sandboxedjs 0.1.50 → 0.1.51

package/README.md

@@ -89,7 +89,7 @@ it alongside their model provider.
 | **Shell** | POSIX `sh` (54 builtins) — pipelines, redirection, here-docs, globbing, brace/parameter/arithmetic/command expansion, functions, `if`/`for`/`while`/`case`/`select`, job control, traps, arrays, `[[ ]]`, `(( ))` |
 | **Coreutils** | 154 programs — `ls cat cp mv rm mkdir grep sed awk find head tail sort uniq wc cut tr tee xargs chmod chown ln du df ps tar gzip base64 sha256sum diff curl wget` and the rest — plus 54 shell builtins |
 | **Node.js** | Its own module engine — `require` *and* `import`, live bindings, `exports` maps, top-level `await`, npm packages, `http`, `fs`, streams, `child_process` |
-| **Python** | CPython 3.13 (Pyodide) on the *same* filesystem, with the real standard library |
+| **Python** | Source-built CPython 3.13/WASM on the *same* filesystem, with the real standard library |
 | **WebAssembly** | A WASI (`preview1`) host — run any `wasm32-wasi` binary from clang, Rust, Zig or TinyGo as an ordinary process, on the same filesystem |
 | **FFmpeg** | `ffmpeg` and `ffprobe` (FFmpeg 5.1) reading and writing container files directly — [optional install](#video-and-audio) |
 | **`/proc`** | Live and synthesised — `ps`, `top`, `free` and `uptime` all read the same source |
@@ -391,7 +391,7 @@ your disk.
 
 ### Python
 
-Python is CPython 3.13, via Pyodide, mounted on the container's filesystem:
+Python is the bundled, source-built CPython 3.13 WebAssembly runtime mounted on the container's filesystem:
 
 ```ts
 await box.exec("python3 -c \"print(open('/etc/hostname').read())\"");
@@ -401,8 +401,10 @@ await box.exec("echo '1 2 3' | python3 -c \"import sys; print(sum(map(int, sys.s
 
 The bundled standard library includes `json`, `re`, `os`, `sys`, `math`, `random`, `hashlib`,
 `binascii`, `struct`, `time`, `collections`, `itertools`, `functools`, `asyncio` and more. It is
-Real CPython, so `sqlite3`, `dataclasses`, `decimal` and `typing` all work. Packages must be built for WebAssembly: `micropip` installs pure-Python wheels, and Pyodide's own distribution covers the rest
-(and only with outbound networking enabled).
+It is real CPython, so `sqlite3`, `dataclasses`, `decimal`, `typing`, `ssl`, and
+`asyncio` work. `pip` installs compatible wheels into the same filesystem and
+creates their `console_scripts` in `/usr/local/bin` (with outbound networking
+enabled). Native extensions still need an Emscripten-compatible build.
 
 ### WebAssembly binaries
 
@@ -701,20 +703,21 @@ Those use dynamic imports, so they only fail if you call them.
 
 ### Python in a browser
 
-Python works lazily in a browser without extra configuration. On first use,
-SandboxedJS loads the matching Pyodide runtime and assets from jsDelivr:
+Python works lazily in a browser without extra configuration. The owned CPython
+runtime and its pthread worker are shipped with the npm package:
 
 ```ts
 const box = await createContainer();
 await box.exec("python3 -c 'import sqlite3; print(sqlite3.sqlite_version)'");
 ```
 
-To self-host Pyodide or use another trusted CDN, override both URLs:
+Pyodide remains available as an explicit compatibility backend:
 
 ```ts
 import { configurePython, createContainer } from "sandboxedjs";
 
