sandboxedjs 0.1.47 → 0.1.49

package/dist/python-worker.js

@@ -0,0 +1,865 @@
+// src/runtime/python/host-abi.ts
+var SBX_HOST_ABI_VERSION = 1;
+var SBX_REQUEST_HEADER_BYTES = 16;
+var SBX_RESPONSE_HEADER_BYTES = 20;
+var Op = {
+  handshake: 0,
+  openat: 1,
+  close: 2,
+  read: 3,
+  write: 4,
+  pread: 5,
+  pwrite: 6,
+  lseek: 7,
+  fstat: 8,
+  statat: 9,
+  ftruncate: 10,
+  renameat: 11,
+  unlinkat: 12,
+  mkdirat: 13,
+  readlinkat: 14,
+  symlinkat: 15,
+  getdents: 16,
+  fsync: 17,
+  dup: 256,
+  dup2: 257,
+  get_flags: 258,
+  set_flags: 259,
+  pipe: 512,
+  poll: 768,
+  clock_gettime: 1024,
+  sleep: 1025,
+  getpid: 1280,
+  getcwd: 1281,
+  chdir: 1282,
+  environ: 1283,
+  getrandom: 1536
+};
+var Errno = {
+  EPERM: 1,
+  ENOENT: 2,
+  ESRCH: 3,
+  EINTR: 4,
+  EIO: 5,
+  ENXIO: 6,
+  E2BIG: 7,
+  EBADF: 9,
+  EAGAIN: 11,
+  ENOMEM: 12,
+  EACCES: 13,
+  EFAULT: 14,
+  EBUSY: 16,
+  EEXIST: 17,
+  EXDEV: 18,
+  ENODEV: 19,
+  ENOTDIR: 20,
+  EISDIR: 21,
+  EINVAL: 22,
+  ENFILE: 23,
+  EMFILE: 24,
+  ENOTTY: 25,
+  EFBIG: 27,
+  ENOSPC: 28,
+  ESPIPE: 29,
+  EROFS: 30,
+  EMLINK: 31,
+  EPIPE: 32,
+  ERANGE: 34,
+  ENAMETOOLONG: 36,
+  ENOSYS: 38,
+  ENOTEMPTY: 39,
+  ELOOP: 40,
+  ENODATA: 61,
+  EPROTO: 71,
+  EOVERFLOW: 75,
+  ETIMEDOUT: 110,
+  ECANCELED: 125,
+  EDQUOT: 122
+};
+var OP_NAMES = Object.fromEntries(
+  Object.entries(Op).map(([name, code]) => [code, name])
+);
+var ERRNO_NAMES = Object.fromEntries(
+  Object.entries(Errno).map(([name, code]) => [code, name])
+);
+
+// src/runtime/python/protocol.ts
+var ProtocolError = class extends Error {
+  code = "ERR_SBX_ABI_PROTOCOL";
+};
+function encodeRequest(header, payload) {
+  const frame = new Uint8Array(SBX_REQUEST_HEADER_BYTES + payload.length);
+  const view = new DataView(frame.buffer);
+  view.setUint16(0, header.version, true);
+  view.setUint16(2, header.op, true);
+  view.setUint32(4, header.requestId, true);
+  view.setUint32(8, header.generation, true);
+  view.setUint32(12, payload.length, true);
+  frame.set(payload, SBX_REQUEST_HEADER_BYTES);
+  return frame;
+}
+function decodeResponse(frame, expected) {
+  if (frame.length < SBX_RESPONSE_HEADER_BYTES) {
+    throw new ProtocolError("the host ABI transport returned an incomplete frame");
+  }
+  const view = new DataView(frame.buffer, frame.byteOffset, frame.byteLength);
+  const header = {
+    version: view.getUint16(0, true),
+    op: view.getUint16(2, true),
+    requestId: view.getUint32(4, true),
+    generation: view.getUint32(8, true)
+  };
+  const status = view.getInt32(12, true);
+  const length = view.getUint32(16, true);
+  if (frame.length - SBX_RESPONSE_HEADER_BYTES < length) throw new ProtocolError("truncated response payload");
+  if (expected) {
+    if (header.requestId !== expected.requestId) throw new ProtocolError("stale response: request id mismatch");
+    if (header.generation !== expected.generation) throw new ProtocolError("stale response: process generation mismatch");
+    if (header.op !== expected.op) throw new ProtocolError("response answers a different operation");
+  }
+  if (header.version !== SBX_HOST_ABI_VERSION) {
+    throw new ProtocolError(`host ABI version ${header.version}, expected ${SBX_HOST_ABI_VERSION}`);
+  }
+  return {
+    header,
+    status,
+    payload: frame.subarray(SBX_RESPONSE_HEADER_BYTES, SBX_RESPONSE_HEADER_BYTES + length)
+  };
+}
+var Reader = class {
+  at = 0;
+  view;
+  bytes;
+  constructor(bytes) {
+    this.bytes = bytes;
+    this.view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  }
+  need(count) {
+    if (this.at + count > this.bytes.length) throw new ProtocolError("payload underrun");
