    def writable(self):
+        return True
+
+    def write(self, data):
+        if isinstance(data, str):
+            text = data
+        else:
+            text = bytes(data).decode("utf-8", "replace")
+        _host.proc_write(self._id, text)
+        return len(data)
+
+    def close(self):
+        if not self.closed:
+            _host.proc_close_stdin(self._id)
+        super().close()
+
+
+class SbxPopen:
+    """A child process, run through the container's kernel.
+
+    The child is a real, live process: it starts when \`Popen\` is constructed
+    and runs on the host's event loop while Python carries on. The parent only
+    suspends when it actually reads, waits, or communicates \u2014 which is what
+    makes streaming from a long-running child work rather than deadlocking on
+    a single interpreter stack.
+    """
+
+    def __init__(self, args, bufsize=-1, executable=None, stdin=None, stdout=None,
+                 stderr=None, preexec_fn=None, close_fds=True, shell=False, cwd=None,
+                 env=None, universal_newlines=None, startupinfo=None, creationflags=0,
+                 restore_signals=True, start_new_session=False, pass_fds=(), *,
+                 text=None, encoding=None, errors=None, **kwargs):
+        self.args = args
+        self.returncode = None
+        self._text = bool(text or encoding or errors or universal_newlines)
+        self._encoding = encoding or "utf-8"
+        self._errors = errors or "replace"
+        self._merge_err = stderr == _STDOUT
+        self._closed = False
+
+        argv = _argv_for(args, shell)
+        env_map = None if env is None else {str(k): str(v) for k, v in dict(env).items()}
+        self._id = _host.proc_start(
+            argv, None if cwd is None else str(cwd), env_map, self._merge_err
+        )
+        self.pid = int(_host.proc_pid(self._id))
+
+        self.stdin = self._wrap_writer() if stdin == _PIPE else None
+        self.stdout = self._wrap_reader(1) if stdout == _PIPE else None
+        # When merged there is only one stream, and it is stream 1.
+        self.stderr = self._wrap_reader(2) if stderr == _PIPE and not self._merge_err else None
+
+        # Output nobody captured belongs on the parent's own streams, or a
+        # program's diagnostics would vanish rather than being seen.
+        self._drain_out = stdout is None
+        self._drain_err = stderr is None and not self._merge_err
+
+    def _wrap_reader(self, which):
+        raw = io.BufferedReader(_ChildReader(self._id, which))
+        if self._text:
+            return io.TextIOWrapper(raw, encoding=self._encoding, errors=self._errors)
+        return raw
+
+    def _wrap_writer(self):
+        raw = io.BufferedWriter(_ChildWriter(self._id))
+        if self._text:
+            return io.TextIOWrapper(raw, encoding=self._encoding, errors=self._errors)
+        return raw
+
+    def _read_all(self, which):
+        _require_blocking("read from a child process")
+        parts = []
+        while True:
+            chunk = _to_bytes_result(run_sync(_host.proc_read(self._id, which, 65536)))
+            if not chunk:
+                break
+            parts.append(chunk)
+        return b"".join(parts)
+
+    def _decode(self, raw):
+        return raw.decode(self._encoding, self._errors) if self._text else raw
+
+    def communicate(self, input=None, timeout=None):
+        if input is not None and self.stdin is not None:
+            if isinstance(input, bytes):
+                input = input.decode(self._encoding, "replace")
+            self.stdin.write(input)
+        if self.stdin is not None:
+            try:
+                self.stdin.close()
+            except Exception:
+                pass
+
+        out = self.stdout.read() if self.stdout is not None else None
+        err = self.stderr.read() if self.stderr is not None else None
+        self.wait()
+        self._flush_uncaptured()
+        return out, err
+
+    def _flush_uncaptured(self):
+        if self._drain_out:
+            text = self._decode_raw(self._read_all(1))
+            if text:
+                sys.stdout.write(text)
+        if self._drain_err:
+            text = self._decode_raw(self._read_all(2))
+            if text:
+                sys.stderr.write(text)
+        self._drain_out = False
+        self._drain_err = False
+
+    def _decode_raw(self, raw):
+        return raw.decode(self._encoding, "replace")
+
+    def poll(self):
+        code = _host.proc_poll(self._id)
+        if code is not None:
+            self.returncode = int(code)
+        return self.returncode
+
+    def wait(self, timeout=None):
+        _require_blocking("wait for a child process")
+        self.returncode = int(run_sync(_host.proc_wait(self._id)))
+        return self.returncode
+
+    def kill(self):
+        self.send_signal("SIGKILL")
+
+    def terminate(self):
+        self.send_signal("SIGTERM")
+
+    def send_signal(self, sig):
+        _host.proc_kill(self._id, sig if isinstance(sig, str) else "SIGTERM")
+
+    def __del__(self):
+        try:
+            _host.proc_release(self._id)
+        except Exception:
+            pass
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        if self.stdin is not None:
+            try:
+                self.stdin.close()
+            except Exception:
+                pass
+        self.wait()
+        self._flush_uncaptured()
+        for stream in (self.stdout, self.stderr):
+            if stream is not None:
+                try:
+                    stream.close()
+                except Exception:
+                    pass
+        # The host holds the process and its pipes until it is told the child
+        # is finished with; a loop spawning children would otherwise keep every
+        # one of them alive. Safe here only because the child has been waited
+        # for and everything anyone wanted has been read.