 configurePython({
+  backend: "pyodide",
   pyodideURL: "https://cdn.jsdelivr.net/pyodide/v0.28.3/full/pyodide.mjs",
   indexURL: "https://cdn.jsdelivr.net/pyodide/v0.28.3/full/",
 });
@@ -723,8 +726,8 @@ const box = await createContainer();
 await box.exec("python3 -c 'import sqlite3; print(sqlite3.sqlite_version)'");
 ```
 
-Python never falls back to a host interpreter or another runtime. A custom
-Pyodide module and its asset directory must use the same Pyodide version.
+Python never falls back to a host interpreter. When selecting the optional
+Pyodide backend, its module and asset directory must use the same version.
 
 ## Uploading files
 
@@ -972,11 +975,10 @@ Honest list of what does not work:
   now?" and run `npm install && npm run dev` from the shell instead.
 - **No `net`, `tls`, `worker_threads` or `vm`.** `http` and `https` are served by a virtual stack
   that `request()` talks to directly, so servers work; raw sockets do not.
-- **Python is CPython via Pyodide.** The standard library is the real one. A C
-  extension works only if it has been built for WebAssembly — Pyodide ships
-  many, including `numpy`, but an arbitrary wheel from PyPI will not install.
-  Starting an interpreter costs about a second and a half; one is kept per
-  container, and each program runs in its own namespace.
+- **Python is source-built CPython/WASM.** Each program gets its own interpreter
+  process worker. Pure-Python wheels install normally; native extensions must
+  be linked or published for Emscripten. Pydantic 2's `pydantic-core` is not
+  currently available, so use a Pydantic 1 constraint for FastAPI deployments.
 - **No real sockets.** HTTP servers work through the request proxy; raw TCP/UDP does not.
 - **No real processes.** Processes are cooperative async tasks: `kill -9` cannot interrupt a
   tight synchronous loop, and `SIGSTOP` only marks state.

package/dist/index.cjs

@@ -19107,7 +19107,7 @@ async function startNodeWorker(url, workerData) {
     /* webpackIgnore: true */
     specifier
   );
-  const worker = new NodeWorker(url, { workerData });
+  const worker = new NodeWorker(url, { workerData, execArgv: [] });
   return {
     postMessage: (message) => worker.postMessage(message),
     onMessage: (listener) => worker.on("message", listener),
@@ -19380,7 +19380,17 @@ async function resolvePackageCandidates(client, requirement, environment) {
   const index = await client.json(`https://pypi.org/pypi/${requirement.name}/json`);
   const candidates = Object.keys(index.releases).filter((version) => requirement.specifiers.every((s) => compareVersions(version, s.version, s.op))).sort((a, b) => compareRelease(releaseOf(a), releaseOf(b)));
   const stable = candidates.filter((version) => !isPreRelease(version));
-  const ordered = (stable.length > 0 ? stable : candidates).reverse();
+  const newestFirst = (stable.length > 0 ? stable : candidates).reverse();
+  const probeIndexes = [
+    0,
+    Math.floor(newestFirst.length / 2),
+    Math.floor(newestFirst.length / 4),
+    Math.floor(newestFirst.length * 3 / 4),
+    newestFirst.length - 1
+  ];
+  const probes = [...new Set(probeIndexes)].map((index2) => newestFirst[index2]).filter((v) => Boolean(v));
+  const probeVersions = new Set(probes);
+  const ordered = [...probes, ...newestFirst.filter((version) => !probeVersions.has(version))];
   let sawSourceOnly = false;
   const resolved = [];
   for (const version of ordered) {
@@ -19450,7 +19460,10 @@ async function installRequirements(options) {
   }
   const archives = /* @__PURE__ */ new Map();
   const unavailable2 = /* @__PURE__ */ new Set();
+  const unsatisfiable = /* @__PURE__ */ new Map();
   const candidateCache = /* @__PURE__ */ new Map();
+  let candidateAttempts = 0;
+  const MAX_CANDIDATE_ATTEMPTS = 96;
   const solve = async (pending, state) => {
     if (pending.length === 0) return state;
     const [first, ...tail2] = pending;
@@ -19474,6 +19487,9 @@ async function installRequirements(options) {
         skipped: [...state.skipped, { name: requirement.name, marker: requirement.marker ?? "" }]
       });
     }
+    const solveKey = `${requirement.name}:${requirement.specifiers.map((s) => `${s.op}${s.version}`).sort().join(",")}:${[...extras].sort().join(",")}`;
+    const knownFailure = unsatisfiable.get(solveKey);
+    if (knownFailure) throw knownFailure;
     const already = state.chosen.get(requirement.name);
     if (already) {
       const satisfied = requirement.specifiers.every(
@@ -19518,6 +19534,12 @@ async function installRequirements(options) {
     let failure2;
     for (const resolved of candidates) {
       try {
+        candidateAttempts += 1;
+        if (candidateAttempts > MAX_CANDIDATE_ATTEMPTS) {
+          throw new Error(
+            "dependency resolution exceeded 96 wheel candidates; add version constraints for packages whose newest generation requires unavailable native WASM extensions"
+          );
+        }
         let entries = archives.get(resolved.url);
         if (!entries) {
           options.progress.downloading(resolved.name, resolved.version);
@@ -19544,10 +19566,13 @@ async function installRequirements(options) {
           skipped: state.skipped
         });
       } catch (error) {
+        if (error?.message?.startsWith("dependency resolution exceeded")) throw error;
         failure2 = error;
       }
     }
-    throw failure2 instanceof Error ? failure2 : new Error(`could not resolve ${requirement.name}`);
+    const resolutionError = failure2 instanceof Error ? failure2 : new Error(`could not resolve ${requirement.name}`);
+    unsatisfiable.set(solveKey, resolutionError);
+    throw resolutionError;
   };
   const solved = await solve(queue, {
     chosen: /* @__PURE__ */ new Map(),