+    const offset = this.at;
+    this.at += count;
+    return offset;
+  }
+  i32() {
+    return this.view.getInt32(this.need(4), true);
+  }
+  u32() {
+    return this.view.getUint32(this.need(4), true);
+  }
+  i64() {
+    return Number(this.view.getBigInt64(this.need(8), true));
+  }
+  u64() {
+    return Number(this.view.getBigUint64(this.need(8), true));
+  }
+  bytes32() {
+    const length = this.u32();
+    const offset = this.need(length);
+    return this.bytes.subarray(offset, offset + length);
+  }
+  string() {
+    return new TextDecoder().decode(this.bytes32());
+  }
+  get remaining() {
+    return this.bytes.length - this.at;
+  }
+};
+var Writer = class {
+  parts = [];
+  i32(value) {
+    const b = new Uint8Array(4);
+    new DataView(b.buffer).setInt32(0, value, true);
+    this.parts.push(b);
+    return this;
+  }
+  u32(value) {
+    const b = new Uint8Array(4);
+    new DataView(b.buffer).setUint32(0, value >>> 0, true);
+    this.parts.push(b);
+    return this;
+  }
+  i64(value) {
+    const b = new Uint8Array(8);
+    new DataView(b.buffer).setBigInt64(0, BigInt(Math.trunc(value)), true);
+    this.parts.push(b);
+    return this;
+  }
+  u64(value) {
+    const b = new Uint8Array(8);
+    new DataView(b.buffer).setBigUint64(0, BigInt(Math.trunc(value)), true);
+    this.parts.push(b);
+    return this;
+  }
+  bytes32(value) {
+    this.u32(value.length);
+    this.parts.push(value);
+    return this;
+  }
+  string(value) {
+    return this.bytes32(new TextEncoder().encode(value));
+  }
+  finish() {
+    const total = this.parts.reduce((sum, part) => sum + part.length, 0);
+    const out = new Uint8Array(total);
+    let at = 0;
+    for (const part of this.parts) {
+      out.set(part, at);
+      at += part.length;
+    }
+    return out;
+  }
+};
+
+// src/runtime/python/syscall-client.ts
+var HostAbiError = class extends Error {
+  errno;
+  code;
+  constructor(errno, op) {
+    const name = ERRNO_NAMES[errno] ?? String(errno);
+    super(`${OP_NAMES[op] ?? `op ${op}`} failed: ${name}`);
+    this.errno = errno;
+    this.code = name;
+  }
+};
+var HostAbiClient = class {
+  transport;
+  generation;
+  nextRequestId = 1;
+  constructor(transport, generation) {
+    this.transport = transport;
+    this.generation = generation;
+  }
+  /** Send one frame, blocking. Returns the status and payload verbatim. */
+  callRaw(op, payload) {
+    const header = {
+      version: SBX_HOST_ABI_VERSION,
+      op,
+      requestId: this.nextRequestId++,
+      generation: this.generation
+    };
+    const frame = this.transport.call(encodeRequest(header, payload));
+    const response = decodeResponse(frame, header);
+    return { status: response.status, payload: response.payload };
+  }
+  /** As {@link callRaw}, but a negative status becomes an exception. */
+  call(op, payload) {
+    const result = this.callRaw(op, payload);
+    if (result.status < 0) throw new HostAbiError(-result.status, op);
+    return result;
+  }
+  handshake() {
+    const { payload } = this.call(Op.handshake, new Uint8Array());
+    const r = new Reader(payload);
+    const version = r.u32();
+    const count = r.u32();
+    const capabilities = {};
+    for (let i = 0; i < count; i += 1) capabilities[r.string()] = r.u32() === 1;
+    return { version, capabilities };
+  }
+  open(path, flags, mode = 438) {
+    return this.call(Op.openat, new Writer().string(path).u32(flags).u32(mode).finish()).status;
+  }
+  close(fd) {
+    this.call(Op.close, new Writer().i32(fd).finish());
+  }
+  read(fd, length) {
+    return this.call(Op.read, new Writer().i32(fd).u32(length).finish()).payload;
+  }
+  write(fd, data) {