+        _host.proc_release(self._id)
+        return False
+
+
+def _system(command):
+    with SbxPopen(command, shell=True) as child:
+        pass
+    # os.system returns a wait status, not an exit code.
+    return (child.returncode or 0) << 8
+
+
+def _popen(command, mode="r", buffering=-1):
+    if "w" in mode:
+        raise OSError("os.popen with mode 'w' is not supported in this container")
+    child = SbxPopen(command, shell=True, stdout=_PIPE, text=True)
+    stream = child.stdout
+    inner = stream.close
+
+    def close():
+        inner()
+        code = child.wait()
+        return None if code == 0 else code << 8
+
+    stream.close = close
+    return stream
+
+
+def _install_processes():
+    subprocess.Popen = SbxPopen
+    os.system = _system
+    os.popen = _popen
+
+
+_install_processes()
+`;
+var ASYNCIO_PY = `
+import asyncio
+from pyodide.ffi import can_run_sync, run_sync
+
+_orig_run = asyncio.run
+
+
+def _run(main, *, debug=None, loop_factory=None):
+    if not asyncio.iscoroutine(main) and not asyncio.isfuture(main):
+        raise ValueError("a coroutine was expected, got {!r}".format(main))
+    if not can_run_sync():
+        # No stack switching: the original at least raises a comprehensible
+        # error rather than this shim inventing a new one.
+        return _orig_run(main, debug=debug, loop_factory=loop_factory)
+    return run_sync(main)
+
+
+def _run_until_complete(self, future):
+    if not can_run_sync():
+        raise RuntimeError(
+            "cannot wait for a coroutine on this host: WebAssembly stack "
+            "switching (JSPI) is unavailable."
+        )
+    return run_sync(future)
+
+
+async def _create_server(self, *args, **kwargs):
+    # Pyodide's loop raises a bare NotImplementedError from deep inside
+    # asyncio, which tells a reader nothing about why their server will not
+    # start. Naming the limit is the least this can do until the container can
+    # route connections to Python.
+    raise NotImplementedError(
+        "this container cannot yet accept network connections from Python: "
+        "asyncio's create_server is not implemented on Pyodide's event loop, "
+        "so an ASGI/WSGI server such as uvicorn will install and import but "
+        "not bind a port. Outbound requests do work."
+    )
+
+
+def _install_asyncio():
+    asyncio.run = _run
+    asyncio.runners.run = _run
+    loop_type = type(asyncio.get_event_loop())
+    loop_type.run_until_complete = _run_until_complete
+    loop_type.create_server = _create_server
+
+
+_install_asyncio()
+`;
+var NETWORK_PY = `
+import builtins, email.message, io, sys, urllib.error, urllib.request, urllib.response
+import _sbx_host as _host
+from pyodide.ffi import can_run_sync, run_sync
+
+
+def _fetch(request):
+    if not can_run_sync():
+        raise urllib.error.URLError(
+            "cannot make a request on this host: WebAssembly stack switching "
+            "(JSPI) is unavailable."
