sandboxedjs 0.1.5 → 0.1.6

package/README.md

@@ -652,6 +652,25 @@ Honest list of what does not work:
   This affects older toolchains — Vite 4 and its contemporaries. Current Vite ships its Rust
   pipeline as WebAssembly and runs fine, dev server included, as do Express, Koa, Fastify-style
   apps and plain `http` servers.
+- **HTTP request bodies into the container are text, not bytes.** Nodepod decodes a request body
+  as UTF-8 on its way to an in-container server, so any byte above `0x7f` is replaced: five bytes
+  containing `0x89` and `0xff` arrive as nine. Uploading a JPEG or an MP4 by POSTing it to a
+  server running inside the sandbox produces a file of roughly the right size that will not open,
+  and reports no error. This affects `box.request()`, `box.expose()` and the request proxy alike.
+
+  Write the file instead — `box.fs.writeFile(path, bytes)` takes a `Uint8Array` and is exact,
+  which the binary round-trip tests assert byte for byte. To accept an upload from a browser,
+  receive it in *your* server and write the bytes into the container:
+
+  ```js
+  // Express on the host, sandboxedjs holding the workspace.
+  app.post("/upload", async (req, res) => {
+    await box.fs.writeFile(`/workspace/uploads/${req.file.originalname}`, req.file.buffer);
+    res.json({ ok: true });
+  });
+  ```
+
+  Text bodies — JSON APIs, form fields, GraphQL — are unaffected.
 - **Python is MicroPython**, so C extensions (`numpy`, `pandas`, `cryptography`) are unavailable.
 - **No real sockets.** HTTP servers work through the request proxy; raw TCP/UDP does not.
 - **No real processes.** Processes are cooperative async tasks: `kill -9` cannot interrupt a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sandboxedjs",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "A Linux-like container that runs entirely inside Node.js — POSIX shell, ~140 coreutils, Node.js and Python runtimes, virtual filesystem and networking. No Docker, no VM, no native modules.",
   "type": "module",
   "license": "MIT",