+    return this.call(Op.write, new Writer().i32(fd).bytes32(data).finish()).status;
+  }
+  /** Write every byte, looping over short writes the way a guest's libc must. */
+  writeAll(fd, data) {
+    let at = 0;
+    while (at < data.length) at += this.write(fd, data.subarray(at));
+  }
+  pread(fd, length, offset) {
+    return this.call(Op.pread, new Writer().i32(fd).u32(length).u64(offset).finish()).payload;
+  }
+  pwrite(fd, data, offset) {
+    return this.call(Op.pwrite, new Writer().i32(fd).bytes32(data).u64(offset).finish()).status;
+  }
+  seek(fd, offset, whence) {
+    const { payload } = this.call(Op.lseek, new Writer().i32(fd).i64(offset).u32(whence).finish());
+    return new Reader(payload).i64();
+  }
+  fstat(fd) {
+    return decodeStat(this.call(Op.fstat, new Writer().i32(fd).finish()).payload);
+  }
+  stat(path, followLinks = true) {
+    return decodeStat(
+      this.call(Op.statat, new Writer().string(path).u32(followLinks ? 1 : 0).finish()).payload
+    );
+  }
+  ftruncate(fd, length) {
+    this.call(Op.ftruncate, new Writer().i32(fd).u64(length).finish());
+  }
+  rename(from, to) {
+    this.call(Op.renameat, new Writer().string(from).string(to).finish());
+  }
+  unlink(path, removeDirectory = false) {
+    this.call(Op.unlinkat, new Writer().string(path).u32(removeDirectory ? 1 : 0).finish());
+  }
+  mkdir(path, mode = 511) {
+    this.call(Op.mkdirat, new Writer().string(path).u32(mode).finish());
+  }
+  readdir(fd, bufferSize = 4096) {
+    const { payload } = this.call(Op.getdents, new Writer().i32(fd).u32(bufferSize).finish());
+    const text = new TextDecoder().decode(payload);
+    return text.split("\0").filter((name) => name.length > 0);
+  }
+  dup(fd, from = 0) {
+    return this.call(Op.dup, new Writer().i32(fd).u32(from).finish()).status;
+  }
+  dup2(fd, target) {
+    return this.call(Op.dup2, new Writer().i32(fd).i32(target).finish()).status;
+  }
+  getFlags(fd) {
+    const r = new Reader(this.call(Op.get_flags, new Writer().i32(fd).finish()).payload);
+    return { flags: r.u32(), cloexec: r.u32() === 1 };
+  }
+  setFlags(fd, flags, cloexec) {
+    this.call(Op.set_flags, new Writer().i32(fd).u32(flags).u32(cloexec ? 1 : 0).finish());
+  }
+  pipe(flags = 0) {
+    const r = new Reader(this.call(Op.pipe, new Writer().u32(flags).finish()).payload);
+    return [r.i32(), r.i32()];
+  }
+  poll(entries, timeoutMs) {
+    const w = new Writer().u32(entries.length);
+    for (const entry of entries) w.i32(entry.fd).u32(entry.events);
+    w.i64(timeoutMs);
+    const r = new Reader(this.call(Op.poll, w.finish()).payload);
+    const count = r.u32();
+    const out = [];
+    for (let i = 0; i < count; i += 1) out.push({ fd: r.i32(), revents: r.u32() });
+    return out;
+  }
+  clockGettime(monotonic) {
+    const r = new Reader(this.call(Op.clock_gettime, new Writer().u32(monotonic ? 1 : 0).finish()).payload);
+    return { seconds: r.i64(), nanos: r.u32() };
+  }
+  sleep(nanos) {
+    this.call(Op.sleep, new Writer().u64(nanos).finish());
+  }
+  identity() {
+    const r = new Reader(this.call(Op.getpid, new Uint8Array()).payload);
+    return { pid: r.i32(), ppid: r.i32(), uid: r.u32(), gid: r.u32(), umask: r.u32() };
+  }
+  getcwd() {
+    return new Reader(this.call(Op.getcwd, new Uint8Array()).payload).string();
+  }
+  chdir(path) {
+    this.call(Op.chdir, new Writer().string(path).finish());
+  }
+  environ() {
+    const joined = new Reader(this.call(Op.environ, new Uint8Array()).payload).string();
+    const out = {};
+    for (const entry of joined.split("\0")) {
+      if (!entry) continue;
+      const split = entry.indexOf("=");