+        )
+    body = request.data
+    if isinstance(body, str):
+        body = body.encode()
+    try:
+        result = run_sync(
+            _host.http(
+                request.full_url,
+                request.get_method(),
+                [[k, v] for k, v in request.header_items()],
+                body,
+            )
+        )
+    except Exception as error:
+        raise urllib.error.URLError(str(error)) from None
+
+    headers = email.message.Message()
+    for pair in result.headers.to_py():
+        headers[str(pair[0])] = str(pair[1])
+    payload = result.body.to_bytes()
+    response = urllib.response.addinfourl(
+        io.BytesIO(payload), headers, str(result.url), int(result.status)
+    )
+    response.msg = str(result.statusText)
+    return response
+
+
+class _SbxHTTPHandler(urllib.request.HTTPHandler):
+    """Both schemes, from one handler.
+
+    Pyodide builds urllib without \`ssl\`, so \`HTTPSHandler\` does not exist to
+    subclass \u2014 and https is the scheme most callers actually want. Serving
+    both from a subclass of the one handler that does exist keeps
+    \`build_opener\` treating this as a replacement rather than stacking it
+    alongside the original.
+    """
+
+    def http_open(self, request):
+        return _fetch(request)
+
+    def https_open(self, request):
+        return _fetch(request)
+
+    https_request = urllib.request.HTTPHandler.do_request_
+
+
+def _raw_fetch(url, method, headers, body):
+    """One request, through the container's network path."""
+    if not can_run_sync():
+        raise urllib.error.URLError(
+            "cannot make a request on this host: WebAssembly stack switching "
+            "(JSPI) is unavailable."
+        )
+    if isinstance(body, str):
+        body = body.encode()
+    result = run_sync(
+        _host.http(url, method, [[str(k), str(v)] for k, v in dict(headers).items()], body)
+    )
+    return {
+        "status": int(result.status),
+        "reason": str(result.statusText),
+        "headers": [(str(p[0]), str(p[1])) for p in result.headers.to_py()],
+        "body": result.body.to_bytes(),
+        "url": str(result.url),
+    }
+
+
+# \u2500\u2500 Routing third-party HTTP stacks \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+#
+# A library that brings its own transport does not go through urllib, and in
+# Pyodide several of them reach JavaScript's fetch directly \u2014 which leaves the
+# container's network policy behind entirely. They cannot all be patched at
+# boot either, because pip installs them later.
+#
+# So: adapters are registered by module name and applied the moment that module
+# is first imported, whenever that happens. Supporting another stack is a small
+# function registered here, not a change to the machinery.
+
+_ADAPTERS = {}
+
+
+def _register_adapter(name):
+    def decorate(fn):
+        _ADAPTERS[name] = fn
+        return fn
+
+    return decorate
+
+
+def _apply_adapter(name):
+    fn = _ADAPTERS.pop(name, None)
+    if fn is None:
+        return
+    try:
+        fn()
+    except Exception:
+        # A stack we cannot adapt must not stop the import that triggered it.
+        pass
+
+
+def _install_import_hook():
+    real_import = builtins.__import__
+
+    def hooked(name, globals=None, locals=None, fromlist=(), level=0):
+        module = real_import(name, globals, locals, fromlist, level)
+        root = name.split(".")[0] if level == 0 else None
+        if root in _ADAPTERS:
+            _apply_adapter(root)
+        return module
+
+    builtins.__import__ = hooked
+
+
+@_register_adapter("requests")
+def _adapt_requests():
+    """Replace the transport, not the API.
+
+    \`HTTPAdapter.send\` is the single seam every requests call passes through,
+    below sessions, redirects, cookies and retries and above the urllib3
+    transport that would otherwise reach the network on its own. Replacing it
+    leaves everything callers actually use intact.
+    """
+    import requests
+    from requests.adapters import HTTPAdapter
+    from requests.structures import CaseInsensitiveDict
+
+    native_send = HTTPAdapter.send
+
+    def send(self, request, stream=False, timeout=None, verify=True, cert=None, proxies=None):
+        if not can_run_sync():
+            # Without stack switching this transport cannot run at all. Falling
+            # back to the library's own is better than breaking requests on
+            # such a host \u2014 but the container's network policy is not the part
+            # that degrades, so a forbidden host is still refused.
