sandboxedjs 0.1.5 → 0.1.7

package/README.md

@@ -607,6 +607,30 @@ Those three use dynamic imports, so they only fail if you call them.
 removed and the seam is there, but treat browser support as "should work, unproven" rather than
 a tested claim.
 
+## Uploading files
+
+A file picker in a browser never hands over a path — it hands over the file's bytes. So getting a
+picked file into the container is an ordinary write, and there is nothing to mirror from the host
+disk.
+
+Two ways in, both byte-exact:
+
+```js
+// 1. Directly, when your own server received the upload.
+await box.fs.writeFile("/workspace/uploads/clip.mp4", bytes);   // creates missing directories
+```
+
+```js
+// 2. Through a server running inside the container — a picker in the previewed
+//    app posting to its own backend. Publish the port and upload normally.
+const bridge = await box.expose(3000);
+await fetch(`${bridge.url}/api/upload`, { method: "POST", body: file });
+```
+
+Either way the file lands on the container's filesystem, and `ffmpeg`, Node and Python all see the
+same bytes. Uploads are held in memory like the rest of the filesystem, so a very large video is
+bounded by RAM.
+
 ## Video and audio
 
 `ffmpeg` and `ffprobe` are FFmpeg 5.1 compiled to WebAssembly, mounted on the container's own

package/dist/index.cjs

@@ -23981,14 +23981,17 @@ var Container = class _Container {
   /** Send an HTTP request to a server running inside the container. */
   async request(port, init = {}) {
     this.assertActive();
-    const res = await this.pod.request(port, {
+    const res = await this.dispatchBinary(port, init) ?? await this.pod.request(port, {
       method: init.method ?? "GET",
       path: init.path ?? "/",
       headers: init.headers ?? {},
       body: init.body ?? null
     });
     const bodyRaw = res.body;
-    const bytes = bodyRaw instanceof Uint8Array ? bodyRaw : typeof bodyRaw === "string" ? new TextEncoder().encode(bodyRaw) : new Uint8Array(0);
+    const bytes = bodyRaw instanceof Uint8Array ? bodyRaw : (
+      // The binary dispatcher answers with an ArrayBuffer.
+      bodyRaw instanceof ArrayBuffer ? new Uint8Array(bodyRaw) : typeof bodyRaw === "string" ? new TextEncoder().encode(bodyRaw) : new Uint8Array(0)
+    );
     const body = typeof bodyRaw === "string" ? bodyRaw : new TextDecoder().decode(bytes);
     return {
       status: res.statusCode ?? 200,
@@ -24001,6 +24004,40 @@ var Container = class _Container {
       }
     };
   }
+  /**
+   * Deliver a request whose body is bytes, without letting them become text.
+   *
+   * Nodepod's public `request()` runs the body through `toString("utf8")` on
+   * its way in, so anything above `0x7f` is replaced: a five-byte payload
+   * containing `0x89` and `0xff` arrives as nine. That silently destroys every
+   * upload — an image or a video reaches the server the wrong size and no
+   * longer decodes, with no error raised anywhere.
+   *
+   * Its own dispatcher one layer down does preserve bytes, so a binary body
+   * goes straight there. This reaches past the published surface deliberately,
+   * so it is written to fail soft: any shape it does not recognise returns
+   * `null` and the caller falls back to the ordinary path, which is exactly
+   * the behaviour that existed before. Text bodies never come through here.
+   */
+  async dispatchBinary(port, init) {
+    if (!(init.body instanceof Uint8Array)) return null;
+    const manager = this.pod._processManager;
+    const dispatch = manager?.dispatchHttpRequest;
+    if (typeof dispatch !== "function") return null;
+    try {
+      const response = await dispatch.call(
+        manager,
+        port,
+        init.method ?? "GET",
+        init.path ?? "/",
+        init.headers ?? {},
+        init.body
+      );
+      return response ?? null;
+    } catch {
+      return null;
+    }
+  }
   /** Wait until something inside the container answers on `port`. */
   waitForPort(port, opts = {}) {
     return this.net.waitForPort(port, opts);