+      out[entry.slice(0, split)] = entry.slice(split + 1);
+    }
+    return out;
+  }
+  getrandom(length) {
+    return this.call(Op.getrandom, new Writer().u32(length).finish()).payload;
+  }
+};
+function decodeStat(payload) {
+  const r = new Reader(payload);
+  return {
+    ino: r.u64(),
+    mode: r.u32(),
+    size: r.u64(),
+    uid: r.u32(),
+    gid: r.u32(),
+    nlink: r.u32(),
+    atimeNs: r.i64(),
+    mtimeNs: r.i64(),
+    ctimeNs: r.i64()
+  };
+}
+
+// src/runtime/python/sync-transport.ts
+var STATE = 0;
+var LENGTH = 1;
+var MORE = 2;
+var STATE_IDLE = 0;
+var STATE_REQUEST = 1;
+var STATE_RESPONSE = 2;
+var STATE_CONTINUE = 3;
+var STATE_CLOSED = 4;
+var WAIT_SLICE_MS = 200;
+var HostTransportError = class extends Error {
+  code = "ERR_SBX_HOST_TRANSPORT";
+};
+var HostCallClient = class {
+  control;
+  data;
+  capacity;
+  wake;
+  closed = false;
+  constructor(buffers, wake) {
+    this.control = new Int32Array(buffers.control);
+    this.data = new Uint8Array(buffers.data);
+    this.capacity = this.data.length;
+    this.wake = wake;
+  }
+  /** Send a frame and block until the whole answer is back. Never returns empty. */
+  call(request) {
+    if (this.closed || Atomics.load(this.control, STATE) === STATE_CLOSED) {
+      this.closed = true;
+      throw new HostTransportError("the host transport is closed");
+    }
+    this.send(request);
+    const response = this.receive();
+    if (response.length === 0) {
+      throw new HostTransportError("the host answered with no frame; the kernel side failed or went away");
+    }
+    return response;
+  }
+  send(request) {
+    let offset = 0;
+    for (; ; ) {
+      const size = Math.min(this.capacity, request.length - offset);
+      this.data.set(request.subarray(offset, offset + size), 0);
+      offset += size;
+      Atomics.store(this.control, LENGTH, size);
+      Atomics.store(this.control, MORE, offset < request.length ? 1 : 0);
+      this.publish(STATE_REQUEST);
+      const next = this.waitWhile(STATE_REQUEST);
+      if (next === STATE_RESPONSE) return;
+      if (next !== STATE_CONTINUE) {
+        this.closed = true;
+        throw new HostTransportError("the host went away mid-request");
+      }
+    }
+  }
+  receive() {
+    const parts = [];
+    let total = 0;
+    for (; ; ) {
+      const size = Atomics.load(this.control, LENGTH);
+      parts.push(this.data.slice(0, size));
+      total += size;
+      if (Atomics.load(this.control, MORE) === 0) break;
+      this.publish(STATE_CONTINUE);
+      if (this.waitWhile(STATE_CONTINUE) !== STATE_RESPONSE) {
+        this.closed = true;
+        throw new HostTransportError("the host went away mid-response");
+      }
+    }
+    Atomics.store(this.control, STATE, STATE_IDLE);
+    if (parts.length === 1) return parts[0];
+    const joined = new Uint8Array(total);
+    let at = 0;
+    for (const part of parts) {
+      joined.set(part, at);
+      at += part.length;
+    }
+    return joined;
+  }
+  publish(state) {
+    Atomics.store(this.control, STATE, state);
+    Atomics.notify(this.control, STATE);
+    this.wake();
+  }
+  waitWhile(state) {
+    for (; ; ) {
+      Atomics.wait(this.control, STATE, state, WAIT_SLICE_MS);
+      const current = Atomics.load(this.control, STATE);
+      if (current !== state) return current;
+    }
+  }
+};
+
+// src/runtime/python/sbxfs.ts
+var S_IFDIR = 16384;
+function createSbxFs(FS, client, errnoCodes) {
+  const translate = (canonical) => {
+    const name = ERRNO_NAMES[canonical];
+    const mapped = name ? errnoCodes[name] : void 0;
+    return mapped ?? errnoCodes.EIO ?? canonical;
+  };
+  const raise = (canonical) => {
+    throw new FS.ErrnoError(translate(canonical));