+            if not _host.policy_allows(request.url):
+                raise requests.exceptions.ConnectionError(
+                    "outbound network access is disabled for this container "
+                    "(enable with network: { allowOutbound: true })"
+                )
+            return native_send(self, request, stream, timeout, verify, cert, proxies)
+        try:
+            result = _raw_fetch(request.url, request.method, request.headers, request.body)
+        except Exception as error:
+            raise requests.exceptions.ConnectionError(str(error)) from None
+        response = requests.Response()
+        response.status_code = result["status"]
+        response.reason = result["reason"]
+        response.headers = CaseInsensitiveDict(result["headers"])
+        response.url = result["url"]
+        response.request = request
+        response.raw = io.BytesIO(result["body"])
+        response.encoding = requests.utils.get_encoding_from_headers(response.headers)
+        return response
+
+    HTTPAdapter.send = send
+
+
+def _install_network():
+    urllib.request.HTTPHandler = _SbxHTTPHandler
+    urllib.request.HTTPSHandler = _SbxHTTPHandler
+    urllib.request.install_opener(urllib.request.build_opener(_SbxHTTPHandler))
+    _install_import_hook()
+    for already_imported in [n for n in _ADAPTERS if n in sys.modules]:
+        _apply_adapter(already_imported)
+
+
+_install_network()
+`;
+async function httpForPython(slot, url, method, headers, body) {
+  const current = slot.current;
+  if (!current) throw new Error("no program is bound");
+  const result = await performRequest(current.ctx, new URL(url), {
+    method,
+    headers: Object.fromEntries(headers),
+    ...body ? { body } : {}
+  });
+  return {
+    status: result.status,
+    statusText: result.statusText,
+    headers: Object.entries(result.headers),
+    body: result.body,
+    url: result.url
+  };
+}
+async function resuming(py, slot, work) {
+  const parent = slot.current;
+  try {
+    return await work();
+  } finally {
+    if (parent && slot.current !== parent) bindProgram(py, parent);
+  }
+}
 function installSyscallBridge(py) {
-  const slot = py.__sbxStdin ??= { active: null };
+  const slot = py.__sbxSlot ??= { current: null };
+  const children = /* @__PURE__ */ new Map();
+  let lastChildId = 0;
   py.registerJsModule("_sbx_host", {
     /* Not `?.` and `??`: `buffered` returns undefined to mean "you will have
      * to wait", and a nullish default would quietly turn that into end-of-file —
      * which is exactly the silent EOF this bridge exists to remove. */
-    buffered: (size) => slot.active ? slot.active.buffered(size) : EMPTY,
-    read: (size) => slot.active ? slot.active.read(size) : Promise.resolve(EMPTY),
-    isatty: () => slot.active?.isatty() ?? false
+    buffered: (size) => slot.current ? slot.current.stdin.buffered(size) : EMPTY,
+    read: (size) => slot.current ? slot.current.stdin.read(size) : Promise.resolve(EMPTY),
+    isatty: () => slot.current?.stdin.isatty() ?? false,
+    proc_start: (argv, cwd, env2, merge) => {
+      const current = slot.current;
+      if (!current) throw new Error("no program is bound");
+      const { ctx } = current;
+      const stdin = new Pipe();
+      stdin.interactive = true;
+      const stdout = new Pipe();
+      const stderr = merge ? stdout : new Pipe();
+      const proc = ctx.kernel.spawn(argv, {
+        cwd: cwd ?? ctx.cwd,
+        env: env2 ?? ctx.env,
+        cred: ctx.cred,
+        stdin,
+        stdout,
+        stderr
+      });
+      void proc.wait().then(() => {
+        stdout.end();
+        if (stderr !== stdout) stderr.end();
+      });
+      const id = ++lastChildId;
+      children.set(id, { proc, stdin, stdout, stderr });
+      return id;
+    },
+    proc_read: (id, which2, size) => {
+      const child = children.get(id);
+      if (!child) return Promise.resolve(EMPTY);
+      const pipe = which2 === 2 ? child.stderr : child.stdout;
+      return resuming(py, slot, async () => await pipe.read(size) ?? EMPTY);
+    },
+    proc_write: (id, text2) => {
+      children.get(id)?.stdin.write(text2);
+    },