+  };
+  const fail = (error) => {
+    if (error instanceof HostAbiError) return raise(error.errno);
+    return raise(Errno.EIO);
+  };
+  const SBXFS = {
+    /** Where this mount sits in the guest's namespace, and where in the container. */
+    mount(mount) {
+      return SBXFS.createNode(null, "/", S_IFDIR | 511, 0);
+    },
+    createNode(parent, name, mode, dev) {
+      if (!FS.isDir(mode) && !FS.isFile(mode) && !FS.isLink(mode)) raise(Errno.EINVAL);
+      const node = FS.createNode(parent, name, mode, dev);
+      node.node_ops = SBXFS.node_ops;
+      node.stream_ops = SBXFS.stream_ops;
+      return node;
+    },
+    /** The container path a guest node stands for. */
+    realPath(node) {
+      const parts = [];
+      let current = node;
+      while (current.parent !== current) {
+        parts.push(current.name);
+        current = current.parent;
+      }
+      parts.push(current.mount.opts.root);
+      parts.reverse();
+      return parts.join("/").replace(/\/+/g, "/");
+    },
+    node_ops: {
+      getattr(node) {
+        const path = SBXFS.realPath(node);
+        let stat;
+        try {
+          stat = client.stat(path, false);
+        } catch (error) {
+          return fail(error);
+        }
+        return {
+          dev: 1,
+          ino: stat.ino,
+          mode: stat.mode,
+          nlink: stat.nlink,
+          uid: stat.uid,
+          gid: stat.gid,
+          rdev: 0,
+          size: stat.size,
+          atime: new Date(stat.atimeNs / 1e6),
+          mtime: new Date(stat.mtimeNs / 1e6),
+          ctime: new Date(stat.ctimeNs / 1e6),
+          /* Emscripten sizes its own reads from this; a wrong block size shows
+           * up as short reads on large files rather than as an error. */
+          blksize: 4096,
+          blocks: Math.ceil(stat.size / 4096)
+        };
+      },
+      setattr(node, attr) {
+        const path = SBXFS.realPath(node);
+        try {
+          if (attr.size !== void 0) {
+            const fd = client.open(
+              path,
+              1
+              /* O_WRONLY */
+            );
+            try {
+              client.ftruncate(fd, attr.size);
+            } finally {
+              client.close(fd);
+            }
+          }
+        } catch (error) {
+          fail(error);
+        }
+      },
+      lookup(parent, name) {
+        const path = `${SBXFS.realPath(parent)}/${name}`.replace(/\/+/g, "/");
+        let stat;
+        try {
+          stat = client.stat(path, false);
+        } catch (error) {
+          if (error instanceof HostAbiError && error.errno === Errno.ENOENT) raise(Errno.ENOENT);
+          return fail(error);
+        }
+        const node = SBXFS.createNode(parent, name, stat.mode, 0);
+        node.node_ops = SBXFS.node_ops;
+        node.stream_ops = SBXFS.stream_ops;
+        return node;
+      },
+      mknod(parent, name, mode, dev) {
+        const path = `${SBXFS.realPath(parent)}/${name}`.replace(/\/+/g, "/");
+        try {
+          if ((mode & S_IFDIR) === S_IFDIR) client.mkdir(path, mode & 511);
+          else {
+            const fd = client.open(path, 1 | 64, mode & 511);
+            client.close(fd);
+          }
+        } catch (error) {
+          fail(error);
+        }
+        return SBXFS.createNode(parent, name, mode, dev);
+      },
+      rename(node, newParent, newName) {
+        const from = SBXFS.realPath(node);
+        const to = `${SBXFS.realPath(newParent)}/${newName}`.replace(/\/+/g, "/");
+        try {
+          client.rename(from, to);
+        } catch (error) {
+          fail(error);
+        }
+        node.name = newName;