+    proc_close_stdin: (id) => {
+      children.get(id)?.stdin.end();
+    },
+    /* Non-blocking on purpose: `poll()` must be able to say "still running". */
+    proc_poll: (id) => children.get(id)?.proc.exitCode ?? void 0,
+    proc_pid: (id) => children.get(id)?.proc.pid ?? 0,
+    proc_wait: (id) => {
+      const child = children.get(id);
+      if (!child) return Promise.resolve(0);
+      return resuming(py, slot, () => child.proc.wait());
+    },
+    proc_kill: (id, signal) => {
+      const child = children.get(id);
+      if (!child) return;
+      const current = slot.current;
+      current?.ctx.kernel.procs.signal(child.proc.pid, signal);
+    },
+    proc_release: (id) => {
+      children.delete(id);
+    },
+    http: (url, method, headers, body) => resuming(py, slot, () => httpForPython(slot, url, method, headers, body)),
+    /* So Python can enforce the container's policy even on a host where it
+     * cannot route the request itself. */
+    policy_allows: (url) => {
+      const current = slot.current;
+      if (!current) return false;
+      const net = current.ctx.kernel.net;
+      try {
+        return net.isLocal(new URL(url).hostname) || net.outboundAllowed(url);
+      } catch {
+        return false;
+      }
+    }
   });
   py.runPython(BRIDGE_PY);
+  py.runPython(PROCESS_PY);
+  py.runPython(NETWORK_PY);
+  py.runPython(ASYNCIO_PY);
 }
-function bindStdin(py, host2) {
-  py.__sbxStdin.active = host2;
+function bindProgram(py, binding) {
+  py.__sbxSlot.current = binding;
+  const { ctx, stdin } = binding;
+  const decoder8 = new TextDecoder();
+  py.setStdout({
+    write: (buffer) => (ctx.write(decoder8.decode(buffer)), buffer.length)
+  });
+  py.setStderr({
+    write: (buffer) => (ctx.stderr.write(decoder8.decode(buffer)), buffer.length)
+  });
+  py.setStdin({
+    read: (buffer) => {
+      const ready = stdin.buffered(buffer.length);
+      if (!ready || ready.length === 0) return 0;
+      buffer.set(ready);
+      return ready.length;
+    }
+  });
 }
 
 // src/runtime/cpython.ts
@@ -18128,30 +18728,9 @@ async function runCPythonProgram(ctx, source, argv, scriptDir = null) {
     });
   } catch {
   }
-  const decoder8 = new TextDecoder();
-  py.setStdout({
-    write: (buffer) => {
-      ctx.write(decoder8.decode(buffer));
-      return buffer.length;
-    }
-  });
-  py.setStderr({
-    write: (buffer) => {
-      ctx.stderr.write(decoder8.decode(buffer));
-      return buffer.length;
-    }
-  });
   const stdinHost = createStdinHost(ctx);
   await stdinHost.prime();
-  bindStdin(py, stdinHost);
-  py.setStdin({
-    read: (buffer) => {
-      const ready = stdinHost.buffered(buffer.length);
-      if (!ready || ready.length === 0) return 0;
-      buffer.set(ready);
-      return ready.length;
-    }
-  });
+  bindProgram(py, { ctx, stdin: stdinHost });
   try {
     bootstrap(py, ctx, argv, scriptDir);
   } catch (error) {
@@ -18190,9 +18769,7 @@ async function runCPythonRepl(ctx) {
   }
   mountContainerDirs(py, ctx);
   bootstrap(py, ctx, [""], null);
-  const decoder8 = new TextDecoder();
-  py.setStdout({ write: (data) => (ctx.write(decoder8.decode(data)), data.length) });
-  py.setStderr({ write: (data) => (ctx.stderr.write(decoder8.decode(data)), data.length) });
+  bindProgram(py, { ctx, stdin: createStdinHost(ctx) });
   ctx.line(`Python ${String(py.runPython("import sys; sys.version.split()[0]"))} (Pyodide)`);
   ctx.line('Type "help()" for more information.');
   let source = "";
@@ -18215,6 +18792,67 @@ async function runCPythonRepl(ctx) {
   }
   return 0;
 }
+var PIP_PY = `
+import json, re
+
+import micropip
+
+_MISSING = re.compile(r"Can't find a pure Python 3 wheel for '([^']+)'")
+_EXTRAS = re.compile(r"^\\s*([A-Za-z0-9._-]+)\\s*\\[([^\\]]+)\\](.*)$")
+
+
+def _name_of(spec):
+    return re.split(r"[\\[<>=!~;\\s]", spec.strip(), 1)[0]
+
+
+def _installed_version(name):
+    try:
+        found = micropip.list()[name.replace("_", "-").lower()]
+        return getattr(found, "version", None)
+    except Exception:
+        return None
+
+
+async def _install_one(spec):
+    """Install one requirement, retrying without extras if they are impossible."""