+        node.parent = newParent;
+      },
+      unlink(parent, name) {
+        const path = `${SBXFS.realPath(parent)}/${name}`.replace(/\/+/g, "/");
+        try {
+          client.unlink(path, false);
+        } catch (error) {
+          fail(error);
+        }
+      },
+      rmdir(parent, name) {
+        const path = `${SBXFS.realPath(parent)}/${name}`.replace(/\/+/g, "/");
+        try {
+          client.unlink(path, true);
+        } catch (error) {
+          fail(error);
+        }
+      },
+      readdir(node) {
+        const path = SBXFS.realPath(node);
+        try {
+          const fd = client.open(
+            path,
+            0
+            /* O_RDONLY */
+          );
+          try {
+            const names = [];
+            for (; ; ) {
+              const batch = client.readdir(fd, 8192);
+              if (batch.length === 0) break;
+              names.push(...batch);
+            }
+            return names;
+          } finally {
+            client.close(fd);
+          }
+        } catch (error) {
+          return fail(error);
+        }
+      },
+      symlink() {
+        raise(Errno.ENOSYS);
+      },
+      readlink() {
+        return raise(Errno.EINVAL);
+      }
+    },
+    stream_ops: {
+      open(stream) {
+        const path = SBXFS.realPath(stream.node);
+        if (FS.isDir(stream.node.mode)) return;
+        try {
+          stream.sbxFd = client.open(
+            path,
+            stream.flags & ~524288
+            /* drop O_CLOEXEC */
+          );
+        } catch (error) {
+          fail(error);
+        }
+      },
+      close(stream) {
+        if (stream.sbxFd === void 0) return;
+        try {
+          client.close(stream.sbxFd);
+        } catch {
+        }
+        stream.sbxFd = void 0;
+      },
+      read(stream, buffer, offset, length, position) {
+        if (length === 0) return 0;
+        try {
+          const data = client.pread(stream.sbxFd, length, position);
+          buffer.set(data, offset);
+          return data.length;
+        } catch (error) {
+          return fail(error);
+        }
+      },
+      write(stream, buffer, offset, length, position) {
+        if (length === 0) return 0;
+        try {
+          return client.pwrite(stream.sbxFd, buffer.subarray(offset, offset + length), position);
+        } catch (error) {
+          return fail(error);
+        }
+      },
+      llseek(stream, offset, whence) {
+        let position = offset;
+        if (whence === 1) position += stream.position;
+        else if (whence === 2 && FS.isFile(stream.node.mode)) {
+          position += SBXFS.node_ops.getattr(stream.node).size;
+        }
+        if (position < 0) raise(Errno.EINVAL);
+        return position;
+      }
+    }
+  };
+  return SBXFS;
+}
+
+// src/runtime/python/worker-entry.ts
+var INTERPRETER_OWNED = /* @__PURE__ */ new Set(["/lib", "/dev", "/proc", "/usr/local"]);
+async function runPythonProcess(start, port) {
+  const transport = new HostCallClient(start.buffers, () => port.postMessage({ type: "wake" }));
+  const stampedCall = (request) => {
+    const stamped = request.slice();
+    new DataView(stamped.buffer).setUint32(8, start.generation, true);
+    return transport.call(stamped);
+  };
+  const client = new HostAbiClient(
+    { call: stampedCall },
+    start.generation
+  );
+  const factory = (await import(
+    /* @vite-ignore */
+    start.moduleUrl
+  )).default;
+  let exitCode = 0;
+  const config = {
+    /* Emscripten resolves `python.wasm` and `python.data` beside its loader;
+     * saying so explicitly survives a host that serves the loader from a
+     * different path than it was built at.
+     *
+     * Under Node the loader reads them with `fs`, which wants a path and not a
+     * `file://` URL — and reports the difference as a bare ENOENT naming the
+     * URL, which reads like a missing file rather than a wrong kind of name. */
+    locateFile: (file) => {
+      const resolved = new URL(file, start.moduleUrl);
+      if (resolved.protocol !== "file:") return resolved.href;
+      return decodeURIComponent(resolved.pathname);
+    },
+    arguments: start.argv,
+    /* Read by the `--wrap`ped `getpid`/`getppid` in library_sbx_posix.js. */
+    sbxPid: start.pid,
+    sbxPpid: start.ppid,
+    quit: (status) => {
+      exitCode = status;
+    }
+  };
+  config.preRun = [
+    () => {
+      mountContainer(config.FS, client, start.mounts, config.ERRNO_CODES ?? {});
+      bindStdio(config.FS, client, start.isTty);
+      for (const [key, value] of Object.entries(start.env)) config.ENV[key] = value;
+      try {
+        config.FS.chdir(start.cwd);
+      } catch {
+      }
+    }
+  ];
+  const module = await factory(config);
+  try {
+    exitCode = module.callMain(start.argv) ?? exitCode;
+  } catch (error) {
+    const status = error.status;
+    if (typeof status === "number") exitCode = status;
+    else {
+      port.postMessage({ type: "failed", message: String(error?.message ?? error) });
+      return;
+    }
+  }
+  port.postMessage({ type: "exit", code: exitCode });
+}
+function mountContainer(FS, client, mounts, errnoCodes) {
+  const SBXFS = createSbxFs(FS, client, errnoCodes);
+  for (const mount of mounts) {
+    if (INTERPRETER_OWNED.has(mount.guest)) continue;
+    try {
+      FS.mkdirTree(mount.guest);
+    } catch {
+    }
+    FS.mount(SBXFS, { root: mount.container }, mount.guest);
+  }
+}
+function bindStdio(FS, client, isTty) {
+  const readByte = () => {
+    const data = client.read(0, 1);
+    return data.length === 0 ? null : data[0];
+  };
+  if (!isTty) {
+    FS.init(readByte, writeThrough(client, 1), writeThrough(client, 2));
+    return;
+  }
+  FS.init(null, null, null);
+  for (const [fd, sink] of [[1, 1], [2, 2]]) {
+    const stream = FS.getStream(fd);
+    if (!stream) continue;
+    stream.stream_ops = {
+      ...stream.stream_ops,
+      write(_stream, buffer, offset, length) {
+        if (length > 0) client.writeAll(sink, buffer.subarray(offset, offset + length));
+        return length;
+      },
+      fsync() {
+        return 0;
+      }
+    };
+  }
+  const stdin = FS.getStream(0);
+  if (stdin) {
+    stdin.stream_ops = {
+      ...stdin.stream_ops,
+      read(_stream, buffer, offset, length) {
+        const data = client.read(0, length);
+        buffer.set(data, offset);
+        return data.length;
+      }
+    };
+  }
+}
+function writeThrough(client, fd) {
+  let pending = [];
+  return (charCode) => {
+    if (charCode === null) {
+      if (pending.length > 0) {
+        client.writeAll(fd, new Uint8Array(pending));
+        pending = [];
+      }
+      return;
+    }
+    pending.push(charCode);
+    if (charCode === 10 || pending.length >= 4096) {
+      client.writeAll(fd, new Uint8Array(pending));
+      pending = [];
+    }
+  };
+}
+
+// src/runtime/python/worker.ts
+async function connect() {
+  const scope = globalThis;
+  if (typeof scope.postMessage === "function" && typeof scope.addEventListener === "function") {
+    const post = scope.postMessage.bind(globalThis);
+    const listen = scope.addEventListener.bind(globalThis);
+    return {
+      port: { postMessage: post },
+      onStart: (handler) => listen("message", (event) => {
+        const data = event.data;
+        if (data?.type === "start") handler(data);
+      })
+    };
+  }
+  const specifier = ["node", "worker_threads"].join(":");
+  const { parentPort } = await import(
+    /* @vite-ignore */
+    /* webpackIgnore: true */
+    specifier
+  );
+  return {
+    port: parentPort,
+    onStart: (handler) => parentPort.on("message", (message) => {
+      const data = message;
+      if (data?.type === "start") handler(data);
+    })
+  };
+}
+void connect().then(({ port, onStart }) => {
+  onStart((start) => {
+    void runPythonProcess(start, port).catch(
+      (error) => port.postMessage({ type: "failed", message: String(error?.message ?? error) })
+    );
+  });
+  port.postMessage({ type: "sandboxedjs:ready" });
+});
+//# sourceMappingURL=python-worker.js.map
+//# sourceMappingURL=python-worker.js.map