+    attempt = spec
+    dropped = None
+    while True:
+        try:
+            await micropip.install(attempt)
+        except ValueError as error:
+            message = str(error)
+            missing = _MISSING.findall(message)
+            extras = _EXTRAS.match(attempt)
+            if missing and extras and dropped is None:
+                dropped = [e.strip() for e in extras.group(2).split(",")]
+                attempt = extras.group(1) + extras.group(3)
+                continue
+            return {
+                "spec": spec, "ok": False, "missing": missing,
+                "reason": message.strip().split("\\n")[0],
+            }
+        except Exception as error:
+            return {"spec": spec, "ok": False, "missing": [], "reason": str(error).strip().split("\\n")[0]}
+
+        name = _name_of(attempt)
+        return {
+            "spec": spec, "ok": True, "name": name,
+            "version": _installed_version(name), "dropped": dropped,
+        }
+
+
+async def __sbx_pip(specs_json):
+    results = []
+    for spec in json.loads(specs_json):
+        try:
+            results.append(await _install_one(spec))
+        except Exception as error:
+            results.append({"spec": spec, "ok": False, "missing": [], "reason": str(error)})
+    return json.dumps(results)
+
+__sbx_pip
+`;
 var micropip = defineCommand({
   name: "micropip",
   path: "/usr/bin/micropip",
@@ -18252,6 +18890,12 @@ var micropip = defineCommand({
       ctx.stderr.write("pip: no packages specified\n");
       return 1;
     }
+    if (!ctx.kernel.net.outboundAllowed("https://pypi.org")) {
+      ctx.stderr.write(
+        "pip: outbound network access is disabled for this container (enable with network: { allowOutbound: true })\n"
+      );
+      return 1;
+    }
     let py;
     try {
       py = await interpreterFor(ctx);
@@ -18259,22 +18903,42 @@ var micropip = defineCommand({
       ctx.stderr.write("pip: Pyodide is unavailable in this host\n");
       return 127;
     }
+    let outcomes;
     try {
       await py.loadPackage("micropip");
-      const micropipModule = py.pyimport("micropip");
-      for (const name of packages) {
-        ctx.line(`Collecting ${name}`);
-        await micropipModule.install(name);
-        ctx.line(`Successfully installed ${name}`);
-      }
-      return 0;
+      for (const name of packages) ctx.line(`Collecting ${name}`);
+      const install2 = py.runPython(PIP_PY);
+      outcomes = JSON.parse(String(await install2(JSON.stringify(packages))));
     } catch (error) {
       ctx.stderr.write(
-        `Package installation failed: ${error instanceof Error ? error.message : String(error)}
+        `pip: installation failed: ${error instanceof Error ? error.message : String(error)}
 `
       );
       return 1;
     }
+    const installed2 = [];
+    for (const outcome of outcomes) {
+      if (outcome.ok) {
+        installed2.push(
+          outcome.version ? `${outcome.name}-${outcome.version}` : String(outcome.name)
+        );
+        if (outcome.dropped?.length) {
+          ctx.stderr.write(
+            `  WARNING: ${outcome.name}: the ${outcome.dropped.map((extra) => `'${extra}'`).join(", ")} extra needs native code with no WebAssembly build; installed ${outcome.name} without it
+`
+          );
+        }
+        continue;
+      }
+      const missing = outcome.missing ?? [];
+      ctx.stderr.write(
+        missing.length > 0 ? `ERROR: could not install ${outcome.spec}: no WebAssembly build exists for ${missing.map((name) => name.split(/[<>=!~;\s]/)[0]).join(", ")}
+` : `ERROR: could not install ${outcome.spec}: ${outcome.reason ?? "unknown error"}
+`
+      );
+    }
+    if (installed2.length > 0) ctx.line(`Successfully installed ${installed2.join(" ")}`);
+    return outcomes.every((outcome) => outcome.ok) ? 0 : 1;
   }
 });